Free Time Stamp Authority
Time Stamp Authority
freeTSA.org provides a free Time Stamp Authority. Adding a trusted timestamp to code or to an electronic signature provides a digital seal of data integrity and a trusted date and time of when the transaction took place.
Trusted timestamping is the process of securely keeping track of the creation and modification times of a document. Security here means that no one - not even the owner of the document - should be able to change it once it has been recorded provided that the timestamper's integrity is never compromised. FreeTSA trusted timestamping Software as a Service (SaaS) provides an easy method to apply RFC 3161 trusted timestamps to time-sensitive transactions through independently verified and auditable date and UTC (Coordinated Universal Time) sources.
Adding a trusted timestamp to code or to an electronic signature provides a digital seal of data integrity and a trusted date and time of when the transaction took place. Recipients of documents and code with a trusted timestamp can verify when the document or code was digitally or electronically signed, as well as verify that the document or code was not altered after the date the timestamp vouches for. (Readme).
For multiple files, the general concept is that timestamping a single file that contains an aggregate list of fingerprints of other files, also proves that these other files must have existed before the aggregate file was created, provided that both the aggregate file and the referenced file are available during verification process. Freetsa also offers the possibility of URLs timestamps (do not abuse). If you are interested in implementing timestamps on your project / company using the FreeTSA service, you can contact me for specific requirements. Freetsa can also be used within the Tor anonymity network.
Making timestamps from Android/iOS devices is possible and no software installation is required (Video). To timestamp a picture you must go to the "Online Signature" section in the browser, click "Choose a file" and select "Use camera". Once the photo or video are completed, you can download the timestamp (TimeStampResponse). Just that. You also may select any other file available in the device if you choose so.
Freetsa.org offers free OCSP and CRL, NTP, DNSCRYPT, DNS (Port 53) and DNS over TLS (DoT) services for time synchronisation and encrypted name resolution respectively. The resolution of DNSCRYPT (Port 553) do not have any type of restriction (SPAM, Malware, Parental,...). No logs are saved. Like the rest of the services offered by FreeTSA, DoT accepts TCP connections to port 853 on all its IPv4/IPv6 addresses.
Guide: How to sign PDF documents files with time stamp
FreeTSA onion domain (Tor): 4bvu5sj5xok272x6cjx4uurvsbsdigaxfmzqy3n3eita272vfopforqd.onion (https /http).
RFC 3161 TSA: Time-Stamp Protocol (TSP).
RFC 958 NTP: Network Time Protocol (NTP).
SSL Labs. Certificate Transparency NTP Pool Project associate membership.
Adding a trusted timestamp to code or to an electronic signature provides a digital seal of data integrity and a trusted date and time of when the transaction took place. Recipients of documents and code with a trusted timestamp can verify when the document or code was digitally or electronically signed, as well as verify that the document or code was not altered after the date the timestamp vouches for. (Readme).
For multiple files, the general concept is that timestamping a single file that contains an aggregate list of fingerprints of other files, also proves that these other files must have existed before the aggregate file was created, provided that both the aggregate file and the referenced file are available during verification process. Freetsa also offers the possibility of URLs timestamps (do not abuse). If you are interested in implementing timestamps on your project / company using the FreeTSA service, you can contact me for specific requirements. Freetsa can also be used within the Tor anonymity network.
Making timestamps from Android/iOS devices is possible and no software installation is required (Video). To timestamp a picture you must go to the "Online Signature" section in the browser, click "Choose a file" and select "Use camera". Once the photo or video are completed, you can download the timestamp (TimeStampResponse). Just that. You also may select any other file available in the device if you choose so.
Freetsa.org offers free OCSP and CRL, NTP, DNSCRYPT, DNS (Port 53) and DNS over TLS (DoT) services for time synchronisation and encrypted name resolution respectively. The resolution of DNSCRYPT (Port 553) do not have any type of restriction (SPAM, Malware, Parental,...). No logs are saved. Like the rest of the services offered by FreeTSA, DoT accepts TCP connections to port 853 on all its IPv4/IPv6 addresses.
Guide: How to sign PDF documents files with time stamp
FreeTSA onion domain (Tor): 4bvu5sj5xok272x6cjx4uurvsbsdigaxfmzqy3n3eita272vfopforqd.onion (https /http).
RFC 3161 TSA: Time-Stamp Protocol (TSP).
RFC 958 NTP: Network Time Protocol (NTP).
SSL Labs. Certificate Transparency NTP Pool Project associate membership.
Request Digest: sha1 / sha224 / sha256 / sha384 / sha512.
Freetsa TSA Certificate: tsa.crt
Key modulus (sha256): 899ba3d9f777e2a74bdd34302bc06cb3f7a46ac1f565ee128f79fd5dab99d68b
Freetsa CA Certificate: cacert.pem
Key modulus (sha256): a4b1a0a81aef68be1cc985d0f83bd6539cfe84174587f900e15ffe3f65433056
Freetsa TSA Certificate: tsa.crt
Key modulus (sha256): 899ba3d9f777e2a74bdd34302bc06cb3f7a46ac1f565ee128f79fd5dab99d68b
Freetsa CA Certificate: cacert.pem
Key modulus (sha256): a4b1a0a81aef68be1cc985d0f83bd6539cfe84174587f900e15ffe3f65433056
Basics: TCP-based client
###########################################################
# 1. create a tsq file (SHA 512)
###########################################################
openssl ts -query -data file.png -no_nonce -sha512 -out file.tsq
# Option -cert: FreeTSA is expected to include its signing certificate (Root + Intermediate Certificates) in the response. (Optional)
# If the tsq was created with the option "-cert", its verification does not require "-untrusted".
#$ openssl ts -query -data file.png -no_nonce -sha512 -cert -out file.tsq
# How to make Timestamps of many files?
# To timestamp multiple files, create a text file with all their SHA-512 hashes and timestamp it.
# Alternatively, you may pack all the files to be timestamped in a zip/rar/img/tar, etc file and timestamp it.
# Generate a text file with all the hashes of the /var/log/ files
$ find /var/log/ -type f -exec sha512sum {} + > compilation.txt
###########################################################
# 2. cURL Time Stamp Request Input (HTTP / HTTPS)
###########################################################
# HTTP 2.0 in cURL: Get the latest cURL release and use this command: curl --http2.
curl -H "Content-Type: application/timestamp-query" --data-binary '@file.tsq' https://freetsa.org/tsr > file.tsr
# Using the Tor-network.
#$ curl -k --socks5-hostname 127.0.0.1:9050 -H "Content-Type: application/timestamp-query" --data-binary '@file.tsq' https://4bvu5sj5xok272x6cjx4uurvsbsdigaxfmzqy3n3eita272vfopforqd.onion/tsr > file.tsr
# tsget is very useful to stamp multiple time-stamp-queries: https://www.openssl.org/docs/manmaster/apps/tsget.html
#$ tsget -h https://freetsa.org/tsr file1.tsq file2.tsq file3.tsq
###########################################################
# 3. Verify tsr file
###########################################################
wget https://freetsa.org/files/tsa.crt
wget https://freetsa.org/files/cacert.pem
# Timestamp Information.
openssl ts -reply -in file.tsr -text
# Verify (two diferent ways).
# openssl ts -verify -data file -in file.tsr -CAfile cacert.pem -untrusted tsa.crt
openssl ts -verify -in file.tsr -queryfile file.tsq -CAfile cacert.pem -untrusted tsa.crt
# Verification: OKOnline Signature
Select a tsq and a tsr file.
verify
Using configuration from /etc/ssl/openssl.cnf
Verification: OK
Using configuration from /etc/ssl/openssl.cnf
Status info:
Status: Granted.
Status description: unspecified
Failure info: unspecified
TST info:
Version: 1
Policy OID: tsa_policy1
Hash Algorithm: sha512
Message data:
0000 - 5c 77 f3 b3 25 ff 5f a9-03 16 5f db ae fc 9f 21 \w..%._..._....!
0010 - 04 9d d3 a0 56 58 3b 13-d9 a7 5e 7b 00 40 05 00 ....VX;...^{.@..
0020 - c9 23 ae 90 fa 29 47 5e-23 ff d6 e1 35 07 48 1b .#...)G^#...5.H.
0030 - 02 54 5c 3e cd 2f 67 84-d4 30 5c 00 5e 3f 6e c4 .T\>./g..0\.^?n.
Serial number: 0xD0FFA7
Time stamp: Aug 30 10:25:14 2021 GMT
Accuracy: unspecified
Ordering: yes
Nonce: unspecified
TSA: DirName:/O=Free TSA/OU=TSA/description=This certificate digitally signs documents and time stamp requests made using the freetsa.org online services/CN=www.freetsa.org/emailAddress=busilezas@gmail.com/L=Wuerzburg/C=DE/ST=Bayern
Extensions:
Status info:
Status: Granted.
Status description: unspecified
Failure info: unspecified
TST info:
Version: 1
Policy OID: tsa_policy1
Hash Algorithm: sha512
Message data:
0000 - 5c 77 f3 b3 25 ff 5f a9-03 16 5f db ae fc 9f 21 \w..%._..._....!
0010 - 04 9d d3 a0 56 58 3b 13-d9 a7 5e 7b 00 40 05 00 ....VX;...^{.@..
0020 - c9 23 ae 90 fa 29 47 5e-23 ff d6 e1 35 07 48 1b .#...)G^#...5.H.
0030 - 02 54 5c 3e cd 2f 67 84-d4 30 5c 00 5e 3f 6e c4 .T\>./g..0\.^?n.
Serial number: 0xD0FFA7
Time stamp: Aug 30 10:25:14 2021 GMT
Accuracy: unspecified
Ordering: yes
Nonce: unspecified
TSA: DirName:/O=Free TSA/OU=TSA/description=This certificate digitally signs documents and time stamp requests made using the freetsa.org online services/CN=www.freetsa.org/emailAddress=busilezas@gmail.com/L=Wuerzburg/C=DE/ST=Bayern
Extensions:
URL screenshot
URL screenshot: Signature + URL timestamps. (Video)
Create evidence of
Create evidence of
- Illegal Internet content / non-repudiation of certain content.
- Deleted / Edited controversial news.
- Slander, threats or insults on Internet (social networks) / Scams.
- Misuse of intellectual property: articles, photographs, plagiarism, etc.
- Publication of unauthorized information
- Simply demonstrate the existence of a specific content at a specific time.
URL screenshot online
Web content and links in PDF / PNG format (attachment) + Signature with Timestamping (SHA-512). Aprox wait time 25 secons.
Normal.
I'm Feeling Lucky (slower).
TOR ".onion" domain / Web visited through the Tor-network
Other informations
OCSP SERVER: http://www.freetsa.org:2560
CRL (Revocation List): https://www.freetsa.org/crl/root_ca.crl
$ openssl ocsp -sha512 -CAfile cacert.pem -issuer cacert.pem -cert tsa.crt -url http://freetsa.org:2560 -resp_text
CRL (Revocation List): https://www.freetsa.org/crl/root_ca.crl
$ wget http://www.freetsa.org/crl/root_ca.crl $ openssl crl -in root_ca.crl -noout -text
FreeTSA Desktop App
Create a direct link to a chromium/chrome or Firefox app. This just run one command.
### Firefox # Activate SSB In firefox it is necessary: "about:config" > "browser.ssb.enabled true" # On Windows: Firefox > Page Actions (three consecutive dots in the address bar) > "Use this site in App Mode" creates a link on the desktop. # On Linux you could make a simple desktop-link / script with the following command: firefox --ssb https://freetsa.org/index_en_app.php ### Chromium / Chrome. chromium --app=https://freetsa.org/index_en_app.php chrome --app=https://freetsa.org/index_en_app.php
FreeTSA IPv6 Addresses
Any of these IPv6 can be used for OCSP, DNSCRYPT resolution (TCP/UDP), DoT (DNS over TLS), normal DNS and NTP Server.
2607:f130:0:f8::3085:e961 2607:f130:0:f8::c5a7:17a4 2607:f130:0:f8::73a7:a9f6 2607:f130:0:f8::4a5c:6f8c 2607:f130:0:f8::7e72:6308 2607:f130:0:f8::a514:d89a 2607:f130:0:f8::2bab:3a16 2607:f130:0:f8::c619:9640 2607:f130:0:f8::4fb7:9035 2607:f130:0:f8::4c85:a645
Security based HTTP response headers
- HPKP helps prevent Man in the Middle attack (MitM) by mitigating fake certificates.
- HSTS forces your browser to use HTTPS, which also mitigages some mitm attacks.
- CSP is a way to combat xss and malware via malicious ad-injection.