Timestamping

Obtain qualified electronic timestamps through Cleverbase using the Time-Stamp Protocol (TSP) defined in RFC 3161. A timestamp token binds a hash of your data to a trusted point in time, providing evidence that the data existed at that moment and has not changed since. The tokens are issued by a qualified time-stamping authority (TSA) under eIDAS, so they carry a legal presumption of accuracy and integrity throughout the EU.

Only the hash of the data is sent to the TSA. The data itself never leaves the client application.

Use cases

• Long-term validation of signatures. Add a signature timestamp to signatures created with the Signing API to prove the signature existed while the certificate was valid (LTV).
• Archiving. Periodically re-timestamp archived documents and signatures to keep them verifiable when algorithms weaken and certificates expire (LTA).
• Proof of existence. Demonstrate that a document, log entry or dataset existed at a given time, without disclosing its content.

Technical overview

The service conforms to RFC 3161 with the updates of RFC 5816, and operates under the ETSI EN 319 421 policy for qualified time-stamping. Requests and responses are DER-encoded ASN.1 structures transported over HTTP, as described in RFC 3161 section 3.4. Any standards-compliant TSP client can be used.

Hosts

Authentication

Requests are authenticated with HTTP Basic authentication over TLS. The username and password are provided by your Cleverbase account manager during onboarding, separately for the sandbox and production environments. This is the authentication scheme supported by common RFC 3161 clients and signing libraries.

What the exchange looks like

1. The client application computes a SHA-256 hash of the data to be timestamped.
2. The client sends a DER-encoded TimeStampReq containing the hash, optionally a nonce and a request for the TSA certificate to be included.
3. The TSA verifies the request, obtains the current time from its trusted time source and signs a TSTInfo structure that binds the hash to that time.
4. The TSA returns a TimeStampResp containing the status and, when granted, the timestamp token as a CMS SignedData structure.
5. The client verifies the token against the request (hash, nonce) and the TSA certificate chain, and embeds it in the signature or stores it alongside the data.

Timestamp policy

The tokens are issued by the qualified time-stamping unit of Uanataca, a qualified trust service provider listed on the EU Trusted List. Timestamps issued in the sandbox environment are not qualified and must not be used in production.