Internet X.509 PKI Time-Stamp Protocol (TSP)

Note

IETF specification describing the format of the request sent to a time-stamping authority (TSA) and of the response, and the security requirements for operating the TSA.

Summary

Purpose

IETF RFC 3161 (August 2001) defines the time-stamp protocol of X.509 public key infrastructures. It describes the request sent to a Time Stamping Authority (TSA) and the response that the TSA returns:

It also sets several security-relevant requirements for processing these requests RFC 3161, Abstract. A time-stamping service makes it possible to prove that a piece of data existed before a given time RFC 3161, § 1. Introduction.

Who it applies to

The RFC itself imposes nothing under eIDAS. Implementing Regulation 2025/1929 refers to it for qualified electronic time stamps Art. 1 List of reference standards and specifications for qualified time stamp services. Its annex makes the standards ETSI EN 319 421 V1.3.1 and ETSI EN 319 422 V1.1.1 applicable, subject to adaptations; it is one of the adaptations of standard EN 319 422 that refers to the RFC List of reference standards and specifications for qualified time stamp services.

This adaptation concerns the time-stamping client and the time-stamping server List of reference standards and specifications for qualified time stamp services.

Compliance with these standards gives rise to a presumption of conformity, within the exact scope of the article concerned:

The requirement therefore remains that of the regulation; the standards in the annex are the ones referred to in that paragraph 2 Art. 1.

Key points

• Wording that differs between language versions. The annex to Implementing Regulation 2025/1929 adapts clause 7 of standard EN 319 422: the time-stamping client and server are to support the time-stamping protocol via HTTPS, as defined in clause 3.4 of the RFC. The English version states that they “shall support” it; the French version uses “il convient” (“it is recommended”) List of reference standards and specifications for qualified time stamp services. The English version reads:

The summary does not decide between the two.

• Transport over HTTP. Clause 3.4 defines two content types, application/timestamp-query for the request and application/timestamp-reply for the response RFC 3161, § 3.4. Time-Stamp Protocol via HTTP. The RFC makes no transport mechanism mandatory; those it describes are optional RFC 3161, § 3. Transports.
• The duties of the TSA. Among other things, it must use a trustworthy source of time, give each token a unique number, time-stamp only a hash of the data, not identify the requester in the token, and sign with a key reserved for that purpose RFC 3161, § 2.1. Requirements of the TSA.
• The exchange formats. The RFC describes the format of the request and that of the response RFC 3161, § 2.4.1. Request Format RFC 3161, § 2.4.2. Response Format.
• No overall security requirements. The RFC does not set the overall security requirements for the operation of a TSA; it provides that the TSA makes its policies known RFC 3161, § 1. Introduction. For qualified time-stamping, these policy and security requirements fall under standard EN 319 421, adapted by the same implementing regulation List of reference standards and specifications for qualified time stamp services.

Clauses referred to by the act

• Clause 3.4 of the RFC (transport over HTTP): the only clause named by the annex to Implementing Regulation 2025/1929, through the adaptation of clause 7 of standard EN 319 422 List of reference standards and specifications for qualified time stamp services.
• The rest of the RFC is not cited by that annex. The annex also adapts standard EN 319 422 on other points (algorithms, key lengths, statement of compliance with the regulation) List of reference standards and specifications for qualified time stamp services.

Links

• Act that refers to it: Implementing Regulation 2025/1929 Implementing Regulation (EU) 2025/1929.
• Intermediate standards: ETSI EN 319 422 ETSI EN 319 422 V1.1.1 and ETSI EN 319 421 ETSI EN 319 421 V1.3.1.
• Related standard: RFC 9110, HTTP semantics, cited in the references of the adapted standard EN 319 422 RFC 9110 List of reference standards and specifications for qualified time stamp services.
• Learning path: step 5, reading a standard.

Written by Asphalia.