Electronic Signatures and Infrastructures (ESI); Time-stamping protocol and time-stamp token profiles

Note

ETSI standard defining the time-stamping protocol and the profile of the time-stamp tokens issued by trust service providers (version 1.1.1).

Summary

Purpose

European standard ETSI EN 319 422 (version 1.1.1, March 2016) defines a profile of the time-stamping protocol and of the time-stamp tokens of RFC 3161 ETSI EN 319 422 V1.1.1, § 1 Scope ETSI EN 319 422 V1.1.1, History RFC 3161. Its scope begins as follows:

It states what the time-stamping client and server support; the validation of time-stamps remains outside its scope ETSI EN 319 422 V1.1.1, § 1 Scope.

Who it applies to

• To providers that issue qualified electronic time stamps, through Implementing Regulation 2025/1929 List of reference standards and specifications for qualified time stamp services.
• To time-stamping clients (software that requests a token) and time-stamping servers, which the standard deals with separately ETSI EN 319 422 V1.1.1, § 4 Requirements for a time-stamping client ETSI EN 319 422 V1.1.1, § 5 Requirements for a time-stamping server.

Key points

• Request and response: the client and the server support the request and the response of RFC 3161, with the standard’s amendments on fields and algorithms ETSI EN 319 422 V1.1.1, § 4.1.1 Core requirement ETSI EN 319 422 V1.1.1, § 5.2.1 Core requirement.
• Time-stamping unit (TSU) certificate: it follows the profile of ETSI EN 319 412-2 (TSA that is a natural person) or EN 319 412-3 (TSA that is a legal person), cited without a version, with amendments ETSI EN 319 422 V1.1.1, § 6.1 General requirements; the corpus contains versions 2.4.1 ETSI EN 319 412-2 V2.4.1 and 1.3.1 ETSI EN 319 412-3 V1.3.1, and the index of ETSI standards in the corpus, consulted on 31 October 2026, mentions more recent published versions, 2.5.1 and 1.4.1, whose text is not in the corpus.
• Transport: HTTP or HTTPS according to RFC 3161, HTTPS being recommended ETSI EN 319 422 V1.1.1, § 7 Profiles for the transport protocols to be supported.
• Qualified time-stamp: a token presented as a qualified electronic time stamp should contain the qcStatements extension with the esi4-qtstStatement-1 statement ETSI EN 319 422 V1.1.1, § 9.1 Regulation compliance statement.

What the acts apply, and how

• Implementing Regulation 2025/1929 (qualified electronic time stamps): the standard applies in version 1.1.1, together with ETSI EN 319 421, subject to adaptations List of reference standards and specifications for qualified time stamp services ETSI EN 319 421 V1.3.1. For EN 319 422, the annex:

  • empties two normative references (HTTP and HTTPS) and adds two: the agreed cryptographic mechanisms published by ENISA and RFC 9110;
  • aligns the hash and signature algorithms and the key lengths with these agreed mechanisms; for several clauses, the strength of the requirement differs between language versions (see below);
  • for clause 7, provides that the client and the server support the time-stamping protocol via HTTPS, with wording that differs between language versions (see below);
  • for clause 9.1, makes the qcStatements extension with the esi4-qtstStatement-1 statement mandatory where the TSA presents a token as a qualified electronic time stamp, the extension not being marked critical List of reference standards and specifications for qualified time stamp services.

  Wording that differs between language versions. For clauses 5.1.3, 5.2.3, 7 and 8 of EN 319 422, the English version of the annex uses shall, whereas the French version of the same passages uses il convient (“it is recommended”); for clauses 4.1.3, 4.2.3, 4.2.4, 6.3 and 6.5, both versions impose the requirement (shall, doit) List of reference standards and specifications for qualified time stamp services. For clause 7, the English version reads:

The French version of the same passage uses “il convient” (“it is recommended”) instead List of reference standards and specifications for qualified time stamp services. The summary does not decide between the two.

In EN 319 421 as adapted, time-stamps must follow the profile of EN 319 422, whose reference is set at version 1.1.1 ETSI EN 319 421 V1.3.1, § 7.7.1 Time-stamp issuance List of reference standards and specifications for qualified time stamp services. A recital adds that supervisory bodies should presume compliance with the relevant requirements of the regulation, the provider being able to demonstrate it through other practices laying down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards the binding of date and time to data and establishing the accuracy of the time sources for the provision of qualified electronic time stamps. Regulation 910/2014, for its part, provides for a presumption with a precise scope:

• Implementing Regulation 2025/2162: Annex II cites EN 319 422, without a version, for the creation of qualified electronic time stamps; conformity assessment schemes state the year and version number of the standards Annex II Art. 6(3).

Important clauses

• ETSI EN 319 422 V1.1.1, § 1 Scope: scope.
• ETSI EN 319 422 V1.1.1, § 4 Requirements for a time-stamping client: time-stamping client.
• ETSI EN 319 422 V1.1.1, § 5 Requirements for a time-stamping server: time-stamping server.
• ETSI EN 319 422 V1.1.1, § 6 TSU certificate profile: TSU certificate.
• ETSI EN 319 422 V1.1.1, § 9 Additional requirements for qualified electronic time-stamps as per Regulation (EU) No 910/2014: qualified time-stamps.

Links

• Policy and security requirements: ETSI EN 319 421 ETSI EN 319 421 V1.3.1.
• Related standards: RFC 3161 RFC 3161, RFC 3739 (qcStatements) RFC 3739.
• Learning path: step 4, trust services.

ETSI standard: the site reproduces only short extracts; the full text is available from ETSI ETSI EN 319 422 V1.1.1. Written by Asphalia.