Hacker News Reader

Comment by malandrew | Hacker News Reader

On a related note are there public time servers out there that sign their timestamps cryptographically?

i.e. are there sources of temporal truth which can not be mocked and imitated, such that so long as you have their public key, you can ping them for the time and confirm that the timestamp they sent you was signed by them?

View on HN

However, this is susceptible to a man-in-the-middle attack, still. A malicious man-in-the-middle could simply send an old timestamp which was already validated. The best alternative would be to require the time server to return a signed timestamp plus challenge to prove that it was sent by the actual server. Unfortunately, this would incur computational cost on the part of the time server, which may make such a scheme impractical.

Some TSAs (GeoTrust) support TLS which solves this problem. Surprisingly (given they sell the product to do that) it doesn't seem many others do...

Pretty much.

It's used extensively in code signing and document signing. If a code signed file has a signed timestamp, it will continue to be treated as valid after expiration so long as the CA doesn't mark your certificate for lifetime signing (really only StartCom Class 2).

If you open Adobe Reader, you can sign PDF files. Just click the second tab on the right, Certificates and then Timestamp. You can use http://timestamp.digicert.com/ as the TSA (time stamping authority) for free.

NTP does take integrity checking into account [0], though due to export restrictions and regulations the methods have varied over the years and are non-ideal. Specifically, the risk of MITM attacks/abuse is acknowledged as is the risk of DoS via the increased computational overhead of crypto [1].

[0] http://www.ntp.org/ntpfaq/NTP-s-algo-crypt.htm

[1] http://en.m.wikipedia.org/wiki/Network_Time_Protocol#Securit...

Not plain timestamps, but there is such as thing as a trusted Time Stamping Authority which will sign a document hash + timestamp to prove that information existed before a certain date. http://en.wikipedia.org/wiki/Trusted_timestamping

Reply on news.ycombinator.com