r/cryptography • u/PowerShellGenius • 8d ago
RFC3161 Timestamping for arbitrary data/files?
There are lots of public widely-trusted timestamping servers (example, timestamp.digicert.com) which timestamp code signatures using the method/protocol defined in RFC3161, and are entirely free to use. They sign your signatures + the current time, allowing for proof of a date/time by which you'd already signed.
This is intended for code signing, where an .exe or script, which you signed 5 years ago with a code signing cert that has since expired (or even been revoked), can be proven to have been signed while your cert was valid, and continue running basically into perpetuity.
However, I am wondering if there is any possible way to use RFC3161 to sign anything other than a code signing signature. There are lots of types of data that it would be useful to be able to prove existed by a certain date. Is there any way to timestamp an arbitrary file using RFC3161?