What is a trusted timestamp, and why signatures need one?

Why "when" is as important as "who"

A digital signature answers who signed and whether the document changed. But a third question often decides a dispute: when was it signed? Timing can determine whether a contract beat a deadline, whether a signature was made before a certificate was revoked, or whether a document is what it claims to be.

The obvious source of a time — your computer's clock — is also the weakest. Clocks can be wrong, and they can be changed on purpose. A date field that says "signed January 3rd" proves nothing if the signer could have set that value themselves. A trusted timestamp replaces self-asserted time with independently verified time.

What a trusted timestamp actually is

A trusted timestamp is a small cryptographic record produced by a time-stamping authority (TSA) — a neutral third party whose entire job is to attest to time. The process, standardized as RFC 3161, works like this:

1. Your software computes a hash (a unique fingerprint) of the document or signature.
2. It sends only that hash to the TSA — never the document itself, so your content stays private.
3. The TSA appends the current time from its trusted clock, then signs the hash-plus-time combination with its own certificate.
4. That signed bundle — the timestamp token — comes back and is attached to your document.

Because the TSA signed it, the timestamp is tamper-evident: change the time, the document, or the signature, and the token no longer validates.

Why your own clock isn't enough

The key property here is independence. The signer doesn't control the TSA's clock, and the TSA doesn't control the document — it never even sees the content, only a hash. That separation is what gives the timestamp its evidentiary weight. Neither party can quietly backdate or forward-date the event, because the proof depends on both, and neither can forge the other's part.

The big reason: long-term validity

Here's a problem that catches people off guard: digital certificates expire. A certificate might be valid for one to three years. So what happens to a document you signed five years ago, when the certificate behind it has long since expired?

Without a timestamp, verification gets shaky — a reader can't easily tell whether the signature was made while the certificate was still valid. With a trusted timestamp, the answer is clear: the timestamp proves the signature existed at a moment when the certificate was valid, so the signature remains verifiable long after expiry. This is the foundation of long-term validation (LTV), where a signed document stays checkable for years or decades.

Timestamps and revocation

Certificates can also be revoked early — for instance, if a private key is compromised. Revocation is time-sensitive: a signature made before revocation should still count, while one made after shouldn't. A trusted timestamp establishes exactly which side of that line a signature falls on, removing the ambiguity that would otherwise let a dispute drag on.

What a timestamp does not do

It's worth being precise about the limits. A trusted timestamp proves when a document in a given state existed — it does not, by itself, prove who signed it (that's the certificate's job) or that a signer had authority to act. It's one pillar of trust among several. Its specific contribution is turning "we think this was signed around then" into "this was provably signed at this exact time."

How PearSign handles timing

PearSign records precise UTC timestamps for every event in a document's lifecycle — sent, viewed, signed, completed — as part of the tamper-evident audit trail, and pairs the digital seal with trusted time so the when of each signature is captured with the same rigor as the who and the what. The result is a signature whose timing can defend itself if the document is ever questioned.

FAQ

What is a trusted timestamp?

A trusted timestamp is cryptographic proof from an independent time-stamping authority that a specific document existed and was signed at a specific moment. It binds the current time to a hash of the document and is signed by the authority, making it tamper-evident and far more reliable than a computer's own clock.

Why can't I just use my computer's clock?

Because a computer's clock can be wrong or deliberately changed by the user, a self-asserted date carries little evidentiary weight. A trusted timestamp comes from a neutral third party that neither controls your document nor can be controlled by you, which is exactly what makes it credible in a dispute.

What is RFC 3161?

RFC 3161 is the standard that defines how trusted timestamps are requested and issued. It specifies that a client sends a hash of the data to a time-stamping authority, which returns a signed timestamp token combining that hash with a trusted time — all without the authority ever seeing the original document.

How does a timestamp keep a signature valid after a certificate expires?

A trusted timestamp proves the signature existed while the certificate was still valid. So even after the certificate expires, verifiers can confirm the signing happened during the valid window. This is the basis of long-term validation, which keeps signed documents checkable for years.

Does the timestamp authority see my document?

No. Only a cryptographic hash — a fingerprint — of your document is sent to the time-stamping authority, never the document itself. The authority can attest to the time without ever accessing your content, so timestamping doesn't compromise confidentiality.