RFC 3161 timestamping
RFC 3161 timestamping is an IETF-standard protocol where a trusted third-party authority (TSA) cryptographically attests that a piece of data existed at a specific time, without seeing the data itself, only its hash. Caisson's audit-worm package submits each periodic audit-chain anchor's hash to a TSA and stores the signed token as a private, verifiable receipt.
In code
export class TsaAnchorLog implements TrustedTimestampLog {
async submit(anchorBytes: Uint8Array): Promise<TimestampReceipt> {
const imprint = createHash("sha256").update(anchorBytes).digest();
const reqBer = buildTimeStampReqBer(imprint, this.#reqPolicy);
const resp = await fetchWithTimeout(
this.#url,
{
method: "POST",
headers: {
"content-type": "application/timestamp-query",
accept: "application/timestamp-reply",
},
body: reqBer,
},
{ timeoutMs: this.#timeoutMs },
);
if (!resp.ok) {
throw new ValidationError("TSA request failed", { status: resp.status });
}
const respDer = new Uint8Array(await resp.arrayBuffer());
return parseTimeStampResp(respDer, imprint, this.#url);
}
}
// Build the DER TimeStampReq (RFC-3161): version 1, sha256 imprint, certReq, random nonce.
function buildTimeStampReqBer(
imprint: Uint8Array,
reqPolicy: string | undefined,
): ArrayBuffer {
const messageImprint = new MessageImprint({
hashAlgorithm: new AlgorithmIdentifier({
algorithmId: SHA256_OID,
algorithmParams: new Null(),
}),
hashedMessage: new OctetString({ valueHex: imprint }),
});
const req = new TimeStampReq({
version: 1,
messageImprint,
certReq: true,
nonce: new Integer({ valueHex: randomBytes(16) }),
...(reqPolicy !== undefined ? { reqPolicy } : {}),
});
return req.toSchema().toBER();
}How it holds
Imprint-only egress, never the data
submit() sends fetchWithTimeout only a DER TimeStampReq whose messageImprint is sha256(anchorBytes), the anchor is already just {length, tipHash, genesisHash}, so the TSA never sees payload or PII, only a hash of a hash.
The response is checked, not just trusted
parseTimeStampResp requires a granted PKIStatus, walks the CMS SignedData to the signed TSTInfo, and constant-time compares (safeEqualFixed) the TSA's attested messageImprint against the one submitted, a TSA that signs the wrong imprint fails the receipt outright rather than being recorded as valid.
A private receipt, not a public one
This is v1's only grade, trusted-timestamped: the token proves timing to whoever holds the tenant's own WORM store. Caisson never markets a TSA receipt as externally verifiable, that stronger claim (externally-transparent) is reserved for the separate public-log target (Rekor/OTS), which a TSA receipt can never silently become.
Full CMS verification on read-back, not a structural parse
verifyExternal's TSA path re-parses the stored token as CMS DER, verifies the SignedData signature over TSTInfo, confirms the signing cert carries the id-kp-timeStamping EKU, and (when the deployment configured trust anchors) validates the certificate chain, surfacing chainValidated: false rather than upgrading the claim when no root was configured.