Overview
ISO/IEC 18014-1:2008 - "Information technology - Security techniques - Time-stamping services - Part 1: Framework" defines the conceptual and protocol framework for secure digital time-stamping. It specifies the objective and general model of a time-stamping service (TSS), the roles of entities such as the Time-Stamping Authority (TSA), requesters and verifiers, and the data structures and basic protocols used to create and verify time-stamp tokens (TSTs). This part is the foundational framework for the other parts of ISO/IEC 18014 (mechanisms for independent and linked tokens).
Key topics and technical requirements
- Purpose and scope: establishes that a time-stamp provides evidence that a data item existed before a specified point in time and supports integrity and non-disclosure by time-stamping data representations (hashes).
- Entities and services: defines roles - TSA, time-stamp requester, time-stamp verifier, certification authority - and the TSS functions.
- Data structures: defines the time-stamp token (TST) structure, including the binding of a data representation (hash value) to a time value and optional additional fields.
- Protocols & message formats: specifies message flows and formats for time-stamp request, response, and verification. Includes extension fields (e.g., ExtHash, ExtMethod, ExtRenewal).
- Generation & verification processes: describes how TSAs generate TSTs and how verifiers validate bindings and signatures.
- Security primitives: requires use of collision-resistant hash functions, digital signatures, and reference to time sources (UTC/time referencing schemes).
- Time-stamp renewal: covers issuance of renewed tokens to extend validity of earlier TSTs.
- Normative modules: includes ASN.1 module for TSTs and an excerpt of Cryptographic Message Syntax (CMS) guidance.
Practical applications and users
Who benefits:
- IT security architects and PKI operators designing time-stamping services
- TSA operators and managed trust-service providers
- Software vendors implementing timestamping in signing, archival, and notarization systems
- Compliance, legal and records-management teams requiring provable creation/alteration times
Common use cases:
- Providing non-repudiable evidence of document creation or modification
- Time-binding digital signatures and electronic records for legal and regulatory compliance
- Long-term archival and proof-of-existence services where integrity and time provenance are required
- Integrating time-stamping into workflows that use PKI and CMS-based message formats
Related standards
- ISO/IEC 18014 (Parts 2 & 3) - mechanisms for independent and linked tokens
- ISO/IEC 10118 - Hash-functions
- ISO 8601 - Date/time representation
- Cryptographic Message Syntax (CMS) - used for signed data encapsulation (referenced in Annex B)
Keywords: ISO/IEC 18014-1:2008, time-stamping services, time-stamp token, Time-Stamping Authority (TSA), time-stamp verification, digital time-stamping, hash function, ASN.1, Cryptographic Message Syntax (CMS).
Open preview (PDF)Information technology — Security techniques — Time-stamping services — Part 1: Framework