CNX Timestamp Authority

A system can record when it created a document, backup, transaction, or log entry, but that timestamp is controlled by the same system that controls the record. A Timestamp Authority provides an independent witness: it signs a cryptographic hash together with the time at which the request was received.

CNX operates an RFC 3161 Timestamp Authority anchored to the same in-country atomic-clock infrastructure as CNX Precision Time. The resulting token can be retained with the original data and verified later without sending that data to CNX.

What a timestamp proves

A valid token establishes that the exact byte sequence represented by its hash existed no later than the token's signed generation time. Verification checks three things:

• Authenticity — the token was signed by a certificate in the CNX TSA chain.
• Integrity — the token's message imprint matches the original data.
• Time — the signed token records when CNX received and processed the request.

The token does not establish authorship, legal validity, correctness, confidentiality, or access control. When combined with a digital signature over the same material, it can establish that the signature existed while the signing certificate was valid.

How the service works

The requester hashes the data locally and sends the hash in a standard RFC 3161 request. CNX does not need the original document or file. The response contains the message imprint, generation time, serial number, applicable Timestamp Policy identifier, signing certificate, and signature.

Each token carries its signing chain. The independently published CNX root trust anchor allows a relying party to verify that chain without trusting certificates merely because they arrived inside the token. The signing certificates are restricted to timestamp signing, and the applicable service commitments and token-handling rules are defined in the versioned Timestamp Policy.

CNX TSA servers derive time from the same GNSS-disciplined Rubidium atomic oscillators used by CNX Precision Time. This gives organisations using CNX NTS or PTP a common physical reference for their internal system clocks and external timestamp evidence.

Evidence patterns

• Sidecar token — retain an unchanged file together with its timestamp request and response.
• Manifest — record the hashes of several files in a manifest and timestamp that manifest, allowing one token to cover a defined evidence set.
• Embedded timestamp — signing formats such as Authenticode, JAR signatures, and PDF signatures can carry an RFC 3161 token inside the signature structure.

The evidence package must retain the bytes that were actually hashed. Timestamping a mutable filename, a later rebuild, or a growing log without preserving the corresponding snapshot does not prove the state the organisation intended to retain.

Common uses

• Backups and database exports — prove that a retained restore point or period-end snapshot existed in a specific state.
• Audit logs and SIEM archives — seal completed log intervals or manifests so later modification is detectable.
• Release artifacts — timestamp the artifact or immutable image digest that was actually published.
• Code and document signatures — preserve evidence that a signature existed during the signing certificate's validity period.
• Incident evidence — timestamp collected disk images, packet captures, exports, and other immutable investigation artifacts before analysis.

Clock synchronisation and timestamp attestation solve different problems. NTS and PTP keep systems on a common timeline; TSA provides independent evidence that particular data existed at a particular time.

Free and contracted use

The public endpoint is available for evaluation, development, and general use without registration. Contracted Precision Time customers receive authenticated TSA access with the service commitments, accountability, and retained issuance records defined by their agreement and the Timestamp Policy.

Operational procedures, endpoints, request formats, trust-anchor handling, verification commands, and integration examples are maintained in the technical documentation.