What does a digital timestamp establish?

What does the date mean?

Suppose you finish a design on Monday and timestamp it on Thursday. The timestamp supports the conclusion that this version existed by Thursday. It does not establish Monday as its creation date.

The same applies to an older file: timestamping it today creates evidence from today. It does not retrospectively certify a date written inside the document.

How is the file connected to the date?

A cryptographic hash identifies the file’s exact contents. A timestamp connects that fingerprint to evidence of time. For example, under RFC 3161, a timestamp authority signs a record containing the hash and a time value. The authority can process the fingerprint without receiving the file itself.

Verification checks both the file and the timestamp. For a timestamp issued by an authority under RFC 3161, this means checking:

• The file’s fingerprint: recalculate its hash and compare it with the hash recorded in the timestamp, using the specified algorithm.
• The authority’s digital signature: verify that the timestamp was signed with the key corresponding to the authority’s signing certificate, and that the signed information—including the hash and time—has not been altered.
• The signing certificate and its trust chain: check that the certificate was authorised for timestamp signing and chains back to a trusted certification authority. Its validity period and relevant revocation information must also be assessed; a mathematically correct signature alone does not establish that the signing key was trustworthy.
• The time information and service policy: check the recorded time, any stated accuracy, and the rules under which the authority issued the timestamp. The signature authenticates the authority’s statement of time; confidence in that time also depends on the authority’s clock and operating procedures.

These checks are normally performed by verification software using the timestamp and supporting certificates and validation data. A matching file hash is only one part of the process.

Does it establish authorship or ownership?

The timestamp dates the material submitted. It does not determine whether the person submitting it created it, had permission to use it or holds the relevant rights. Nor does it check whether statements inside the file are true.

For example, a timestamped project note may say that a contractor assigned their rights to a company. The timestamp shows that the note existed by a date; it does not replace the assignment agreement. Preserve the records that support the statements you may later need to substantiate.

What should I keep for later verification?

Keep the exact timestamped file, its certificate or proof file, and any supporting verification data needed to check it independently. The provider’s complete export may bundle these together. A certificate cannot reconstruct a missing file or restore an altered one to its certified version.

There is no single certificate file format. Common forms you may encounter include:

• PDF: a readable certificate or report. Some PDFs also contain embedded timestamps, signatures or proof attachments; others are only a summary. Preserve the original digital PDF and its attachments, not a printout or scan.
• RFC 3161 response or token: a machine-readable file, often named .tsr or .tst. It contains the signed timestamp information used by verification software. File extensions vary between providers.
• Blockchain proof file: for example, an OpenTimestamps .ots file. It contains the information needed to connect a file’s fingerprint to a blockchain record. Other services use their own proof formats.

Depending on the format, the proof file may need supporting verification data to be checked independently. For an authority-issued timestamp, this can include the authority’s signing certificate, intermediate certificates linking it to a trusted root, and dated certificate-status records showing whether certificates had been revoked. These may already be embedded in the export or supplied separately. For a blockchain timestamp, it means the proof connecting the file’s hash to the blockchain entry, rather than just a transaction number or screenshot.

You should not normally need to assemble these technical components yourself. Export the complete verification package, keep the provider’s instructions, and check that it includes what is needed for independent verification and long-term preservation. The filename extension alone does not tell you whether the package is complete.

When the work changes, preserve and timestamp the new version separately. This produces a sequence of dated records rather than asking one timestamp to describe the whole history of a project.