E-signatures · How it works
What is an RFC 3161 timestamp?
An RFC 3161 timestamp is a small signed statement from an independent time stamping authority saying that a given hash existed at a given moment. Attached to a signed PDF, it proves when the document was signed, independently of the signer's own computer clock, which nobody has any reason to trust.
A signature proves who and what. A timestamp proves when, and it is the part most people leave out. Without one, the only record of the signing time is a clock the signer controls.
Nuwan Madhusanka · Co-founder
3 min read · Published
- 1
Hash the signature
The signing system takes a hash of the signature block, not of the document, and puts it in a timestamp request.
- 2
Ask the authority
The request goes to a time stamping authority over HTTP. Only a response with status granted or granted with modifications is accepted.
- 3
Attach the token
The token comes back signed by the authority and is attached to the signature as an unsigned attribute, under the object identifier 1.2.840.113549.1.9.16.2.14.
- 4
Leave room for it
The placeholder reserved in the PDF has to grow from 8192 bytes to 24576, because a timestamp token does not otherwise fit.
Why the signer's clock is not evidence
A signature records a time taken from the machine that made it. That machine belongs to one of the parties, and its clock can be set to anything. In a dispute about whether a document was signed before or after some event, a self reported time is worth very little. A timestamp replaces it with a statement from somebody with no stake in the outcome, signed with their own key.
How to tell whether a signed PDF has one
Look at the recorded algorithm. A certificate that reads PAdES-SHA256-DocMDP is telling you there is no timestamp; PAdES-SHA256-DocMDP-RFC3161 means a token was attached. It is worth checking rather than assuming, because timestamping is often configured off by default, and a certificate that mentions no timestamp is not making a mistake, it is telling you the truth.
What it does not prove
A timestamp says a document existed at a moment. It says nothing about who signed it, whether they had authority, or whether they read it. Those come from the signature, the identity check and the audit trail respectively. The four together are what makes a signed document defensible; any one of them alone is thin.
Questions people ask
Is a timestamp the same as the date in the signature?
No, and the difference is the whole point. The date in a signature comes from the signer's own computer. A timestamp comes from an independent authority, is signed with that authority's key, and can be verified without trusting either party. One is a claim, the other is evidence.
Who runs a time stamping authority?
Certificate authorities and some national providers run them, and many are free to use at low volume. The requirement is that they are independent of the parties to the document and that their own certificate is trusted by whoever verifies later, which is why picking one already in the common trust lists saves argument.
What happens if the authority is down?
The request has a timeout, and a signing flow has to decide what to do when it expires: sign without a timestamp, or fail the whole thing. Failing is usually the safer default for high value agreements, because a document that quietly lost its timestamp looks identical to one that never asked for it.
Does a timestamp expire?
The token itself does not, but the authority's certificate does, and once it expires you need the revocation data captured at the time to keep validating. That is exactly what the long term PAdES levels add, which is why archives use B-LT or B-LTA rather than a plain timestamp.
Can I add a timestamp after signing?
Not to the existing signature. The token is attached inside the signature block, so it has to be requested as part of signing. What you can do afterwards is timestamp the whole file again as a separate signature, which proves the file existed at that later moment but says nothing about the original signing time.
Make one with e-signatures
The button opens the generator with this use case already described. Change the wording to match your own.
Send a document for signingRelated questions
- What is PAdES?PAdES is the ETSI standard for digital signatures embedded in a PDF. What it adds over a plain signature, its levels, and how to spot one in a reader.
- Electronic signature against digital signatureAn electronic signature is any mark made with intent to sign. A digital signature is cryptography. One is a legal category, the other is a technique.
- Initials against a signatureA signature signs the agreement. Initials mark that a specific page or clause was seen. When to ask for each, and when initials are theatre.
- What is a certificate of completion?A certificate of completion is the PDF summary of a finished signing: the envelope, each signer with their identity check and IP, and the full event log.
Step by step in the builder: Send a PDF for e-signature.
Written and checked by the OneCraft team. Last checked .