Skip to content
NOQTIS

nqchkt(3)

nqchkt — check a capsule and its RFC 3161 timestamp

libnoqtis, -lnoqtis

#include <noqtis.h>

int
nqchkt(const char *dir, const uint8_t *trust, size_t trustlen, const uint8_t *const *anc, const size_t *anclen, size_t nanc, nqrep **rep);

() is nqchk(3) with nanc trust anchors for time-stamping authorities (TSAs): anc[i] is a DER X.509 certificate of anclen[i] bytes, for i below nanc, at most 32.

With anchors, the seal must carry a ‘timestamp’: the base64 of an RFC 3161 time-stamp token. The ‘timestamp’ row passes only when

  • the token parses as a strict DER RFC 3161 token;
  • its message imprint is its own hash (SHA-256, SHA-384 or SHA-512) of the decoded ‘signature’ bytes of the seal;
  • its signature verifies under the TSA's certificate, whose path leads to one of the anchors and is valid at the token's genTime;
and the row's detail then gives the genTime. A seal without a timestamp fails the row.

With nanc 0, () is exactly (): a timestamp present fails its row (“not checked: no TSA trust anchors given”), and no timestamp gives no row.

The timestamp proves that the signature existed at genTime, according to the TSA. It does not make an untrusted seal key trusted; pin the key with trust.

As for nqchk(3), and also:

[NQELIM]
nanc is over 32. No report.
[NQEARG]
nanc is nonzero and anc or anclen is NULL, or an anchor is NULL or empty. No report. An anchor that is not a certificate fails the ‘timestamp’ row instead.

const uint8_t *anc[1] = {tsa_der};
size_t anclen[1] = {tsa_der_len};
nqrep *rep = NULL;
int rc = nqchkt("results", pk, sizeof pk, anc, anclen, 1, &rep);

noqtis-check(1), nqchk(3), nqrep(3), nqtsput(3), noqtis-capsule(5)

Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP), RFC 3161, August 2001. Internet X.509 Public Key Infrastructure Certificate and CRL Profile, RFC 5280, May 2008.

The library makes no network request: a timestamp is obtained by the caller, with nqtsreq(3) and nqtsput(3) around its own HTTP request, or by noqtis-seal(1) --tsa. noqtis-check(1) --anchor calls this function.