Skip to content
NOQTIS

noqtis-ers(1)

noqtis-ers — start or renew a capsule's RFC 4998 evidence record

noqtis ers --tsa url ... [--anchor der-file ...] [--hash sha256 | sha384 | sha512] dir

A timestamp proves when a seal existed only as long as the TSA's certificate and its hash can be trusted, a few years. An evidence record (RFC 4998) keeps that proof for decades: noqtis ers writes noqtis.ers beside the seal of the capsule dir (sealed before with noqtis-seal(1)), an EvidenceRecord whose data object is the seal file noqtis.sig, byte for byte, and adds one archive timestamp to it each time it runs.

The first run starts the record with a timestamp over the hash of the seal file. Each later run renews it, after the record there has been checked:

  • timestamp renewal, the default: a timestamp over the record's last one, in the same chain. Run it before the last TSA certificate expires.
  • hash-tree renewal, with a --hash other than the record's: a new chain whose first timestamp covers the seal and every chain before, with the new hash. Run it before the record's hash weakens.

The request, the nonce and the checks on the reply are those of noqtis-timestamp(1), over the hash the next archive timestamp covers; the reply must also not be dated before the record's last timestamp. --tsa may be given more than once: the TSAs are tried in order until one gives a timestamp that checks.

noqtis-check(1) checks the record under its --anchor certificates: the first timestamp must be over this seal, each next one over the one before (or, opening a chain, over the seal and the chains before it), and each TSA certificate valid at its own timestamp's time and at the next one's; the last must be valid now. While a record is there, noqtis-seal(1) and noqtis-timestamp(1) refuse the folder, since either would change the seal it proves.

url
A time-stamping authority, as for noqtis-timestamp(1). At most 32.
der-file
A TSA's root or issuing certificate, DER-encoded: the record there and the new timestamp must verify under the anchors. Without one, each token is checked alone and the TSA is not trusted. At most 32.
name
The new timestamp's hash: sha256, sha384 or sha512. The default is the record's last one, or SHA-256 for a new record.

dir/noqtis.ers
The evidence record, DER. Keep it with noqtis.sig and noqtis.json: the three prove the folder as it was sealed.

0
the record was written
1
the record there does not check (it is not extended)
2
a usage error, a folder that is not a sealed capsule, or no TSA gave a timestamp that checks (nothing written)

$ noqtis ers --tsa http://timestamp.digicert.com results
started an evidence record for results: archive timestamp from ...
$ noqtis ers --tsa http://timestamp.digicert.com --anchor digicert.der \
    results
renewed the evidence record's timestamp for results: ...
$ noqtis ers --tsa http://timestamp.digicert.com --anchor digicert.der \
    --hash sha512 results
renewed the evidence record with a new hash chain for results: ...
$ noqtis check -p me.pub --anchor digicert.der results

noqtis(1), noqtis-check(1), noqtis-seal(1), noqtis-timestamp(1), nqersput(3), noqtis-capsule(5)

Evidence Record Syntax (ERS), RFC 4998. Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP), RFC 3161.