Skip to main content

rfc3161-client

rfc3161-client is a Python library implementing the Time-Stamp Protocol (TSP) described in RFC 3161.

It is composed of three subprojects:

  • :crab: tsp-asn1: A Rust crate using rust-asn1 to create the types used by the Time-Stamp protocol. This crate depends on rust-asn1 and cryptography to minimize the amount of duplicated code. While it is usable as a standalone crate, this is not officially supported. Drop us a message if you are interested in using it.
  • :crab: rfc3161-client: Another Rust crate that provides Python bindings to the tsp-asn1 crate using PyO3.
  • :snake: rfc3161-client A Python library using the crate above to provide a usable API to create Timestamp Request and read Timestamp Response.

Goals and anti-goals

  • This library should be correct and provide an accurate implementation of protocol described in the RFC 3161.
  • This library does not perform any network activity, it simply provides primitive to build and verify objects. Network activity must be handled separately.

Usage

There are two parts to timestamping: retrieving + verifying the timestamp.

1. Retrieving a timestamp

The below code uses requests to get the timestamp from the Identrust TSA server:

# /// script
# dependencies = [
#   "requests",
#   "rfc3161-client",
# ]
# ///
import requests
from rfc3161_client import (
    decode_timestamp_response,
    TimestampRequestBuilder,
    VerifierBuilder,
    VerificationError,
)

# the data to sign. Could be a hash or any message. Should be bytes
message = b"Hello, World!"

# build the timestamp request
timestamp_request = (
    TimestampRequestBuilder().data(message).build()
    # Note: you could also add .hash_algorithm(XXX) to specify a specific hash algorithm
)

# TSA servers must be RFC 3161 compliant (see https://github.com/trailofbits/rfc3161-client/issues/46
# for a list of working servers)
tsa_server = "http://timestamp.identrust.com"

# make the request, remember to set content-type headers appropriately
response = requests.post(
    tsa_server,
    data=timestamp_request.as_bytes(),
    headers={"Content-Type": "application/timestamp-query"},
)
response.raise_for_status()

# if successful, should give a valid TimeStampResponse object
timestamp_response = decode_timestamp_response(response.content)

Verifying a timestamp

The second part is to verify the timestamp, this is done against a set of root certificates. In this example, we'll Mozilla's list of root certs provided in the certifi package:

import certifi
from cryptography import x509
import hashlib


# get trusted root certs from certifi
with open(certifi.where(), "rb") as f:
    cert_authorities = x509.load_pem_x509_certificates(f.read())

# for each of the root certs we have, try to verify the TSR with it
root_cert = None
for certificate in cert_authorities:
    verifier = VerifierBuilder().add_root_certificate(certificate).build()
    try:
        verifier.verify_message(timestamp_response, message)
        root_cert = certificate
        break
    except VerificationError:
        continue

# if successful, the TSR was verified and we should have the root cert that signed this TSR :)
print("Here's the root cert that signed your TSR:")
print(root_cert)

License

Copyright 2024 Trail of Bits

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Authors

Trail of Bits

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

rfc3161_client-1.0.8.tar.gz (107.4 kB view details)

Uploaded Source

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

rfc3161_client-1.0.8-cp39-abi3-win_amd64.whl (2.4 MB view details)

Uploaded CPython 3.9+Windows x86-64

rfc3161_client-1.0.8-cp39-abi3-win32.whl (2.0 MB view details)

Uploaded CPython 3.9+Windows x86

rfc3161_client-1.0.8-cp39-abi3-musllinux_1_2_x86_64.whl (2.6 MB view details)

Uploaded CPython 3.9+musllinux: musl 1.2+ x86-64

rfc3161_client-1.0.8-cp39-abi3-musllinux_1_2_i686.whl (2.6 MB view details)

Uploaded CPython 3.9+musllinux: musl 1.2+ i686

rfc3161_client-1.0.8-cp39-abi3-musllinux_1_2_armv7l.whl (2.4 MB view details)

Uploaded CPython 3.9+musllinux: musl 1.2+ ARMv7l

rfc3161_client-1.0.8-cp39-abi3-musllinux_1_2_aarch64.whl (3.0 MB view details)

Uploaded CPython 3.9+musllinux: musl 1.2+ ARM64

rfc3161_client-1.0.8-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (2.4 MB view details)

Uploaded CPython 3.9+manylinux: glibc 2.17+ x86-64

rfc3161_client-1.0.8-cp39-abi3-manylinux_2_17_i686.manylinux2014_i686.whl (2.4 MB view details)

Uploaded CPython 3.9+manylinux: glibc 2.17+ i686

rfc3161_client-1.0.8-cp39-abi3-manylinux_2_17_armv7l.manylinux2014_armv7l.whl (2.0 MB view details)

Uploaded CPython 3.9+manylinux: glibc 2.17+ ARMv7l

rfc3161_client-1.0.8-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl (2.6 MB view details)

Uploaded CPython 3.9+manylinux: glibc 2.17+ ARM64

rfc3161_client-1.0.8-cp39-abi3-macosx_11_0_arm64.whl (2.4 MB view details)

Uploaded CPython 3.9+macOS 11.0+ ARM64

rfc3161_client-1.0.8-cp39-abi3-macosx_10_12_x86_64.whl (2.1 MB view details)

Uploaded CPython 3.9+macOS 10.12+ x86-64

File details

Details for the file rfc3161_client-1.0.8.tar.gz.

File metadata

  • Download URL: rfc3161_client-1.0.8.tar.gz
  • Upload date:
  • Size: 107.4 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.14

File hashes

Hashes for rfc3161_client-1.0.8.tar.gz
Algorithm Hash digest
SHA256 4bda5a2bc6947c16b6f8df90ff0e99cb333d78ab1465517f637d313d75703651
MD5 ae9e6b4db68908efc08ff7a9a636d336
BLAKE2b-256 18a6cf05ce2b73da1e7c876c8992035bcbede938483f16ad04f0bda34c39b299

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.8.tar.gz:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.8-cp39-abi3-win_amd64.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.8-cp39-abi3-win_amd64.whl
Algorithm Hash digest
SHA256 5c1889d6bae269dc0f1e418f82e554b413066b5f8dd864f9367cf1ffb3d0a312
MD5 7e10f8eb2b78fff60bed3d4cc8800105
BLAKE2b-256 7657da3c2f7784d1e7b7c48f8ce2e391314f6e50a14f5eb1a9d9460bb7b4fc8e

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.8-cp39-abi3-win_amd64.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.8-cp39-abi3-win32.whl.

File metadata

  • Download URL: rfc3161_client-1.0.8-cp39-abi3-win32.whl
  • Upload date:
  • Size: 2.0 MB
  • Tags: CPython 3.9+, Windows x86
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.14

File hashes

Hashes for rfc3161_client-1.0.8-cp39-abi3-win32.whl
Algorithm Hash digest
SHA256 9d382372e7fdfde592584f985fb1063d1506ae0573df45fcb2b41e2ed82e3431
MD5 2cb49935e8a9d236ef37f530ba0e9af4
BLAKE2b-256 65530de416266baddfac030b80602a8034e0133673deb18d4934623f78087d44

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.8-cp39-abi3-win32.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.8-cp39-abi3-musllinux_1_2_x86_64.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.8-cp39-abi3-musllinux_1_2_x86_64.whl
Algorithm Hash digest
SHA256 d3c25311c67a7daeef990fb5b94eaed706135c6a6fd98c6e382bbc857faa4214
MD5 7603bd473a59d793515f3ece0b495aa3
BLAKE2b-256 5d49141ecbee41a7cef5d819ad692305d99775af3ecb5b145d323dfd8458f32f

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.8-cp39-abi3-musllinux_1_2_x86_64.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.8-cp39-abi3-musllinux_1_2_i686.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.8-cp39-abi3-musllinux_1_2_i686.whl
Algorithm Hash digest
SHA256 51adc82dbd04d2b88e3a17f524f0e57d0270d7276887a5800c81833f79fb4f4a
MD5 3e8256f7606db18c2c773c9b4c1220e6
BLAKE2b-256 23faad5e2a354d01d2f1cedaa5ea24548f7cf71cef427715bf3104f3f81c461d

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.8-cp39-abi3-musllinux_1_2_i686.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.8-cp39-abi3-musllinux_1_2_armv7l.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.8-cp39-abi3-musllinux_1_2_armv7l.whl
Algorithm Hash digest
SHA256 7f8b82c97c1935a09376591b45bd81aa57a4232f4d446eee3a44c025ef7c4d5a
MD5 2a6f8f23fb5c7e9ad379b0537f26c886
BLAKE2b-256 eea6d5f7964d180b6ecf659d989d3474edaa7ef721a0038562b226ec89fc8811

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.8-cp39-abi3-musllinux_1_2_armv7l.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.8-cp39-abi3-musllinux_1_2_aarch64.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.8-cp39-abi3-musllinux_1_2_aarch64.whl
Algorithm Hash digest
SHA256 e95ca8a64fddfdd639e09e48bab4722f31b26ce099067ad2bb8e85f88fcc707b
MD5 0052c6520ff4f1e6f426b679f33ec9d8
BLAKE2b-256 a4f199638e03afae594418f9e9c27aeb189fe6dabc3d853cd48b36a1cf61e0a4

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.8-cp39-abi3-musllinux_1_2_aarch64.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.8-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.8-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Algorithm Hash digest
SHA256 55cd9366f20dcea8dc65f93b08d12607c071015d2f5b5d24129128f04643a77d
MD5 ed3dea1b23f3ce47720c7e1b18042429
BLAKE2b-256 cef56e0775d3219d791cac11e30b5a3071d62a2a7fe21bbfffa801903a15ab12

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.8-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.8-cp39-abi3-manylinux_2_17_i686.manylinux2014_i686.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.8-cp39-abi3-manylinux_2_17_i686.manylinux2014_i686.whl
Algorithm Hash digest
SHA256 9826227dc04e1a86f2598f9c1829f078afc35f558987df77578ea1508d1460a1
MD5 29e31f721bc8e87d30da8f5f3fbb7649
BLAKE2b-256 032bfdbcf18d362eb7e149d4a6552ccb3e2c8c40d058cb8a44b2f305d6f16a2d

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.8-cp39-abi3-manylinux_2_17_i686.manylinux2014_i686.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.8-cp39-abi3-manylinux_2_17_armv7l.manylinux2014_armv7l.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.8-cp39-abi3-manylinux_2_17_armv7l.manylinux2014_armv7l.whl
Algorithm Hash digest
SHA256 38c5c278c7d4605e9c166a332c13b286475730b750109235b547f7d1b21c5c6f
MD5 d2739794edfbe719950462a30f94adb1
BLAKE2b-256 5966b739e4c8778e8221eb58e09de47543fa07da039204ef2c87d3aa6e3ec4d4

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.8-cp39-abi3-manylinux_2_17_armv7l.manylinux2014_armv7l.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.8-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.8-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl
Algorithm Hash digest
SHA256 29cebab8dadec88b85eac43505db186749e23ddf1c7699ffa08f7cbdc86a52fe
MD5 5f7819b0ea69d35c1fcb6ea6c376a2d9
BLAKE2b-256 8cd664bf6b0af601e3a532d1800180058088a086bca6bd8119acd576dba3c8b7

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.8-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.8-cp39-abi3-macosx_11_0_arm64.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.8-cp39-abi3-macosx_11_0_arm64.whl
Algorithm Hash digest
SHA256 4bdb12618f98ee634d3625208f4f1c3cdde2306a8187a7416bfa47d45cad3dba
MD5 d2baa52f30674380e2de44c7932b0247
BLAKE2b-256 385962123806432e3fa42c06e74ee66b0dbdce66fa5cc0582d478de4ef6934e3

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.8-cp39-abi3-macosx_11_0_arm64.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.8-cp39-abi3-macosx_10_12_x86_64.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.8-cp39-abi3-macosx_10_12_x86_64.whl
Algorithm Hash digest
SHA256 3951db9573e4f6b4a1a62ad4f0074683610714625bf50c010739ffa568f23beb
MD5 4875979de3e17606140f17738346b2a9
BLAKE2b-256 ca0aa06fa0af9676fa8ae6962def859cb1966fb1caf0be507d5abcc22994ca13

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.8-cp39-abi3-macosx_10_12_x86_64.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page