Skip to main content

rfc3161-client

rfc3161-client is a Python library implementing the Time-Stamp Protocol (TSP) described in RFC 3161.

It is composed of three subprojects:

  • :crab: tsp-asn1: A Rust crate using rust-asn1 to create the types used by the Time-Stamp protocol. This crate depends on rust-asn1 and cryptography to minimize the amount of duplicated code. While it is usable as a standalone crate, this is not officially supported. Drop us a message if you are interested in using it.
  • :crab: rfc3161-client: Another Rust crate that provides Python bindings to the tsp-asn1 crate using PyO3.
  • :snake: rfc3161-client A Python library using the crate above to provide a usable API to create Timestamp Request and read Timestamp Response.

Goals and anti-goals

  • This library should be correct and provide an accurate implementation of protocol described in the RFC 3161.
  • This library does not perform any network activity, it simply provides primitive to build and verify objects. Network activity must be handled separately.

Usage

There are two parts to timestamping: retrieving + verifying the timestamp.

1. Retrieving a timestamp

The below code uses requests to get the timestamp from the Identrust TSA server:

# /// script
# dependencies = [
#   "requests",
#   "rfc3161-client",
# ]
# ///
import requests
from rfc3161_client import (
    decode_timestamp_response,
    TimestampRequestBuilder,
    VerifierBuilder,
    VerificationError,
)

# the data to sign. Could be a hash or any message. Should be bytes
message = b"Hello, World!"

# build the timestamp request
timestamp_request = (
    TimestampRequestBuilder().data(message).build()
    # Note: you could also add .hash_algorithm(XXX) to specify a specific hash algorithm
)

# TSA servers must be RFC 3161 compliant (see https://github.com/trailofbits/rfc3161-client/issues/46
# for a list of working servers)
tsa_server = "http://timestamp.identrust.com"

# make the request, remember to set content-type headers appropriately
response = requests.post(
    tsa_server,
    data=timestamp_request.as_bytes(),
    headers={"Content-Type": "application/timestamp-query"},
)
response.raise_for_status()

# if successful, should give a valid TimeStampResponse object
timestamp_response = decode_timestamp_response(response.content)

Verifying a timestamp

The second part is to verify the timestamp, this is done against a set of root certificates. In this example, we'll Mozilla's list of root certs provided in the certifi package:

import certifi
from cryptography import x509
import hashlib


# get trusted root certs from certifi
with open(certifi.where(), "rb") as f:
    cert_authorities = x509.load_pem_x509_certificates(f.read())

# for each of the root certs we have, try to verify the TSR with it
root_cert = None
for certificate in cert_authorities:
    verifier = VerifierBuilder().add_root_certificate(certificate).build()
    try:
        verifier.verify_message(timestamp_response, message)
        root_cert = certificate
        break
    except VerificationError:
        continue

# if successful, the TSR was verified and we should have the root cert that signed this TSR :)
print("Here's the root cert that signed your TSR:")
print(root_cert)

License

Copyright 2024 Trail of Bits

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Authors

Trail of Bits

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

rfc3161_client-1.0.7.tar.gz (107.3 kB view details)

Uploaded Source

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

rfc3161_client-1.0.7-cp39-abi3-win_amd64.whl (2.4 MB view details)

Uploaded CPython 3.9+Windows x86-64

rfc3161_client-1.0.7-cp39-abi3-win32.whl (2.0 MB view details)

Uploaded CPython 3.9+Windows x86

rfc3161_client-1.0.7-cp39-abi3-musllinux_1_2_x86_64.whl (2.6 MB view details)

Uploaded CPython 3.9+musllinux: musl 1.2+ x86-64

rfc3161_client-1.0.7-cp39-abi3-musllinux_1_2_i686.whl (2.6 MB view details)

Uploaded CPython 3.9+musllinux: musl 1.2+ i686

rfc3161_client-1.0.7-cp39-abi3-musllinux_1_2_armv7l.whl (2.4 MB view details)

Uploaded CPython 3.9+musllinux: musl 1.2+ ARMv7l

rfc3161_client-1.0.7-cp39-abi3-musllinux_1_2_aarch64.whl (3.0 MB view details)

Uploaded CPython 3.9+musllinux: musl 1.2+ ARM64

rfc3161_client-1.0.7-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (2.4 MB view details)

Uploaded CPython 3.9+manylinux: glibc 2.17+ x86-64

rfc3161_client-1.0.7-cp39-abi3-manylinux_2_17_i686.manylinux2014_i686.whl (2.4 MB view details)

Uploaded CPython 3.9+manylinux: glibc 2.17+ i686

rfc3161_client-1.0.7-cp39-abi3-manylinux_2_17_armv7l.manylinux2014_armv7l.whl (2.0 MB view details)

Uploaded CPython 3.9+manylinux: glibc 2.17+ ARMv7l

rfc3161_client-1.0.7-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl (2.7 MB view details)

Uploaded CPython 3.9+manylinux: glibc 2.17+ ARM64

rfc3161_client-1.0.7-cp39-abi3-macosx_11_0_arm64.whl (2.4 MB view details)

Uploaded CPython 3.9+macOS 11.0+ ARM64

rfc3161_client-1.0.7-cp39-abi3-macosx_10_12_x86_64.whl (2.1 MB view details)

Uploaded CPython 3.9+macOS 10.12+ x86-64

File details

Details for the file rfc3161_client-1.0.7.tar.gz.

File metadata

  • Download URL: rfc3161_client-1.0.7.tar.gz
  • Upload date:
  • Size: 107.3 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for rfc3161_client-1.0.7.tar.gz
Algorithm Hash digest
SHA256 8c02330b8b09cbf88f2f5f1ecdb6e6b76c0c9bd7c4199a5068ab43b95d7ab8e5
MD5 118024d537fc0fa5917c502e80909aeb
BLAKE2b-256 350db9e726d45557d756d2e162bd3ca23f641119c4fd0717b9e4b7519080be10

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.7.tar.gz:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.7-cp39-abi3-win_amd64.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.7-cp39-abi3-win_amd64.whl
Algorithm Hash digest
SHA256 5ea1340fa199c529af7b432c06689c865db8f395f4d6756b0a7663ffdbc04840
MD5 49b49ef561b8d4a9d5aedfc9b733f18b
BLAKE2b-256 b41a3bf139b58746d80f5e6eca2573e796ecb2b17e3726b091f0606ee5c06218

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.7-cp39-abi3-win_amd64.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.7-cp39-abi3-win32.whl.

File metadata

  • Download URL: rfc3161_client-1.0.7-cp39-abi3-win32.whl
  • Upload date:
  • Size: 2.0 MB
  • Tags: CPython 3.9+, Windows x86
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for rfc3161_client-1.0.7-cp39-abi3-win32.whl
Algorithm Hash digest
SHA256 f5ba8607a6d44dd194e0e0ba68f9b6e8501d69a79b5b7b34a2228040050b59a4
MD5 04dc027529669fe390fe6fb4e860912d
BLAKE2b-256 cf13a3f0cdd7eb2110b59dcd73e70a5a822f2aa1bffdb24f784653ae5eeb96f3

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.7-cp39-abi3-win32.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.7-cp39-abi3-musllinux_1_2_x86_64.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.7-cp39-abi3-musllinux_1_2_x86_64.whl
Algorithm Hash digest
SHA256 563d2a87d21fa184782afd0cf57f06e3713580810c0dd62f7271ec2ae83b7219
MD5 aabf6ef17ada054d19ed401c48a208c6
BLAKE2b-256 0544acc2aa9aa119c0db865275b90658dcc92d0cd6a8be2d96c2b0099bdc2888

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.7-cp39-abi3-musllinux_1_2_x86_64.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.7-cp39-abi3-musllinux_1_2_i686.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.7-cp39-abi3-musllinux_1_2_i686.whl
Algorithm Hash digest
SHA256 ad799a0500e4a7c56172e247fe29c6029903b5c43eb2c5ff5b35d5641e37a325
MD5 34822929616fcf482eb6b8b073b95c69
BLAKE2b-256 f23937d80f9bb14f6cc5e86b8b10b30b81938f68e85cd1f32f65a5e7d5e805e8

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.7-cp39-abi3-musllinux_1_2_i686.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.7-cp39-abi3-musllinux_1_2_armv7l.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.7-cp39-abi3-musllinux_1_2_armv7l.whl
Algorithm Hash digest
SHA256 c5b29bf5e4c01350654e80db8761466bbdf41efd2794c819493da63effa8a226
MD5 809d8bd302da4bf19a097777ba60050e
BLAKE2b-256 eea625e7e030f75bf1a10573e7ab31468d852f82cd68c08eb087b92ae985c883

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.7-cp39-abi3-musllinux_1_2_armv7l.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.7-cp39-abi3-musllinux_1_2_aarch64.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.7-cp39-abi3-musllinux_1_2_aarch64.whl
Algorithm Hash digest
SHA256 ec52ada36981e74f8926290f5cf9e8e81b4779b907dab17cf2e7d000d0e5a230
MD5 6138a7e63bad96c1c8176b5def9e43bf
BLAKE2b-256 d6205e0ef07211a5b3c2a87ece05e540a1b962294695eb9158e9042cd4a99c2e

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.7-cp39-abi3-musllinux_1_2_aarch64.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.7-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.7-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Algorithm Hash digest
SHA256 2ee940d6c65648732fa02606d6277356382347e34e89be54403ed4825cc9d391
MD5 ce8499f56ed4518a0ea4a3b22c7132db
BLAKE2b-256 fe72b403d38c83e7d667a72eb1495d11dbcfeeb3bda9703301a0d2adf5af0ee7

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.7-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.7-cp39-abi3-manylinux_2_17_i686.manylinux2014_i686.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.7-cp39-abi3-manylinux_2_17_i686.manylinux2014_i686.whl
Algorithm Hash digest
SHA256 8db252741022bc27e1150c066b163130dc9fcded5822dc079217d5df3e5689a1
MD5 d6b7abb049df8aea2375f251605137ca
BLAKE2b-256 93618228f3c5d603a8797d942a1a387b8fae4672a456ebf57777c369fd85a30d

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.7-cp39-abi3-manylinux_2_17_i686.manylinux2014_i686.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.7-cp39-abi3-manylinux_2_17_armv7l.manylinux2014_armv7l.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.7-cp39-abi3-manylinux_2_17_armv7l.manylinux2014_armv7l.whl
Algorithm Hash digest
SHA256 3cf66df2e31674206699a5d4d31ca81f57e84c4892de3c676341ec2c3f764ae1
MD5 b78888a0ee8eb50018b58a1eff09bb85
BLAKE2b-256 edef91229ff3c659f09bbed9f956e2dc16baec7077280e20834538a4fc96ee38

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.7-cp39-abi3-manylinux_2_17_armv7l.manylinux2014_armv7l.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.7-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.7-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl
Algorithm Hash digest
SHA256 83cd871823fa998e2d6a91e1a09881c798b016a87b71bad8e29b9135e4b6c036
MD5 b4cf4a9e9368a6bebd1ae874e6751ec9
BLAKE2b-256 927344e1acdcc2d9c8dbf1faa11151a0e93cfa309aae25a9acf44228818d391a

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.7-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.7-cp39-abi3-macosx_11_0_arm64.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.7-cp39-abi3-macosx_11_0_arm64.whl
Algorithm Hash digest
SHA256 966ab2b49b1dd157527818985512099c44fa8d3510eb4288e7bb986cd215b860
MD5 6dc36744b88333146b1f5a305a0d4704
BLAKE2b-256 08b86296398bfeaf900a3d5bfac638c654c7b88c97d3fad5aa52f45ad18847fe

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.7-cp39-abi3-macosx_11_0_arm64.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rfc3161_client-1.0.7-cp39-abi3-macosx_10_12_x86_64.whl.

File metadata

File hashes

Hashes for rfc3161_client-1.0.7-cp39-abi3-macosx_10_12_x86_64.whl
Algorithm Hash digest
SHA256 351cb9149ea4f0db6206711d795f29ab23be2f28d4ac615d2ac6e47aed96d5fa
MD5 b922174a58cf8fed0f902e52b8f18a68
BLAKE2b-256 3cdd27f5a2b7a452bfa6ac65f70240707bd45259db67eab0460aef2a6baace02

See more details on using hashes here.

Provenance

The following attestation bundles were made for rfc3161_client-1.0.7-cp39-abi3-macosx_10_12_x86_64.whl:

Publisher: CI.yml on trailofbits/rfc3161-client

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page