Long ago, I thought some site -- maybe a certificate source like Thawte? -- should provide a provable timestamping service over the web. The basic idea is that when an application wants to timestamp some item, such as an entry in QuickBooks or an executed PDF or whatever, it would (1) generate a signature of the item, using SHA1 or the favorite hash function du jour, (2) then post a request to the timestamp site with the signature, (3) in the hope of receiving (a) a global timestamp and (b) a validation signature of the timestamp and item signature. The website also would maintain a globally accessible log, by time, of what validation signatures it had generated. These provide independent proof if ever needed that the item was indeed timestamped -- and hence, existed -- when claimed. It seems to me that this would be useful for a broad range of applications, from bookkeepping to facility monitoring. I can imagine all sorts of reasons for wanting a verified timestamp, from the legal to the mundane. Is anyone doing this? _______________________________________________ FoRK mailing list http://xent.com/mailman/listinfo/fork ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]