Advanta / Evidence

Evidence timestamps

Every day we publish the fingerprints that seal our evidence logs, and two independent timestamping authorities sign them with the time. Anyone can check them without asking us.

Published every day at 01:10 UTC

What is published

Every step of an assignment notice, and every event of a buyer programme, is written to a log in which each entry carries the SHA-256 fingerprint of the entry before it. Once a day each log is sealed with a root fingerprint that depends on every entry so far, so changing any past entry would change every root after it.

After midnight (UTC) we publish the list of the roots sealed for the previous day and ask two public timestamping authorities, DigiCert and Sectigo, to sign the fingerprint of that list together with the time. The signature shows that the list existed no later than that time. It is made with the authority's key, not ours, so nobody can produce one afterwards.

Recent days

Loading the recent days.

Raw data (JSON): evidence-publications. Add ?date=YYYY-MM-DD for one day, or ?root= followed by a root to find the day that lists it.

How an auditor checks a record

  1. Recompute the root. From the records, with the chain verifier we provide: evidence_verify_chain() for assignment notices, corp_audit_verify_chain() for a buyer programme. The formulas are public, so any SHA-256 tool gives the same result.
  2. Find it in the day's list. Each line is cession|date|root or corp|seal id|root, one per root, sorted.
  3. Fingerprint the list. The SHA-256 of the list, byte for byte including the last line break, must equal the published fingerprint.
  4. Check each timestamp with OpenSSL 1.1.1 or later and the authority's certificate:
    openssl ts -verify -digest <fingerprint> -in day.tst -token_in -CAfile digicert.pem
    Certificate files: digicert.pem and sectigo.pem. Compare their fingerprints with your own trust store before relying on them.

What a timestamp proves, and what it does not

It proves that the list, and every root in it, existed no later than the time the authority signed. It does not say when a root was computed.

Days sealed before we started publishing were all published on the first day of publication. Their timestamps prove that those roots existed on that date, not on the day they were sealed. The list shows both dates and marks those days as published later.

These are standard RFC 3161 timestamps. They are not qualified electronic timestamps under the eIDAS Regulation.

What the list contains

Only fingerprints and the identifiers of the seals: no company names, no people, no amounts. Questions: diogo@advanta.pt.