Qualified Electronic Time Stamp

A qualified electronic time stamp proves two things: that a particular piece of data existed at the stated date and time, and that it has not been altered since. Article 3(33) of the eIDAS Regulation defines an electronic time stamp as data in electronic form which binds other electronic data to a particular time, establishing evidence that the data existed at that time. A qualified one is a time stamp that meets the requirements of Article 42.

The data can be anything: a contract, a signature, a set of board minutes, a photograph, an export from a database. The time stamp is tied to the exact content. Change one character and the two no longer match.

The limits matter as much. A time stamp shows that the data existed no later than the stated moment. The document may have been written a year before. It says nothing about who wrote the document, who sent it or whether its content is true. Those are questions for a signature or a seal. A time stamp answers one question, which is when, and it answers on the authority of an independent third party instead of somebody's own clock.

A qualified electronic time stamp works by having an independent provider sign a statement that links a document's fingerprint to the current time. The software that requests the stamp calculates a hash of the data, a short value that in practice is unique to that exact content, and sends only the hash to the provider. The provider adds the date and time from its own clock, seals the two together with its private key and sends the result back. That result is called a time-stamp token. It is stored with the document or inside the document's signature.

Two things follow from this design. The provider never sees the document. It receives only the hash, from which the content cannot be reconstructed, so a confidential file can be stamped without being disclosed. The stamp can also be checked by anyone, at any later date, without relying on the person who holds the document. The checker recalculates the hash, compares it with the one in the token and verifies the provider's seal.

The exchange between the software and the provider follows a public protocol, RFC 3161, which the ETSI standards for time-stamping build on. It is automatic. In most signing tools the user never sees it happen.

A qualified electronic time stamp carries a legal presumption. Under Article 41(2) of eIDAS, it enjoys the presumption of the accuracy of the date and time it indicates and of the integrity of the data to which that date and time are bound. In a dispute, the court starts from the position that the stamped time is right and the data unchanged. Whoever says otherwise has to prove it.

An electronic time stamp that is not qualified still counts for something. Article 41(1) says it must not be denied legal effect or admissibility as evidence solely because it is electronic or because it is not qualified. It carries no presumption, though, so the party relying on it may have to show that the clock was accurate and the record has not been touched.

The table sets the two beside the date most documents actually carry, the one their author's own system recorded.

The presumption also travels. Under Article 24a(6), a qualified electronic time stamp provided in one member state must be recognised as a qualified electronic time stamp in all the others.

A qualified electronic time stamp must meet the three requirements in Article 42(1) of eIDAS. It must bind the date and time to the data in a way that reasonably rules out the data being changed undetectably. It must be based on an accurate time source linked to Coordinated Universal Time. It must be signed with an advanced electronic signature or sealed with an advanced electronic seal of the qualified trust service provider, or by an equivalent method.

The third requirement carries a fourth inside it: the provider has to be qualified. A provider holds that status only once a national supervisory body has granted it, and under Article 21(3) it may begin to offer a qualified service only after the status appears in the trusted list. Article 20(1) then requires an audit by a conformity assessment body at least every 24 months.

This makes the status easy to check. The EU Trusted List browser shows, for each provider, which qualified services it may offer and since when. ZealiD, for example, has run a qualified time-stamp service listed on the EU Trusted List since 10 October 2022.

On the technical side, the regulation leaves the detail to standards. Article 42 tasks the Commission with listing reference standards for binding the time to the data and for the accuracy of time sources, and a time stamp that complies with them is presumed to meet those requirements.

A signature shows who. A time stamp shows when. Most signed documents need both, because the validity of a signature depends on the moment it was made.

Article 32(1)(b) of eIDAS makes a qualified signature valid only if its certificate was valid at the time of signing. Certificates do not stay valid. They expire, and they are revoked when a phone is lost or an employee leaves. Under Article 28(4) a revoked certificate loses its validity from the moment of revocation, so signatures made before that moment remain good. That holds only if someone can show they were made before.

Here the signature has a weak point. Unless a time stamp is added, the signing time written into a signature comes from the signer's own device. A person holding a revoked key could set the clock back and sign. A qualified time stamp applied over the signature closes the gap. It proves, on a third party's authority, that the signature already existed at a moment when the certificate was still valid.

eIDAS does not list a time stamp among the requirements for a qualified signature. Signing services commonly add one anyway, and a validator will look for it. If you receive a signed document that matters, it is worth checking that one is there.

Qualified electronic time stamps matter for long-term evidence because they are what keeps a signature checkable after its certificate and its algorithms have aged. A share transfer or a loan agreement may have to be proved ten or twenty years after signing. Every certificate has an end date, and the algorithms behind today's signatures will be retired as computing power grows. Left alone, an old signature reaches a point where nobody can tell whether it was made in time or forged later.

The remedy works in layers. A time stamp is placed over the signature together with the certificate's status at that moment, which freezes the evidence as it stood. The time stamp has a certificate with an end date too, so before that date arrives a fresh time stamp is placed over everything, using current algorithms. Each layer vouches for the one beneath it.

eIDAS recognises this as a service of its own. Under Article 34(1), a qualified preservation service must use procedures and technologies capable of extending the trustworthiness of a qualified electronic signature beyond the technological validity period. For a firm, the practical question is whether the signing tool adds a time stamp and the certificate status at signing, and who renews them for documents that must be kept for a long time.

Qualified electronic time stamps are also used on their own, wherever the date of a record may later be disputed.

One use is written into the regulation. Article 44(1)(f) of eIDAS requires a qualified electronic registered delivery service to indicate the date and time of sending and receiving by a qualified electronic time stamp. That is the electronic counterpart of the postmark on a registered letter.

Others are a matter of practice. A firm can stamp a draft, a design or a piece of source code to show later that it existed on a given day, without signing it or showing it to anyone. It can stamp the version of a file as it stood when a deadline passed. It can stamp its logs at regular intervals, so that any later edit to an earlier entry becomes detectable. The value is the same each time: a date that does not depend on the firm's own systems or on its word.