How to use the command 'openssl ts' (with examples)

OpenSSL is a robust, full-featured open-source toolkit implementing the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. One of its lesser-known but very useful commands is openssl ts, which is employed for handling timestamp requests and responses. This command helps in generating and verifying timestamps, assuring the proof of integrity and existence of data at a particular point in time.

Use case 1: Generate a SHA-512 timestamp request of a specific file and output to file.tsq

Code:

openssl ts -query -data path/to/file -sha512 -out path/to/file.tsq

Motivation:

Timestamping allows users to demonstrate that the data existed at a specific time without revealing the data itself. This is particularly useful for compliance purposes, contractual obligations, or simply ensuring data integrity. By generating a timestamp request using SHA-512, a highly secure hashing algorithm, users can seek a timestamp token that verifies the presence of the file at the time the request was made.

Explanation:

• -query: Indicates that a timestamp request is to be made.
• -data path/to/file: Specifies the data file for which the timestamp request is being generated.
• -sha512: Encrypts the data file using the SHA-512 hashing algorithm for enhanced security.
• -out path/to/file.tsq: Directs the output to the specified file, in this case, a .tsq file which contains the request details.

Example output:

The command successfully generates a binary timestamp request file file.tsq, which contains the hashed data along with other parameters ready to be sent to a Time Stamping Authority (TSA) for processing.

Use case 2: Check the date and metadata of a specific timestamp response file

Code:

openssl ts -reply -in path/to/file.tsr -text

Motivation:

It’s essential to verify the content of a timestamp response file to ensure the integrity and authenticity of the timestamp received from the Time Stamping Authority (TSA). This process involves checking the date, time, and metadata associated with the timestamp response, which aids in validating the creation time and confirming no tampering has occurred since its creation.

Explanation:

• -reply: Instructs the command to operate on a timestamp response.
• -in path/to/file.tsr: Specifies the input timestamp response file to be inspected.
• -text: Requests a human-readable textual representation of the data within the timestamp response file for easier inspection and verification.

Example output:

The operation outputs various details of the timestamp response, including the date and time when the timestamp was issued, details about the hashing algorithm used, and the identifier of the TSA. This readable output helps confirm the response file’s authenticity.

Use case 3: Verify a timestamp request file and a timestamp response file from the server with an SSL certificate file

Code:

openssl ts -verify -in path/to/file.tsr -queryfile path/to/file.tsq -partial_chain -CAfile path/to/cert.pem

Motivation:

Verification is vital to ascertain that the timestamp response corresponds accurately to the initial request and is issued by a trusted Time Stamping Authority (TSA). Using an SSL certificate for verification ensures that the TSA issuing the timestamp is genuine and the proof of data existence is irrefutable.

Explanation:

• -verify: Initiates the verification process of the timestamps by comparing request and response files.
• -in path/to/file.tsr: Specifies the timestamp response file for verification.
• -queryfile path/to/file.tsq: The original timestamp request file to be matched against the response.
• -partial_chain: Helps in constructing a partial trust chain for verification.
• -CAfile path/to/cert.pem: Provides the Certificate Authority (CA) file to validate the trust chain of the TSA’s certificate.

Example output:

The command either confirms the authenticity and match of the response with the request or denies it if discrepancies are found, ensuring that the timestamp is issued by a legitimate authority and hasn’t been altered.

Use case 4: Create a timestamp response for request using key and signing certificate and output it to file.tsr

Code:

openssl ts -reply -queryfile path/to/file.tsq -inkey path/to/tsakey.pem -signer tsacert.pem -out path/to/file.tsr

Motivation:

For those operating a private Time Stamping Authority (TSA), it may be necessary to sign timestamp requests in-house. Creating a timestamp response by signing with a private key and appropriate certificate increases authenticity and trust in the timestamping process while reducing reliance on external TSAs.

Explanation:

• -reply: Indicates that a timestamp response should be generated.
• -queryfile path/to/file.tsq: Specifies the request file needing a timestamp response.
• -inkey path/to/tsakey.pem: The private key used for signing the timestamp response.
• -signer tsacert.pem: Certificate used to sign the timestamp, linking it to the signing authority.
• -out path/to/file.tsr: Specifies where the output timestamp response file should be stored.

Example output:

A new file.tsr is created as a response to the input request, containing a timestamp linked to the signing certificate, thus affirming the data’s existence and integrity contemporaneously as verified by the signature.

Conclusion:

The openssl ts command is a powerful utility for handling timestamps, an integral component in securing and proving data integrity across different environments. Each use case shows its applicability in documenting when data existed, confirming authenticity, or even operating your timestamping system efficiently. By utilizing this command with the appropriate parameters, users can enhance their data security and compliance strategies effectively.