Trusted Timestamping: Making Logs Legally Valid with RFC 3161

The problem: "Was this file really like this on that day?"

A log file is evidence in court or at an audit only if two questions can be answered affirmatively:

Did this record exist on the claimed date?
Can it be proven that not a single byte has changed since?

Filesystem "modified" dates prove nothing — they can be manipulated in seconds. A trusted timestamp answers both questions with the cryptographic signature of an independent, authorized third party.

How it works (RFC 3161)

The timestamping protocol is standardized in RFC 3161. The process takes four steps — and the elegant part is this: the file itself is never sent anywhere.

Digest A SHA-256 digest of the file is computed: a unique 64-character fingerprint. Change one character and the digest is completely different.
Stamp request (TSQ) Only this digest is sent to a Time Stamping Authority (TSA) inside a TimeStampRequest.
Signed response (TSR) The TSA combines the digest with its trusted clock's time and signs it with its private key: a TimeStampToken.
Archive The token is stored with the file. At verification time, the file's digest is recomputed and compared to the one inside the token.

# The same process done manually with OpenSSL:
openssl ts -query -data 2026-10-25.log -sha256 -out request.tsq
curl -s -H "Content-Type: application/timestamp-query" \
     --data-binary @request.tsq https://tsa.example-provider.gov.tr > reply.tsr
openssl ts -verify -data 2026-10-25.log -in reply.tsr -CAfile tsa-chain.pem
# => Verification: OK

A Verification: OK is mathematical proof: this file existed at the date inside the stamp and has not changed since.

The Turkish context: Law 5070 and authorized providers

Not every TSA's stamp is legally equal. In Türkiye, E-Signature Law No. 5070 defines the "qualified timestamp" and states that only Electronic Certificate Service Providers authorized by BTK may issue it. TÜBİTAK Kamu SM and private providers offer the service.

The "provable accuracy" requirement for log records under Law 5651 is met in practice with this qualified stamp. Free foreign TSAs work technically but do not carry qualified status under Turkish law.

Log stamping in practice

In theory you could stamp every log line individually; in practice that is expensive and unnecessary. The right pattern is daily batch stamping:

At day close (e.g. 00:05), per-source log files are closed and compressed.
A SHA-256 digest of each file is computed; optionally a single "day digest" is derived from all of them (hash tree).
A stamp is obtained from the provider; the token and digest list are written to the archive with the logs.
If stamping fails (network/provider outage), the system raises an alert and retries — silent failure is unacceptable.

ℹ In SYSLOG this is fully automatic: daily files are closed, digested, stamped via an authorized provider, archived with their tokens, and the status is reported on the panel. During audits, a "verify" button produces an integrity report in one step.

Frequently asked

Does the stamp expose file contents to the provider? No. The provider only sees the 64-character digest; log content never leaves your organization — a critical privacy advantage.

Does a stamp expire? TSA certificates have limited lifetimes; for very long retention, re-stamping archives is good practice. SYSLOG tracks archive stamps.

Can I hash now and stamp later? The stamp's date is the moment the TSA signs — whatever you did before doesn't count. That is why stamping must happen without delay, on the day of the record.

Summary

A trusted timestamp proves logs "existed then and haven't changed"; file dates prove nothing.
RFC 3161 works on digests; log content never leaves your premises.
For legal validity in Türkiye, stamps must come from a provider authorized under Law 5070.
Daily automatic stamping plus failure alerts is the minimum standard of a compliant setup.