Reproducible verification for retained logs (RFC 8785 canonicalisation + OpenTimestamps)

[Colin Winter]

David,

Correct, and the anchor was never meant to answer "who". It answers "when", and given a "who", "you cannot quietly move this later". Those are orthogonal to identity, and all three are needed.

The layering, explicitly: signature is the identity layer, the record is signed by a party a verifier already trusts, and nothing in the anchor substitutes for that. The anchor is the time layer, binding the signed bytes to a clock no operator owns. The witnessed log is the non-equivocation layer, and that is the part worth being precise about.

An attacker can timestamp, exactly as an attacker can build. Timestamping carries no identity on its own. A bare signature fixes who, not when, since the signer holds their own clock. An RFC 3161 TSA fixes when but reintroduces a party to trust. The Bitcoin anchor fixes when against a source neither the signer nor we control. That is the only thing the raw anchor buys.

The raw anchor does not by itself stop equivocation. A signer can produce two divergent records and anchor both. Stopping that needs the log published and monitored, which is the transparency-log layer, not the timestamp. We run a C2SP tlog-witness for exactly this.

On recording who performed the verification: that event is itself a record. Canonicalise it, sign it with the verifier's key, anchor it, put it in the witnessed log. You get a signed, time-fixed, non-equivocable "party X verified artifact Y at time T", worth exactly as much as X's key is trusted and no more.

For a rebuilder attestation specifically, where would you draw the line between what the signature must carry inline and what the log must carry, so a re-verifier a year later needs nothing from the original signer?

Colin