Qualified timestamp
A qualified timestamp is an electronic timestamp from a recognized trust service for which the law presumes the accuracy of time and the integrity of the data.
Technically, a qualified timestamp is usually a token following RFC 3161, issued by a provider with special recognition. In the EU, the eIDAS Regulation governs qualified electronic timestamps and presumes the accuracy of date and time as well as the integrity of the data. In Switzerland, the Federal Act on Electronic Signatures (ZertES) governs qualified timestamps from recognized providers.
For agent evidence, such a timestamp independently proves when a mandate, decision or receipt existed. A time taken from one's own server does not carry this weight.
Example
A company attaches a timestamp from a recognized provider to every receipt chain of an agent. If a dispute arises months later, the timestamp shows that the receipt existed before the complaint, and no one has to rely on server logs.
How it differs
Every timestamp following RFC 3161 proves a point in time technically. It is qualified only if the provider is legally recognized; then the legal presumption is added. A time taken from one's own server has neither.
In practice
- Use qualified timestamps where a point in time must hold up in court or an audit.
- Provide the root certificate of the recognized provider you chose as the anchor.
- Check whether the provider appears on the list of recognized trust services.
Role in KYA
KYA verifies timestamps following RFC 3161 up to the trust anchor provided by the verifying party. The highest level, KYA-A4, requires an independently anchored point in time; whether the provider is qualified follows from the choice of anchor.
Related check: Timestamp (timestamp_assurance). Is the RFC 3161 timestamp valid, bound to the content and traceable to an anchor of the verifying party?
Frequently asked questions
What makes a timestamp qualified?
The legal recognition of the provider, in the EU under eIDAS and in Switzerland under ZertES. For qualified timestamps, the law presumes the accuracy of time and the integrity of the data.
Is every timestamp following RFC 3161 qualified?
No. RFC 3161 only describes the technical format. A timestamp is qualified only when a recognized trust service issues it.
Does KYA verify qualified timestamps?
KYA verifies the timestamp's signature, its binding to the content and the path to the trust anchor. Whether the provider is qualified follows from the anchor provided by the verifying party.
General information, not legal advice. The statutes and the circumstances of each case are decisive.