How do I prove a document was signed before a specific deadline?

To prove a document was signed before a specific deadline, you use RFC-3161 trusted timestamping. This process binds a cryptographic timestamp to the document's signature, creating a tamper-evident record that proves the signing time. The timestamp is anchored to a public, auditable time source, ensuring the proof remains valid even if the original signing key is compromised or quantum computing breaks classical encryption. For long-term validity, post-quantum re-anchoring binds the classical signature into a hybrid (Falcon-1024 + ML-DSA) attestation, preserving the proof offline and indefinitely.

Why RFC-3161 trusted timestamping works

RFC-3161 timestamps are issued by a Time Stamping Authority (TSA), a trusted third party that cryptographically signs a hash of your document along with the current time. This timestamp is then bound into the document's signature, creating a chain of trust:

1. The document is hashed: A unique fingerprint (hash) of the document is generated.
2. The TSA signs the hash + time: The TSA issues a timestamp token, cryptographically linking the document's hash to the exact time.
3. The timestamp is bound to the signature: The token is embedded into the document's signature, creating a permanent record of when the signature was applied.

This process ensures the signing time cannot be altered or back-dated, even if the original signing key is later compromised. The proof is offline-verifiable, meaning it can be validated without relying on the TSA or any other external service after issuance.

How post-quantum re-anchoring preserves the proof

Classical signatures (RSA, ECDSA) are vulnerable to quantum computing attacks, which could break their encryption and invalidate long-term records. Post-quantum re-anchoring solves this by:

1. Verifying the classical signature: Confirming the original RSA/ECDSA signature is valid.
2. Binding it into a post-quantum attestation: The classical signature is re-signed using Falcon-1024 (a NIST-standardized post-quantum algorithm) and ML-DSA (Module-Lattice Digital Signature Algorithm), creating a hybrid signature that resists quantum attacks.
3. Preserving the RFC-3161 timestamp: The original timestamp is embedded into the post-quantum attestation, ensuring the signing time remains provable.

This process creates an offline-verifiable, quantum-resistant proof that survives even if classical encryption is broken. The attestation can be verified forever using the free, open-source verifier (pip install algovoi-reseal-verify), with no dependency on AlgoVoi or the TSA.

Do it with AlgoVoi

AlgoVoi Reseal (AV-RSL) automates this process for your existing documents. It: - Verifies PDF (PAdES/CMS) and detached .p7s signatures, including full certificate chain validation. - Binds the classical signature into a Falcon-1024 + ML-DSA post-quantum attestation, preserving the RFC-3161 timestamp. - Works offline (air-gap capable) and never stores or governs your records. - Includes shadow-PDF and SHA-1 weak-digest detection to flag vulnerable documents.

Price: 99 USD perpetual, or 39 USD per year (paid in USDC). Free verifier: pip install algovoi-reseal-verify (Apache-2.0, no licence required).

Start now

Buy Reseal on the Suite Store (99 USD perpetual).