ISO/IEC TR 29149:2012 PDF

Information technology — Security techniques — Best practices for the provision and use of time-stamping services

First page of standard ISO/IEC TR 29149:2012

Open preview (PDF)

Title (English):

ISO/IEC TR 29149:2012

Information technology — Security techniques — Best practices for the provision and use of time-stamping services

Document status:: Active
Format:: Electronic (PDF)
Number of pages:: 21
Publication date:: March 5, 2012
Edition:: ISO/IEC TR 29149 edition 1 version 1
ICS:: 35.030

Delivery type:

Full version25 €Read online 24h10 €Read online 72h15 €

Document language:

enru

Delivery time:Immediate download

Price:25 €

Description (English):

ISO/IEC TR 29149:2012 explains how to provide and use time-stamping services so that time-stamp tokens are effective when used to provide timeliness, data integrity, and non-repudiation services in conjunction with other mechanisms. It defines: how time-stamp requesters should use time-stamp token generation services; how TSAs (time-stamping authorities) should provide a service of guaranteed quality; how TSAs should deserve trust based on good practices; which algorithms and parameters should be used in TST (time-stamp token) generation and TST renewal, so that TSTs resist during the time period during which the TSTs can be verified as being valid; how time-stamp verifiers should use the time-stamp token verification services, both when validating individual TSTs, and when validating sequences of renewal TSTs.

Technical details

Technical committee: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
SKU: ISO/IEC TR 29149:2012

Abstract

Overview

ISO/IEC TR 29149:2012 - "Information technology - Security techniques - Best practices for the provision and use of time‑stamping services" - provides practical guidance for operating and using time‑stamping services so that time‑stamp tokens (TSTs) reliably support timeliness, data integrity, and non‑repudiation. The report complements ISO/IEC 18014 by describing how requesters, time‑stamping authorities (TSAs) and verifiers should behave, which algorithms and parameters to consider, and how to manage token renewal and long‑term verification.

Key technical topics and requirements

Time‑stamp service lifecycle: generation, renewal and verification of time‑stamp tokens (TSTs) and handling of time‑stamp packets (TSPs).
Roles and entities: time‑stamp requester, time‑stamp verifier, Time‑Stamping Authority (TSA) and trusted third parties (TTPs).
Security and trust: recommended good practices for TSAs to deserve trust (operational policies, custody of evidence, service continuity and availability).
Cryptographic considerations: use and selection of hash functions, message authentication codes (MAC/HMAC) and signature algorithms to ensure TSTs remain verifiable throughout their validity period. The report highlights risks from weak cryptography and guidance on avoiding them.
TST renewal and verification: procedures for renewing tokens to extend validity and for validating individual TSTs as well as sequences of renewed TSTs.
Non‑repudiation usage: practical use cases showing how timestamps support evidence generation and verification when combined with digital signatures and policies.

Practical applications and who should use it

ISO/IEC TR 29149 is intended for practitioners implementing or relying on time‑stamping for legal, audit or integrity purposes:

Time‑Stamping Authorities (TSAs) - operational, policy and cryptographic best practices to earn trust and guarantee service quality.
PKI and signing service providers - guidance on integrating reliable time‑stamps with digital signatures and certificates.
Software developers - implementing token generation, renewal and verification workflows.
Legal, compliance and records management teams - understanding how time‑stamps support non‑repudiation and evidence custody.
Auditors and security architects - assessing service continuity, evidence retention and cryptographic adequacy.

Related standards

ISO/IEC 18014 (time‑stamping services specification)
ISO/IEC 10118 (hash functions)
ISO/IEC 13888 (non‑repudiation)
Other PKI and signature standards referenced for certificates and verification procedures

ISO/IEC TR 29149:2012 is a practical resource for organizations that need robust, verifiable time‑stamping to support integrity, auditability and non‑repudiation in digital workflows. Keywords: time‑stamping, time‑stamp tokens, TST, TSA, non‑repudiation, data integrity, timestamp renewal, ISO/IEC 29149:2012.

Related standards

Standards mentioned in the description

Abstract

Overview

Key technical topics and requirements

Time‑stamp service lifecycle: generation, renewal and verification of time‑stamp tokens (TSTs) and handling of time‑stamp packets (TSPs).
Roles and entities: time‑stamp requester, time‑stamp verifier, Time‑Stamping Authority (TSA) and trusted third parties (TTPs).
Security and trust: recommended good practices for TSAs to deserve trust (operational policies, custody of evidence, service continuity and availability).
Cryptographic considerations: use and selection of hash functions, message authentication codes (MAC/HMAC) and signature algorithms to ensure TSTs remain verifiable throughout their validity period. The report highlights risks from weak cryptography and guidance on avoiding them.
TST renewal and verification: procedures for renewing tokens to extend validity and for validating individual TSTs as well as sequences of renewed TSTs.
Non‑repudiation usage: practical use cases showing how timestamps support evidence generation and verification when combined with digital signatures and policies.

Practical applications and who should use it

ISO/IEC TR 29149 is intended for practitioners implementing or relying on time‑stamping for legal, audit or integrity purposes:

Time‑Stamping Authorities (TSAs) - operational, policy and cryptographic best practices to earn trust and guarantee service quality.
PKI and signing service providers - guidance on integrating reliable time‑stamps with digital signatures and certificates.
Software developers - implementing token generation, renewal and verification workflows.
Legal, compliance and records management teams - understanding how time‑stamps support non‑repudiation and evidence custody.
Auditors and security architects - assessing service continuity, evidence retention and cryptographic adequacy.

Related standards

ISO/IEC 18014 (time‑stamping services specification)
ISO/IEC 10118 (hash functions)
ISO/IEC 13888 (non‑repudiation)
Other PKI and signature standards referenced for certificates and verification procedures

ISO/IEC TR 29149:2012 PDF

Technical details

Abstract

Overview

Key technical topics and requirements

Practical applications and who should use it

Related standards

Related standards

Abstract

Overview

Key technical topics and requirements

Practical applications and who should use it

Related standards

Related standards

Information technology. Security techniques. Time-stamping services. Framework.

IT Security techniques — Hash-functions — Part 3: Dedicated hash-functions

Information technology. Security techniques. Non-repudiation - Mechanisms using asymmetric techniques - ISO/I…