Repository navigation
Multiple timestamps: what Windows accepts and uses #533
Description
Use Case / Motivation
Timestamps get added more than once in practice: a file is re-timestamped later, or a second TSA is used for redundancy. The proposed multiple-timestamp support in #511 assumed that a verifier would take any valid timestamp. Testing with Windows shows otherwise, so it is worth recording what Windows actually accepts before designing this again.
Testing signtool verify /pa (Windows Server 2022, signtool 10.0.26100) with RFC 3161 tokens from the test TSA, on a signature whose certificate is valid only during 2018, so the result depends on the timestamp used:
| Stored timestamps | Result |
|---|---|
| One RFC 3161 attribute, one valid 2018 token | verified |
| One RFC 3161 attribute, two values | rejected, 0x00000057 "File is not timestamped", even with a still-valid signing certificate |
| Two RFC 3161 attributes, 2018 first | verified, 2018 token used |
| Two RFC 3161 attributes, 2030 first | rejected |
| PKCS#9 countersignature attribute, one value | verified |
| PKCS#9 countersignature attribute, two values | verified, first value used |
| PKCS#9 and RFC 3161 attribute | verified, the attribute stored first is used |
Consequences:
- A second timestamp adds no redundancy on Windows.
- Which attribute or value is used is decided by DER byte order, not by the order in which they were added.
- One attribute with several values is rejected outright, which is the layout
osslsigncode add -tstwice produces.
Proposed Change
Make verify follow Windows: use the first stored timestamp attribute and value, and warn when an RFC 3161 attribute holds more than one value instead of accepting it. Document that the order is DER-determined.
Additional Notes (optional)
Caveats: the PKCS#9 countersignatures in this test were generated by script rather than by a real Authenticode timestamp server, and only one Windows version was checked.
Related: #511 (multiple-timestamp support, superseded for its fixes by #532), #532.
Activity