Electronic Timestamps and Long-Term Validation (LTV)

A signature may become harder to validate after certificate expiry when historical certificate status and validation material are unavailable. A trusted timestamp and preserved revocation evidence help a verifier establish that the signature existed while the relevant credentials were valid.

LTV embeds all validation data within the signature: the signing certificate, its chain, revocation data (CRL/OCSP), and the timestamp. This allows verification even after the certificate expires — because the embedded data proves everything was valid at signing time.

Level B: basic signature. T: adds trusted timestamp. LT: adds validation data (certificates, revocation). LTA: adds periodic re-timestamping for indefinite validity. For contracts and regulatory documents, LT or LTA is recommended.

Retention periods vary by jurisdiction, document type, and sector. LTV profiles preserve technical validation material for later verification, but they do not by themselves determine legal validity or replace the organisation's records-retention policy.

Qualified timestamps must come from a Time Stamping Authority accredited under eIDAS Article 40 (EU) or equivalent national framework. The timestamp token must conform to RFC 3161 (Time-Stamp Protocol). TSA certificate validity is typically 4-6 years; timestamps must be renewed before certificate expiry for continued validation.

Timestamp pricing depends on qualification status, volume, service level, geographic coverage, validation endpoints, and whether timestamps are bundled with another trust service. Request a dated quote and test the commercial model against expected signing and re-timestamping volume.

B-LT embeds revocation data (CRL/OCSP) at signing time, adding 10-50 KB per signature. B-LTA adds archival timestamps, growing the document by 5-15 KB per re-timestamp. For a 100-signature approval chain over 10 years, B-LTA storage reaches 5-8 MB — significant for high-volume archival systems.

A TSAlite (non-qualified) timestamp provides evidence of existence but does not receive the presumption of validity under eIDAS Article 41. In EU litigation, only qualified timestamps receive the same evidentiary presumption as QES. Outside the EU, courts evaluate timestamp weight case-by-case regardless of qualification status.

EU MiCA (Markets in Crypto-Assets Regulation): requires timestamped records for crypto-asset transactions. FDA 21 CFR Part 11.50: requires date and time stamps for all electronic signature manifestations. China's Electronic Signature Law: timestamps strengthen evidence of signing time but are not mandatory. Singapore MAS guidelines: financial transaction records should include trusted timestamps for audit trails.

In contract disputes, the critical question is often "when was this signed?" A qualified timestamp from an accredited TSA provides presumption of accuracy under eIDAS Article 41. Without a trusted timestamp, the signing time relies on platform server logs — which are less convincing in court. For cross-border agreements where parties are in different time zones, UTC timestamps with timezone conversion records prevent ambiguity.

For documents requiring long-term verifiability, an archival profile may add new timestamps before earlier evidence becomes too weak to validate. The organisation should define who monitors cryptographic change, when evidence is augmented, and how the process is tested; automation availability must be confirmed for the deployed platform.