# Time Stamping in Notation post v1.0

After signing a software artifact, the signature should be counter-signed by a time stamp authority (TSA). A time stamp provides proof that the signing has taken place at a certain date and time. Each code signing certificate has a validity period of usually one to three years. Without timestamps, all signatures would be invalid after this period. Time stamps extend each signatures signature validity to that of the time stamp certificate, which is usually at least another 10 years from the time of signing.It allows your container image (signature) to be verified even after your code signing certificate expires.

If a container image is not signed using a TimeStamping Authority, its signature is assessed based on the current time. You might have distributed your signed image months or years ago, and in that case, the code signing certificate used for signing that container image may have expired, and the signature might no longer be considered valid. For example, a code signing certificate you used for signing had a validity period of the entirety of 2022 (1/1/2022 to 12/31/2022), and you signed and time stamped your image in October 2022. Now, a user downloads your signed image and tries to verify the signature today – if it wasn’t time stamped, the user will get a validation error. However, if the signature was timestamped, Notation will use the time stamp to evaluate whether the code signing certificate was valid at the time of signing instead of today’s date while verifying the signature.Time stamp is signed and protected by the CAs, which stops tampering or any other malicious activity while keeping it cryptographically secure.

Post v1.0 release, Notation will add implementation for time stamping as part of the code signing process. It’ll help you avoid unexpected issues and errors during container image verification. Notation will have timestamping as an optional step. Time stamps give assurance that signatures will remain secure, trusted, and valid, even if a code signing certificate loses its validity.
Notation will support TSA signatures and verification as per RFC 3161 protocol, RFC3161 protocol recently was updated as RFC5035, which also allows using ESSCertlDv2.