QCVN 138 · RFC 3161 · ETSI

Trusted time-stamps for every digital system

From digital signing, DMS and finance to CI/CD and long-term preservation, Trusted TSA provides integration profiles, conformance testing and trust disclosure based on open standards.

Start integration Use Sandbox Verify token

QCVN 138 · Clause matrixRFC 3161/5816 · TSPETSI 319 421/422Demo licence · XXXX-XX

Time-stamp orchestrationDEMO DATA

Integrating application

Creates the message imprint and TimeStampReq.

Trusted TSA Core

Checks policy, trusted time and HSM/TSU signing.

Policy OIDTrusted TimeHSM / TSUAudit Log

TimeStampResp

CMS token with generation time, serial and TSA signature.

REQUESTTimeStampReq

HASHSHA-256

POLICYOID demo

STATUSSandbox

THREE PRIMARY PATHS

Integrate, verify and review compliance

The website prioritizes integrators and the TSA application ecosystem while publishing verifiable trust records.

Integrate TSA

Quick start, RFC 3161 profile, SDKs and conformance tests.

Start integration →

Verify time-stamps

Separate file parsing, structural analysis and cryptographic verification.

Verify token →

Review compliance

Track QCVN 138 clauses and corresponding assurance evidence.

QCVN 138 →

Application ecosystem

Signing, DMS, finance, government, software and long-term preservation.

Explore →

Trust records

Licence, TSA Policy, Practice Statement, trusted time and HSM/TSU.

Review trust records →

QCVN 138:2025/BKHCN

Clause mapping instead of blanket claims

Each requirement maps to an implementation approach, evidence, owner and publication state.

2.1.1

Cryptography and digital signatures

Publish approved algorithms, key sizes, hashes and deprecation plan.

Cryptographic profile

Under assessment

2.1.2

Information and data

X.509, CMS, key formats, TimeStampReq/TimeStampResp.

Technical profile

Documented

2.1.3

Certificates

TSA certificate, trust chain, CRL/OCSP and publication points.

Certificate profile

Pending publication

2.1.4

HSM

Protect TSA signing keys in HSM; claim standards only with evidence.

HSM/TSU assurance

Under assessment

2.1.5

TSA protocol

RFC 3161/RFC 5816 or ETSI EN 319 422.

RFC 3161 profile

Documented

2.2

Operations and controls

Policy, risk, personnel, incidents and continuity under ETSI EN 319 421.

TSA Practice Statement

Draft

3.1

Conformity assessment

Management-system assessment and technical audit.

Assessment report

Not provided

3.2

Conformity declaration

Certification/declaration as required.

Conformity file

Not provided

4.2

TSA responsibility

Retain certification and inspection records.

Retention policy

In development

QUICK START

From source data to an RFC 3161 token

The sample endpoint is a safe placeholder, not a production endpoint.

1. Create hashSHA-256/SHA-3 per profile

LOCAL

2. TimeStampReqCMS request, nonce and Policy OID

RFC 3161

3. Send requestStandard content type

HTTP

4. TimeStampRespTSA-signed token

CMS

5. VerifyHash, signature, chain, OCSP/CRL

VERIFY

OpenSSL + cURL

# 1. Create the message imprint request
openssl ts -query -data document.pdf -sha256 -cert -out request.tsq

# 2. Send RFC 3161 request
curl --fail --silent --show-error --max-time 15 \
  -H "Content-Type: application/timestamp-query" \
  --data-binary @request.tsq \
  https://sandbox.example.invalid/rfc3161 -o response.tsr

# 3. Inspect the response
openssl ts -reply -in response.tsr -text

# 4. Verify against the original file and TSA chain
openssl ts -verify -data document.pdf -in response.tsr -CAfile tsa-chain.pem