Seals and cryptographic time-stamping explained for non-specialists

“Fingerprint”, “signature”, “anchoring”: once stripped of jargon, these technical words describe a simple idea — being able to prove that a document existed in a precise form on a given date, without depending solely on the word of the person presenting it. This guide explains these three notions without mathematics, with concrete examples.

The fingerprint: a signature of the content, not of the author

A cryptographic fingerprint (often called a “hash”) is a calculation applied to the content of a document, which produces a string of characters unique to that precise content. Two properties make it the basic tool of any digital proof:

• The same document always produces the same fingerprint.
• A change, even of a single character, completely changes the fingerprint — it is impossible to predict or offset that change so as to recover the original fingerprint.

In concrete terms: if the fingerprint calculated today on a document matches the one recorded a year ago, the document has not been modified since. It is a check that requires trusting nobody — it can simply be recalculated.

What we use, to make the description verifiable rather than illustrative: the fingerprint is a SHA-256 calculated over a canonical form of the document. This last point is the only surprising one, and it is decisive: two JSON files identical in substance but with their keys in a different order would produce two different fingerprints. Canonicalisation fixes that order before the calculation; otherwise the fingerprint would prove the formatting as much as the content.

The signature: who produced the document

A cryptographic signature associates a document (via its fingerprint) with a key held by whoever produced it. Unlike a handwritten signature, which can be imitated visually, a cryptographic signature depends on a private key that only its holder possesses — verifying it requires only the corresponding public key, which can be shared freely.

With us, it is an Ed25519 signature applied to the fingerprint, and not to the whole document — hence the order of operations: the fingerprint is calculated, then the fingerprint is signed. A signature is therefore never worth more than the fingerprint it covers, which is a good reason to start by understanding the fingerprint.

Time-stamping: the date, but verifiable

A date displayed in a document (“created on 12/06/2026”) can be freely modified in most systems — it is a simple text field. A cryptographic time-stamp, by contrast, proves that a document (via its fingerprint) existed at a given moment, by linking it to an independent time source that a third party can verify.

Anchoring: making the proof enforceable against an outside party

Anchoring consists of publishing the fingerprint of a set of documents in an external register that is hard to modify retroactively (a blockchain, a public log). What matters is not the technology chosen but the principle: once anchored, the proof no longer depends solely on the good faith of whoever holds it — anyone can re-check it independently.

What these tools change in practice

Without these three elements, a traceability proof rests entirely on the trust placed in whoever presents it — a temperature record or a lot declared “compliant” can only be verified by taking their word for it. With fingerprint, signature and time-stamp, the same information becomes independently re-checkable: an inspector, a customer or a court can verify it themselves without depending on the honesty of the party presenting the document.

What is NOT a cryptographic time-stamp

• A file creation date displayed by an operating system — modifiable simply by changing the device’s clock.
• A visual “dated …” stamp applied to a document — an image, not a verifiable proof.
• A date field in a conventional database, modifiable by anyone with administrator access.

Common mistakes

• Confusing “displayed” with “proven” — a date visible on screen guarantees nothing about its truthfulness without an independent verification mechanism.
• Not checking what a tool vendor really means by “secure time-stamping” — the term is sometimes used commercially with no real cryptographic mechanism behind it.

Checklist to check that a tool offers a real time-stamp

1. Ask whether the tool calculates a fingerprint of the content, not merely a modifiable date field.
2. Check whether that fingerprint is signed with a key linked to the issuer.
3. Check whether the fingerprint is anchored in an external register that a third party can re-check.
4. Test, if possible, the re-checkability: can the proof be verified without going through the tool that produced it?