AsOf / RFC 3161 · LTV

Proof of date (LTV)

Every archived version has an independent proof of the date it existed, built for long-term validation. Anyone can check it with OpenSSL, without trusting AsOf.

How it works

  1. After the daily run AsOf writes a manifest: for every document the source, URL, SHA-256 of the extracted text and of the original file, and the date we first saw this version. A Merkle root sums them up.
  2. The SHA-256 of the manifest is sent to two independent RFC 3161 time-stamping authorities, FreeTSA and DigiCert. Each returns a signed token with the time.
  3. LTV: next to each token AsOf stores the authority's certificate chain and the certificate revocation lists (CRL) valid at that moment, so the token can be checked after the certificates expire or the service closes.
  4. Each new manifest contains the hashes of the previous manifest and its tokens. The proofs form a chain: every day re-stamps everything before it.

Daily proofs

DateDocumentsManifest SHA-256Time-stampsFiles
24 Oct 202691fedf12070cb7fe2fd92e10b88e8f493169d645e906a36a3f7d054bed5e4061dc
FreeTSA Oct 24 20:18:43 2026 GMT
✓ checked with OpenSSL · LTV: 4
DigiCert Oct 24 20:18:45 2026 GMT
✓ checked with OpenSSL · LTV: 4
manifest.json
freetsa.tsr
digicert.tsr
proof.json

Check it yourself

Download the manifest and a token of one day, then run:

curl -O https://asof.pro/data/proofs/2026-10-24/manifest.json
curl -O https://asof.pro/data/proofs/2026-10-24/freetsa.tsr
curl -O https://asof.pro/data/proofs/2026-10-24/freetsa-ca.pem
openssl ts -reply -in freetsa.tsr -text
openssl ts -verify -in freetsa.tsr -data manifest.json -CAfile freetsa-ca.pem
# → Verification: OK

# DigiCert: the root is in the system store
curl -O https://asof.pro/data/proofs/2026-10-24/digicert.tsr
openssl ts -verify -in digicert.tsr -data manifest.json -CAfile /etc/ssl/cert.pem

Check one document

Every passport lists the SHA-256 of each source and links to the proof that covers that exact version. Find the same hash in that day's manifest: then the token shows that this version existed no later than the stamped time.

What it proves and what not

A token proves that a manifest with exactly these fingerprints existed at the stamped time. It does not say that the documents are true, and it does not replace the issuer's own records. FreeTSA and DigiCert are public RFC 3161 services, not qualified trust services under eIDAS; a qualified time-stamp can be added later. Full documents stay in the private archive; only fingerprints are published.