Trusted timestamps for AI agent logs: what RFC 3161 proves, and what it does not

Description and use

This guide explains how to provide reliable timestamps for AI agent logs using RFC 3161 and transparency logs, enabling third parties to trust the time of record creation.

Problem

AI agent logs need reliable timestamps that third parties can trust, especially for dispute resolution and legal evidence.

Outcome

The workflow yields AI agent logs that are cryptographically signed and timestamped with an independent, legally recognized upper bound on existence, enabling reliable dispute resolution and compliance with EU eIDAS.

Workflow

• 1. Sign each log record at the point of action with a key inaccessible to the agent.
• 2. Generate an RFC 3161 time‑stamp token over the record’s hash (or append the hash to a transparency log).
• 3. Verify the token or log checkpoint using the TSA’s CA certificate (or witness’s public key).
• 4. Store the signed record, the time‑stamp token, and the log checkpoint together for audit and legal purposes.

Evidence

A digital signature binds a key to a sequence of bytes. If the bytes include a time, the signature covers that time, but it says nothing about whether the time was true when the signer wrote it.

Source

RFC 3161, published in August 2001, defines the Time-Stamp Protocol. In its words, a time-stamping authority (TSA) "is a TTP that creates time-stamp tokens in order to indicate that a datum existed at a particular point in time."

Source

The token says the receipt existed by 14:02:15. It does not say the agent acted at 14:02:11, or that the receipt was not prepared hours earlier and stamped later.

Source

In the EU, the eIDAS Regulation gives electronic time stamps a defined legal status.

Source