Trusted timestamping: public proof that I knew something at a given time without revealing it

Question

I have found a few vulnerabilities that I want to sell (legally!).

In case they get publicly revealed before I manage to sell them, I want to be able to prove that I knew about them before that for bragging rights.

I am currently considering the following system (if you see a better alternative, I'd like to hear that as well):

• SHA-2 encode a date marker (2000-01-01) + a description of the vulnerability
• publish the SHA-2 on a web-app that keeps it's date
• if it gets publicly revealed in the future, I can publish my description, and anyone can verify that it generates the SHA-2, and the date that the SHA-2 was published

For this method to work, I need a webapp that:

• keeps a timestamp for a given data
• does not allow me to modify the data without altering the timestamp, and will not allow that in the future
• allows everyone to see the timestamp publicly
• is not likely to disappear tomorrow (of course, this is a "soft" requirement, but also an important one)
• allows me to publish any data I want (excludes, say, Stack Overflow which only allows programming questions)
• keeping the SHA timestamps hidden before disclosure would be a plus but not required: that would hide the vulnerability count, which is desirable but not crucial to me. This could be achieved with "undoable delete" functionality like for Stack Exchange answers or other privacy control mechanisms.
• does not produce notifications to people who are not concerned. E.g., I don't want to publish on my main Facebook timeline so as to not spam my friends. I could create a fake account, but it may be against Facebook's ToS (TODO)

A few options I have considered are:

• email myself. But I can't make an email publicly visible AFAIK
• big social media with posts / comments: might be used, but I'm afraid they change the timestamp rules at some time since it's not their design goal:
  • Twitter: not possible to edit. Cannot undelete or control privacy, but multiple accounts appear to be tolerated.
  • Facebook: can edit but keeps an undeletable history. Deletion is permanent.
  • Google +: shows "edited at" on a on-hover title
  • GitHub: issue titles are a candidate, as any title edit gets an undeletable comment. Issue descriptions and comments however can get edited without trace.

Does anyone see a better option?

EDIT

After Grant gave me the keyword "Trusted timestamping", I found other sources:

• https://crypto.stackexchange.com/questions/12647/a-timestamping-authority-digital-notary : tons of alternatives. I propose we move further discussion there unless that gets closed someday.

• https://stackoverflow.com/questions/25052925/does-anyone-know-a-freetrial-timestamp-server-service : closed as off topic

Also there is one thing I should improve in my system: my name <email> pair should be included inside the files to be hashed.

Answer 1

One option is https://www.btproof.com

It takes your text and creates a hash of it - turns that hash into a bitcoin address and sends some money there. This creates a permenant (at least as long as someone has a full copy of the bitcoin chain) record of the hash, with an incredibly difficult to forge timestamp. The money sent to the address is lost forever.

Answer 2

You could publish cryptographic hashes of file X in the Classified Ads of your local newspaper. If anyone subsequently disputes that file X existed on the newspaper's publication date, refer them to the newspaper and send them a copy of file X (which, of course, you backed up in several places).