I have found a few vulnerabilities that I want to sell (legally!).

In case they get publicly revealed before I manage to sell them, I want to be able to prove that I knew about them before that for bragging rights.

I am currently considering the following system (if you see a better alternative, I'd like to hear that as well):

  • SHA-2 encode a date marker (2000-01-01) + a description of the vulnerability
  • publish the SHA-2 on a web-app that keeps it's date
  • if it gets publicly revealed in the future, I can publish my description, and anyone can verify that it generates the SHA-2, and the date that the SHA-2 was published

For this method to work, I need a webapp that:

  • keeps a timestamp for a given data
  • does not allow me to modify the data without altering the timestamp, and will not allow that in the future
  • allows everyone to see the timestamp publicly
  • is not likely to disappear tomorrow (of course, this is a "soft" requirement, but also an important one)
  • allows me to publish any data I want (excludes, say, Stack Overflow which only allows programming questions)
  • keeping the SHA timestamps hidden before disclosure would be a plus but not required: that would hide the vulnerability count, which is desirable but not crucial to me. This could be achieved with "undoable delete" functionality like for Stack Exchange answers or other privacy control mechanisms.
  • does not produce notifications to people who are not concerned. E.g., I don't want to publish on my main Facebook timeline so as to not spam my friends. I could create a fake account, but it may be against Facebook's ToS (TODO)

A few options I have considered are:

  • email myself. But I can't make an email publicly visible AFAIK
  • big social media with posts / comments: might be used, but I'm afraid they change the timestamp rules at some time since it's not their design goal:

Does anyone see a better option?


After Grant gave me the keyword "Trusted timestamping", I found other sources:

Also there is one thing I should improve in my system: my name <email> pair should be included inside the files to be hashed.

  • Bitcoin can be used to do this...but I don't know exactly how it works well enough to write it as an answer. – Grant Nov 23 '14 at 22:33
  • @Grant yes, I was thinking about those techniques as well, heard people even got married like that, but I don't know the details either. – Ciro Santilli 新疆改造中心 六四事件 法轮功 Nov 23 '14 at 22:38
  • bitproof.io is a blockchain based solution backed by a startup. – Ciro Santilli 新疆改造中心 六四事件 法轮功 May 27 '16 at 8:56
  • How about the old-fashioned method of documenting everything on paper, putting it in a sealed envelope that you have time-stamped and kept by a notary? Sounds much easier (faster) and reliable. Yes, it will cost you some money, include that in your selling costs. – Jan Doggen May 27 '16 at 10:22
  • @JanDoggen the blockchain might be safer than any notary, and with the services mentioned on answers, likely faster and less expensive ;-) – Ciro Santilli 新疆改造中心 六四事件 法轮功 May 27 '16 at 10:37
up vote 3 down vote accepted

One option is https://www.btproof.com

It takes your text and creates a hash of it - turns that hash into a bitcoin address and sends some money there. This creates a permenant (at least as long as someone has a full copy of the bitcoin chain) record of the hash, with an incredibly difficult to forge timestamp. The money sent to the address is lost forever.

You could publish cryptographic hashes of file X in the Classified Ads of your local newspaper. If anyone subsequently disputes that file X existed on the newspaper's publication date, refer them to the newspaper and send them a copy of file X (which, of course, you backed up in several places).

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.