TSA Practice Statement v1.0 — Fidelir Trust Services

This Time-Stamp Authority Practice Statement (TSA PS) describes how Fidelir S.R.L., operating Fidelir Trust Services, issues RFC 3161 time-stamp tokens at https://trust.fidelir.com/tsa. It is intended for subscribers, relying parties, integrators, auditors, and supervisory review.

Non-qualified time-stamping service. This TSA PS does not describe a qualified trust service or a qualified electronic time stamp within the meaning of Regulation (EU) No 910/2014 (eIDAS) or Law no. 124/2022 of the Republic of Moldova. The service is not a QTST and is not listed as a qualified time-stamping service on the Moldova trusted list or the EU LOTL. The unit certificate profile is in the CP/CPS §6.4. Signature validation of third-party documents is governed by the Validation Policy, not this TSA PS.

1. Introduction

1.1 Purpose

The purpose of this statement is to declare, in auditable form: which time-stamp policy identifier is asserted in tokens; what Accuracy, genTime and ordering mean; which digest algorithms are accepted; how the TSU clock relates to UTC; where the unit certificate and revocation services are published; and what guarantees and limitations apply to relying parties.

1.2 Applicability

This TSA PS applies to all RFC 3161 time-stamp tokens issued by Fidelir Trust Services TSA under policy OID 0.4.0.2023.1.1. It implements the Best practices Time-Stamp Policy (BTSP) of ETSI EN 319 421 as a non-qualified service and the token profile of ETSI EN 319 422 / RFC 3161.

1.3 Relying party obligations

Relying parties shall verify the token signature, the TSU certificate chain to the Fidelir Trust Services Root CA, certificate status at the time of reliance, the policy OID, and that Accuracy and genTime match this TSA PS. A time-stamp is cryptographic evidence of the hash at genTime within the declared Accuracy, not legal advice on document content.

1.4 Relationship to other programme documents

The CP/CPS governs PKI issuance, the TSU certificate, and NCP subscriber certificates. This TSA PS governs token issuance practice. The Validation Policy governs validation of submitted signatures, including whether a covering time-stamp is treated as proof of existence.

2. Definitions

Accuracy — RFC 3161 TSTInfo Accuracy: the declared maximum deviation of genTime from the TSU time source.
BTSP — ETSI Best practices Time-Stamp Policy, OID 0.4.0.2023.1.1 (EN 319 421).
genTime — GeneralizedTime in TSTInfo; UTC with millisecond fractional seconds.
QTST — Qualified trust service for time-stamping. Not this service.
TSA — Time-Stamp Authority (Fidelir Trust Services TSA).
TST — Time-Stamp Token (RFC 3161 SignedData wrapping TSTInfo).
TSU — Time-Stamping Unit: the signing certificate and clock that produce tokens.

3. Service provider identification

Legal entity: Fidelir S.R.L.
IDNO: 1026023126883
organizationIdentifier: NTRMD-1026023126883
Commercial designation: Fidelir Trust Services
TSA common name: Fidelir Trust Services TSA
Time-stamp endpoint: https://trust.fidelir.com/tsa
TSU certificate: https://trust.fidelir.com/cer/tsa.cer
This TSA PS: https://trust.fidelir.com/tsa-ps/
Trust material repository: https://trust.fidelir.com/repository/
Supervisory notification: SIS notification of intent (ref. 01.21.08.2026); not approval, registration, or qualified-list inclusion. See the Provider notice.

4. Time-stamp policy

4.1 Policy identifier

Every issued token asserts TSTInfo policy 0.4.0.2023.1.1 (itu-t(0) identified-organization(4) etsi(0) time-stamp-policy(2023) policy-identifiers(1) best-practices-ts-policy(1)). That OID is the ETSI BTSP defined in EN 319 421. It is not a Fidelir-private identifier and is not a qualified time-stamp policy.

A request that includes a TSA policy OID other than 0.4.0.2023.1.1 is rejected (unacceptedPolicy). A request with no policy OID is stamped under BTSP.

The TSU certificate carries the same BTSP OID in certificatePolicies, a CPS URI, and a user notice that the certificate is a time-stamp authority certificate under ETSI BTSP. No QCStatements are asserted.

4.2 One service

Fidelir Trust Services operates a single public time-stamping service under this TSA PS and policy OID 0.4.0.2023.1.1.

5. Token profile

Field	Value
Protocol	RFC 3161 over HTTP POST; `Content-Type: application/timestamp-query`
Policy OID	`0.4.0.2023.1.1` (BTSP)
Accuracy	10 milliseconds (RFC 3161 Accuracy; millis = 10)
genTime	UTC GeneralizedTime with millisecond fractional seconds
Ordering	Not asserted (`false`)
Nonce	Echoed when present in the query
MessageImprint	SHA-256, SHA-384, or SHA-512 only
Token signature	SHA-256 with RSA; TSU key RSA 4096 bit (CP/CPS §7)
certificates	TSU certificate (and Root when `certReq` is set) may be included in the response

Unsupported digest algorithms are rejected (badAlg). Critical unexplained extensions in the query are rejected (unacceptedExtension). Non-POST requests to the endpoint receive HTTP 418 with an informational page; that is not a time-stamp response.

6. TSU certificate and revocation

The TSU certificate is signed by Fidelir Trust Services Root CA. It is not a CA (basicConstraints CA:FALSE). extKeyUsage is critical and contains timeStamping only. Full profile: CP/CPS §6.4.

Certificate: https://trust.fidelir.com/cer/tsa.cer
Status: Root CRL /crl/root.crl; Root OCSP /ocsp/root

The TSU private key is used only to sign time-stamp tokens. It is protected in a hardened or hardware-backed environment (CP/CPS §10.4).

7. Time source and Accuracy

Item	Practice
Time scale	UTC. genTime is never a local civil timezone.
Synchronisation	Each TSU host maintains NTP to UTC at stratum 1 only (no stratum > 1).
Declared Accuracy	10 milliseconds, matching the Accuracy field in issued tokens.
Monitoring	Operators monitor NTP offset and jitter on TSU hosts.
Loss of sync	Material loss of stratum-1 synchronisation, or clock unavailability, requires the TSA to stop issuing tokens until restored. Clients receive RFC 3161 `timeNotAvailable` rather than a token with an unbacked genTime.
Calibration records	Operational NTP status is retained for incident and audit review under CP/CPS §10.7.

EN 319 421 requires that declared Accuracy be consistent with the TSU time source. The 10 ms value in this TSA PS is that declared Accuracy, not a 60-second placeholder.

8. Standards applied

RFC 3161 — Time-Stamp Protocol (token request/response).
ETSI EN 319 421 — BTSP (0.4.0.2023.1.1) as the public policy for this non-qualified TSA.
ETSI EN 319 422 — time-stamp token profile (policy OID, Accuracy, genTime).
ETSI EN 319 411-1 NCP — TSU certificate issued under the Fidelir CP/CPS, not QCP.

9. Guarantees

Fidelir Trust Services guarantees that, at the time a token is issued:

The token asserts policy 0.4.0.2023.1.1 and Accuracy 10 milliseconds as declared in this TSA PS.
genTime is UTC with millisecond fraction from the TSU clock operated under §7.
The token is signed with the published TSU certificate, whose private key is used only for time-stamping.
If the TSU clock cannot be treated as synchronized per §7, no token is issued.

10. Limitations and non-guarantees

Tokens are not qualified electronic time stamps.
Inclusion of this TSA on the Fidelir-operated repository Trusted List is a Fidelir scheme entry. It is not Moldova or EU qualification.
Ordering across tokens is not asserted; genTime values are not a serial order of requests.
The TSA does not inspect or retain the hashed document; only the MessageImprint is processed.
Availability of /tsa is governed by CP/CPS §9.3 (target monthly availability 99.9%, excluding announced maintenance), unless a written programme agreement states a stricter commitment.
This TSA PS does not replace the CP/CPS for certificate issuance or the VP for signature validation.

11. Amendments

Material changes are published at https://trust.fidelir.com/tsa-ps/ and listed on Policies. The TSU certificate user notice is brief and statute-neutral; this TSA PS may be revised without re-issuing the TSU certificate where the change does not alter token semantics (policy OID, Accuracy, or hash algorithms).

12. Normative references

RFC 3161 (Internet X.509 PKI Time-Stamp Protocol)
ETSI EN 319 421 (Policy and Security Requirements for TSAs; BTSP)
ETSI EN 319 422 (Time-stamping protocol and profiles)
ETSI EN 319 411-1 (NCP)
Regulation (EU) No 910/2014 (eIDAS)
Law no. 124/2022 of the Republic of Moldova
Fidelir CP/CPS: https://trust.fidelir.com/cps/
Fidelir Validation Policy: https://trust.fidelir.com/vp/