The 9-Point Time Stamping System

The 9-point system places every seal between two kinds of outside proof:

• "Not before": proof the seal couldn't have been made before a certain moment.
• "Existed by": proof the seal already existed by a later moment.

Together they give each seal a tight time window that independent outside parties vouch for. No single company, including 0REI, is trusted on its own for the time.

A clock on any one company's server is a time that company states about itself. 0REI records its own microsecond time in every seal (signed_at) and then backs it with outside witnesses. Binding each seal to an outside "existed by" receipt is what stops anyone holding a stolen key from backdating a seal to before that key was revoked.

A live bundle of outside time values that 0REI keeps refreshing all day: drand (run by the League of Entropy), a public random value every 3 seconds; the NIST Randomness Beacon, a signed "pulse" every 60 seconds; Roughtime, signed time readings from Cloudflare and Netnod; and 0REI's server clock, synced to NIST. 0REI's hosting clock has been measured within about 50 to 100 milliseconds of NIST.

Nobody can know a drand or NIST value before it is published, so a seal that contains one can't have been made earlier.

In plain English: It works like a photo of someone holding today's newspaper. The photo cannot have been taken before that day's headlines were printed.

When a document is sealed, 0REI does all of this in one step, with no wait: it locks the content inside a Pedersen commitment, takes a plain hash of that box as the seal's permanent fingerprint, locks in the current Time Pocket, records 0REI's own time to the microsecond (signed_at), and signs everything together with 0REI's current key, so no part can be changed later.

It is an atomic seal: payload digest, metadata, time context and key-lineage state in one signed record.

The outside witnesses stamp the plain hash rather than the Pedersen box itself, because hash-based proof is the strongest long-term protection that the content can't be changed.

In plain English: Think of a tamper-evident evidence bag. The item goes in, the bag is sealed with today's dated tag inside, and an officer signs across the seal. Open or alter anything and it shows.

Open the page: Evidence Rail

The seal's fingerprint goes straight to Roughtime servers run by Cloudflare and Netnod. Within seconds there is a signed outside receipt showing the seal already existed. This receipt is what stops a thief with a stolen key from backdating a seal past the key's revocation.

In plain English: It is like handing a sealed envelope to a neutral clerk who instantly stamps the time on the receipt and gives you a signed copy.

The fingerprint goes to RFC 3161 Time-Stamp Authorities: DigiStamp, DigiCert and FreeTSA. Each returns a signed stamp showing the seal existed by that moment. Stamps arrive in about a minute.

New seals are gathered into a Merkle tree, so one stamp covers a whole batch. Each token is authenticated before a batch is marked anchored. Stamping runs alongside sealing, so a timestamp-service outage never holds up sealing; the batch simply waits for its stamp.

In plain English: It is like having a notary stamp and sign a document, except three independent notaries do it, and one stamp can cover a whole stack of documents at once.

Once an hour, the fingerprints are rolled up and written into Bitcoin through OpenTimestamps, with Guardtime KSI alongside. Both are built only on hashes, not on digital signatures. OpenTimestamps proofs are checked against Bitcoin block headers.

Because it relies only on hashes, this layer doesn't depend on any signature scheme: future quantum computers are not expected to break hashes the way they could break today's signatures. It is the foundation of 0REI's post-quantum migration. That is also why the witnesses stamp the hash fingerprint from the Seal.

In plain English: It is like carving the document's fingerprint into a public stone wall that the whole world watches and nobody can repaint.

The Time Pocket proves the seal wasn't made before a certain point. Roughtime, the RFC 3161 stamps and the Bitcoin anchor prove it existed by a later point. That is five or more independent third parties vouching for the time: drand, the NIST Beacon, Roughtime (Cloudflare and Netnod), DigiStamp, DigiCert, FreeTSA, OpenTimestamps on Bitcoin, and Guardtime KSI.

Combined with the key chain (point 8), the window is what defeats backdating past a key revocation, and it works together with 0REI's signed chain head so the two protections stack.

In plain English: Picture bookends. The newspaper in the photo is the left bookend, the stamped receipts are the right bookend, and the seal sits between them.

Range proofs show each hidden value is valid, for example not negative and inside its limit. Total proofs show a set of sealed values adds up to a stated total while every individual value stays private. Aggregates use a minimum set size of five. Customer-held blinding means only the customer can open their own values. A command-line tool builds and checks these proofs.

In plain English: Imagine locked cash boxes on a scale. You can prove the total weight is right without unlocking any single box, and only each owner holds their own key.

Open the page: Pedersen Commitments & K1 Key Pre-Rotation

0REI's signing keys form an unbroken chain that starts at the genesis key from the key ceremony. Each key commits in advance to the next by publishing a hash of the next public key. At rotation, the outgoing key signs a link handing authority to the new key, the new key must match the commitment made in advance, and every link is also signed by the incoming key. Every seal ever signed stays verifiable through the chain, back to genesis.

An attacker can't slip in a substitute key, because it wouldn't match the published commitment.

In plain English: It is like a line of succession announced in advance. Each office-holder names their successor publicly before handing over, so an impostor cannot claim the seat.

Open the page: Pedersen Commitments & K1 Key Pre-Rotation

Anyone can check a seal with the 0REI Offline Verifier, without trusting 0REI or even contacting it. The verifier works the result out from scratch from the seal itself against pinned roots, and checks five things:

1. The fingerprint matches the Pedersen box.
2. The Time Pocket values match the public drand and NIST records.
3. The Roughtime, RFC 3161 and Bitcoin receipts are genuine.
4. The signing key traces through the K1 chain to genesis.
5. Any total or range proofs add up.

The verifier supplies no time of its own. It confirms the time evidence from the outside witnesses. Clients never depend on 0REI being online, cooperative or even in business to prove their evidence.

In plain English: It is like a self-checking receipt you can verify at home with a calculator, instead of phoning the shop to ask whether it is real.

Open the page: Offline Verifier

Stamping runs alongside sealing. If an outside timestamp service is slow or down, sealing carries on and the batch waits for its stamp, so clients are never held up by a third party.

Private contents, provable totals, a key chain that rotates cleanly, and time vouched for by independent witnesses, all checkable by anyone, offline.

"Every 0REI seal sits between two outside proofs. First, it locks in public random values from drand and the NIST beacon that nobody can know in advance, so it can't have been made earlier. Then its fingerprint is stamped by Roughtime within seconds, by formal RFC 3161 timestamp authorities within about a minute, and every hour into Bitcoin, so it provably existed by then. That's five or more independent outside witnesses, not just our own clock. Contents stay private in Pedersen boxes, our keys are pre-committed in an unbroken chain, and anyone can check all of it offline."