CSTP v1 · the format
A stamp puts a fence around a moment.
CSTP is the envelope. OpenStamps is the product that mints, chains and files with it. Checking a stamp is free, offline, and stays that way — not a paid tier. Anyone who types cosmicstamps.com, cosmictimestamps.com or cosmictimestamps.org is meant to land here, on openstamps.com. There is one commercial site.
Sister engine for the sky picture: phoenixephemeris.com. Company: protosonic.eu.
- What a stamp shows, and what it does not
- Two edges are better than one
- No internet? It still checks
- Three answers a check may give
- Five ways a stamp can turn out
- How a stamp is made
- Catching a lie is cheap
- Time, place, and the sky picture
- C2PA, and what stays closed
- What you may implement
What a stamp shows. And what it doesn't.
Two lists people remember, and a third they forget. The glyphs are the site's shape grammar: ◇ holds up, ◔ not checked, ✕ doesn't hold. There is no tick.
The second column is extra you can add. The third is a limit of timestamps, including ours.
- The file has not changed.Change one byte and the check fails.
- The seal was not made earlier.It is tied to a public number nobody could work out in advance.
- The file existed by a later moment.Only when a timestamp authority answers. Then both ends are set.
- Anyone can check it with no internet.The keys live inside the checker. There is no server to ask.
- Who made the file.A seal carries no name. Bind it to a passkey or a wallet credential if you need a holder. That is extra, not the base stamp.
- Where the file was made.A file on a laptop has no sensors to measure a place. Seal on a device that measures, or do not claim a street.
- Whether the file is true.Stamp a photo of a lie and the stamp still holds up as a stamp. It does not read the picture.
- That the file is new.Something written years ago can be stamped today. The stamp dates the seal, not the writing.
About the sky picture. Every stamp can draw the planets for its moment. That is a portrait, not a lock. Anyone can work out the sky for any date, so it costs an attacker nothing. It is there to make a proof readable. It does not make a proof stronger. This is orbital arithmetic, not astrology. The engine that computes a precise sky is Phoenix Ephemeris.
Two edges are better than one.
Each fence post is planted by someone else. Neither one is ours to move.
A stamp that names both posts brackets the moment. A stamp that names only the left post is weaker, and it says so on its face.
Both edges
One edge
If no authority answers, you still get a stamp. It has a left post and no right post, and it says so in plain words on its face. That is weaker, and being told it is weaker is the whole point. A one-sided stamp is not an error and is never blocked.
No internet? It still checks.
Most proofs make you phone someone to find out if they are real. This one does not.
the internet is down
A normal notary
The proof may be fine. You just cannot reach the thing that would tell you so. If the company also shuts down, that day never ends. You get silence, which is not a pass and not a fail.
A Cosmic Time Stamp
The beacon key and the authority keys are built into the checker. Drop the file, drop the proof, read the answer in a basement or on a boat. There is nobody to ask.
This is how the format works, not a paid tier. Checking a stamp is free, it is offline, and it stays that way. We charge organisations that build with it. This web page still has to load once; a checker already on the machine needs nothing else. Sometimes the honest answer is “I could not check this part”. That is shown as not-checked (◔), never as a tick, because being unable to check something is different from finding it wrong.
Three answers a check may give.
Every check, and every chain of checks, speaks one of three words. Colour is not enough: a dossier is photocopied in greyscale, so the shapes differ.
Holds up
The reader ran the check and found no contradiction. That is also the ordinary outcome for a careful fake. It is not a finding that the file is true.
Not checked
There was nothing to check this with — a gap in the evidence or in this reader. Never a finding against the record.
Doesn't hold
The reader checked, and the evidence contradicts what this record says. This is the strong result. It costs one disagreement.
A chain of stamps shows one of four lights: red, amber, white, or anchored when every floor record holds up and its time anchors were reached. Anchored is derived, never asserted. None of those words is a marketing seal.
Five ways a stamp can turn out.
Strongest at the top. Read the rank number, not the letter code. The codes are names, not scores: C4 is better than C1, and C3 is better than C4. They name the situation the device was in when it sealed.
A low rank is not an error. The stamp still exists and still checks. It is refusing to claim more than it was given.
A device with no route to an authority can still seal, and the seal says on its face what it does not carry. OpenStamps furniture profiles that ask for a closed bracket are not met by a one-sided stamp. That is a property of the profile, not a restriction we apply at mint time.
How a stamp is made.
Your file never leaves your computer. Only its fingerprint is sent, and only to get a time put on the right post.
The browser turns the file into a short code. Change anything, even one letter, and the code changes. The method is named in the digest (sha256:), so a later method does not break old stamps.
drand is a public beacon. We tie the fingerprint to the newest round. That shows the stamp was not made before that number existed.
Timestamp authorities sign the fingerprint and add their own clock. If neither answers, the stamp is one-sided: an earliest time and no latest one.
Work out where the Sun, Moon and planets were at that second. Anyone can repeat the sum. It makes the stamp readable and adds no security.
Checking redoes the fingerprint, tests the beacon's signature against a key already inside the checker, and works out the sky again. No account. The check itself asks no server of ours.
Two things you might want to prove
A file existed by a certain time
One drop on the stamp page, with no phone and no account. The beacon fixes the earliest moment. Authorities fix the latest. If they do not answer, you get the earliest only, and the stamp says so.
Two devices were together
Open the phone page. No app, no pairing. Camera and sound can show two devices were in the same place. They do not show where that place was. A laptop file has no sensors, so this site does not try to say where it was made.
Catching a lie is cheap. Proving the truth is not.
This is the most useful thing a stamp does, and it is the opposite of what most people expect.
An example
A photo is offered as proof of flooding at the depot overnight. The stamp holds up. The file is unchanged. The signatures check.
And the stamp fixes a time at which the sun was 40° above the horizon. “Overnight” is not a matter of opinion. One number, free for anyone to work out, and the claim is finished.
Turn it round. Suppose the sun had agreed with the caption. That would prove nothing at all — whoever wrote it could have looked up the same number you did, for nothing, and written something that fits.
To knock a claim down you need one thing that disagrees. To hold a claim up you need everything to agree, and nothing quietly left out that would have disagreed, and you still cannot rule out an honest device measuring the real world on somebody else's behalf. That is not a gap in what we built. It is a fact about checking anything at all. If you want a machine that certifies things are true, there isn't one, and we will not sell you one.
Time, place, and the sky picture
How well “where” can be shown depends on what the device can measure. More sensors, tighter answer. Rows marked as not built are in the table so the ladder is complete, not because this site measures them today.
| Sky and magnetic reading only, for a file on a laptop | right country · hundreds of km |
| Photo of the real night sky, read like a sailor reads stars | right town · about a kilometre |
| Phone GNSS with spoof checks · not built here yet | metres |
| Two devices together: camera and sound · today · UWB · not built yet | the gap between them |
The coarse country row is only a sanity veto. It catches a “Dublin” photo whose magnetic field says Sahara. Real street precision needs a device that measures its own position, which is why that work runs on a phone, not a laptop file. Sound can be relayed; camera codes that change every second cannot be faked with a still photograph. Neither answers “where on Earth”. They answer “were these two devices together”.
Built to sit beside C2PA, not against it
C2PA Content Credentials prove a key signed the bytes. They do not, by themselves, assert that the depicted scene is physically consistent with the time and place it claims. A Cosmic Time Stamp can travel with a file as a custom assertion. We would contribute the assertion schema openly; the high-precision sky-consistency engine stays licensed. Harder to forge is not the same as un-spoofable, and we say so.
Crypto-agile fingerprints
Every digest names its method. Hashing already stands up to a quantum computer in the honest sense: the known attack halves the margin, so the answer is a longer fingerprint, not exotic unvetted math. Everyday stamps use SPT-256. SPT-512 is defined for evidence meant to last a lifetime. SPT-FAST is for very large files.
What stays closed
The envelope — bytes, hashes, signatures, the three-outcome grammar — is published and bit-reproducible. Scoring how well an observation matches a computed sky uses maths that is not bit-reproducible and stays licensed. An open reader confirms an envelope is well-formed. It does not re-derive that score. US provisional 64/125,042 has been filed; no patent has been granted.
What you may implement
The specification text is CC BY 4.0. Anyone may implement the wire format — the core, the container, the allocated proof types, the verdict grammar and the reader rules — royalty-free, in any product, open or closed. What stays ours, and what is open, is written down in one place. A patent covenant on the Open Specification Promise model is a draft for counsel until the applicant of record gives it; this page does not claim a covenant that has not been given.
Furniture, EUDR desks and industry profiles live on the rest of this site. They are products on the format, not a second format.