17

I have some files (e.g. of 10MB in size, think of it as a paper, an article, a photo, etc), and want to permanently prove that "at 2022.05.24, I already come up with such a file with such content".

So, is it possible to be done via bitcoin? My very naive thought is that, transferring some bitcoin with "attachment" being the hash of my file. Then, since this money transfer record is permanently unmodifiable and visible to everyone, I prove that I have it at this time.

In addition, can this be evidence in, for example, courts?

I am new to blockchain/bitcoin so I am not sure whether this thought is reasonable or not. Thanks for any suggestions!

17
  • 5
    "In addition, can this be evidence in, for example, courts?" might be better asked on law.SE .
    – Brian
    May 24 at 15:49
  • @Brian Thank you! I will ask there
    – ch271828n
    May 25 at 0:02
  • 1
    You can also (ab)use Certificate Transparency logs for this purpose without involving Bitcoin or any other cryptocurrency. May 25 at 13:06
  • 1
    @DanM. Well, then how can I prove the mail is not fake, e.g. Outlook/Gmail/... create a fake mail at that time? For USB stick, I even cannot prove the file is created at that time.
    – ch271828n
    May 25 at 14:34
  • 1
    Easy way to do it with CT logs: just bring up a https site for "$hash.$yourdomain" with a configuration that auto-deploys Lets Encrypt, and the hash will be permanently recorded in an append-only ledger (attesting to the time/sequence in which it was published) by virtue of being the hostname for which a certificate was issued. May 25 at 14:45

6 Answers 6

29

Embedding arbitrary data in the Bitcoin blockchain is possible with the use of an OP_RETURN output. If you embed a hash of your file this way, it will prove its existence at that point in time, for as long as Bitcoin exists and its timestamps can be trusted. Note that block timestamps in Bitcoin can theoretically be up to 2 hours different from real time.

However, embedding a hash of a single file in a transaction is wasteful. Using a merkle tree, you can timestamp thousands or millions of files at the same time, and still use only one transaction. The OpenTimestamps project creates an open standard for exactly that and lists several so-called "calendar servers" that allow you to create a trusted timestamp for free (they rely on donations to cover transaction fees and other expenses).

Example OpenTimestamps transaction: f1127bd52c1fe4894134379403f4dc7287018fc4f1361c3ce01a554ae6995f9c

9
  • 8
    the only thing he can prove is that statement "the transaction submitter created a hash arount time t". Not that he actually has the message that generated that hash. And even less that that message was in fact, a file on a filesystem at any point.
    – v.oddou
    May 24 at 13:58
  • 1
    @v.oddou The hash is good enough.
    – fraxinus
    May 24 at 14:14
  • 10
    @v.oddou Not sure what you're getting at there.... are you saying that someone could report a hash, and then later do a preimage attack to simulate the original existence of the file?
    – Sneftel
    May 24 at 14:14
  • 6
    @v.oddou I think this is just an issue of imprecise wording. In cryptographic terms, it sounds like the OP is striving to make a "commitment" that a file existed at a certain time. The "proof" is actually done at a later time, by providing the file (which can be hashed), and some key material to prove that the OP was the instigator of the transaction. And, to your comment about random hashes, the validity of this commitment does depend on the quality of the algorithm used. At time of writing this, SHA-256 is considered pretty reliable for these purposes.
    – Cort Ammon
    May 24 at 18:12
  • 8
    It also depends on the intended use. If the OP is an inventor in a nation whose patent office used "first to invent," they may want to use bitcoin to timestamp a key document, and then keep that document secret until the patent is issued or contested. At that point, they produce the file and use the blockchain to argue its date of origin. If the OP wishes to claim "ownership" of a file before distributing it en-masse, that's trickier. That's effectively an NFT. Ensuring the minter of a NFT isn't merely the first person to stick a pre-existing file on the blockchain is complicated.
    – Cort Ammon
    May 24 at 18:17
5

Yes, it is possible today. Have a look to https://originstamp.com/ - this service already performs it. I do not recommend you to upload your files to this site, but you will find more information there, rather in my answer

2
  • As I am new to bitcoin, I am worried whether this approach has drawbacks or not? Thanks
    – ch271828n
    May 24 at 6:48
  • 10
    For an open source version of this type of time-stamping service: opentimestamps.org
    – chytrik
    May 24 at 7:17
3

In addition to the services already mentioned, Proof of Existence, billed as "the original Blockchain notary service", does exactly what you are asking for (if you're asking only about existence and not possession), for a fee of 0.00025 BTC each.

Actually uploading the document to the server is not necessary; it only needs the hash, which is computed client-side. I can't vouch for whether or not what's currently on the web site secretly uploads your submissions somewhere. However, they do host their code on GitHub, so you could e.g. run your own server (or just see what exactly it puts on the blockchain, so you could do the same on your own). There is also a free API available, with which you know for sure only the hash is being submitted.

2

You cannot use bitcoin alone to prove something about arbitrary files, because bitcoin does not interact with arbitrary files. Any software which calculates a file hash and puts it on the blockchain could have been a software which read hashes from a website, e.g. [1], and never had the actual files.

So a verifier like a court would have to trust a combination of blockchain, custom software and your deployment of it.

[1] http://ftp.debian.org/debian/dists/bullseye/Release

10
  • 5
    This misses the point. The very existence of a hash matching a given file (which someone needing to verify prior existence has a copy of) implies that hash was with very high probability calculated from the given file (assuming, of course, a collision attack could not be used). If said hash is found in the Bitcoin blockchain, whose time stamps are very likely to be trustworthy, this then implies the given file probably existed when the block was mined, regardless of how the hash made its way into a transaction.
    – ddawson
    May 25 at 16:57
  • 2
    @ddawson Small note: broken collision resistance wouldn't be a problem in this case since you still wouldn't be able to prove you had a file that you didn't actually have at the time. Being able to prove two different files with the same hash doesn't provide any real benefit over just timestamping two different hashes. Preimage resistance is what matters here. May 25 at 22:36
  • @VojtěchStrnad Yes, good point.
    – ddawson
    May 25 at 22:47
  • 1
    @ddawson, "This misses the point" -> To quote some parts of the question: "I already come up with such a file with such content" and "I prove that I have it at this time". This sounds like possession not pure existence. Having a hash of a file does not mean to have the file.
    – Damian
    May 25 at 23:05
  • @Damian Well, if it is indeed possession by oneself (whether this is really necessary may depend on the nature of the file), as opposed to mere existence, then yeah, you'd need something more. Maybe take a photo/video showing your face while holding a sign with the hash of the file written on it, and put the hash of that photo/video in the blockchain. You'd need to present an exact copy of the photo/video and not a re-encoded version on a hosting site (or you could instead rely on such a site's date stamp and forgo Bitcoin), as well as a copy of the file you want to prove possession of.
    – ddawson
    May 25 at 23:21
1

Ethereum could be the right choice, Bitcoin require more hassle. I developed a simple smart contract for certification as you described more than three years ago and it is still working and used by the customer. Moreover, you can label the output so that it is not required to give a lot of explanation when you need to demonstrate your certification: the smart contract “print out” all whatever needed to understand (I.e. not a simple number or hash, but a complete “legenda” of the record).

2
  • 1
    I think a source or link could be helpful here. May 25 at 18:54
  • Yes, I agree but unfortunately surely I can mention the application here for educational purpose, but… first of all it is an Ethereum application (and this is th Bitcoin section), secondly that implementation it is property of the customer and it is not open-source. Sorry for this.
    – Rick Park
    May 26 at 8:28
-1

Frame challenge: this is a solved problem via Git.

The whole point of a version control software like git is to keep track of who changed/created files at what time. As such, you can show all modifications that have ever happened to a file and when they occurred.

As for the legality aspect of this, git has already been used for maintaining laws in such areas as Washington DC: https://arstechnica.com/tech-policy/2018/11/how-i-changed-the-law-with-a-github-pull-request/

2
  • 3
    It might be useful in some contexts. But there is a question of how robust this solution is. Bitcoin's blockchain is practically immutable (with exponentially increasing certainty for a given block the more blocks are added after it). Git has git commit --amend, git push --force, and other things, which are specifically designed to alter history. It doesn't necessarily work if people are keeping their own copies, but if the only copies are your own and one on a central repo like on GitHub, it's easy, or at least doable.
    – ddawson
    May 25 at 20:12
  • 3
    Yeah, as @ddawson says, the linked article and described practice of maintaining a set of law on a publicly accessible git repository don't actually compare well to what OP here is trying to achieve. The point of putting the hash of a file in a public timestamped record is to create widely distributed reliable evidence to show that the corresponding document already existed. Git commits just use the local time of the computer that generated them, so pointing at your own git repository to document the existence of something in the past would be significantly weaker evidence.
    – Murch
    May 26 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.