Adding verified timestamps

[Zackaryia]

Currently timestamps can't be trusted, this can be remedied with something like OpenTimestamps.org "signing" the timestamp allowing future users to check and verify the (approximate) timestamp of an event if they trust the timestamps of Bitcoin blocks. I believe that adding something like this is critical as it would allow less untrusted information in the ecosystem, prevent malicious actors and many types of malicious exploits, as well as allows for adding hard cutoffs for migration of the protocol while still allowing for legacy data. For example if Atproto wanted to migrate to a new version of the protocol then someone could submit an old event claiming it was generated before the cutoff, with a timestamp signing it would be impossible to do so.

However instead of using Bitcoin to sign timestamps (As OpenTimestamps.org does) I would recommend using Ethereum because of its short (~14 second) block times and cheaper fees allowing for decentralization of time-stamping servers.

How this time-stamping would work is that the user would generate a hash for their event, hash it with the last Ethereum block (known as the previous Ethereum block) and submit it to a time-stamping notary server. The server would add the hash to a merkle tree of other pending timestamps to be notarized and submit a transaction to the Ethereum network with the value of the root node in the merkle tree. To prove the event was published between the previous Ethereum block and the new Ethereum block all someone needs to see is verify that the transaction was published to the Ethereum network, and verify that the event's hash with the previous Ethereum block is in the merkle tree. This would give fairly granular timestamps (less than a minute) in a trustless way with 100% confidence.

However a block chain could be used to create verifiable decentralized DID updates for example by publishing the newest DID document hash & signature to the Ethereum network and making that the discovery source for new DID updates.

I chose Ethereum as an example network however this could be done on many other networks or on a block chain created just for At Protocol but that is not as important as getting verified timestamps because that has many value adds with relatively little cost.

Edit: After looking into it more, the average transaction fee for Ethereum currently is arround $1.5 USD and this is prohibitive for most projects to do especially at the needed frequency, maybe other projects should be looked into to "sign" timestamps like Ripple or Monero. Ethereum could still be used a way to sign events daily but at the frequency needed to maintain a granularity under 1 minute the cost of using Ethereum to sign transactions is too great.

[petertodd]

FWIW the OpenTimestamps protocol actually has Ethereum support: https://github.com/opentimestamps/python-opentimestamps/blob/python-opentimestamps-v0.4.5/opentimestamps/core/dubious/notary.py

Someone was even running an Ethereum calendar for awhile. But they gave up when the client funding it stopped paying because their Ethereum node kept on having problems, making it too much work to maintain. As you noted, transaction fees aren't much different on Ethereum vs Bitcoin. What is different is running a Bitcoin node is much easier due to Bitcoin's stable and reliable core protocol, so fully validating Bitcoin timestamps is much easier.

Anyway, nothing is stopping people from running more OpenTimestamps calendars if needed. There is however the issue that you shouldn't do that unless you are upgrading your timestamps to have the full set of data, proving all the way to a block header. OpenTimestamps can return a timestamp within a second or so because it relies on having a small set of calendars, that the community can back up, where the timestamp data is going to be available for verification far into the future. If you start adding a lot of "decentralized" calendars, that's not likely to work as intended unless you proactively upgrade the timestamps while the data is still available.