<p>Embedding arbitrary data in the Bitcoin blockchain is possible with the use of an OP_RETURN output. If you embed a hash of your file this way, it will prove its existence at that point in time, for as long as Bitcoin exists and its timestamps can be trusted. Note that block timestamps in Bitcoin can theoretically be up to 2 hours different from real time.</p>
<p>However, embedding a hash of a single file in a transaction is wasteful. Using a merkle tree, you can timestamp thousands or millions of files at the same time, and still use only one transaction. The <a href="https://opentimestamps.org/" rel="noreferrer">OpenTimestamps</a> project creates an open standard for exactly that and lists several so-called &quot;calendar servers&quot; that allow you to create a trusted timestamp for free (they rely on donations to cover transaction fees and other expenses).</p>
<p>Example OpenTimestamps transaction: <a href="https://mempool.space/tx/f1127bd52c1fe4894134379403f4dc7287018fc4f1361c3ce01a554ae6995f9c" rel="noreferrer">f1127bd52c1fe4894134379403f4dc7287018fc4f1361c3ce01a554ae6995f9c</a></p>

CC BY-SA 4.0
2022-05-24T13:58:32.540Z
the only thing he can prove is that statement "the transaction submitter created a hash arount time t". Not that he actually has the message that generated that hash. And even less that that message was in fact, a file on a filesystem at any point.
v.oddou
CC BY-SA 4.0
2022-05-24T14:14:28.937Z
@v.oddou The hash is good enough.
fraxinus
CC BY-SA 4.0
2022-05-24T14:14:48.537Z
@v.oddou Not sure what you're getting at there.... are you saying that someone could report a hash, and then later do a preimage attack to simulate the original existence of the file?
Sneftel
CC BY-SA 4.0
2022-05-24T14:31:29.153Z
@Sneftel well yes, but the fact that this hard makes it an acceptable solution for that case. My point wasn't for the case where we query the system with valid queries. The point was as long as there is no query, anybody can just put some random hashes in there and pretend they "have files" when in fact they have nothing.
v.oddou
CC BY-SA 4.0
2022-05-24T14:39:58.480Z
@v.oddou Putting "some random hashes" into the blockchain is no use when there are potentially 2^256 valid SHA-256 hashes. This is no better than a preimage attack.
Vojtěch Strnad
CC BY-SA 4.0
2022-05-24T18:12:19.757Z
@v.oddou I think this is just an issue of imprecise wording.  In cryptographic terms, it sounds like the OP is striving to make a "commitment" that a file existed at a certain time.  The "proof" is actually done at a later time, by providing the file (which can be hashed), and some key material to prove that the OP was the instigator of the transaction.  And, to your comment about random hashes, the validity of this commitment does depend on the quality of the algorithm used.  At time of writing this, SHA-256 is considered pretty reliable for these purposes.
Cort Ammon
CC BY-SA 4.0
2022-05-24T18:17:08.540Z
It also depends on the intended use.  If the OP is an inventor in a nation whose patent office used "first to invent," they may want to use bitcoin to timestamp a key document, and then keep that document secret until the patent is issued *or* contested.  At that point, they produce the file and use the blockchain to argue its date of origin.  If the OP wishes to claim "ownership" of a file before distributing it en-masse, that's trickier.  That's effectively an NFT.  Ensuring the minter of a NFT isn't merely the first person to stick a pre-existing file on the blockchain is complicated.
Cort Ammon
CC BY-SA 4.0
2022-05-25T06:56:52.683Z
@CortAmmon: First-to-invent basically [doesn't exist any more](https://en.wikipedia.org/wiki/First_to_file_and_first_to_invent).
Kevin
CC BY-SA 4.0
2022-05-26T21:00:45.160Z
@fraxinus the hash is good enough unless it's compromised in a way that allows creating files that you can control the hash of.
Dan Is Fiddling By Firelight
CC BY-SA 4.0
2022-05-24T11:42:05.647Z
2022-05-24T11:42:05.647Z
Vojtěch Strnad
<p>Yes, it is possible today. Have a look to <a href="https://originstamp.com/" rel="noreferrer">https://originstamp.com/</a> - this service already performs it. I do not recommend you to upload your files to this site, but you will find more information there, rather in my answer</p>

CC BY-SA 4.0
2022-05-24T06:48:24.807Z
As I am new to bitcoin, I am worried whether this approach has drawbacks or not? Thanks
ch271828n
CC BY-SA 4.0
2022-05-24T07:17:17.797Z
For an open source version of this type of time-stamping service: https://opentimestamps.org/
chytrik
CC BY-SA 4.0
2022-05-24T05:53:07.510Z
2022-05-24T05:53:07.510Z
amaclin
<p>In addition to the services already mentioned, <a href="https://proofofexistence.com/" rel="nofollow noreferrer">Proof of Existence</a>, billed as &quot;the original Blockchain notary service&quot;, does exactly what you are asking for (if you're asking only about existence and not possession), for a fee of 0.00025 BTC each.</p>
<p>Actually uploading the document to the server is not necessary; it only needs the hash, which is computed client-side. I can't vouch for whether or not what's currently on the web site secretly uploads your submissions somewhere. However, they do host their code on GitHub, so you could e.g. run your own server (or just see what exactly it puts on the blockchain, so you could do the same on your own). There is also a free API available, with which you know for sure only the hash is being submitted.</p>

CC BY-SA 4.0
2022-05-25T17:38:03.643Z
2022-05-25T23:34:53.937Z
2022-05-25T23:34:53.937Z
ddawson
<p>You cannot use bitcoin alone to prove something about arbitrary files, because bitcoin does not interact with arbitrary files. Any software which calculates a file hash and puts it on the blockchain could have been a software which read hashes from a website, e.g. [1], and never had the actual files.</p>
<p>So a verifier like a court would have to trust a combination of blockchain, custom software and your deployment of it.</p>
<p>[1] <a href="http://ftp.debian.org/debian/dists/bullseye/Release" rel="nofollow noreferrer">http://ftp.debian.org/debian/dists/bullseye/Release</a></p>

CC BY-SA 4.0
2022-05-25T16:57:02.700Z
This misses the point. The very existence of a hash matching a given file (which someone needing to verify prior existence has a copy of) implies that hash was *with very high probability* calculated from the given file (assuming, of course, a collision attack could not be used). If said hash is found in the Bitcoin blockchain, whose time stamps are very likely to be trustworthy, this then implies the given file *probably* existed when the block was mined, *regardless of how the hash made its way into a transaction*.
ddawson
CC BY-SA 4.0
2022-05-25T22:36:08.690Z
@ddawson Small note: broken collision resistance wouldn't be a problem in this case since you still wouldn't be able to prove you had a file that you didn't actually have at the time. Being able to prove two different files with the same hash doesn't provide any real benefit over just timestamping two different hashes. Preimage resistance is what matters here.
Vojtěch Strnad
CC BY-SA 4.0
2022-05-25T22:47:52.150Z
@VojtěchStrnad Yes, good point.
ddawson
CC BY-SA 4.0
2022-05-25T23:05:50.027Z
@ddawson, "This misses the point" -> To quote some parts of the question: "I already come up with such a file with such content" and "I prove that I have it at this time". This sounds like possession not pure existence. Having a hash of a file does not mean to have the file.
Damian
CC BY-SA 4.0
2022-05-25T23:21:08.620Z
@Damian Well, if it is indeed possession by oneself (whether this is really necessary may depend on the nature of the file), as opposed to mere existence, then yeah, you'd need something more. Maybe take a photo/video showing your face while holding a sign with the hash of the file written on it, and put the hash of *that photo/video* in the blockchain. You'd need to present an exact copy of the photo/video and not a re-encoded version on a hosting site (or you could instead rely on such a site's date stamp and forgo Bitcoin), as well as a copy of the file you want to prove possession of.
ddawson
CC BY-SA 4.0
2022-05-25T23:28:27.533Z
No, now that I think about it some more, that wouldn't be enough either. As you said, having the hash is not enough. Proving possession *now* is not difficult. There are already protocols for that, but I believe they tend to be interactive, to prevent a claimant cheating. But proving it in the past is another matter.
ddawson
CC BY-SA 4.0
2022-05-30T08:35:33.970Z
@ddawson, you are fine. OP is not asking about "possession" (whatever that means), but is exactly interested in `there exists a file with content at this point of time`. Having a hash of the file together with a timestamp (as part of the Bitcoin chain) would be perfectly fine to prove exactly OP's statement in court or wherever else. Provided the judge and jury grok the meaning of hashes and the (im)probability of clashes, and the difficulty in doctoring a file to meet a given hash, of course.
AnoE
CC BY-SA 4.0
2022-05-30T15:08:23.170Z
@AnoE: "OP is not asking about possession". That is not true, as I have quoted other parts saying so. OP's question is ambiguous at best.
Damian
CC BY-SA 4.0
2022-05-31T19:39:02.383Z
@AnoE Possession means exactly what it sounds like: possessing a copy of the file. One who possesses it can answer questions about its contents that one who only has knowledge of existence cannot, and there exist **challenge-response protocols** that use this property to (probabilistically) prove current possession without transmitting the actual contents. But how would one show that they possessed it at a given time in the past?
ddawson
CC BY-SA 4.0
2022-06-01T09:07:18.843Z
@ddawson, the question has the title "Can I use Bitcoin to permanently prove that "there exists a file with content at this point of time"?" (which was the pertinent question to me, regarding my comments). In the question, OP asks "I already come up with such a file with such content". I agree that these are contradictory terms. The question seems to leave much room for interpretation, so ... yeah. Hard to tell anything unless we know what OP wants. ;)
AnoE
CC BY-SA 4.0
2022-05-24T17:02:54.117Z
2022-05-24T17:02:54.117Z
Damian
<p>Ethereum could be the right choice, Bitcoin require more hassle. I developed a simple smart contract for certification as you described more than three years ago and it is still working and used by the customer. Moreover, you can label the output so that it is not required to give a lot of explanation when you need to demonstrate your certification: the smart contract “print out” all whatever needed to understand (I.e. not a simple number or hash, but a complete “legenda” of the record).</p>

CC BY-SA 4.0
2022-05-25T18:54:04.523Z
I think a source or link could be helpful here.
Matt Popovich
CC BY-SA 4.0
2022-05-26T08:28:56.053Z
Yes, I agree but unfortunately surely I can mention the application here for educational purpose, but… first of all it is an Ethereum application (and this is th Bitcoin section), secondly that implementation it is property of the customer and it is not open-source. Sorry for this.
Rick Park
CC BY-SA 4.0
2022-05-24T12:31:29.920Z
2022-05-24T12:31:29.920Z
Rick Park
<p>Frame challenge: this is a solved problem via Git.</p>
<p>The whole point of a version control software like git is to keep track of who changed/created files at what time. As such, you can show all modifications that have ever happened to a file and when they occurred.</p>
<p>As for the legality aspect of this, git has already been used for maintaining laws in such areas as Washington DC: <a href="https://arstechnica.com/tech-policy/2018/11/how-i-changed-the-law-with-a-github-pull-request/" rel="nofollow noreferrer">https://arstechnica.com/tech-policy/2018/11/how-i-changed-the-law-with-a-github-pull-request/</a></p>

CC BY-SA 4.0
2022-05-25T20:12:46.083Z
It might be useful in some contexts. But there is a question of how robust this solution is. Bitcoin's blockchain is practically immutable (with exponentially increasing certainty for a given block the more blocks are added after it). Git has `git commit --amend`, `git push --force`, and other things, which are specifically designed to alter history. It doesn't necessarily work if people are keeping their own copies, but if the *only* copies are your own and one on a central repo like on GitHub, it's easy, or at least doable.
ddawson
CC BY-SA 4.0
2022-05-26T14:19:48.867Z
Yeah, as @ddawson says, the linked article and described practice of maintaining a set of law on a publicly accessible git repository don't actually compare well to what OP here is trying to achieve. The point of putting the hash of a file in a public timestamped record is to create widely distributed reliable evidence to show that the corresponding document already existed. Git commits just use the local time of the computer that generated them, so pointing at your own git repository to document the existence of something in the past would be significantly weaker evidence.
Murch
CC BY-SA 4.0
2022-05-25T18:30:34.530Z
2022-05-25T18:30:34.530Z
Robin Clower
<p>I have some files (e.g. of 10MB in size, think of it as a paper, an article, a photo, etc), and want to permanently prove that &quot;at 2022.05.24, I already come up with such a file with such content&quot;.</p>
<p>So, is it possible to be done via bitcoin? My very naive thought is that, transferring some bitcoin with &quot;attachment&quot; being the hash of my file. Then, since this money transfer record is permanently unmodifiable and visible to everyone, I prove that I have it at this time.</p>
<p>In addition, can this be evidence in, for example, courts?</p>
<p>I am new to blockchain/bitcoin so I am not sure whether this thought is reasonable or not. Thanks for any suggestions!</p>

CC BY-SA 4.0
2022-05-24T15:49:47.967Z
"In addition, can this be evidence in, for example, courts?" might be better asked on law.SE .
Brian
CC BY-SA 4.0
2022-05-25T13:06:55.960Z
You can also (ab)use Certificate Transparency logs for this purpose without involving Bitcoin or any other cryptocurrency.
R.. GitHub STOP HELPING ICE
CC BY-SA 4.0
2022-05-25T13:33:25.040Z
@R..GitHubSTOPHELPINGICE Could you please elaborate it a bit more?
ch271828n
CC BY-SA 4.0
2022-05-25T13:37:24.673Z
@R.. There might be many alternative ways of creating the evidence the OP desires; I am not sure how that is relevant here.
Brian Drake
CC BY-SA 4.0
2022-05-25T13:39:57.130Z
The title and question body are inconsistent. Do you only want to prove that the file exists (that is, *someone* had the file) at the relevant time? Or do you want to prove that *you* had the file at that time? It seems that the former is much easier than the latter.
Brian Drake
CC BY-SA 4.0
2022-05-25T13:46:13.130Z
@ch271828n: Just by arranging for the hash you want recorded to be present in the CSR submitted to Lets Encrypt or whatever ACME provider you use. Then it gets recorded in one or more append-only ledgers as required by policy for CAs.
R.. GitHub STOP HELPING ICE
CC BY-SA 4.0
2022-05-25T13:50:42.180Z
For the purpose of courts, wouldn't something like mailing yourself the hash (or even a disk/usb stick containing the file in question) be sufficient/better/cheaper?
Dan M.
CC BY-SA 4.0
2022-05-25T14:32:49.930Z
@BrianDrake I guess the former is enough. The data has identity in it, consider it like an article with author's name and id. Thus, as long as I can prove this file content exists, I also show the article is by this author (me).
ch271828n
CC BY-SA 4.0
2022-05-25T14:33:35.013Z
@R..GitHubSTOPHELPINGICE Looks interesting (and not using bitcoin)
ch271828n
CC BY-SA 4.0
2022-05-25T14:34:16.013Z
@DanM. Well, then how can I prove the mail is not fake, e.g. Outlook/Gmail/... create a fake mail at that time? For USB stick, I even cannot prove the file is created at that time.
ch271828n
CC BY-SA 4.0
2022-05-25T14:43:22.487Z
@ch271828n: Indeed, and even methods like relying on "$mailprovider's DKIM keys signed the mail attesting that they saw it at the time" are not valid because DKIM keys often leak after their validity expires (and many folks even propose intentionally leaking them after validity expires so that they don't create unwanted nonrepudiation properties).
R.. GitHub STOP HELPING ICE
CC BY-SA 4.0
2022-05-25T14:45:43.930Z
Easy way to do it with CT logs: just bring up a https site for "$hash.$yourdomain" with a configuration that auto-deploys Lets Encrypt, and the hash will be permanently recorded in an append-only ledger (attesting to the time/sequence in which it was published) by virtue of being the hostname for which a certificate was issued.
R.. GitHub STOP HELPING ICE
CC BY-SA 4.0
2022-05-25T23:08:56.903Z
Can you see that "… already come up with…" inarguably proves, you need a better translator? Do you doubt that matters?

Can you say how or why this is about Bitcoin, specifically? How would a Bitcoin transfer allow you to attach files that a standard bank transfer would not?

Why ask about evidence in, for example, courts,l when everyone else knows that courts are the obvious, over-riding example? How could what  works in court, not work anywhere else?
Robbie Goodwin
CC BY-SA 4.0
2022-05-26T16:42:54.100Z
You may want to google for "timestamp server".  Such services, based on cryptographic signatures, have existing for many years and there's a lot written about them.  The variant you're suggesting is a way to make sure the record of the timestamping is public and permanent - an improvement (depending on your use case) from depending on a privately operated timestamp server to persist.
davidbak
CC BY-SA 4.0
2022-05-27T00:56:07.310Z
You might have, but not with that wording.

I suggest any court would "ask" you to find a (much) better translator.

Can you re-phrase "… use Bitcoin to permanently prove that 'there exists a file with content at this point of time' " at least three ways, or see that no court will accept your argument?
Robbie Goodwin
<proof-of-existence>
Can I use Bitcoin to permanently prove that "there exists a file with content at this point of time"?
ch271828n
# Can I use Bitcoin to permanently prove that "there exists a file with content at this point of time"?

(Asked by: username_0 on 2022-05-24)

I have some files (e.g. of 10MB in size, think of it as a paper, an article, a photo, etc), and want to permanently prove that "at 2022.05.24, I already come up with such a file with such content".

So, is it possible to be done via bitcoin? My very naive thought is that, transferring some bitcoin with "attachment" being the hash of my file. Then, since this money transfer record is permanently unmodifiable and visible to everyone, I prove that I have it at this time.

In addition, can this be evidence in, for example, courts?

I am new to blockchain/bitcoin so I am not sure whether this thought is reasonable or not. Thanks for any suggestions!

**Tags:** proof-of-existence

> **Comments:**
> **username_1**: "In addition, can this be evidence in, for example, courts?" might be better asked on law.SE .  
> **username_2**: You can also (ab)use Certificate Transparency logs for this purpose without involving Bitcoin or any other cryptocurrency.  
> **username_0**: @username_2 Could you please elaborate it a bit more?  
> **username_3**: @R.. There might be many alternative ways of creating the evidence the OP desires; I am not sure how that is relevant here.  
> **username_3**: The title and question body are inconsistent. Do you only want to prove that the file exists (that is, *someone* had the file) at the relevant time? Or do you want to prove that *you* had the file at that time? It seems that the former is much easier than the latter.  
> **username_2**: @username_0: Just by arranging for the hash you want recorded to be present in the CSR submitted to Lets Encrypt or whatever ACME provider you use. Then it gets recorded in one or more append-only ledgers as required by policy for CAs.  
> **username_4**: For the purpose of courts, wouldn't something like mailing yourself the hash (or even a disk/usb stick containing the file in question) be sufficient/better/cheaper?  
> **username_0**: @username_3 I guess the former is enough. The data has identity in it, consider it like an article with author's name and id. Thus, as long as I can prove this file content exists, I also show the article is by this author (me).  
> **username_0**: @username_2 Looks interesting (and not using bitcoin)  
> **username_0**: @DanM. Well, then how can I prove the mail is not fake, e.g. Outlook/Gmail/... create a fake mail at that time? For USB stick, I even cannot prove the file is created at that time.  
> **username_2**: @username_0: Indeed, and even methods like relying on "$mailprovider's DKIM keys signed the mail attesting that they saw it at the time" are not valid because DKIM keys often leak after their validity expires (and many folks even propose intentionally leaking them after validity expires so that they don't create unwanted nonrepudiation properties).  
> **username_2**: Easy way to do it with CT logs: just bring up a https site for "$hash.$yourdomain" with a configuration that auto-deploys Lets Encrypt, and the hash will be permanently recorded in an append-only ledger (attesting to the time/sequence in which it was published) by virtue of being the hostname for which a certificate was issued.  
> **username_5**: Can you see that "… already come up with…" inarguably proves, you need a better translator? Do you doubt that matters?  Can you say how or why this is about Bitcoin, specifically? How would a Bitcoin transfer allow you to attach files that a standard bank transfer would not?  Why ask about evidence in, for example, courts,l when everyone else knows that courts are the obvious, over-riding example? How could what  works in court, not work anywhere else?  
> **username_6**: You may want to google for "timestamp server".  Such services, based on cryptographic signatures, have existing for many years and there's a lot written about them.  The variant you're suggesting is a way to make sure the record of the timestamping is public and permanent - an improvement (depending on your use case) from depending on a privately operated timestamp server to persist.  
> **username_5**: You might have, but not with that wording.  I suggest any court would "ask" you to find a (much) better translator.  Can you re-phrase "… use Bitcoin to permanently prove that 'there exists a file with content at this point of time' " at least three ways, or see that no court will accept your argument?  

---

## 6 answers

### Answer by username_7 on 2022-05-24. Score: 30

Embedding arbitrary data in the Bitcoin blockchain is possible with the use of an OP\_RETURN output. If you embed a hash of your file this way, it will prove its existence at that point in time, for as long as Bitcoin exists and its timestamps can be trusted. Note that block timestamps in Bitcoin can theoretically be up to 2 hours different from real time.

However, embedding a hash of a single file in a transaction is wasteful. Using a merkle tree, you can timestamp thousands or millions of files at the same time, and still use only one transaction. The [OpenTimestamps](https://opentimestamps.org/) project creates an open standard for exactly that and lists several so-called "calendar servers" that allow you to create a trusted timestamp for free (they rely on donations to cover transaction fees and other expenses).

Example OpenTimestamps transaction: [f1127bd52c1fe4894134379403f4dc7287018fc4f1361c3ce01a554ae6995f9c](https://mempool.space/tx/f1127bd52c1fe4894134379403f4dc7287018fc4f1361c3ce01a554ae6995f9c)

> **Comments:**
> **username_8**: the only thing he can prove is that statement "the transaction submitter created a hash arount time t". Not that he actually has the message that generated that hash. And even less that that message was in fact, a file on a filesystem at any point.  
> **username_9**: @username_8 The hash is good enough.  
> **username_10**: @username_8 Not sure what you're getting at there.... are you saying that someone could report a hash, and then later do a preimage attack to simulate the original existence of the file?  
> **username_8**: @username_10 well yes, but the fact that this hard makes it an acceptable solution for that case. My point wasn't for the case where we query the system with valid queries. The point was as long as there is no query, anybody can just put some random hashes in there and pretend they "have files" when in fact they have nothing.  
> **username_7**: @username_8 Putting "some random hashes" into the blockchain is no use when there are potentially 2^256 valid SHA-256 hashes. This is no better than a preimage attack.  
> **username_11**: @username_8 I think this is just an issue of imprecise wording.  In cryptographic terms, it sounds like the OP is striving to make a "commitment" that a file existed at a certain time.  The "proof" is actually done at a later time, by providing the file (which can be hashed), and some key material to prove that the OP was the instigator of the transaction.  And, to your comment about random hashes, the validity of this commitment does depend on the quality of the algorithm used.  At time of writing this, SHA-256 is considered pretty reliable for these purposes.  
> **username_11**: It also depends on the intended use.  If the OP is an inventor in a nation whose patent office used "first to invent," they may want to use bitcoin to timestamp a key document, and then keep that document secret until the patent is issued *or* contested.  At that point, they produce the file and use the blockchain to argue its date of origin.  If the OP wishes to claim "ownership" of a file before distributing it en-masse, that's trickier.  That's effectively an NFT.  Ensuring the minter of a NFT isn't merely the first person to stick a pre-existing file on the blockchain is complicated.  
> **username_12**: @username_11: First-to-invent basically [doesn't exist any more](https://en.wikipedia.org/wiki/First_to_file_and_first_to_invent).  
> **username_13**: @username_9 the hash is good enough unless it's compromised in a way that allows creating files that you can control the hash of.  

---

### Answer by username_14 on 2022-05-24. Score: 5

Yes, it is possible today. Have a look to <https://originstamp.com/> - this service already performs it. I do not recommend you to upload your files to this site, but you will find more information there, rather in my answer

> **Comments:**
> **username_0**: As I am new to bitcoin, I am worried whether this approach has drawbacks or not? Thanks  
> **username_15**: For an open source version of this type of time-stamping service: https://opentimestamps.org/  

---

### Answer by username_16 on 2022-05-25. Score: 3

In addition to the services already mentioned, [Proof of Existence](https://proofofexistence.com/), billed as "the original Blockchain notary service", does exactly what you are asking for (if you're asking only about existence and not possession), for a fee of 0.00025 BTC each.

Actually uploading the document to the server is not necessary; it only needs the hash, which is computed client-side. I can't vouch for whether or not what's currently on the web site secretly uploads your submissions somewhere. However, they do host their code on GitHub, so you could e.g. run your own server (or just see what exactly it puts on the blockchain, so you could do the same on your own). There is also a free API available, with which you know for sure only the hash is being submitted.


---

### Answer by username_17 on 2022-05-24. Score: 2

You cannot use bitcoin alone to prove something about arbitrary files, because bitcoin does not interact with arbitrary files. Any software which calculates a file hash and puts it on the blockchain could have been a software which read hashes from a website, e.g. [1], and never had the actual files.

So a verifier like a court would have to trust a combination of blockchain, custom software and your deployment of it.

[1] <http://ftp.debian.org/debian/dists/bullseye/Release>

> **Comments:**
> **username_16**: This misses the point. The very existence of a hash matching a given file (which someone needing to verify prior existence has a copy of) implies that hash was *with very high probability* calculated from the given file (assuming, of course, a collision attack could not be used). If said hash is found in the Bitcoin blockchain, whose time stamps are very likely to be trustworthy, this then implies the given file *probably* existed when the block was mined, *regardless of how the hash made its way into a transaction*.  
> **username_7**: @username_16 Small note: broken collision resistance wouldn't be a problem in this case since you still wouldn't be able to prove you had a file that you didn't actually have at the time. Being able to prove two different files with the same hash doesn't provide any real benefit over just timestamping two different hashes. Preimage resistance is what matters here.  
> **username_16**: @username_7 Yes, good point.  
> **username_17**: @username_16, "This misses the point" -> To quote some parts of the question: "I already come up with such a file with such content" and "I prove that I have it at this time". This sounds like possession not pure existence. Having a hash of a file does not mean to have the file.  
> **username_16**: @username_17 Well, if it is indeed possession by oneself (whether this is really necessary may depend on the nature of the file), as opposed to mere existence, then yeah, you'd need something more. Maybe take a photo/video showing your face while holding a sign with the hash of the file written on it, and put the hash of *that photo/video* in the blockchain. You'd need to present an exact copy of the photo/video and not a re-encoded version on a hosting site (or you could instead rely on such a site's date stamp and forgo Bitcoin), as well as a copy of the file you want to prove possession of.  
> **username_16**: No, now that I think about it some more, that wouldn't be enough either. As you said, having the hash is not enough. Proving possession *now* is not difficult. There are already protocols for that, but I believe they tend to be interactive, to prevent a claimant cheating. But proving it in the past is another matter.  
> **username_18**: @username_16, you are fine. OP is not asking about "possession" (whatever that means), but is exactly interested in `there exists a file with content at this point of time`. Having a hash of the file together with a timestamp (as part of the Bitcoin chain) would be perfectly fine to prove exactly OP's statement in court or wherever else. Provided the judge and jury grok the meaning of hashes and the (im)probability of clashes, and the difficulty in doctoring a file to meet a given hash, of course.  
> **username_17**: @username_18: "OP is not asking about possession". That is not true, as I have quoted other parts saying so. OP's question is ambiguous at best.  
> **username_16**: @username_18 Possession means exactly what it sounds like: possessing a copy of the file. One who possesses it can answer questions about its contents that one who only has knowledge of existence cannot, and there exist **challenge-response protocols** that use this property to (probabilistically) prove current possession without transmitting the actual contents. But how would one show that they possessed it at a given time in the past?  
> **username_18**: @username_16, the question has the title "Can I use Bitcoin to permanently prove that "there exists a file with content at this point of time"?" (which was the pertinent question to me, regarding my comments). In the question, OP asks "I already come up with such a file with such content". I agree that these are contradictory terms. The question seems to leave much room for interpretation, so ... yeah. Hard to tell anything unless we know what OP wants. ;)  

---

### Answer by username_19 on 2022-05-24. Score: 1

Ethereum could be the right choice, Bitcoin require more hassle. I developed a simple smart contract for certification as you described more than three years ago and it is still working and used by the customer. Moreover, you can label the output so that it is not required to give a lot of explanation when you need to demonstrate your certification: the smart contract “print out” all whatever needed to understand (I.e. not a simple number or hash, but a complete “legenda” of the record).

> **Comments:**
> **username_20**: I think a source or link could be helpful here.  
> **username_19**: Yes, I agree but unfortunately surely I can mention the application here for educational purpose, but… first of all it is an Ethereum application (and this is th Bitcoin section), secondly that implementation it is property of the customer and it is not open-source. Sorry for this.  

---

### Answer by username_21 on 2022-05-25. Score: -1

Frame challenge: this is a solved problem via Git.

The whole point of a version control software like git is to keep track of who changed/created files at what time. As such, you can show all modifications that have ever happened to a file and when they occurred.

As for the legality aspect of this, git has already been used for maintaining laws in such areas as Washington DC: <https://arstechnica.com/tech-policy/2018/11/how-i-changed-the-law-with-a-github-pull-request/>

> **Comments:**
> **username_16**: It might be useful in some contexts. But there is a question of how robust this solution is. Bitcoin's blockchain is practically immutable (with exponentially increasing certainty for a given block the more blocks are added after it). Git has `git commit --amend`, `git push --force`, and other things, which are specifically designed to alter history. It doesn't necessarily work if people are keeping their own copies, but if the *only* copies are your own and one on a central repo like on GitHub, it's easy, or at least doable.  
> **username_22**: Yeah, as @username_16 says, the linked article and described practice of maintaining a set of law on a publicly accessible git repository don't actually compare well to what OP here is trying to achieve. The point of putting the hash of a file in a public timestamped record is to create widely distributed reliable evidence to show that the corresponding document already existed. Git commits just use the local time of the computer that generated them, so pointing at your own git repository to document the existence of something in the past would be significantly weaker evidence.  

---

