checkId: check.timestamp.timesync.rekor-correlation plugin: stellaops.doctor.timestamping severity: warn tags: [timestamping, timesync, rekor, correlation, transparency]

TST-Rekor Time Correlation

This Stella Ops Doctor check cross-checks the timestamp token (TST) genTime against the Rekor transparency-log integratedTime for recent attestations. It is a tamper-detection signal: an attestation whose TST is dated after its Rekor entry is a strong indicator of backdating or clock manipulation, so operators of audited release pipelines should treat any failure as a security event.

What It Checks

Verifies that TST genTime and Rekor integratedTime are properly correlated. The check:

Retrieves recent attestations from the lookback window (default 24 hours).
For each attestation with both TST and Rekor timestamps, computes the gap.
Fails (unhealthy) if any attestation has TST after Rekor (potential backdating – TST should always precede Rekor integration).
Warns (degraded) if the gap between TST and Rekor exceeds the maximum threshold (default 5 minutes).

Why It Matters

Proper time correlation between the TST and its Rekor (transparency log) entry is a key integrity signal. If a TST is dated after its Rekor entry, it may indicate clock manipulation or backdating. Excessive gaps suggest pipeline delays that could indicate operational issues.

Common Causes

System clock drift causing ordering violations
Pipeline delays between timestamping and Rekor submission
Rekor transparency log ingestion delays
Network issues causing timestamp reordering

How to Fix

Docker Compose

# Check system time sync
timedatectl status

# Verify pipeline timing
docker exec <platform-container> stella evidence audit --recent --show-timing

Bare Metal / systemd

# Investigate time synchronization
chronyc tracking

# Review attestation timing
stella evidence audit --recent --show-timing

Kubernetes / Helm

timestamping:
  rekorCorrelation:
    lookbackWindow: "24h"
    maximumGap: "5m"

Investigate ordering violations immediately as they may indicate tampering.

Verification

stella doctor run --check check.timestamp.timesync.rekor-correlation

System Time Synchronization (check.timestamp.timesync.system) — checks system clock synchronization
TSA Time Skew (check.timestamp.timesync.tsa-skew) — checks TSA time skew