checkId: check.timestamp.evidence.tst.deprecated-algo plugin: stellaops.doctor.timestamping severity: warn tags: [timestamping, evidence, tst, algorithm, deprecated]

TST Deprecated Algorithms

This Stella Ops Doctor check flags timestamp tokens (TSTs) that were signed with a weak hash algorithm such as SHA-1. It is aimed at platform operators preparing release evidence for compliance review: collision-prone algorithms can cause eIDAS or FIPS auditors to reject otherwise-valid attestations. For the rolled-up view across all evidence-staleness dimensions, see Evidence Staleness.

What It Checks

Detects timestamps using deprecated hash algorithms (default: SHA-1):

Fails (unhealthy) if the count of affected timestamps exceeds the critical threshold (default 10).
Warns (degraded) otherwise.

Why It Matters

Timestamps using deprecated algorithms like SHA-1 are vulnerable to collision attacks. Compliance frameworks (eIDAS, FIPS) may reject evidence signed with deprecated algorithms, blocking release attestation verification.

Common Causes

Legacy artifacts timestamped with older TSA configurations
TSA provider still using SHA1 by default
Migration to SHA-256 not yet completed

How to Fix

Re-timestamp affected artifacts using approved algorithms:

stella retimestamp run --algorithm SHA256 --filter deprecated-algo

Ensure TSA providers are configured to use SHA-256 or stronger.

Verification

stella doctor run --check check.timestamp.evidence.tst.deprecated-algo

Evidence Staleness (check.timestamp.evidence.staleness) — aggregated evidence staleness check
TSA Valid Response (check.timestamp.tsa.valid-response) — verifies TSA returns valid responses