318

Port 318/tcp is registered with IANA as pkix-timestamp with the description "PKIX TimeStamp," assignee Robert Zuccherato (one of the four named authors of RFC 3161), and a blank reference field — RFC 3161 is the defining specification but is not cited in the registry row — dual-registered on TCP and UDP. This is the one entry in its batch with genuine current relevance: it is the dedicated port for trusted timestamping via the Time-Stamp Protocol (TSP). RFC 3161 (August 2001) defines a request/response protocol in which a client sends a TimeStampReq containing a MessageImprint (a hash algorithm OID plus the hash of the data), an optional policy ID, an optional nonce, and a certReq flag, and a Time Stamping Authority (TSA) returns a TimeStampResp containing, on success, a signed TimeStampToken — a CMS SignedData whose content is a TSTInfo carrying the messageImprint, a serial number, a genTime, optional accuracy/ordering, and the nonce — signed with a key whose certificate bears the critical extended-key-usage id-kp-timeStamping. RFC 5816 (2010) updates it to permit ESSCertIDv2 (hash algorithms beyond SHA-1), and RFC 3628 specifies TSA policy requirements; TSP underpins ANSI X9.95 and, in the EU, is profiled by ETSI EN 319 421/319 422 for eIDAS qualified timestamps. The IANA reference field is blank. A crucial practical point is that although 318 is the dedicated port, virtually all public TSAs serve TSP over HTTP or HTTPS (80/443) using the application/timestamp-query and application/timestamp-reply content types — Microsoft SignTool, Java jarsigner, and OpenSSL ts all consume HTTP TSA URLs — which is why 318 is recorded at an nmap open-frequency of 0.000000. Security-wise the protocol is itself a security mechanism (proof-of-existence for code signing and long-term CAdES/XAdES/PAdES signature validation), and the dedicated port is rarely seen open; a misconfigured open TSA could be abused to obtain tokens or as a minor DoS target, but TSP is relatively benign and production TSAs typically sit behind HSMs and audited operations. For an analyst, an open 318 indicates a TSP/timestamping service that is usually benign and rare on the dedicated port since HTTP(S) dominates, so triage means confirming whether a legitimate internal TSA is intended.

IANA assignment

pkix-timestamp — "PKIX TimeStamp"; reference (blank — RFC 3161 is the defining spec but is NOT cited in the IANA registry row); assignee Robert Zuccherato; dual-registered 318/tcp + 318/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.000000 — rarely open on the dedicated port (de-facto) [Well-established] — nmap-services file

Related ports

80/443 (TSP-over-HTTP(S), the de-facto transport); wider PKI (OCSP/CRL over HTTP, 389/636 LDAP)

Primary use

trusted timestamping (bind a hash to a TSA-asserted UTC time) — RFC 3161 TSP

Other/unofficial uses

in practice TSP runs over HTTP/HTTPS (80/443), not the dedicated 318

Security implications

the protocol is a security mechanism (code-signing/long-term-validation timestamps); dedicated port rarely open; benign; production TSAs are HSM-backed [Well-established]

Typically seen on

TSA/timestamping servers (rare on this port; HTTP(S) dominates)

Analyst note

An open 318 indicates a TSP/timestamping authority — usually benign and rare on the dedicated port since HTTP(S) dominates; confirm whether an internal TSA is intended.

Port 318/udp is registered with IANA as pkix-timestamp, nominally carrying the PKIX Time-Stamp Protocol (TSP) used to request and receive cryptographically signed timestamps from a Time Stamping Authority (TSA); in practice this specific port sees little to no genuine traffic, since real-world TSA deployments run TSP over HTTP/HTTPS instead, making an open 318/udp worth treating as anomalous rather than expected.

IANA's Service Name and Transport Protocol Port Number Registry lists 318 as pkix-timestamp / "PKIX TimeStamp" on both TCP and UDP, assigned to Robert Zuccherato, a co-author of RFC 3161. The registry's Reference column for this entry is blank — no RFC is formally cited there. Several third-party port databases informally label the port "RFC 3161," but that document defines the TSP message format only and does not mandate a dedicated transport port, so attributing it directly to this IANA assignment would be unsupported.

TSP exists to let a client hash a piece of data, submit that hash to a TSA, and receive back a signed timestamp token proving the data existed at a given time — used for non-repudiation, long-term digital-signature validity, and electronic archiving under PKI. The protocol itself is transport-agnostic and does not require raw port 318.

No dedicated TSA product, client library, or daemon was found tied specifically to raw port 318 in this pass; Entrust (the assignee's employer) and other TSA vendors expose TSP over HTTP(S) endpoints instead. Nmap's nmap-services file and general exposure-scanning sources show no elevated frequency, malware association, or CVE tied to this port.

IANA assignment

pkix-timestamp — "PKIX TimeStamp"; reference blank; assignee/contact [Robert_Zuccherato]; dual-registered 318/tcp + 318/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry-648; IANA registry

Range class

well-known (0–1023) [Confirmed]

Prevalence

Unknown — no nmap-services open-frequency figure or scanning telemetry specific to this port found this pass [Unknown]

Related ports

80/443 (HTTP/HTTPS — the transport TSP is actually deployed over in practice) [Likely]

Primary use

PKIX Time-Stamp Protocol (TSP) timestamp request/response for PKI-based data timestamping

Other/unofficial uses

none identified; real-world TSA deployments predominantly run TSP over HTTP(S) rather than this dedicated port

Security implications

no known CVE or malware association found for port 318; low/no observed exposure signal; an unexpected open 318 is more likely misconfiguration, a legacy service, or a UDP-scan false positive than malicious use

Typically seen on

rarely seen in the wild; if present, expect legacy or experimental TSP implementations rather than mainstream production TSA services [Likely]

Analyst note

treat an open 318/udp as anomalous — the dedicated port carries little genuine traffic since TSP is overwhelmingly deployed over HTTP(S) instead [Likely]