318

Port 318/tcp is registered with IANA as pkix-timestamp with the description "PKIX TimeStamp," assignee Robert Zuccherato (one of the four named authors of RFC 3161), and a blank reference field — RFC 3161 is the defining specification but is not cited in the registry row — dual-registered on TCP and UDP. This is the one entry in its batch with genuine current relevance: it is the dedicated port for trusted timestamping via the Time-Stamp Protocol (TSP). RFC 3161 (August 2001) defines a request/response protocol in which a client sends a TimeStampReq containing a MessageImprint (a hash algorithm OID plus the hash of the data), an optional policy ID, an optional nonce, and a certReq flag, and a Time Stamping Authority (TSA) returns a TimeStampResp containing, on success, a signed TimeStampToken — a CMS SignedData whose content is a TSTInfo carrying the messageImprint, a serial number, a genTime, optional accuracy/ordering, and the nonce — signed with a key whose certificate bears the critical extended-key-usage id-kp-timeStamping. RFC 5816 (2010) updates it to permit ESSCertIDv2 (hash algorithms beyond SHA-1), and RFC 3628 specifies TSA policy requirements; TSP underpins ANSI X9.95 and, in the EU, is profiled by ETSI EN 319 421/319 422 for eIDAS qualified timestamps. The IANA reference field is blank. A crucial practical point is that although 318 is the dedicated port, virtually all public TSAs serve TSP over HTTP or HTTPS (80/443) using the application/timestamp-query and application/timestamp-reply content types — Microsoft SignTool, Java jarsigner, and OpenSSL ts all consume HTTP TSA URLs — which is why 318 is recorded at an nmap open-frequency of 0.000000. Security-wise the protocol is itself a security mechanism (proof-of-existence for code signing and long-term CAdES/XAdES/PAdES signature validation), and the dedicated port is rarely seen open; a misconfigured open TSA could be abused to obtain tokens or as a minor DoS target, but TSP is relatively benign and production TSAs typically sit behind HSMs and audited operations. For an analyst, an open 318 indicates a TSP/timestamping service that is usually benign and rare on the dedicated port since HTTP(S) dominates, so triage means confirming whether a legitimate internal TSA is intended.

IANA assignment

pkix-timestamp — "PKIX TimeStamp"; reference (blank — RFC 3161 is the defining spec but is NOT cited in the IANA registry row); assignee Robert Zuccherato; dual-registered 318/tcp + 318/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.000000 — rarely open on the dedicated port (de-facto) [Well-established] — nmap-services file

Related ports

80/443 (TSP-over-HTTP(S), the de-facto transport); wider PKI (OCSP/CRL over HTTP, 389/636 LDAP)

Primary use

trusted timestamping (bind a hash to a TSA-asserted UTC time) — RFC 3161 TSP

Other/unofficial uses

in practice TSP runs over HTTP/HTTPS (80/443), not the dedicated 318

Security implications

the protocol is a security mechanism (code-signing/long-term-validation timestamps); dedicated port rarely open; benign; production TSAs are HSM-backed [Well-established]

Typically seen on

TSA/timestamping servers (rare on this port; HTTP(S) dominates)

Analyst note

An open 318 indicates a TSP/timestamping authority — usually benign and rare on the dedicated port since HTTP(S) dominates; confirm whether an internal TSA is intended.

Port 318/udp is registered with IANA as pkix-timestamp, nominally carrying the PKIX Time-Stamp Protocol (TSP) used to request and receive cryptographically signed timestamps from a Time Stamping Authority (TSA); in practice this specific port sees little to no genuine traffic, since real-world TSA deployments run TSP over HTTP/HTTPS instead, making an open 318/udp worth treating as anomalous rather than expected.

IANA's Service Name and Transport Protocol Port Number Registry lists 318 as pkix-timestamp / "PKIX TimeStamp" on both TCP and UDP, assigned to Robert Zuccherato, a co-author of RFC 3161. The registry's Reference column for this entry is blank — no RFC is formally cited there. Several third-party port databases informally label the port "RFC 3161," but that document defines the TSP message format only and does not mandate a dedicated transport port, so attributing it directly to this IANA assignment would be unsupported.

TSP exists to let a client hash a piece of data, submit that hash to a TSA, and receive back a signed timestamp token proving the data existed at a given time — used for non-repudiation, long-term digital-signature validity, and electronic archiving under PKI. The protocol itself is transport-agnostic and does not require raw port 318.

No dedicated TSA product, client library, or daemon was found tied specifically to raw port 318 in this pass; Entrust (the assignee's employer) and other TSA vendors expose TSP over HTTP(S) endpoints instead. Nmap's nmap-services file and general exposure-scanning sources show no elevated frequency, malware association, or CVE tied to this port.

Exposure

No evidence of meaningful internet-wide exposure; port 318 is rarely observed open in scans, and legitimate TSP traffic is overwhelmingly carried over HTTP/HTTPS instead.

Anomaly signal

An unexpected open 318/tcp or 318/udp is more likely a misconfigured or legacy service, or a UDP-scan false positive (non-response treated as open), than a deliberate production TSA.

Malware/CVE

No known malware association or CVE specific to port 318 was found in this research pass.

Recommendation

Treat an open 318 as worth investigating rather than dismissing as routine, given how little legitimate deployment uses this literal port.

IANA assignment

pkix-timestamp — "PKIX TimeStamp"; reference blank; assignee/contact [Robert_Zuccherato]; dual-registered 318/tcp + 318/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry-648; IANA registry

Range class

well-known (0–1023) [Confirmed]

Prevalence

Unknown — no nmap-services open-frequency figure or scanning telemetry specific to this port found this pass [Unknown]

Related ports

80/443 (HTTP/HTTPS — the transport TSP is actually deployed over in practice) [Likely]

Primary use

PKIX Time-Stamp Protocol (TSP) timestamp request/response for PKI-based data timestamping

Other/unofficial uses

none identified; real-world TSA deployments predominantly run TSP over HTTP(S) rather than this dedicated port

Security implications

no known CVE or malware association found for port 318; low/no observed exposure signal; an unexpected open 318 is more likely misconfiguration, a legacy service, or a UDP-scan false positive than malicious use

Typically seen on

rarely seen in the wild; if present, expect legacy or experimental TSP implementations rather than mainstream production TSA services [Likely]

Analyst note

treat an open 318/udp as anomalous — the dedicated port carries little genuine traffic since TSP is overwhelmingly deployed over HTTP(S) instead [Likely]