How to receive large files guaranteeing authenticity, integrity and sending time

If it's actually important that you can provide legal evidence, then you should discuss this with a (specialized) lawyer. While we can come up with all kinds of technical approaches, that doesn't mean any of them will hold up in court. We're not legal experts.

From a purely technical standpoint, you could ask the other person to upload the documents to a public file sharing service like Dropbox (encrypted if necessary) and then send you an e-mail with the link and a cryptographic hash (e.g., using a SHA-2 or SHA-3 algorithm) of the file content. Ideally, the sender should obtain an S/MIME certificate from a trusted Certificate Authority (CA) and sign their mail. This demonstrates the other person sent you the link to a particular file (identified through the hash). The hash ensures that the file content cannot secretly be changed afterwards.

You can also use the Time-Stamp Protocol (TSP) to obtain a cryptographically verifiable timestamp for a particular piece of data. The idea is that you send a cryptographic hash of the data to a Time Stamping Authority (TSA). In response, you get a TSA-signed timestamp token which contains the data hash and the timestamp determined by the TSA. Many commercial certificate authorities also act as TSAs and run TSP servers. You don't have to install any special software. Of course you'll have to decide which information you want timestamped, e.g., a hash of the file content and a public link.

But again, this is just the technical perspective. If you need to convince a judge, then other approaches might be more suitable (e.g., a written contract where both parties agree on exchanging certain documents at certain points in time).

The more complicated you make it technically, even if perfectly correct and tamper-proof, the more you have the problem that a judge will need to listen to one sides "technical expert" and then the other sides "technical expert" and will have to believe one of them because it goes way over their head. Whether that is your expert in the end has very little to do with whether your process was correct.

You should consult a lawyer for the juristiction you think you would need to present your case in.

My guess would be that the proven way is to meet with a notary, bring the documents, have the notary make a physical copy they keep safe and then part ways. This way the notary can attest that those were the documents exchanged, who was present and when it happened.

(I'm not adressing here the issues of the "specific person", it is I believed addressed well enough by other answers, whether electronically or in the real world)

You are here dealing with notarization. You need a "legally trusted" 3rd party, that is a 3rd party whose statement will be accepted by a court in the jurisdiction(s) you are interested in.

When you say "at a specific moment", it's a bit of tricky question. Like Ja1024 said, using a 3rd party service like Dropbox might do the job for you, you would need to talk to a lawyer.

Now I'm wondering if your question is properly asked.

You could want to prove that you got a file "before a specific moment". That's the easy one. A lot of notarization services could do the job (typically with hashes). Or you can go for the the "all out" solution: in some jurisdictions, you could leave a copy of the files to a legal officer who will keep your files in a safe and give you a certified document they were deposited at such date. In others, leaving the document with your lawyer might be enouh. Using the hash solutions, I know jurisdictions where you could write the hash of the file (and size) on a paper, and just get a doctor to sign that you presented them the paper at a specific date.

If you want to proof that you got the file at a specific time, meaning "not before, not after", that's the above, plus proving you DIDN'T get the files BEFORE a specific moment, or in another words you got them "after a given moment", and this is virtually impossible. That would mean having someone certify that at no point did you get those files before, which basically implies monitoring your every interaction prior to that moment...

This problem is actually in 3 parts:

• audit trail with privacy, integrity and authorisation and for each step.
• Full transmission and receiving of files over a (inter-)network
• Independent verifiable evidence of the result.

The first part is simple, use TLS 1.3 on each connection, together with a encryption at rest system to store the data in (such as AWS S3 or minio could provide)

The second part requires that you make (multiple) hashes of the data, even before the first transmission and verify at each step the hashes still check out (you need the hashes in your audit trail too)

The last part is the hardest, and best done through the use of Time-Stamp protocol and a Time-Stamp authority to stamp both the data itself and 1 of the audit hashes. This will ensure you can than later still provide evidence of what data was received in a tamper resistant way.

Be advised, this is one of the hardest solutions in IT, so:

• don’t roll your own solution unless you must (as in use as many audited libraries as you can)
• Have your code audited by at least 2 independent parties.
• re audit this code regularly.