Veridis Attestation

What this check covers

This page runs one check, and runs it fully: it recomputes the file's fingerprint in your browser and compares it with the expected one. It answers "is the file still identical to what was attested?".

• CHECKS that the file is bit for bit the same one that was attested. A single changed character breaks the comparison.
• DOES NOT CHECK the hardware proof itself. The cryptographic checks of the attestation, from the chain up to the processor manufacturer through to the time stamp, are run by the verifier Veridis distributes, which runs on the checker's own machine and does not query this site.

The separation is deliberate. If this page listed the hardware-proof checks, it would imply it had run them, and it has not. A check that was not performed must never appear as performed.

How it works

1. You submit the document. It passes through our application server and is forwarded to a trusted execution environment (TEE), which computes the fingerprint (SHA-256) inside the enclave and discards the file once processing ends. The document is not written to any database nor retained after the attestation.
2. The hardware issues the proof. The chip itself signs a proof that this document passed through it, in an environment that not even the machine's administrator can open.
3. You receive the document with the seal plus a pre-certificate: the file already carries the whole hardware proof, missing only the issuer's signature. The Veridis private key is deliberately not kept on this site, so signing happens off it. The verifier only accepts the certificate once signed.
4. Verification is independent of the issuer. With the signed certificate and the verifier provided by Veridis, a third party checks on their own machine, without querying this site, that the document has not changed and that the proof was issued by genuine hardware. The proof stays verifiable even if this site goes offline.

The date: why it has to come from outside

The secure environment has no trustworthy clock of its own. The time it sees is served by the host machine, which is exactly the machine attestation exists so you need not trust. So the date cannot come from inside the enclave: it would be the host's word wearing the appearance of proof.

Proof of when comes from a Time Stamping Authority, under RFC 3161. You send it only the fingerprint, never the file, and it returns a document signed with its own key stating that this fingerprint was presented to it at that instant. Document confidentiality is untouched.

In the certificate signed by Veridis, the stamp is taken over the whole hardware proof, not just over the document fingerprint. Since the hardware proof already contains that fingerprint, dating the proof also dates the binding between document and hardware.

• PROVES the attestation already existed at the stamped instant.
• DOES NOT prove the document was created on that date, nor that it did not exist earlier: the stamp gives the upper bound, not the lower one.
• DOES NOT come with an attestation made directly on this site. The stamp goes into the certificate Veridis signs. Without it, the date shown is the one declared by the issuer, and a declared date is not a proven date.

What this seal proves (and what it does not)

• PROVES that the document has not been altered since the attestation.
• PROVES that this fingerprint was computed on genuine hardware, bound to this document.
• PROVES checkable by a third party, independently of the issuer, without querying this site.
• DOES NOT prove that we did not retain the document: non-retention is our policy, not a fact demonstrable by cryptography. We keep only the fingerprint, for the link's verification counter.
• DOES NOT replace verification by an accredited body (OVV): it says whether the data is correct; we say that no one tampered with it. The two layers add up.
• DOES NOT constitute public faith (notary) and does not assert that the content is true.

For developers and white-label integration

• POST /api/attest → attestation + PDF + pre-certificate (issuer signing happens off this site)
• GET /api/resolve?token=… → link seal state
• GET /api/tee-info → hardware status