04f735eda6
Measured 2026-08-16: a 42-byte contract that merely STORES the constant 0x0AE1 and never calls anything still scores GREEN, with the reference marked medium confidence. So the headline colour does not separate a resolved call from a bare constant, and a client who tests that in five minutes would find it before we admitted it. The scan text now says, per address, whether a CALL to each verifier resolved from the bytecode or whether only the address is present, and says plainly that a present address can also be plain data. The colour stays what the scanner computes; the sentence next to it carries what it means.
69 lines
3.6 KiB
Markdown
69 lines
3.6 KiB
Markdown
# The notarization half: issue a certificate, and check one without asking us
|
|
|
|
A notarization is worth exactly as much as an outsider's ability to check it without asking the
|
|
notary. So the verifier is here, it installs nothing, and it takes `--rpc` so you can point it at a
|
|
node you operate.
|
|
|
|
## Check a certificate
|
|
|
|
node verifica-certificat.mjs certificate.json --fisier your-document.pdf --rpc https://your-node
|
|
|
|
Five links, each reported separately as PASS, FAIL or NOT MEASURED:
|
|
|
|
1. the file you hold hashes to the digest the certificate names;
|
|
2. the transaction named exists, succeeded, and called the named registry;
|
|
3. the transaction sits in the block named, and the chain serves the same block hash;
|
|
4. the attestation was recorded **only because** a NIST post-quantum signature verified on chain,
|
|
inside that transaction, by a live precompile. Re-checked on every run through the registry's own
|
|
free read method;
|
|
5. the block is covered by the chain's post-quantum validator certificate.
|
|
|
|
## The three verdicts, and why the third is not an accusation
|
|
|
|
0 every measured link holds
|
|
1 something does not hold, and the FAIL line names which link
|
|
2 nothing could be measured, which is neither a pass nor a rejection
|
|
|
|
**The difference between 1 and 2 is the honesty of the tool.** "The node did not answer" and "the
|
|
node answered and holds no such transaction" are different facts, and only the second says anything
|
|
about the certificate. Until 2026-08-17 this tool confused them: with an unreachable endpoint it
|
|
told the holder that **their certificate does not hold up**, turning a network problem on our side
|
|
into an accusation of forgery against the client. That is the worst way a notarization product can
|
|
be wrong, and it is fixed.
|
|
|
|
## Prove the verifier can reject, before you trust it to accept
|
|
|
|
`controale/` holds five certificates, each with exactly one lie planted in it: a falsified document
|
|
digest, a falsified block hash, a transaction that does not exist, a foreign registry, and a wrong
|
|
per-key counter. Run them:
|
|
|
|
for f in controale/*.json; do node verifica-certificat.mjs "$f"; done
|
|
|
|
Measured 2026-08-17: all five exit 1. The genuine certificate in `certificat-exemplu.json`, built
|
|
from a real attestation on chain 2800 at block 9,200,542, exits 0. An unreachable node exits 2 with
|
|
every line NOT MEASURED.
|
|
|
|
## Issuing: it never signs anything, on purpose
|
|
|
|
node emite-certificat.mjs pregateste document.pdf # unsigned request + the challenge
|
|
... the key holder signs the challenge and submits the transaction ...
|
|
node emite-certificat.mjs finalizeaza cerere.json --tx 0x...
|
|
|
|
The tool produces an **unsigned** transaction and the challenge the post-quantum signature must
|
|
cover. Signing is a separate act by whoever holds the key, in a wallet they control. A notarization
|
|
service that quietly holds a hot key and signs on your behalf has made itself the thing you were
|
|
supposed to be able to check.
|
|
|
|
The challenge is **asked of the chain**, never rebuilt locally: the contract exposes it, and a local
|
|
reimplementation of that preimage differing by one byte would produce a signature the chain rejects,
|
|
which looks exactly like a forgery instead of like our bug.
|
|
|
|
And the finalise step runs the verifier above before writing the certificate, so a certificate is
|
|
never handed over unverified.
|
|
|
|
## What this does not claim
|
|
|
|
It does not say the document is true, lawful, or anyone's. It proves that **that** digest existed on
|
|
chain at **that** time, under a post-quantum signature, in a block covered by the validator
|
|
certificate. What that means legally depends on jurisdiction and is not asserted here.
|