Evidence layer & verification
The proof NoSign embeds in every sealed PDF — and how anyone can verify it offline.
NoSign’s prime directive is provability. The evidence layer is its strongest expression: every sealed PDF carries its own proof, and anyone can verify it — without trusting the platform that produced it.
What gets embedded
Bilingual audit-certificate page
Before the seal is applied, NoSign appends a human-readable audit-certificate page to the document, rendered in both German and English. It records:
- Signer identity (email-verified).
- The verbatim consent text each signer accepted.
- An HMAC-hashed IP per signer.
- The document hash.
- A QR code.
Because the page is appended before sealing, it falls inside the sealed bytes — it cannot be swapped without breaking the seal.
Embedded structured audit record
NoSign also embeds a machine-readable nosign-audit.json inside the signed ByteRange. It is schema-versioned, so consumers can parse it reliably across NoSign versions. The structured record travels inside the bytes, not bolted on beside them.
The public /verify portal
NoSign ships a public /verify portal — a stateless fourth trust boundary with no auth, no session, and no database. You upload a sealed PDF; it returns one of five verdicts:
| Verdict | Meaning |
|---|---|
VALID | Seal intact, ByteRange matches, timestamp validates |
TAMPERED | Bytes changed after signing (incl. trailing-byte shadow attacks) |
INVALID | A seal is present but the signature or timestamp fails to validate |
NO_SEAL | The PDF carries no NoSign seal — nothing to verify |
INPUT_ERROR | Not a readable PDF, or the upload could not be parsed |
Under the hood the verifier performs a ByteRange-integrity check, validates the embedded RFC3161 timestamp, and runs shadow-attack detection (trailing bytes appended after the signed range). It is built on openssl cms / openssl ts and holds no state.
Why it matters
This is real PAdES-B-T proof made checkable by anyone — not only by platforms that already pre-trust the seal certificate. It is a concrete step toward the long-term-validation story; full PAdES-LTV and an AATL-trusted certificate remain a later drop-in (see legal class).