FrançaisEnglish
Sign up

Independent verification

Verify an Ipocamp proof, without Ipocamp

An Ipocamp proof can be verified with free public tools, by anyone, at any time, including on a day when Ipocamp no longer exists. All you need is the original file, intact, and its PDF certificate.

Step 1

Recompute the fingerprint of the file

Use the tool built into your computer, with nothing to install. Open a terminal in the folder containing the file and run the command for your system.

SystemCommand
Windows (PowerShell)Get-FileHash "fichier.pdf" -Algorithm SHA256
Windows (Command Prompt)certutil -hashfile "fichier.pdf" SHA256
macOSshasum -a 256 fichier.pdf
Linuxsha256sum fichier.pdf

The result is a 64-character string. It must be identical to the “Empreinte SHA-256” (SHA-256 fingerprint) line on the certificate. Windows displays it in capital letters, which makes no difference.

Step 2

Find the record on Tezos

  1. On the certificate, copy the reference on the “Blockchain” line. It starts with “oo”.
  2. Paste it into any Tezos explorer, for example TzKT (tzkt.io) or Better Call Dev (better-call.dev).
  3. Check three things: the status is applied, the operation is sent by Ipocamp’s address to Ipocamp’s contract (both listed below), and the block date matches the timestamp date on the certificate.

Step 3

Read the recorded fingerprint and compare

  1. In the operation, the parameter of the storeValue call is a signed token: three blocks of text separated by dots.
  2. Decode the middle block with a tool such as jwt.io or CyberChef. It contains a hash field: the fingerprint of the file, written in base64url format.
  3. Convert it to hexadecimal. In CyberChef: “From Base64” with the “URL safe” alphabet, then “To Hex”. On macOS or Linux, the command below does the same (add an = sign at the end of the value).
  4. The result must be identical to the fingerprint computed in step 1.
echo 'VALEUR=' | tr '_-' '/+' | base64 -d | od -An -tx1 | tr -d ' \n'

Older deposits: for the earliest deposits, the recorded value is directly the fingerprint in hexadecimal (64 characters). Compare it as is with the result of step 1.

Optional step

Check the token signature

  1. The token is signed by Ipocamp with the ES256 algorithm. The public signing keys are published in the standard JWKS format at ipocamp.io/.well-known/jwks.json.
  2. Read the kid field in the token header (the first block), take the key with the same kid, and check the signature with any JWT tool or library, for example jwt.io.

These keys are computed from the public signatures recorded on Tezos, and each one is confirmed by at least two signatures. The list is updated regularly. If the key of a very recent deposit is not listed yet, steps 1 to 3 are enough to verify the proof.

What this verification proves

If the three steps match, the file existed in this exact state on the date of the Tezos block. The date is set by the network that maintains the registry, independently of Ipocamp. Each deposit has its own record, so it can be verified on its own.

The token also contains an id field: a fingerprint of the author details chosen at deposit. The author is linked to the proof without appearing in plain text in the public registry.