verify_web_page_attestation

com.tizonaintelligence/tizona · Verify this server

Recomputes the hashes in a capture record and says whether they still match. What it does: - Tells you if any field has changed since the record was issued - Checks the HTML and the image against their hashes, if you supply them - Reads the timestamp token and says whether it covers this record, so a genuine token lifted onto a different capture does not go unnoticed - Reports the gap between the stated capture time and the signed time. A few seconds means the record cannot have been backdated. Hours means much less - Works for anyone. You do not have to trust whoever gave you the record What it does not do: - Say the content is true. Only that the record has not been altered - Prove the record came from this service. It proves it hashes to what it claims - Check the signature on the timestamp token. That needs the authority's certificate chain, so run openssl ts -verify for it. timestamp.coversThisRecord means the token says it signed this record, and only the signature makes that true