evalseal VERIFIER

Ed25519 · runs in this tab · nothing is uploaded

Run the check
in this tab

Paste a record and its signature below, or load seal no. 1 and watch it check itself. The record never leaves your browser: the SSHSIG envelope is parsed here, SHA-512 and Ed25519 run through WebCrypto here, and the verdict is computed here. This is a convenience, not the authority — the page is served by the party it is checking, and the reason that is survivable is set out below.

The check

Nothing checked yet.

Editing one character of the record and checking again is the fastest way to see what a seal actually does. The signature fails, and it fails the same way for us as it does for you.

Who is running this check

A verifier served by the party being verified is a conflict of interest, and pretending otherwise would undo the point of the whole site. So, plainly:

The conflictThis page is JavaScript we wrote, delivered from a domain we control. It could be written to report success on anything. Nothing about a green tick on this page is evidence by itself.
Why it survivesBecause it is not the authority and does not need to be. The authoritative check is ssh-keygen -Y verify on your own machine, against a key you fetched yourself — the commands are on the seal. This page exists so that people who will never run that command can still watch a signature break.
The public keyThe third box is pre-filled from our copy, which is the weakest link here. Replace it with a copy obtained from anywhere else — another host, a colleague, an archive — and the check becomes worth something.
Read the sourceIt is one file, no dependencies, no minification, no network calls beyond fetching the seal you asked for: verify.js. Auditing it is a ten-minute job, which is roughly the point.

What it does, step by step

The same four operations ssh-keygen performs, in the same order. All of it is defined in the format.

1 · unwrap    strip the PEM armour, base64-decode, read the SSHSIG fields
              → version · public key · namespace · hash algorithm · signature

2 · reject    namespace must be "evalseal", and the key must equal the one
              in allowed_signers — otherwise stop, before any crypto runs

3 · digest    SHA-512 over the record bytes, then rebuild the blob that was
              actually signed:  "SSHSIG" ‖ namespace ‖ reserved ‖ hashalg ‖ digest

4 · verify    Ed25519 over that blob, via crypto.subtle.verify

Step 2 is why a key you also use for git cannot be tricked into vouching for a seal: the namespace is inside the signed blob, so a signature made anywhere else fails step 4 even when the key is right.

A check you can only run by asking us is not a check. This one you can run without us — and the version that matters, you run without this page too.

Read the format See a seal in full