IsoKron · Evidence Pack

Evidence verification

Each anchor commits a Merkle root over a range of the audit's tamper-evident event log. Two kinds of evidence are checked here, in your browser:

IsoKron anchor receipt — signed by IsoKron's anchor service key (keys), over the auditor-signed checkpoint, with the service's own clock.
Independent timestamps — RFC 3161 tokens from Sectigo and DigiCert, third-party timestamp authorities, over the SHA-256 of each receipt; signatures and certificate chains are checked against the pinned time-stamping CAs below. These do not depend on IsoKron.

JavaScript is required for in-browser verification. The same checks can be run offline with the commands under Verify offline, using:

GET /v1/chains/ — anchored ranges, roots and signed receipts
GET /v1/chains//timestamps — RFC 3161 tokens for each receipt
GET /.well-known/anchor-keys.json and /.well-known/tsa-ca.json — service keys and pinned TSA CAs

Summary

LOADING Loading anchors…

Anchors

Loading…

Verify offline

Every result on this page can be reproduced without this page, with Node ≥ 20 or OpenSSL 3. Replace PACK with the Evidence Pack directory, <anchor_id> and <tsa> (sectigo or digicert); each anchor below lists its exact commands.

1. Evidence Pack — files, hash chain, signatures, anchor receipts and independent timestamps, in one command; the auditor key fingerprint is in your report:

npx -y kronicle-lite@0.10.1 verify-audit PACK --key-fingerprint <from your statement of work>

2. Evidence Pack with OpenSSL 3 only — run in the pack directory; its VERIFY.md lists every command with the pack's own file names. <tsa>.pem is the CA file built from the TSA's own repository (commands in the table below):

openssl pkey -pubin -in auditor-key.pem -outform DER | shasum -a 256   # compare with the fingerprint in your report
openssl pkeyutl -verify -pubin -inkey auditor-key.pem -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig
shasum -a 256 -c SHA256SUMS
D=$(shasum -a 256 anchors/01-harness-frozen.receipt.json | cut -c1-64)
openssl ts -verify -digest $D -in anchors/01-harness-frozen.<tsa>.tsr -CAfile <tsa>.pem -partial_chain

3. Receipt and independent timestamps from this service — the token is over sha256 of the receipt as served (canonical JSON):

B=https://anchor.isokron.ai
curl -s $B/v1/receipts/<anchor_id> | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>process.stdout.write(JSON.parse(s).receipt_jcs))' > receipt.json
D=$(shasum -a 256 receipt.json | cut -c1-64)
curl -s -o <tsa>.tsr $B/v1/receipts/<anchor_id>/timestamps/<tsa>.tsr
# <tsa>.pem: the CA certificate from the TSA's own repository (commands in the table below)
openssl ts -verify -partial_chain -digest $D -in <tsa>.tsr -CAfile <tsa>.pem
openssl ts -reply -in <tsa>.tsr -text | grep 'Time stamp'

Pinned time-stamping CAs — each token must chain to one of these TSA-dedicated CAs. Build the CA file from the certificate the TSA publishes in its own repository and compare the fingerprints it prints:

TSA	Time-stamping CA	SHA-256 fingerprint

-partial_chain makes the pinned CA file the trust anchor (OpenSSL 1.1 or later; on macOS use Homebrew openssl@3). Pass only that file: with a full system CA bundle, OpenSSL can follow the cross-signed root copies DigiCert embeds and report unable to get local issuer certificate. OpenSSL checks certificate validity at the current time; after a TSA certificate expires, add -attime with the token's time.

Summary

Anchors

Verify offline

Verify a receipt or checkpoint