How VeriTrust Works

A step-by-step guide to the cryptography powering our zero-knowledge document provenance protocol.

1. The Issuer Hashes the Document

When an institution (e.g., a University) issues a document, VeriTrust normalizes the text and generates a unique cryptographic fingerprint (SHA-256 hash).

2. The Private Key Signs the Hash

The issuer uses their highly secure ECDSA secp256k1 Private Key to mathematically sign the document hash. This proves the institution authorized the data.

3. Metadata Injection

The signature and the issuer's Public Key are injected directly into the PDF's structural metadata. The visual document itself remains completely unchanged.

4. Zero-Knowledge Verification

A third party receives the PDF and drops it into VeriTrust. The app locally re-computes the hash and checks the embedded signature using the Public Key.

Advanced Features

Multi-Signature

Maker-Checker workflows allow multiple parties to sign the same document. Each signature forms a chain that is independently verified.

Registry Lookup

The protocol queries a central ledger to check if the signing Public Key belongs to a verified institution, preventing identity spoofing.