Receipt Format

A Veristamp receipt is a JSON object containing all the information needed to verify a file's timestamp.

Fields

receipt_idstring

required

Unique identifier for this receipt, prefixed with vst_r_.

issuerstring

required

Always "Veristamp".

issued_atstring

required

ISO 8601 UTC timestamp of when the request reached the signer.

key_idstring

required

ID of the active signing key used to sign this receipt (resolvable in the keyring).

algorithmstring

required

Hash algorithm used (always "SHA-256").

hashstring

required

Hex-encoded SHA-256 digest of the file. Computed locally on the user's device.

noncestring

required

Base64url-encoded random 16-byte nonce to prevent brute-forcing the leaf hash.

signaturestring

required

Base64url-encoded Ed25519 signature of the canonical receipt payload.

Example

{
  "receipt_id": "vst_r_7f3a2b1c",
  "issuer": "Veristamp",
  "issued_at": "2026-06-05T14:32:00Z",
  "key_id": "vst_sign_2026_q2_01",
  "algorithm": "SHA-256",
  "hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "nonce": "xK9mP2vL8nQ4wR7j",
  "signature": "aBcDeFgHiJkLmNoPqRsTuVwXyZ..."
}

Signature payload

The Ed25519 signature covers the deterministic UTF-8 bytes of a canonical JSON object containing the receipt payload. The object is structured as follows:

{
  "veristamp_version": "1.0",
  "type": "veristamp.receipt.payload",
  "receipt_id": "vst_r_7f3a2b1c",
  "issued_at": "2026-06-05T14:32:00Z",
  "hash": {
    "algorithm": "SHA-256",
    "value": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
  },
  "nonce": "xK9mP2vL8nQ4wR7j",
  "issuer": {
    "name": "Veristamp",
    "key_id": "vst_sign_2026_q2_01"
  }
}

To sign or verify, this object is serialized using the JSON Canonicalization Scheme (JCS) with strict field ordering (see the Canonicalization Specification in the shared package).

Leaf hash (for transparency log)

The transparency log stores and indexes a privacy-safe leaf hash instead of the raw fields. The leaf hash is computed by hashing a pipe-concatenated canonical string prefixed with a 0x00 domain separator byte:

leaf_hash = SHA-256(0x00 || receipt_id | hash | issued_at | key_id | nonce)

Where:

• 0x00 is a single raw byte domain separator.
• The rest of the payload is the UTF-8 string concatenation: receipt_id + "|" + hash + "|" + issued_at + "|" + key_id + "|" + nonce.

The leaf hash is published in public epoch bundles on R2. Because the raw hash and nonce are never published, observers cannot inspect or brute-force your file hashes.

Verification steps

1. Recompute SHA-256(file_contents) and confirm it matches hash.
2. Look up the public key for key_id in the keyring.
3. Verify signature against the leaf hash using Ed25519.
4. (Optional) Confirm the leaf hash appears in the public transparency log.