Verify a receipt

Paste a receipt file and its public key. This page recomputes every hash, checks every signature and walks the chain, in your browser. It is one HTML file with no scripts, fonts or images loaded from anywhere: save it and it keeps working with the network off, on a machine that has never heard of us. That is the point — evidence you can only check with the issuer's permission is not evidence.

What this checks
  1. Every line is parsed as one JSON receipt.
  2. prevReceiptHash equals the SHA3-512 of the canonical JSON of the previous receipt, including its signature. The first must be genesis.
  3. kid matches the supplied public key, where kid is the first 16 hex characters of the SHA3-512 of that key. An unrecognised kid is reported separately from a bad signature: one means you are missing a key, the other means the file was altered.
  4. The Ed25519 signature verifies over the SHA3-512 of the canonical JSON of the receipt with sig removed.

Canonical JSON is RFC 8785 style: keys sorted by UTF-16 code unit, no insignificant whitespace, standard escaping. This is the same procedure as the eg-verify command and verifyReceiptFile(); the three agree by construction, and a test asserts it.

SHA3-512 is not in SubtleCrypto, which offers SHA-1 and SHA-2 only, so an audited implementation is inlined below. Ed25519 uses SubtleCrypto where the browser has it and an inlined implementation where it does not. Signature checks in this session used: not run yet.