Verify a signed evidence pack
An unsigned PDF is a claim; a signed evidence pack is checkable. PQLens signs compliance evidence with ML-DSA-65 — a NIST-standardised post-quantum signature (FIPS 204) — and anyone, paid tier or not, can verify a pack in the app for free.
How it works
- Get the evidence pack — either the JSON file from an Enterprise account’s “Sign current inventory” button, or an HTML export, which carries its signature embedded.
- Sign in (free) and drop the file into the Verify box — verification needs no paid tier and no signing key.
- The pack’s canonical JSON is re-hashed and compared to its
integritySha256, then the ML-DSA-65 signature is checked against the issuer’s public key (identified by itskid). - A clear pass/fail shows whether the pack is intact and authentic. Change one byte and watch it fail.
Why sign a post-quantum readiness report with post-quantum signatures
It would be strange to attest quantum readiness with a signature scheme the report itself classifies as quantum-vulnerable. ML-DSA-65 is the FIPS 204 lattice signature standardised by NIST in 2024 — the report is signed with the class of cryptography it recommends. Producing signed packs is the Enterprise tier; the signing key is generated once in the app’s Evidence panel and never leaves your browser.
The engine is open source
Canonical JSON, the integrity hash, and ML-DSA-65 signing and verification live in cybxsan-evidence, an Apache-2.0 Go module shared with other CybXSan tools. You do not have to trust our app to trust the format — read the code, or reimplement verification yourself.
What is actually inside a pack
The classified findings, scan metadata, and compliance mappings (PCI DSS 12.3.3, ISO 27001 A.8.24, CNSA 2.0 targets) — all inside the hashed, signed record, so none of it can be altered after signing.
Frequently asked questions
Do I need a paid tier to verify a pack?
No. Verification is free for everyone with an account — that is the point. Producing signed packs is the Enterprise tier.
What is ML-DSA-65?
The NIST-standardised lattice-based digital signature (FIPS 204, 2024), at security category 3. It is believed secure against both classical and quantum attackers — "believed" is the honest word; that is why nothing is called quantum-proof.
What happens if a pack was tampered with?
The canonical hash or the signature check fails and the Verify box tells you which one, immediately. Even a one-byte change is caught.
How do I know which issuer signed a pack?
Each pack carries a kid — a fingerprint derived from the issuer public key (SHA-256 of the key, truncated). Match it against the issuer key its owner published.