Skip to main content
RelixQBEYOND QUANTUM
Menu
Request demo

Verify

Check a RelixQ evidence package yourself.

Drop the evidence package that came with a QAST report. The page re-hashes it and checks its signatures in your browser, so the check does not depend on trusting RelixQ's servers or this page's copy of the data.

Trust Center

Verification

Hash, then keys, then signatures.

This page states exactly what it verified. ES256 is verified here. ML-DSA-65 is reported as not checked in browser; the relixq command line checks both.

  1. Step 1

    Hash

    SHA-256 of the exact bytes of content.json is compared with the hash the package declares.

  2. Step 2

    Keys

    Signing keys come from the key set you supply, never from the package. Each key id is recomputed from its public key.

  3. Step 3

    Signatures

    Every detached signature is checked by its own algorithm tag and key id. A signature that could not be checked says so.

Verification tool

1. Choose the evidence package

The zip you downloaded beside the report (relixq-evidence-bundle-*.zip).

Adds one more check: that this file is the exact report the bundle was signed for.

2. Supply the published signing keys

Keys are never read from the package: a key shipped beside the data it vouches for would prove nothing. Use the key set your RelixQ deployment publishes at /api/v1/evidence-bundles/signing-keys.

This page checks ES256 in your browser. ML-DSA-65 signatures are listed as "not checked in browser"; verify them with the relixq CLI.

Runs entirely in your browser. The only network request is the optional key fetch above.

Offline

Prefer the command line?

The same package verifies offline with the relixq CLI, including the ML-DSA-65 signature.

relixq attest verify relixq-evidence-bundle-<id>.zip --keys signing-keys.json
relixq attest verify bundle.zip --keys <url> --report relixq-report.pdf   # also checks the report file
# exit 0 = valid, 1 = invalid, 2 = unverifiable

A package records which report existed, with which hash and claim split. It is not a certification, and it does not claim any traffic was decrypted: no field in a bundle is produced by a language model.