Manav.id
Topic· 8 essays

Receipt cryptography and standards

What makes a record still verifiable in a decade: canonicalisation, key publication, revocation and a verifier small enough to audit. These essays cover the primitives and their trade-offs.

Start here Receipts: evidence that survives is the reference piece behind this topic.

All 8 essays

Compliance

A session token is not an audit record

JWTs carry claims for minutes, which is what they were built for. As decade-long evidence they fail on canonicalisation and key availability.
Compliance

Transaction confirmation in the browser: the extension that never shipped

WebAuthn signs a challenge. It has never signed the text a user was shown. An extension to do that has been discussed for a decade and is not deployed.
Compliance

Rotating signing keys without breaking verification

Key rotation causes outages when verifiers reject signatures made with a key they have not yet seen.
Comparison

Revocation without a network call at verification time

Online status checking leaks what you are verifying, adds latency, and fails open when the responder is down.
Compliance

Planning the post-quantum migration for long-lived signatures

Signatures differ from encryption in their quantum exposure: there is no harvest-now-decrypt-later risk, but records that must verify decades out need a plan.
Compliance

Zero-knowledge proofs and the audit that needs to see the data

A zero-knowledge proof establishes that a constraint held without revealing the inputs. An auditor, a regulator and a court all want the inputs.
Compliance

Four tiers of presence, matched to what an action can cost

Treating every approval the same produces either unbearable friction or a session click guarding a wire transfer.
Compliance

A verifier small enough that someone can read all of it

Verification is the point where trust is established. A verifier pulling hundreds of transitive dependencies has a trust base nobody has examined.

← All topics · All essays