Skip to main content
AlgoVoi Reseal quantum-seals evidence you already hold. Every post-quantum product on the market protects tomorrow’s data; Reseal rescues yesterday’s. A document signed with RSA or ECDSA stays provable only while those algorithms stay unforgeable. Records on decade-long retention clocks (contracts, clinical records, deeds, qualified e-signatures) outlive that window: once a quantum adversary can forge the classical signature, the original can no longer be told apart from a tamper. The rescue is only possible now, while the classical signature still verifies. Reseal verifies it today and binds that verification into a Falcon-1024 + ML-DSA (65 or 87), RFC-3161 timestamped, offline-verifiable attestation.

​
Two parts: an open verifier and a licensed sealer

Verification is open on purpose: you should not have to trust the sealer. Anyone can verify what a seal proves, from the bytes alone, with no AlgoVoi service in the trust path.

​
Verify or inspect (free, open)

Exit codes: 0 verified and anchored, 1 failed, 2 malformed, 3 cryptographically intact but the signing key is self-asserted (pin the sealer’s published kid with --expect-kid to anchor authenticity).

​
Seal (licensed)

After purchase on the Suite Store you receive an index token and a licence key. Install the sealer from the token-gated AlgoVoi index (its public dependencies come from PyPI):
The index token is a secret. Prefer configuring it out of the command line so it does not land in shell history or CI logs, for example with pip config or a PIP_EXTRA_INDEX_URL / netrc entry, rather than pasting it inline.
Then set your licence and seal:
Sealing requires a valid licence; inspection and verification never do.

​
Two signing profiles

Both are first-class; the verifier accepts either and neither can be downgraded (the algorithm set is bound inside the signed payload).

​
What it understands

  • PDF embedded signatures (PAdES / PKCS#7): every /ByteRange CMS signature, with a shadow-attack partial-coverage check and a SHA-1 weak-digest flag.
  • Detached CMS (.p7s) over any file.
  • Optional offline trust-path and CRL revocation validation (--trust-roots, --crl) — air-gap capable, no OCSP fetch.
  • Optional RFC-3161 time anchoring (--tsa-roots); unanchored timestamps are labelled, never presented as authoritative.

​
Trust model, stated honestly

An attestation carries its signing public key, so verification proves it is internally consistent and unaltered, not who sealed it. Anchor authenticity by pinning the sealer’s published kid (--expect-kid, a full 256-bit digest). The dual signature is bound inside the signed payload, so ML-DSA cannot be stripped to fall back to Falcon-only. Signatures cross-verify against liboqs (Open Quantum Safe) in both directions. Reseal produces cryptographic evidence artifacts. It is not a guarantee of legal admissibility or regulatory compliance; treat each attestation as a per-record, independently verifiable proof.

​
Standards

RFC 8785 (JCS), RFC 3161 (timestamping), RFC 5652 (CMS), RFC 5280 (X.509), FIPS 204 (ML-DSA), FIPS 206 draft (FN-DSA / Falcon).