Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.deepidv.com/llms.txt

Use this file to discover all available pages before exploring further.

When you land on proof.deepidv.com/a/{id}, you’re looking at the full proof of one specific verification.

​
Reading the six-step pipeline

Each step has a status badge:
  • Verified — the check passed. The cryptographic signature, the timestamp, the inclusion proof, the anchor all check out.
  • Skipped — applies only to TSA token verification in the SDK verifyBundle() path, because the SDKs do not ship X.509 chain validation in v1. The explorer always verifies all six steps; only the offline-SDK path skips TSA.
  • Failed — should never happen for a legitimate attestation. If you see it, something has been tampered with.

​
What each step means

1

Envelope hash

SHA-256 of the canonicalized (JCS, RFC 8785) envelope JSON. Anchors the rest of the chain — every signature below is over this hash.
2

Issuer signature

ECDSA P-256 signature by the issuer’s KMS-held private key over the envelope hash. Verified against the issuer’s public key, which is in the bundle and on the issuer profile page.
3

Dual RFC 3161 timestamps

Independent timestamp tokens from DigiCert and Sectigo, each binding the envelope hash to a specific moment in time. Either alone is sufficient evidence; both together are belt-and-suspenders.
4

Merkle inclusion

The audit path from this envelope’s leaf to the segment’s STH root. Verifies the envelope is actually in the log — not just claimed to be.
5

Master STH signature

ECDSA P-256 signature by the chain-master key over the STH (root + tree size + timestamp). Verified against master.pem published on the log page.
6

On-chain anchor

The Base L2 transaction hash committing the STH root. Click through to Basescan to confirm the root appears on-chain at the claimed block height.

​
Label commitments

Each envelope carries a list of labels — structured metadata like country, tier, document type, KYC level. In the bundle and on the detail page, you see:
namevaluestatus
countryCARevealed
tier[committed but not revealed]Committed
A label is Revealed when the issuer has chosen to publish the salt alongside the value commitment. The value is then verifiable: take the value, append the salt, hash it, and compare to the commitment in the envelope. If they match, the label is real. A label is Committed when only the commitment is published. The issuer holds the salt off-chain. They can prove the label’s value to a specific counterparty without revealing it publicly.
Salts are never rendered in the explorer or included in proof bundles.