How do I batch-verify a signed archive?

To batch-verify an archive of signed documents for compliance, scan the entire folder of PDFs and detached .p7s files, check every classical and post-quantum signature, flag weak algorithms (like SHA-1), expired certificates, and broken chains, and generate a signed audit report. Use AlgoVoi Evidence Auditor (AV-EVID) to automate this process, ensuring your archive meets compliance requirements with a verifiable, tamper-evident report.

Why batch verification matters

Compliance teams must ensure that every signed document in an archive is valid, tamper-evident, and resistant to quantum computing threats. Manual verification is error-prone and time-consuming, especially for large archives. Batch verification automates this process, checking: - Classical signatures (RSA, ECDSA) for validity and chain integrity. - Post-quantum signatures (Falcon-1024, ML-DSA) for long-term security. - Weak algorithms (e.g., SHA-1) that could compromise document integrity. - Expired or revoked certificates that invalidate signatures. - Broken trust chains that fail to link to a trusted root certificate.

A signed audit report provides auditors with a verifiable record of compliance, reducing manual effort and ensuring transparency.

How batch verification works

1. Scan the archive Point your tool at a folder containing PDFs, detached .p7s files, or AlgoVoi Reseal attestations. The tool recursively scans all files, extracting signatures and certificates.

2. Verify signatures Each document is checked for: - Classical signatures: RSA or ECDSA signatures are validated against their certificate chains. - Post-quantum signatures: Falcon-1024 and ML-DSA signatures are verified for quantum resistance. - Weak digests: SHA-1 signatures are flagged as non-compliant. - Certificate validity: Expired or revoked certificates are identified. - Trust chain integrity: Broken or incomplete chains are reported.

3. Flag compliance risks Documents are categorized based on their verification status: - Valid: Fully compliant with no issues. - Invalid: Failed signature or certificate validation. - Unsigned: No signature detected. - Weak digest: Uses SHA-1 or other deprecated algorithms. - Expired: Certificate is no longer valid. - Broken chain: Missing or untrusted intermediate certificates. - Quantum-exposed: Lacks post-quantum protection.

4. Generate a signed audit report The tool produces a tamper-evident report in HTML, JSON, and CSV formats. This report includes: - A summary of verification results. - Per-document flags for compliance risks. - A baseline comparison against prior reports (if available). - A digital signature to ensure the report's integrity.

Auditors can verify the report using the free algovoi-reseal-verify tool, ensuring transparency and trust.

Do it with AlgoVoi Evidence Auditor

AlgoVoi Evidence Auditor (AV-EVID) is a CLI tool and open package designed for batch-verifying archives of signed documents. It automates the entire process, from scanning to reporting, and is built for compliance teams who need to verify large volumes of documents efficiently.

Key features

• Batch verification: Scan folders of PDFs, .p7s files, and Reseal attestations.
• Comprehensive checks: Validate classical and post-quantum signatures, weak algorithms, expired certificates, and broken chains.
• Signed audit reports: Generate tamper-evident reports in HTML, JSON, and CSV formats.
• Offline and air-gap capable: No internet required after installation.
• Read-only: Never modifies or stores your documents.

Pricing

• Perpetual licence: 599 USD (paid in USDC).
• Annual subscription: 299 USD (paid in USDC).

Get started

Install the package:

pip install algovoi-evidence-audit

Or purchase a licence on the AlgoVoi Suite Store.

Next steps

Ready to batch-verify your archive? Buy AlgoVoi Evidence Auditor on the Suite Store.