Quantum-seal the documents you already signed
AlgoVoi Reseal re-anchors documents already signed with RSA or ECDSA into post-quantum, RFC-3161 timestamped, offline-verifiable attestations. Every post-quantum product on the market protects tomorrow's data. Reseal rescues yesterday's, while the classical signature still verifies and the rescue is still possible.
The problem it solves
A document signed with RSA or ECDSA stays provable only while those algorithms stay unforgeable. Records on decade-long retention clocks (contracts, clinical records, deeds, qualified e-signatures) outlive that window. Once a quantum adversary can forge the classical signature, the original can no longer be told apart from a tamper, and the evidentiary value is gone. The rescue is only possible now, while the classical signature still verifies. Reseal verifies it today and binds that verification into a Falcon-1024 plus ML-DSA (65 or 87), RFC-3161 timestamped, offline-verifiable attestation.
Two parts: an open verifier and a licensed sealer
| Package | Licence | What it does | |
|---|---|---|---|
| Verify | algovoi-reseal-verify | Apache-2.0, public (PyPI) | Inspect classical signatures and verify reseal attestations, offline |
| Seal | algovoi-reseal | Commercial, from $99 | Mint the post-quantum attestations |
Verification is open on purpose: you should not have to trust the sealer. Anyone can verify what a seal proves, from the bytes alone, with no AlgoVoi service in the trust path.
What it understands
PDF embedded signatures
Every PAdES / PKCS#7 /ByteRange CMS signature, with a shadow-attack partial-coverage check and a SHA-1 weak-digest flag.
Detached CMS
Detached .p7s signatures over any file, with the full certificate chain captured as bytes.
Offline trust and revocation
Optional trust-path and CRL revocation validation (--trust-roots, --crl), air-gap capable, no OCSP fetch.
RFC-3161 time anchoring
Optional timestamp anchoring (--tsa-roots); unanchored timestamps are labelled, never presented as authoritative.
Two signing profiles
Both are first-class; the verifier accepts either and neither can be downgraded, because the algorithm set is bound inside the signed payload.
| Profile | Signatures | NIST level | Trade-off |
|---|---|---|---|
| Compact (default) | Falcon-1024 + ML-DSA-65 | L5 + L3 | smaller seals |
| Matched | Falcon-1024 + ML-DSA-87 | L5 + L5 | both at NIST L5 (about +1.3 KB per signature) |
How verification works
An attestation carries its signing public key, so verification proves it is internally consistent and unaltered, recomputed from its own canonical bytes under RFC 8785 (JCS) and SHA-256. There is no issuer call, no registry lookup, and no network dependency, so an auditor checks the evidence on an air-gapped machine. Anchor authenticity by pinning the sealer's published key id (--expect-kid, a full 256-bit digest). The dual signature is bound inside the signed payload, so ML-DSA cannot be stripped to fall back to Falcon-only, and signatures cross-verify against liboqs (Open Quantum Safe) in both directions.
Where Reseal sits
Reseal is the entry rung of the AlgoVoi post-quantum evidence ladder:
Free: av-reseal-verify
Inspect and verify a single document, offline. Apache-2.0, no licence.
Reseal (this)
Mint the post-quantum attestations for the documents you already hold.
Evidence Auditor
Batch-verify a whole archive and produce a signed, tamper-evident audit report.
Compliance Suite
Store write-once, retain, place legal holds, run a console, seal at scale.
Pricing
The sealing engine is a licensed product from $99 perpetual or $39 per year, bought self-serve from the suite store. Inspecting exposure and verifying seals is always free with the open av-reseal-verify tool and never needs a licence. Reseal produces cryptographic evidence artifacts; it is not a guarantee of legal admissibility, and each attestation is a per-record, independently verifiable proof.
Frequently asked questions
What is AlgoVoi Reseal?
AlgoVoi Reseal quantum-seals evidence you already hold. It verifies a document's existing classical signature (RSA or ECDSA) today and binds that verification into a Falcon-1024 plus ML-DSA (65 or 87), RFC-3161 timestamped, offline-verifiable attestation. A free open verifier inspects exposure and checks seals; a licensed sealer mints them.
How is Reseal different from other post-quantum products?
Every post-quantum product on the market protects tomorrow's data. Reseal rescues yesterday's. Documents on decade-long retention clocks were signed with RSA or ECDSA and stay provable only while those algorithms stay unforgeable. Reseal re-anchors them while the classical signature still verifies, which is the only time the rescue is possible.
Is the verifier really free and open?
Yes. algovoi-reseal-verify is published on PyPI under Apache-2.0. It inspects what is signed on a document, whether it verifies today and how exposed it is, and it verifies any reseal attestation offline. Verification is open on purpose: you should not have to trust the sealer to check what a seal proves.
Does verifying a seal depend on AlgoVoi?
No. An attestation carries its own signing public key and recomputes from its own bytes under RFC 8785 (JCS) and SHA-256, so an auditor verifies it offline with no AlgoVoi service, account, or network call in the trust path. Pinning the sealer's published key id with --expect-kid anchors authenticity, and the dual signature is bound inside the signed payload so ML-DSA cannot be stripped.
Which signatures and standards does Reseal use?
Dual post-quantum signatures: Falcon-1024 with ML-DSA-65 (Compact profile, L5 plus L3) or ML-DSA-87 (Matched profile, both at NIST L5), plus one RFC-3161 timestamp per batch. It reads PDF PAdES/PKCS#7 and detached CMS (.p7s) signatures and follows RFC 8785, RFC 3161, RFC 5652, RFC 5280, and FIPS 204.
How much does Reseal cost?
The sealing engine is a licensed product from $99 perpetual or $39 per year, bought self-serve from the suite store. Inspecting exposure and verifying seals is always free with the open av-reseal-verify tool and never needs a licence.
Last updated: 11 August 2026.