Scope
This explainer describes how the technology works. It is not legal advice and does not state how any rule of evidence applies in a particular court.
§What the certificate says
A Pasqio Certificate of Integrity states that one specific electronic file existed, in exactly the form identified on the certificate, no later than a stated time. It identifies the file by its SHA-256 “fingerprint”, names the person who requested the certification, and records when they did so.
It does not say who wrote the document, whether its contents are true, or what happened to the document before it was certified. It speaks only to the file’s exact contents and to a point in time.
§The fingerprint (SHA-256)
SHA-256 is a published standard (NIST FIPS 180-4) that turns any file into a 64-character code. The same file always produces the same code. Changing even one character of the file produces a completely different code, and no one knows how to construct a different file with the same code. Comparing the code of the file produced in court with the code on the certificate therefore shows whether the file is the one that was certified.
Pasqio computed the code from the document itself, as stored, not from an encrypted copy. Only the code ever left Pasqio; the document did not.
§The time
The certificate carries two independent records of time:
The Bitcoin blockchain. The fingerprint was submitted to OpenTimestamps, a free public service that bundles many fingerprints together and records a single combined value in a Bitcoin transaction. Once that transaction is included in a block, the block’s timestamp shows the fingerprint existed by then. Bitcoin has run continuously since January 2009 and no single party controls it. Block timestamps are set by the miner and may differ from real time by up to about two hours; the certificate also shows the more conservative “median time past”.
An independent time-stamping authority. Within seconds of certification, the fingerprint was also sent to a time-stamping authority under the RFC 3161 standard, which returned a token it signed stating the fingerprint existed at that moment. Courts and the European eIDAS framework already recognise this kind of token.
§Why Pasqio does not have to be trusted
The proof linking the fingerprint to the Bitcoin block is a short file attached to the certificate PDF. Anyone can replay its arithmetic and compare the result with the block as published by any Bitcoin block explorer. Before Pasqio marked the certification confirmed, it did exactly that against two independent explorers. The certificate PDF is itself digitally sealed, so a reader such as Adobe Acrobat reports whether it has been altered since Pasqio issued it.
§Chain of custody
Where the document was uploaded to Pasqio as a file, the certificate also records who uploaded it and when, and the fingerprint Pasqio computed while the upload arrived. If that upload fingerprint matches the certified fingerprint, the stored file had not changed between upload and certification.
§How to check it
See the one-page verification sheet, or use pasqio.com/verify, which performs every check in the reader’s own browser.