Verify an issuance as a third party

You're an auditor, an organization has handed you a ledger extract, and you need to show that an issuance was properly approved, without access to the database or the installation.

TrustBridge provides a ledger extract in a published format, the rule set versions with their public keys, and a verification tool that performs these steps without access to the installation. You verify the chain, the approval, the match between order and certificate, and the revocations.

1. Verify the chain. Recompute the hashes of the ledger extract and compare the chain head at the anchor times with the entries in external storage.
2. Verify the approval. For each issuance, verify the approval signatures over the order hash with the public keys from the rule set version named in the entry.
3. Match order and certificate. Recompute the SHA-256 of the order bytes and check that the certificate matches the order (names, key, extensions, lifetime) and carries the CA's signature.
4. Verify revocations. Check that CRL numbers strictly increase and that every recorded revocation is contained in every CRL from its point in time onward.

Result. You can show that person X approved bytes Y, verifiable with the public key from the rule set, and that certificate Z matches those bytes and carries the CA's signature.

• The same procedure applies to relationships: every relationship, every change, and every revocation is in the ledger with its approval signatures and can be matched against the signed trust bundle the TLS adapters used at that time.
• There's one chain per tenant, so a partner can verify its extract completely without seeing anyone else's data.
• A ledger restore is in the chain as an event of its own, pointing to the last anchor; falling back is explained, not hidden.

• Audit and evidence – what the ledger proves and how the chaining works
• Security commitments – commitment S-06 on proving every issuance