How verification works — and where its limits are

Provenia is a private platform for documenting how creative, technical, and other meaningful work evolves. A Project gathers chronological milestones and can produce a Documentary Dossier containing technical and contextual information about that path.

Provenia is not a government registry, copyright registry, notarial service, or legal-certification authority. It does not grant or transfer intellectual-property rights and does not replace official registrations, agreements, expert review, or professional advice.

Documentary evidence does not decide a dispute by itself. Its usefulness depends on artifact integrity, preservation of original files, the declarations made, the wider context, and the assessment of the person or authority reviewing it.

Hash, timestamp, and signature: different questions, different evidence

• SHA-256 hash: identifies an exact sequence of bytes so you can compare a retained file for integrity. A hash alone supplies no time evidence.
• External RFC 3161 timestamp: provides independent time evidence tied to the hash, supporting a check that it existed by the certified time. This is not the date the content was originally created.
• Ed25519 digital signature: lets a verifier check the signed payload’s integrity and its relationship to a key. In Provenia, it authenticates institutional issuance of Dossier.json, with trust dependent on checking the key and its published state.

Neither these mechanisms individually nor their combination automatically establishes absolute authorship, ownership, originality, or the original creation date. They do not guarantee legal outcomes. See the limits of the evidence.

A Project contains Records in chronological order. Each Record describes a milestone and may identify an earlier Record on which it is based. Provenia preserves this structure, its metadata, and its activity history so new milestones can be added without erasing the earlier path.

When a file is used for a Record:

1. its SHA-256 hash is calculated locally on the user’s device;
2. the original file contents are never sent to Provenia;
3. only the hash and declared metadata, including file name and size, are transmitted;
4. the Record is created from that data after the required validation succeeds.

The Record retains the hash, declared name and size, dates, description, links, and corresponding history. You must keep the original file. Without it, the byte-for-byte comparison cannot be repeated later.

System overview

The interactive map below shows the entities in this model, from the original file on the user’s device to independent public verification, and the documented relationships between them.

Copyright rules vary by jurisdiction, but the Berne Convention establishes protection without formalities among its members. WIPO explains that protection is generally automatic while voluntary registration systems differ between countries in their procedures and effects.

What this means for Provenia

• Provenia does not create copyright;
• using Provenia is not a condition for copyright protection;
• a Dossier is not a public certificate of authorship or ownership;
• Records can help document statements, files, versions, decisions, and development stages;
• official registrations or other steps may still be appropriate for the work, purpose, and jurisdiction involved.

Electronic documents and technical evidence may form part of a broader evidentiary record. Their acceptance and weight are not automatic; they depend on authenticity, integrity, provenance, context, applicable procedure, and the reviewer’s assessment.

Provenia therefore presents the Dossier as a private electronic document with transparent technical verification mechanisms, not as a substitute for any formality required by a particular jurisdiction.

SHA-256 is a cryptographic hash function specified by NIST FIPS 180-4. It turns a sequence of bytes into a fixed-length digest. Changing even one byte will normally produce a different hash.

When the SHA-256 value recalculated from a preserved file exactly matches the registered value, the compared bytes correspond to the bytes that produced that registered hash.

The comparison must use the original bytes. Re-exporting, recompressing, converting, or saving a file again may change its hash even if it looks the same. A mismatch establishes only that the compared bytes differ; it does not establish when or how they changed.

The PDF hash recorded in JSON links the two artifacts. A verifier can calculate SHA-256 over the received PDF and compare it with that value. Each generated Dossier captures the Project’s documentary state at that time and does not replace earlier Dossiers kept by the user.

The Luma Demo Dossier shows how these artifacts bring four stages of an evolving project together, with source files you can review.

PDF digital signature

Dossier.pdf is digitally signed by Provenia using PAdES and an ICP-Brasil e-CNPJ certificate. The certificate identifies the operating entity within that Brazilian infrastructure and applies a no-changes policy after signing.

The package does not rely on that layer alone. The hash of the final signed PDF is stored in Dossier.json, which is signed separately with Ed25519. Individual Records also retain their RFC 3161 timestamp evidence where available.

These layers support independent checks of PDF integrity, the PDF–JSON relationship, the JSON signature, and Record timestamp evidence. They do not guarantee acceptance or any particular legal effect.

Ed25519 is a digital-signature scheme described in RFC 8032. Provenia signs the canonical Dossier.json payload with a private key that is never published or included in the artifacts. The corresponding public key lets anyone verify the signature mathematically.

A fingerprint is a hash of the canonical public-key representation. It provides a compact identifier for comparing the key named in a Dossier with the key published through Provenia’s official registry.

Check the key and its published status in the Public Signing Keys registry.

Key states

Active

Approved for new production signatures.

Retired

No longer signs new Dossiers but remains published so historical documents can still be verified.

Revoked

Institutional trust has been withdrawn. The key remains published with its reason and context so earlier documents can be assessed accurately.

Every Record records the time at which it was created in Provenia’s infrastructure. This organizes the internal chronology and indicates when the file hash was presented to Provenia.

Where external timestamp evidence is available, FreeTSA, an external RFC 3161 timestamp authority independent of Provenia, issues a response containing a UTC time linked to the Record’s file hash. The platform time and externally certified time serve different purposes.

Provenia can document many kinds of processes and artifacts: writing, images, photographs, illustrations, music, video, product and design work, research, sketches, software versions, technical files, communications, and other meaningful creative or documentary milestones.

Documenting material does not mean that it qualifies for copyright, patent, trademark, or another form of intellectual-property protection. Copyright generally protects expression rather than ideas, methods, procedures, systems, or facts in isolation; WIPO provides a useful international overview.

Many copyright systems distinguish between rights connected to the creator’s personal relationship with a work and rights connected to its economic use. The exact categories, duration, transfer rules, and exceptions vary by jurisdiction.

Provenia does not transfer, license, or assign either category of rights. A Dossier documents artifacts and chronology; the legal consequences depend on authorship, ownership, agreements, and applicable law.

A Dossier has no contractual expiry date that causes its mathematical checks to stop working. Its future usefulness does, however, depend on preserving everything needed for review.

Keep:

• Dossier.pdf without changes;
• the corresponding Dossier.json;
• the original files associated with Records;
• backups in separate locations;
• relevant context, agreements, and communications;
• earlier Dossier versions when issued.

Historical verification also depends on published public keys and their states. Provenia therefore keeps retired and revoked keys available so earlier documents can be assessed in context.

1. Keep the PDF and JSON unchanged.
2. Check the PAdES signature and certificate information on Dossier.pdf with a compatible tool.
3. Confirm that the signature identifies Provenia’s operating entity and does not permit changes after signing.
4. Calculate SHA-256 over Dossier.pdf.
5. Compare it with the PDF hash in Dossier.json.
6. Identify the Ed25519 public key, fingerprint, and state.
7. Consult Provenia’s Public Signing Keys registry and check the key’s state at issue time.
8. Validate the Ed25519 signature over the canonical JSON payload.
9. For a particular Record, obtain the corresponding original file.
10. Calculate its SHA-256 hash.
11. Compare it with the hash in Dossier.json.
12. If external timestamp evidence is present, locate the external_timestamp object.
13. Confirm that its certified imprint corresponds to the Record hash.
14. Decode and validate the full Base64 RFC 3161 response, signature, certificate chain, authority, UTC time, serial number, policy, and certificate fingerprint.
15. Check that every “Based on” link points to an existing Record and that the chronology is internally consistent.
16. Review the declarations alongside other relevant documents and evidence.

A matching original-file hash confirms byte-for-byte correspondence with the content that produced the registered hash. A mismatch means the compared bytes differ, even if the file appears similar.

You can also use Provenia’s public Dossier verifier to perform the supported package checks.

When a sequence of Records preserves successive versions and, where available, each hash is linked to independent time evidence, that documentary sequence can contribute to showing that particular material existed or was under development by those documented times. It does not by itself establish authorship, ownership, or legal priority over third-party evidence.

Provenia provides documentary evidence and transparent verification mechanisms. Conclusions about authorship, ownership, priority, or legal effect must consider the complete body of evidence, applicable law, and the competent reviewer’s assessment.

Depending on the work and your objective, Provenia documentation may need to be combined with official registrations, agreements, deposits, expert assessments, certifications, or other appropriate measures.

Examples include copyright or software registration where available, trademark or design applications, patent filings, assignments, licenses, commissioned-work agreements, co-creation terms, confidentiality agreements, and advice from an intellectual-property professional.

The appropriate step depends on the nature of the work, the people involved, its intended use, and the relevant countries.

External sources may be updated, reorganized, or replaced by their publishers. Their inclusion explains the referenced technical or institutional concept and is not a claim that one jurisdiction’s legal rules apply everywhere.