Skip to content
NOQTIS

noqtis-prove(1)

noqtis-prove — prove that some files are in a capsule, without the others

noqtis prove [-p key.pub] [-o file] [-f] dir path ...

noqtis prove writes a proof that the files path ... are in the format 2 capsule dir (noqtis-capsule(5)): the seal, the manifest's head (its Merkle root and number of files) and, for each file, its entry and its Merkle audit path. A reader checks the proof with noqtis-check(1) --proof, which verifies the seal's signature over the head and each path to the signed root, and, given the files, the files against their entries. The proof holds no name, size or digest of the capsule's other files.

Paths are relative to dir, with ‘/’ between folders, as the manifest lists them; one given twice is proven once. The capsule must check first, against -p when given: a proof of a capsule that does not check is not written.

key.pub, --pub=key.pub
The public key the capsule must be sealed with.
file, --out=file
Write the proof to file instead of standard output.
, --force
Replace file if it exists.

0
The proof was written.
1
The capsule does not check.
2
A usage error, a format 1 capsule, a path the manifest does not list, a file that cannot be written, or a library error.

Seal in format 2, prove one file, and check the proof without the rest of the folder:

$ noqtis seal --format 2 -k me results
$ noqtis prove -p me.pub -o in.proof results data/in.csv
$ noqtis check -p me.pub --proof in.proof

With the file at hand, check it too:

$ noqtis check -p me.pub --proof in.proof results

noqtis(1), noqtis-check(1), noqtis-seal(1), nqchkp(3), nqprove(3), noqtis-capsule(5)

Certificate Transparency Version 2.0, RFC 9162, December 2021.