emblem.red

IETF DIEM · digital emblems

Digital emblems, delivered over DNS.

A digital emblem is a signed marker, discoverable in DNS, that binds a protected status to a resource. emblem.red signs a COSE hash envelope over the resource, carries it in the asset's HTTPS record, and verifies it from anywhere.

Verify a domainArchitecture draft

This domain is marked. See emblem.red's own emblem

How an emblem travels

  1. 01

    Issue

    Hash the resource and sign a COSE hash envelope (ES256) over the digest.

    cose-hash-envelope
  2. 02

    Mark

    Add key65280 to the asset's own HTTPS record, beside its normal service params.

    RFC 9460 · HTTPS RR
  3. 03

    Discover

    A client already fetches this record at connection setup, so the emblem rides along.

    HTTPS query
  4. 04

    Verify

    Check the COSE signature, then re-fetch the resource and re-hash it.

    COSE + digest

A worked example

St. Stephen's Cathedral, Vienna

The resource is application/json — GeoJSON that marks the landmark protected. The emblem is a COSE hash envelope over those exact bytes, so it stays valid only while the resource is unchanged. CWT claims ride in the protected header (RFC 9597), kept minimal: a sub and a cnf key (RFC 8747) the holder can later prove possession of.

Verify this emblemView the resourceFetch the emblem
resource
application/json (GeoJSON)
emblem
application/digital-emblem+cose
payload
SHA-256 digest of the resource
headers
258 hash-alg · 259 type · 260 location
claims
15 CWT claims → sub · cnf
cnf
COSE_Key (EC2 P-256) for PoP

Try it live

Issue an emblem, mark a domain in DNS, verify it, and remove it. Writes hit real DNS when a Cloudflare token is configured.

Sign a COSE hash envelope (ES256) over the resource digest, with CWT claims and a cnf key in the protected header, and render the HTTPS record.