Emblem verification

emblem.red

Queried emblem.red for an HTTPS record over DNS-over-HTTPS.

✓

PROTECTED

emblem.red

apex HTTPS recordemblem.red

Carried in the asset's own HTTPS record (key65280), the record a browser already fetches at connection setup. Verifying issues the same query an ordinary client does, so the zone operator cannot tell a protection check from a normal visit.

Protected

48.2085°N, 16.3735°E

St. Stephen's Cathedral

Stephansdom · Vienna, AT · application/json

Resource →

Verification checks

COSE signature, then re-hash of the referenced resource.

COSE_Sign1 signature valid (kid: emblem-demo-1)
Resource hash matches the signed payload (566 B, application/json)

Hash envelope

draft-ietf-cose-hash-envelope — the payload is a hash of an external resource.

Media type: application/digital-emblem+cose
Hash alg: SHA-256
Preimage type: application/json
Location: https://emblem.red/landmarks/stephansdom.json
Payload hash: b07107db58695f2c090a8bc0207c2d831f9e2d78735f0bb3566d351bc256b025

340 bytesCOSE_Sign1 · ES256HTTPS key65280

CWT claims & holder key

RFC 9597 claims in the protected header; a cnf key (RFC 8747) for proof of possession.

sub: https://emblem.red/landmarks/stephansdom.json
cnf kty: EC2 · P-256
cnf kid: holder-demo-1
cnf x: XLGv7xfBaFtPu9kq5Dv9EWDORjxnsc9l7bqc1zMJCqA
cnf y: DzKTaiV4sSTiPMvN_n_YsZybjsSLH_C8w3WHU-t7akQ

The holder of the matching private key can present proof of possession of this key in the future.

Decoded emblem (CBOR)

340 bytes of COSE_Sign1, annotated. Every octet on the wire.

d2  # tag(18)  COSE_Sign1
84  # array(4)
58eb  # bytes(235)
a6  # map(6)
01  # unsigned(1)
26  # alg: -7  (ES256)
04  # unsigned(4)
4d  # kid: bytes(13)
656d626c656d2d64656d6f2d31  # content
0f  # unsigned(15)
a2  # CWT Claims: map(2)
02  # unsigned(2)
782d68747470733a2f2f656d626c656d2e7265642f6c616e646d61726b732f7374657068616e73646f6d2e6a736f6e  # sub: text(45)  "https://emblem.red/landmarks/stephansdom.json"
08  # unsigned(8)
a1  # cnf: map(1)
01  # unsigned(1)
a5  # COSE_Key: map(5)
01  # unsigned(1)
02  # kty: 2  (EC2)
02  # unsigned(2)
4d  # kid: bytes(13)
686f6c6465722d64656d6f2d31  # content
20  # negative(-1)
01  # crv: 1  (P-256)
21  # negative(-2)
5820  # x: bytes(32)
5cb1afef17c1685b4fbbd92ae43bfd1160ce463c67b1cf65  # content
edba9cd733090aa0
22  # negative(-3)
5820  # y: bytes(32)
0f32936a2578b124e23ccbcdfe7fd8b19c9b8ec48b1ff0bc  # content
c3758753eb7b6a44
190102  # unsigned(258)
2f  # payload-hash-alg: -16  (SHA-256)
190103  # unsigned(259)
706170706c69636174696f6e2f6a736f6e  # preimage-ct: text(16)  "application/json"
190104  # unsigned(260)
782d68747470733a2f2f656d626c656d2e7265642f6c616e646d61726b732f7374657068616e73646f6d2e6a736f6e  # location: text(45)  "https://emblem.red/landmarks/stephansdom.json"
a0  # map(0)
5820  # bytes(32)
b07107db58695f2c090a8bc0207c2d831f9e2d78735f0bb3  # content
566d351bc256b025
5840  # bytes(64)
4f1cc7dda85d2700b7c78c3d0470c52504a9b444b33bfd9f  # content
b58565ed36ca5711e3523177d795457524ed325bbc8c02d8
862736c2793aa70f2297834e2707d47f

Raw bytes

Hex

d2 84 58 eb a6 01 26 04 4d 65 6d 62 6c 65 6d 2d
64 65 6d 6f 2d 31 0f a2 02 78 2d 68 74 74 70 73
3a 2f 2f 65 6d 62 6c 65 6d 2e 72 65 64 2f 6c 61
6e 64 6d 61 72 6b 73 2f 73 74 65 70 68 61 6e 73
64 6f 6d 2e 6a 73 6f 6e 08 a1 01 a5 01 02 02 4d
68 6f 6c 64 65 72 2d 64 65 6d 6f 2d 31 20 01 21
58 20 5c b1 af ef 17 c1 68 5b 4f bb d9 2a e4 3b
fd 11 60 ce 46 3c 67 b1 cf 65 ed ba 9c d7 33 09
0a a0 22 58 20 0f 32 93 6a 25 78 b1 24 e2 3c cb
cd fe 7f d8 b1 9c 9b 8e c4 8b 1f f0 bc c3 75 87
53 eb 7b 6a 44 19 01 02 2f 19 01 03 70 61 70 70
6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 19 01 04
78 2d 68 74 74 70 73 3a 2f 2f 65 6d 62 6c 65 6d
2e 72 65 64 2f 6c 61 6e 64 6d 61 72 6b 73 2f 73
74 65 70 68 61 6e 73 64 6f 6d 2e 6a 73 6f 6e a0
58 20 b0 71 07 db 58 69 5f 2c 09 0a 8b c0 20 7c
2d 83 1f 9e 2d 78 73 5f 0b b3 56 6d 35 1b c2 56
b0 25 58 40 4f 1c c7 dd a8 5d 27 00 b7 c7 8c 3d
04 70 c5 25 04 a9 b4 44 b3 3b fd 9f b5 85 65 ed
36 ca 57 11 e3 52 31 77 d7 95 45 75 24 ed 32 5b
bc 8c 02 d8 86 27 36 c2 79 3a a7 0f 22 97 83 4e
27 07 d4 7f

base64url

0oRY66YBJgRNZW1ibGVtLWRlbW8tMQ-iAngtaHR0cHM6Ly9lbWJsZW0ucmVkL2xhbmRtYXJrcy9zdGVwaGFuc2RvbS5qc29uCKEBpQECAk1ob2xkZXItZGVtby0xIAEhWCBcsa_vF8FoW0-72SrkO_0RYM5GPGexz2XtupzXMwkKoCJYIA8yk2oleLEk4jzLzf5_2LGcm47Eix_wvMN1h1Pre2pEGQECLxkBA3BhcHBsaWNhdGlvbi9qc29uGQEEeC1odHRwczovL2VtYmxlbS5yZWQvbGFuZG1hcmtzL3N0ZXBoYW5zZG9tLmpzb26gWCCwcQfbWGlfLAkKi8AgfC2DH54teHNfC7NWbTUbwlawJVhATxzH3ahdJwC3x4w9BHDFJQSptESzO_2ftYVl7TbKVxHjUjF315VFdSTtMlu8jALYhic2wnk6pw8il4NOJwfUfw

Scan another domain