Verify the integrity of any published IIC file

Verify in your browser

Drop one of the eight official IIC v9.0 release files below. Verification runs entirely on your device — nothing is uploaded.

Accepted files: IIC-v9_0-Complete-Package.zip, IIC-User-Guide-v9.0.pdf, IIC-Wallet-User-Guide-v1.0.pdf, IIC-Technical-Specification-v9.0.pdf, IIC-Engineering-Specification-v9.0.pdf, IIC-Threat-Model-v9.0.pdf, IIC-Defensive-Publication-MultiZone-v2.pdf, IIC-Defensive-Publication-StapledFreshness.pdf

Published release manifest

These are the cryptographic fingerprints of the published IIC releases. Compare locally-computed hashes against these values. The v9.0 entries are retained: a file issued under that release remains verifiable here.

0. v10.0 release package — anchored digest

This is the digest committed to Bitcoin and Ethereum for v10.0. It is the digest of SHA256SUMS, not of any archive: a ZIP embeds timestamps and compression choices that differ between runs, so its digest cannot be reproduced and proves nothing about the contents. Verify the package with shasum -c SHA256SUMS, then check this value. Anchored on Bitcoin at block 961351 (Aug 7, 2026, 00:30:52 AM UTC) and on Ethereum at block 25701188 (Aug 7, 2026, 06:06:47 AM UTC), both on 7 August 2026. Times are block times in UTC, read from the explorers; OriginStamp certificates render them in local time.

0b. IIC generator v10.0

1. Complete Package (ZIP)

2. User Guide

3. Wallet User Guide

4. Technical Specification

5. Engineering Specification

6. Threat Model

7. Defensive Publication — Multi-Zone Canonical Neutralization (v2)

8. Defensive Publication — In-File Stapled Freshness

Files inside the Complete Package are individually listed in its SHA256SUMS file; the generator file is internet-identity-card-v9.html, SHA-256 17aea67549cdf0214c04e9c89b0849efe08e74d3632efe2bc78d32fbe93f5bfc.

ECDSA P-256 public key (Base64-encoded)

Used to verify the ECDSA signature of the Complete Package ZIP.

Verify from your terminal

Prefer the command line? Compute the SHA-256 of the file you downloaded and compare with the published hash above.

macOS / Linux

shasum -a 256 IIC-v9_0-Complete-Package.zip
shasum -a 256 IIC-User-Guide-v9.0.pdf
shasum -a 256 IIC-Wallet-User-Guide-v1.0.pdf
shasum -a 256 IIC-Technical-Specification-v9.0.pdf
shasum -a 256 IIC-Engineering-Specification-v9.0.pdf
shasum -a 256 IIC-Threat-Model-v9.0.pdf
shasum -a 256 IIC-Defensive-Publication-MultiZone-v2.pdf
shasum -a 256 IIC-Defensive-Publication-StapledFreshness.pdf

Windows (PowerShell)

Get-FileHash IIC-v9_0-Complete-Package.zip -Algorithm SHA256
Get-FileHash IIC-User-Guide-v9.0.pdf -Algorithm SHA256
Get-FileHash IIC-Wallet-User-Guide-v1.0.pdf -Algorithm SHA256
Get-FileHash IIC-Technical-Specification-v9.0.pdf -Algorithm SHA256
Get-FileHash IIC-Engineering-Specification-v9.0.pdf -Algorithm SHA256
Get-FileHash IIC-Threat-Model-v9.0.pdf -Algorithm SHA256
Get-FileHash IIC-Defensive-Publication-MultiZone-v2.pdf -Algorithm SHA256
Get-FileHash IIC-Defensive-Publication-StapledFreshness.pdf -Algorithm SHA256

If the computed hash exactly matches the published value above, the file is bit-for-bit identical to the published release (integrity verified).

What this verification provides

A successful match between your locally-computed SHA-256 hash and the published value provides:

• Integrity — the file is bit-for-bit identical to the published release
• Tamper detection — any modification to the file (even a single bit) would change the SHA-256 hash entirely
• Source consistency — the file you have is the same one published by Https Card — Internet Identity Card Ltd

For the Complete Package ZIP, an additional ECDSA P-256 signature can be verified against the published public key. The signature provides cryptographic evidence that the release was issued by the holder of the corresponding private key, assuming the public key has been obtained from a trusted source.

Independent timestamping (BTC + ETH) — anchor timeline

Every release is anchored on the Bitcoin and Ethereum blockchains via OriginStamp, and additionally on Bitcoin via OpenTimestamps. Anchors are cumulative: superseding a release never removes the proof that its predecessor existed. The complete chronology:

Defensive publications

The cryptographic architecture verified here is disclosed as open prior art on Technical Disclosure Commons, released under the Creative Commons Attribution 4.0 license:

• TDCommons #10079 — Cryptographic Identity Document System Using TOTP-Derived Symmetric Keys (12 May 2026)
• TDCommons #10167 — Self-Verifying Single-File Cryptographic Documents with Dual-Passphrase Architecture (19 May 2026)
• TDCommons #10394 — Composite Defense-in-Depth Architecture for Self-Verifying Cryptographic Documents and Their Optional Offline Launchers (7 June 2026)
• TDCommons #10795 — Multi-Zone Canonical Neutralization (v2), anchored BTC + ETH 3 July 2026
• TDCommons #10796 — In-File Stapled Freshness (Zone F), anchored BTC + ETH 3 July 2026
• TDCommons #11121 — Post-Quantum Ready, Offline-Verifiable Digital Identity Credential (hybrid ECDSA P-256 + ML-DSA-65, FIPS 204), published 23 July 2026, anchored BTC + ETH 23–24 July 2026

Important notice

This verification confirms file integrity only. It does not constitute legal recognition, certification, accreditation, or endorsement by any authority. Internet Identity Card ™ is a private software-based identity and verification platform developed by Https Card — Internet Identity Card Ltd. References to electronic signatures, eIDAS, or regulatory frameworks are informational only.