IRLid — Verification Score Breakdown

Current v3 implementation · 14 checks · weighted as I'd recommend

🔐 Cryptographic Signatures

×2
Initiator signatureECDSA P-256 verify — A signed their payload with their private key
×2
Collaborator signatureECDSA P-256 verify — B signed their payload with their private key
×2
HELLO offer signatureA's original offer was signed — proves QR wasn't tampered in transit

🔗 Hash Integrity

×1
Initiator structureA's response has all required fields
×1
Initiator hashSHA-256(canonical(a.payload)) matches stored hash
×1
Collaborator structureB's response has all required fields
×1
Collaborator hashSHA-256(canonical(b.payload)) matches stored hash

🧲 Cross-Session Binding

×1
A binds to HELLOA's response references the correct HELLO hash — prevents substitution attacks
×1
B binds to HELLOB's response references the same HELLO hash
×1
A binds to offerA's response references the offer payload hash
×1
B binds to offerB's response references the same offer hash

🔒 Secure Enclave, Bio-metrics & Face Capture v5 planned · all optional · Settings only

×1
Hardware-backed key (Secure Enclave)Key in device TEE — never extractable, even on rooted device. Replaces localStorage.
×1
Bio-metric unlockFingerprint / Face ID gates the signing key — proves device owner was physically present
×1
A witnessed B's faceAt scan time, A's camera captured B's face + B's QR. Hash signed into A's payload. B cannot deny presence.
×1
B witnessed A's faceAt scan time, B's camera captured A's face + A's QR. Hash signed into B's payload. Mutual witness — neither photographs themselves.

All four checks off by default. User enables in Settings. Never prompted during handshake. 100% score without these is valid for all everyday use — maximum score reserved for extraordinary verification.

📍 Co-Presence Proof

×2
Time delta ≤ 90 secondsBoth devices signed within 90s of each other — proves simultaneous presence
×2
Distance ≤ 12 metresGPS Haversine distance — both devices reported same location
×1
Receipt age ≤ limitWidget-enforced — receipt not older than site's configured threshold

Score out of 100 — base 20pts · full system 100pts · symmetry with % confirmed

🔐 Signatures (3 × 4pts)
12 pts
🔗 Hash integrity (4 × 1pt)
4 pts
🧲 Binding (4 × 1pt)
4 pts
📍 Co-presence GPS + time (2 × 2pts)
4 pts
🕐 Age check (1pt)
1 pt
Base total (v3 now)
20 / 100
+ L2 Trust history (+10pts)
30 / 100
+ L3 v5 Enclave+Bio+Face (+20pts)
50 / 100
+ L4 v6 Trust network (+15pts)
65 / 100
+ L5 v6 Blockchain (+15pts)
80 / 100
+ L6 v6 IoT / Drones (+10pts)
90 / 100
+ L7 v7 Zero Knowledge (+10pts)
100 / 100

Score out of 100 = % confirmed. Symmetry intentional. Base receipt (20pts) is valid for all everyday use. 100pts reserved for extraordinary verification — legal, government, high-security access. Optional enhancements (L2b) take you to 50pts — halfway — with no server changes needed.