Introduction

NOQTIS is open-source software that seals the exact files behind a result, so that anyone can check later, offline, that nothing changed. The name stands for Notary of Quantum-Safe Traceable Inputs and Seals.

A sealed folder is called a capsule. It carries a manifest of every file and a signature over that manifest. A check finds any file that was changed, added or removed, and shows which key sealed the folder. The signatures are post-quantum: they are meant to stay sound against an attacker with a large quantum computer.

Unaudited

The code has not had an external security audit. Do not rely on it for anything that matters yet. How it is tested is on the security page.

What it is made of

• A C11 library with no dependencies. It implements the signature schemes ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), the key-encapsulation scheme ML-KEM (FIPS 203), SHA-2 and SHA-3, and checks itself against the NIST test vectors. See the C interface.
• A command-line program, noqtis, that makes keys, seals folders, checks capsules, signs single files and adds timestamps. See the command reference.
• Bindings for Python, JavaScript, R, Rust, Go and Java, each calling the same library, so a capsule sealed in one language checks in every other.
• A data layer. A capsule can carry a data record: where each file came from, the schema of its tables, summaries that show later whether the data drifted, the software environment, and how to cite it. See data records, schemas and drift.
• An open format. The capsule is a few small text files with a written specification, so another program can read and check one without this library.

What it is for

• Publishing data or results with a seal a reader can check.
• Showing that the files behind a paper, a report or a court exhibit are the ones that were analysed.
• Recording when a capsule existed, with a timestamp from a public time-stamping authority.
• Checking files in a build or a pipeline before they are used.

Why NOQTIS exists says more, and how it compares sets it beside other tools.

Licence

Apache License 2.0 with the LLVM exception. The source is on GitHub.

Where to start

1. Install the program or a binding.
2. Make your first capsule.
3. Or check a capsule in your browser, with nothing installed.