Crypto ID

about

description

Use cases: - Attest the state of a Linux computer When your computer is in a trustworthy state, you can generate a private key hidden in the TPM2 of your computer. This private key can be sealed with the current state of the computer (PCRs). Then the computer can only sign a message with this key when it is in the correct state according to the PCRs. For example, you can seal the key against the secure boot state (PCR7). If your computer is booting an operating system signed by another vendor, the TPM2 cannot unseal the private key. So if your computer can generate a correct signature, it is in this known state. You can create a sealed private key and create such a signature with cryptographic-id-rs (https://gitlab.com/cryptographic_id/cryptographic-id-rs). This is similar to tpm2-totp (https://github.com/tpm2-software/tpm2-totp) but uses asymmetric cryptography. This means you do not need to keep the verification code secure. You can share it safely with the world. - Verify the identity of a phone You can generate a private key when your phone is in a trustworthy state. If your phone can create a correct signature, you know it is the same phone. Since the operating system can access the private key, the security guarantees are much weaker than with a TPM2. So the verification is just as secure as your phone. If you use Graphene OS, also have a look at Auditor (https://attestation.app/tutorial). - Verify that a person is in possession of a private key This works as well as the section above but has the same shortcomings. It can be used to verify someone in person when he sends his public key to you in advance over a secure channel.

publisher

78ce6faa72264387284e647ba6938995735ec8c7d5c5a65737e55130f026307d

first seen

2026-10-08T07:45:51.215205+00:00

last event

2026-10-08 07:45 UTC

install

zapstore.dev or any Zapstore-compatible client

source & build

repository

https://gitlab.com/cryptographic_id/cryptographic-id-flutter

arch flags

android-arm64-v8a android-armeabi-v7a android-x86_64

manifest

missing

releases (kind 30063)

1 release indexed; latest 0.5.7.

assets & verification

Every app, release and asset event is schnorr-verified (NIP-01 id + signature) before it enters the catalog, and assets are content-addressed by sha256. We subscribe read-only to the catalog relay — never write to it.

0.5.7 — io.gitlab.cryptographic_id_23.apk

sha256

90b2d626c66f3aef179437105513f6354cb335f66e06bd8c2345492f4daafc76

size

52.2 MB

archs

android-arm64-v8a, android-armeabi-v7a, android-x86_64

version code

23

apk cert sha256

2c63ae15024bd36e4cbdfc58d5548a7299c70c98a1ca011cba2ab1339b034528

download

io.gitlab.cryptographic_id_23.apk

Showing the newest 1 asset descriptor; the full set is in /api/apps/78ce6faa…