Attestations and Fingerprints

Embedded Metadata

The SVG contains:

<metadata id="bar-v1" type="application/json">
  ...
</metadata>

The metadata is JSON stored within the SVG.

Attestation Fields

Example Structure

{
  "v": 1,
  "id": "A1B2C3D4E5F6",
  "url": "https://example.com/a/A1B2C3D4E5F6.json",
  "img_sha256": "sha256:FULL_SHA256_HEX_VALUE",
  "iat": 1792281600,
  "kid": "badge-signing-2026-01",
  "alg": "ES256",
  "jwk": {
    "kty": "EC",
    "crv": "P-256",
    "x": "PUBLIC_X",
    "y": "PUBLIC_Y"
  },
  "sig": "BASE64URL_SIGNATURE"
}

This is an illustrative structure, not a valid signed attestation.

Artwork Hashing

BadgeMax Pro constructs a normalized representation of the SVG artwork.

The normalizer:

1. Locates the g#art element.
2. Clones the artwork group.
3. Removes fingerprint digit elements from g.code.
4. Replaces the assertion link with #.
5. Includes the SVG style text.
6. Includes the SVG width and fixed height.
7. Serializes the normalized artwork.
8. Calculates its SHA-256 hash.

The resulting hash is stored in img_sha256.

Why Remove the Fingerprint Digits?

The visible fingerprint is derived from the artwork hash.

Including those same digits in the hash input would create a circular dependency.

The normalizer removes them before calculating the artwork hash.

Why Normalize the Assertion Link?

The assertion URL can contain the generated badge identifier.

Normalizing the link avoids creating a circular dependency between the identifier and its own assertion URL.

The actual assertion URL is still included separately in the signed attestation message.

What Is Protected by the Hash?

The normalized artwork includes visual elements such as:

• Background
• Border
• Label
• Logo markup
• Checkmark
• Styles
• Dimensions

Changing included artwork or styles should change the hash.

The fingerprint digit group is intentionally excluded from that hash.

The verifier does not independently check that the visible fingerprint digits equal the attestation ID.

Fingerprint Identifier

The badge ID is the beginning of the full SHA-256 artwork hash, displayed in uppercase.

The length is controlled by Fingerprint Length.

Example:

A1B2C3D4E5F6

This is an identifier derived from the artwork, not an independently generated UUID.

Signature Message

The attestation signature covers a structured message:

BAR1|id|url|img_sha256|iat|kid

The fields are joined using literal pipe characters.

The message is encoded as UTF-8 and signed using ECDSA P-256 with SHA-256.

Signature Encoding

The generated signature is encoded using Base64URL without padding.

This encoding is suitable for JSON and web-based data exchange.

Public Key Cross-Check

The attestation includes an embedded public JWK.

During verification, the application fetches the issuer's public key from JWKS and compares the key's core EC coordinates with the embedded key.

This helps detect mismatches between the badge's embedded key and the issuer's published key.

Attestation vs Assertion

These are different objects.

Attestation: Embedded in the SVG, describing the signed badge.

Assertion: Hosted separately as JSON, describing the published badge status.

Both are relevant to a complete verification workflow.

Important Limitations

• A fingerprint alone is not a signature.
• A signature alone does not establish that an issuer is trustworthy.
• The artwork hash uses this application's custom normalization procedure.
• Changes to the normalization algorithm could affect compatibility.
• The embedded metadata format is application-specific.
• The supplied implementation does not establish compatibility with an external badge-attestation standard.

Important: To verify a badge reliably, use the corresponding BadgeMax Pro verification logic rather than assuming a generic SVG or JSON signature verifier understands this format.