Abstract
Revocation of frozen offline credentials — single-file HTML documents, PDFs, or other self-serialized digital credentials verified without any network, server, or public-key infrastructure — is information-theoretically constrained: a file sealed at issuance cannot learn of a later revocation event unless some information reaches the verification context. This disclosure does not remove that channel; it reduces it to one short, public, unforgeable hash-chain token per validity period, relayable by any untrusted party, and relocates the freshness proof inside the credential file itself. At issuance, a hash-chain tip (Micali NOVOMODO style) and period parameters are embedded in the credential's signed core, attested by hybrid classical plus post-quantum signatures (ECDSA P-256 and ML-DSA-65, FIPS 204). While the credential remains valid, the issuer releases one 32-byte chain preimage per period; revocation is the cessation of release. The holder writes the latest token into a dedicated fixed-width, length-preserving zone of the frozen file — excluded from the coverage of both the embedded signatures and the file's self-integrity digest through canonical multi-zone neutralization — so the immutable file is updated without issuer re-signing and without breaking self-verification. An offline verifier authenticates the token by iterated SHA-256 hashing against the signed tip and applies fail-stale semantics using only its local clock: FRESH within the grace window, STALE when tokens stop appearing, INVALID on chain failure or future-dated tokens. Hash-chain validity tokens, OCSP-style status stapling, short-lived credentials, and multi-zone neutralization are acknowledged prior art; the contribution disclosed is narrowly the in-file stapling of successive freshness tokens into an immutable self-verifying document, with generalizations to hash trees, multiple status chains, and other container formats.
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.
Recommended Citation
Benaudis, Michael, "In-File Stapled Freshness: Hash-Chain Validity Tokens Written into a Frozen Self-Serialized Document via a Length-Preserving Neutralized Zone, with Fail-Stale Offline Verification", Technical Disclosure Commons, ()
https://www.tdcommons.org/dpubs_series/10796