Verifiable document comparison: checksums and a signed comparison certificate

A comparison result is worth only as much as can be proven about the versions it was based on. CompareDesk states the SHA-256 checksum of both files in every output and embeds a signed comparison certificate in every output, which can be verified without a network connection.

The checksum in every output

The particulars of every Word file, every comparison PDF, every result workbook and every machine-readable result state the SHA-256 checksums of the two compared files. Whoever recomputes the checksum of a file at hand, on Windows with certutil -hashfile file SHA256, and obtains the same value has exactly the checked version in front of him; any change to the file yields a different value. This statement allows attribution, not proof of the report's integrity.

The signed comparison certificate

Every comparison produces a signed comparison certificate. It resides in the output itself, in Word and Excel files as an embedded data part, in the PDF as a file attachment, and alongside it as a file .nachweis.json; the appendix of the output states its identifier. It binds the checksums of both versions, the time, the program version, the settings, the key figures and a digest of the complete list of changes with an asymmetric signature. The certificate proves the integrity and repeatability of the comparison, not its substantive correctness.

The verification

The command CompareDesk verify takes the certificate and, where available, the two source versions. It reads the certificate from the .nachweis.json file as well as from the result file itself and checks the signature and the checksums of the versions presented. An altered certificate and a substituted version are detected. The verification works without a network connection and without a licence.

The self-check

In the Word comparison CompareDesk recovers both original versions from the produced comparison version and holds them against the originals. The appendix states that this self-check was passed. You do not have to believe what it states; it is computed.

Czeste pytania

What is the checksum for?

It proves which file was compared. A file name can stay the same while the content changes; the checksum cannot.

Can a third party verify the comparison certificate?

Yes, with the program through the verify command, without an internet connection and without a licence; the certificate file or the result file itself suffices.

Does the certificate prove that the comparison is correct?

It proves that exactly these files were compared at this time with this result and that the certificate has been unchanged since. The substantive assessment remains the reviewer's.

Try CompareDesk

CompareDesk is available in the Microsoft Store and as a direct download. The first twenty-five comparisons are free, with no registration. Your documents stay on your own computer.

Download Read the manual