# Witnessory post-quantum check

> Checks whether one website's encryption would stay private against a future quantum computer: whether a current
> browser gets post-quantum key exchange (TLS 1.3 with X25519MLKEM768 or another post-quantum hybrid), and what the
> site's certificate uses. Part of Witnessory (https://witnessory.org), an observatory of the internet's move to
> post-quantum cryptography. Free to try, no account or key; paid plans raise the limits and add watching over time
> (https://witnessory.org/pricing.json).

## API

- `GET https://check.witnessory.org/api/check?domain=example.org` returns JSON: `record` (the signed result:
  `domain`, `level`, `checked_utc`, key exchange as seen by a browser-like and a post-quantum-only client, the
  certificate's algorithms), `signatures` (base64), `summary` (plain English), `cached` and `cache_expires_utc`.
- `level`: `ready` (a browser gets post-quantum key exchange), `partly` (only when offered alone), `not_yet`
  (classical only), `unknown` (could not be reached; the summary says why).
- `GET https://check.witnessory.org/badge/example.org.svg`: an SVG badge of the latest result.
- `GET https://check.witnessory.org/keys`: the public keys (PEM) for verifying results.
- Full description: https://check.witnessory.org/openapi.json

## Rules

- Domain names only (no addresses, ports or private names); port 443 only; names resolving to private addresses are
  refused.
- 20 new checks an hour from one address; a domain's result is reused for 10 minutes (cached
  results do not count). Over the limit: HTTP 429 with Retry-After; busy: HTTP 503 with Retry-After.
- Errors are JSON: `{"error": "<sentence>", "code": "<stable code>"}`. Codes: missing_domain, address, port,
  too_long, invalid_domain, non_public, excluded, rate_limited, busy, not_found, method_not_allowed.

## Paid plans (machine-readable prices: https://witnessory.org/pricing.json)

- Every answer carries `offers` (what more there is, and where the prices are).
- With a key, `Authorization: Bearer <key>`: every check is fresh (never a reused result), counted against the plan's
  month instead of the address. Used up: HTTP 429, code `plan_exhausted`, Retry-After until the 1st. Unknown key:
  HTTP 401, code `bad_key`.
- Watching a site over time from several networks, alerts and signed evidence are separate products on the same page.
- Until checkout exists, a plan is bought by writing to security@witnessory.org; the key arrives by reply.

## Verifying a result

The signed bytes are `record` as canonical JSON: keys sorted, separators `,` and `:` with no spaces, UTF-8, non-ASCII
characters as is. `signatures.ed25519` is an Ed25519 signature and `signatures.mldsa65` an ML-DSA-65 signature
(pure, empty context), both over those bytes, base64-encoded, by the keys at /keys. `record.result_sha256` is the
SHA-256 of the canonical JSON of `record` without that field. A result is a measurement at one time from one place,
not a certification.