How do I verify a forensic report?
Run auralwatermark verify-report proof.json --key <secret>. It recomputes the HMAC over the report body and compares it in constant time. Exit code 0 means the seal matches; 1 means the report changed or the key is wrong. Verification needs the same shared secret that sealed the report, and it checks the report, not the authorship of the audio.
How Aureal handles it
The verifier reads the JSON, reconstructs the canonical body with the signature removed, recomputes HMAC-SHA256 and compares the result. A single changed character in a covered field, or a different secret, produces exit 1. If the report predates the current canonicalisation or carries an unknown scheme, verification fails with an explicit reason instead of guessing. The seal covers the recorded file hashes, so they cannot be swapped without breaking it, but verification does not re-read the audio: check the file's SHA-256 and SHA-512 yourself if the evidence file matters.
Common failure mode
“A successful verify-report proves the audio is authentic and the report is conclusive.”
Why it fails: The command checks a shared-secret seal over the report body. It does not hash the audio file again, does not establish who ran the scan, and does not provide a trusted timestamp or chain of custody. Re-hash the evidence file and compare it with the recorded values before drawing any conclusion about the file.
Verified example
Verify the seal, then verify the evidence file independently:
node aureal-watermark.cjs verify-report proof.json --key "$AUREAL_SEAL_KEY"
# exit 0 = seal valid; 1 = modified or wrong key
sha256sum evidence.mp3
# compare with targetFile.hashes.sha256 in proof.json
Use the JSON for the full SHA-512; the text certificate shortens it for display.Example only. Validate against your own audio, codec and processing chain.
Scope and limits
- Requires the same shared secret used to seal the report.
- A valid seal does not establish authorship, ownership or scan time.
- The command does not re-hash the audio file; compare the recorded hashes yourself.
- The public default key makes the seal reproducible by anyone.
Frequently asked questions
What if I lost the key?
You cannot verify the existing seal. You can regenerate a report with a new key, but that is a new seal, not a recovery of the old one. Keep the key with the verification record.
Can I verify with the default key?
Yes, if the report was sealed with the default. That confirms the body matches the public constant, which anyone can reproduce; it is not evidence that a particular party produced the report.
Related topics
Test the actual delivery chain. A fixture result is a starting point, not a guarantee for your material.
Open the Studio →