achab/imda

Imda (إمضاء) — open-source digital signature and public key registry for Algerian public documents # Imda — إمضاء **Open-source digital signature for Algerian public documents.** A minimal tool to sign documents, plus a public key registry so that anyone can verify a document really comes from the institution that issued it (city hall, wilaya, ministry, university…). *An Open Source Algeria (OSA) project.* > **Status: prototype.** The signature format and the registry may still > change. Please don't use Imda in production without discussing it first in > the issues. ## What Imda does - `imda keygen` — generates an Ed25519 keypair; the private key is encrypted with a passphrase (scrypt + ChaCha20-Poly1305). - `imda sign document.pdf` — produces a detached signature `document.pdf.sig` (the original document is left untouched). - `imda verify document.pdf -signer dz/universities/usthb` — verifies the signature by resolving the public key from the registry. - Web verification page — a citizen drops in the document and its `.sig` and gets a verdict. Everything runs in the browser; no file is ever uploaded. - Public registry — one JSON file per institution, enrollment by pull request, Git history acting as a public audit log. One algorithm (Ed25519), one format, no options: the attack surface and the audit surface both stay tiny. ## Try it in two minutes ```sh go build ./cmd/imda ./imda keygen -comment "My city hall" ./imda sign order-42.pdf ./imda verify order-42.pdf -pubkey imda.pub ``` To verify against the local registry instead of the published one: ```sh ./imda verify order-42.pdf -signer dz/example/demo -registry ./registry ``` Verification works **offline** with any copy of the registry (`git clone` is enough) — useful where connectivity is limited. ## Trust model Cryptography only answers "this key signed this file." The real question is: **"does this key actually belong to this institution?"** The registry answers that transparently: every entry declares *how* the identity was verified — proof of control over the official domain (`.gov.dz`/`.dz …