Verification Guide

This guide explains how to verify MotionPrint-signed animations. Verification is completely client-side - your files never leave your device.

Online Verification

The easiest way to verify an animation:

1. Visit thirdrez.com/motionprint/verify
2. Drag and drop your GLB or BVH file
3. View the verification result

What You'll See

If verified successfully:

• Green checkmark
• Creator information
• License type
• Registration timestamp
• Certificate link

If verification fails:

• Red warning
• Reason for failure (no watermark, invalid signature, etc.)

Understanding Results

Verification Report Fields

Field	Description
ok	Boolean - true if signature is valid
creatorId	Creator identifier or alias
licenseId	License type (restricted, commercial, etc.)
issuedAt	ISO 8601 timestamp of registration
method	Embedding method (extras-v1, bvh-header-v1)
nonce	Unique 128-bit value for this registration
wmHash	SHA-256 fingerprint of canonical payload
signature	Ed25519 signature (hex encoded)

Sample Report

{
  "ok": true,
  "wmHash": "2ea3f0e7cacc2ee03bf5d62c789c...",
  "fileMeta": {
    "name": "dance_animation.glb",
    "size": 1186292,
    "type": "glb"
  },
  "watermark": {
    "creatorId": "green",
    "licenseId": "restricted",
    "issuedAt": "2025-11-25T22:52:51.331Z",
    "method": "extras-v1",
    "nonce": "f707614d6a07ff66d51933d6eeb3e0b0"
  },
  "signature": "0xeb1f72a31d84eea35c2aa249..."
}

Certificate of Authenticity

Each registered animation receives a PDF Certificate of Authenticity containing:

• Asset name and file metadata
• Creator alias and license type
• Verification timestamp
• Unique registry ID
• QR Code linking to online verification
• SHA-256 fingerprint

Accessing Certificates

Certificates are available:

1. At time of registration (download link)
2. Via the certificate URL embedded in QR code
3. Through your dashboard at app.thirdrez.com/motionprint

Programmatic Verification

JavaScript/TypeScript

import { verifyGLB, verifyBVH } from '@thirdrez/motionprint';

// Verify GLB file
const result = await verifyGLB(
  arrayBuffer,
  'animation.glb',
  PUBLIC_KEY_HEX
);

if (result.ok) {
  console.log('Verified!', result.watermark);
} else {
  console.log('Verification failed:', result.reason);
}

Canonical Payload

The signed message is a canonicalized JSON string:

function canonicalPayload(p: Payload): string {
  const ordered = {
    creatorId: p.creatorId,
    licenseId: p.licenseId,
    issuedAt: p.issuedAt,
    method: p.method,
    nonce: p.nonce,
  }
  return JSON.stringify(ordered) + '\n'
}

Field order matters: creatorId → licenseId → issuedAt → method → nonce

The trailing newline is required.

Security Considerations

Threat Model

Threat	Description	Mitigation
Removal	Attacker strips payload	Presence check, chain-of-custody
Forgery	Attacker creates fake signature	Ed25519 (EUF-CMA secure)
Transplant	Attacker copies watermark to different file	Content hash binding
Spoofing	Attacker manipulates verification UI	Open source verification code

Limitations

1. Format Conversion - Converting GLB to OBJ strips all metadata
2. Key Compromise - Private key exposure invalidates signatures
3. Creator Collusion - A creator may sign unauthorized copies

FAQ

Does verification upload my file?

No. All verification happens in your browser using WebAssembly. The file never leaves your device. You can verify this by:

• Opening browser DevTools → Network tab
• Performing verification
• Observing no file uploads

Can I verify offline?

Yes, after the initial page load, verification works without network connectivity. The verification code and public key are cached locally.

What if verification fails?

Possible reasons:

• File has no MotionPrint watermark
• Watermark was corrupted or modified
• File was converted to a format that strips metadata
• Signature doesn't match (tampered file)

Is MotionPrint like DRM?

No. MotionPrint doesn't restrict access or usage. It provides proof, not permission. Anyone can use the file; MotionPrint simply allows verification of origin.

---

Verify your animations: thirdrez.com/motionprint/verify