How Bit-Sign verification works
Bit-Sign creates a verifiable identity token by combining a HandCash cryptographic handshake with multi-factor evidence — passport photos, video statements, and hand-drawn signatures.
This identity token is portable and uniquely yours. It serves as an on-chain root for secure commit signing, IP registration, and document verification.
All sensitive operations — file hashing, encryption key derivation, and document locking — happen entirely in your browser. Bit-Sign never sees your plaintext data.
We use the HandCash SDK to trigger signing requests. Your signature locks and unlocks your secure assets on the Bitcoin SV blockchain.
When you authorize Bit-Sign via HandCash, we request the following permissions:
Bit-Sign supports true end-to-end encrypted document sharing. Documents are encrypted in your browser before upload and can only be decrypted by authorized recipients.
Each user generates an ECDH P-256 keypair in their browser. The public key is stored on the server for sharing. The private key is encrypted with a key derived from your HandCash wallet signature (AES-256-GCM) before server backup — the server never sees your private key in plaintext.
Each document is encrypted with a random AES-256-GCM envelope key. The envelope key is then wrapped for each authorized recipient using ECDH key agreement (with HKDF derivation and AES-KW wrapping). One encrypted document, multiple key wrappings.
To share a document: enter the recipient's HandCash handle → their public key is fetched → ECDH key agreement produces a shared secret → the envelope key is wrapped with that secret → only the recipient can unwrap and decrypt. The server facilitates transport but never has access to the plaintext.
The server stores: encrypted document blobs, encrypted private key backups, public keys, and wrapped key grants. It cannot see: plaintext documents, private keys, or envelope keys. Even a complete server breach reveals no readable content.
Your E2E private key is backed up on the server, but encrypted with a key derived from your HandCash wallet signature. To unlock your private key, you must sign a specific challenge with your HandCash wallet. This means:
Important
We never store your signatures or private keys in plaintext. Bit-Sign is an interface. Your data lives on the blockchain; your keys stay in your wallet. If you lose access to your HandCash account, you lose access to your encrypted documents and your E2E private key. There is no password reset.