quey-verify-demo

Verify a Quey draw certificate in under 30 lines of code.

Quey produces verifiable random selections — every draw is signed with Ed25519 and published with a certificate anyone can check. This repo shows how to verify a draw locally, without trusting Quey or any server. Just standard cryptography against a public key.

• verify.py — Python verification (uses cryptography)
• verify.js — Node.js verification (uses native crypto, zero npm dependencies)
• certificate.json — A cached certificate from the live demo draw, for offline testing

---

Run it

# Python
pip install cryptography
python3 verify.py

# Node.js (no install needed)
node verify.js

Expected output:

✓ Signature verified
  Draw ID:    89421ffc-6af3-427e-8123-fa6c799cc166
  Timestamp:  2026-05-25T22:17:05.037Z
  Winners:    indices [2, 4] out of 5 participants
  Public key: 4fad999c2b586aab53155afc97f564a231350087b4c66d6a8f868963f42caf15

Other ways to run:

python3 verify.py <draw_id>          # verify a specific draw
python3 verify.py --offline          # verify the cached certificate.json
node verify.js <draw_id>
node verify.js --offline

---

What's being verified

Each Quey draw produces a certificate like this:

{
  "version": 1,
  "draw_id": "89421ffc-6af3-427e-8123-fa6c799cc166",
  "timestamp": "2026-05-25T22:17:05.037Z",
  "input_hash": "bba0fa0d23ba8190e914d02173a470bb7cce7c04d69d8bd576c3e30969caaa97",
  "total_participants": 5,
  "num_winners": 2,
  "winning_indices": [2, 4],
  "entropy_consumed_bytes": 1,
  "key_id": "1ec2b73ecd9dab6e",
  "signature": "2db13ef4b5fd180ac9435443c6e2f39410c3e126a5cbdfc8c7010b8a2e90a722b34cf4f9446e125f711dba8a6ec4be26f8beac2024212f6fe2d1275aec955b01",
  "verify_url": "https://queyquantum.io/verify/89421ffc-6af3-427e-8123-fa6c799cc166"
}

Quey signs a canonical representation of nine of these fields with Ed25519. The signature can be verified offline using Quey's public key — no API call, no server trust required.

The canonical format is:

QUEY-DRAW-CERT-V1|<draw_id>|<timestamp>|<input_hash>|<total_participants>|<num_winners>|<winning_indices joined with ",">|<entropy_consumed_bytes>|<key_id>

For the demo draw above, that yields:

QUEY-DRAW-CERT-V1|89421ffc-6af3-427e-8123-fa6c799cc166|2026-05-25T22:17:05.037Z|bba0fa0d23ba8190e914d02173a470bb7cce7c04d69d8bd576c3e30969caaa97|5|2|2,4|1|1ec2b73ecd9dab6e

The Ed25519 signature in the certificate is computed over the UTF-8 bytes of this string.

---

Quey's public key

4fad999c2b586aab53155afc97f564a231350087b4c66d6a8f868963f42caf15

This key is constant. You can fetch it yourself at any time:

curl https://getpublickey-33ssvbagba-uc.a.run.app

---

What this proves

Successful signature verification establishes that:

1. The certificate was produced by Quey. Only the private key paired with the public key above can produce a signature that verifies.
2. The certificate hasn't been modified. Changing any field invalidates the signature.
3. No trust in Quey is required. Verification runs locally with public cryptography. Quey could go offline forever and you could still verify this certificate.

---

Full trustless verification for list-mode draws

When a Quey draw is made with mode: "list", the client sends a list of participants and the server computes input_hash as the SHA3-256 of participants.join("\n"). A giveaway organizer can publish both the participant list and the certificate, letting any participant re-derive the hash themselves:

import hashlib

participants = ["Alice", "Bob", "Charlie", "Diana", "Eve"]
expected_input_hash = hashlib.sha3_256("\n".join(participants).encode("utf-8")).hexdigest()
assert expected_input_hash == cert["input_hash"]

This binds the certificate to that exact participant list. Combined with the signature check, it gives end-to-end verification: the right list was used, the result wasn't tampered with, and Quey didn't pick favourites.

---

Learn more

• Website: queyquantum.io
• Documentation: queyquantum.io/documentation
• NIST SP 800-90B validation: queyquantum.io/stats
• See the demo draw verified in your browser: queyquantum.io/verify/89421ffc-...

---

License

MIT