Cryptographically signed export (asymmetric signature)

Sign the integrity manifest with an asymmetric ECDSA key so an exported file is tamper-evident and attributable, verifiable with standard JWS tooling.

Problem

A SHA-256 hash manifest detects accidental corruption, but anyone who edits the file can recompute the hash and rewrite the sidecar — it proves nothing about who produced the file. For a clinical-legal or clinical-trial chain of custody you need a signature that a determined adversary cannot forge and that ties the export to a specific signing identity.

The app signs the integrity manifest with an asymmetric ECDSA P-256 (ES256) key. The .dcm.sig sidecar is a JWS JSON Serialization envelope whose signature covers the whole manifest body — the DICOM byte hash and the audit snapshot — so any later modification, or a swapped signer, fails verification. The sidecar verifies with off-the-shelf JWS tooling (jose, python-jose, OpenSSL) without any dcmage code.

Scope. This is a detached sidecar signature over the export plus its audit snapshot. It is not a DICOM PS3.15 in-file signature (CMS/PKCS#7 inside the .dcm), which targets PACS interoperability and stays deferred.

Steps

Establish a signing identity

1. Open Settings → Signing identity (or run “Signing identity…” from the command palette). A persistent ECDSA P-256 keypair is generated in your browser on first use — or import an existing key (JWK or PKCS#8 PEM).

2. The tab shows the key fingerprint (SHA-256 thumbprint), algorithm, and creation date. Use Download private key (.jwk) to back it up, and Download public key (.jwk) to share with recipients for out-of-band trust. Regenerate and Remove are confirmation-gated.

Export a signed manifest

3. Open the file (⌘O), then Click Export → Export with Integrity Manifest…. Two files download: the .dcm and the signed .dcm.sig manifest. The signing identity is established automatically if you have not set one up.

Verify signature and signer

4. Open the Verify Integrity Manifest modal — ⌘K → “verify”.

5. Upload the .dcm and the .dcm.sig; a ✓ indicator confirms each file loaded.

6. Click Verify — a matching, unmodified pair reads “Signature verified” and displays the signer fingerprint taken from the embedded public key.

7. Tamper test — flip a byte of the .dcm, or forge an entry inside the manifest, then re-verify: the modal reads “Verification FAILED”. A swapped public key, a legacy unsigned manifest, or a malformed envelope all fail closed too.

Result

The exported .dcm.sig is an ES256 JWS that proves the file is unmodified and attributes it to a signing identity. Verification confirms the signature against the embedded public key and surfaces the signer fingerprint, while any tampering, key swap, or legacy/malformed manifest fails closed — restoring the tamper-evident, non-repudiation property a bare hash manifest cannot provide.