Document cryptography — .qros envelopes, signatures and OTP

QROS document cryptography protects sensitive files with hybrid .qros envelopes — each document is signed and encrypted with a post-quantum key (ML-DSA, SLH-DSA, Falcon) layered over a classical key (Ed25519, X25519), so the envelope stays secure even if one family is broken. A one-time password bound to the recipient's certificate unlocks the payload, and anyone can re-verify the signature through a shareable link without contacting your backend.

What a .qros envelope includes

• Hybrid sign + encrypt — post-quantum (ML-DSA / SLH-DSA / Falcon) and classical (Ed25519 / X25519) keys in one envelope, so a break of either family does not expose the document
• Cert-bound OTP — a one-time password tied to the recipient's certificate; the document can only be opened by the holder of the matching private key
• Detached signatures — the signature travels with the file but can be verified independently of the payload
• Shareable verify link — a public page re-validates the signature, chain and revocation status without your backend
• LaTeX report — every envelope operation is recorded for the audit trail and exportable to the executive report

Sign, encrypt, verify

QROS splits each document into a signed payload, an encrypted envelope and a verifiable proof. The recipient proves possession of the cert-bound credential, enters the OTP, and decrypts; a third party — a regulator, an auditor or a counterparty — re-verifies the signature through the public link at any time, even years later, and the proof remains valid after the certificate expires.