Feranor

Consulting

Feranor PQC Suite releases

The release certificate

Every version is one archive, the same for every customer, whose checksums are signed with Feranor's release certificate. The archive carries it as feranor-release.pem (SLH-DSA-SHA2-256s, valid until 8 October 2036). Before trusting it, compare its SHA-256 fingerprint with this one:

07:F1:60:E8:CE:C5:C5:CF:A9:F8:DC:44:E5:6F:09:19:9C:63:C1:79:E9:7D:6C:AF:C5:76:C2:E5:CA:E8:77:C1

Checking an archive

In the folder of the unpacked archive, with the signature SHA256SUMS.p7s next to it, and OpenSSL 3.5 or later: the first command must print 1, the second the fingerprint above (without its colons, in lowercase), the third CMS Verification successful, the last OK for every file. The customer guide in the archive gives the same checks for Windows and for older systems.

grep -c 'BEGIN CERTIFICATE' feranor-release.pem
awk '/-----BEGIN CERTIFICATE-----/{f=1;next} /-----END CERTIFICATE-----/{exit} f' feranor-release.pem | base64 -d | sha256sum
openssl cms -verify -binary -inform DER -in SHA256SUMS.p7s -content release/SHA256SUMS \
  -CAfile feranor-release.pem -purpose any -out /dev/null
cd release && sha256sum -c SHA256SUMS

Published versions

The first version listed here will be 1.0.0.