PharmaQR

Lock 1 verifies the Dilithium2 (ML-DSA-44) signature against the standard, with no classical fallback. Lock 2 matches a SHA-256 fingerprint over the batch key, composition, pack size and manufacturer, so a valid signature on the wrong product still fails. Lock 3 is SPKI SHA-256 certificate pinning with Play Integrity or App Attest, so an unverified app cannot obtain a verdict. Lock 4 has the server recompute the strip HMAC, sign the verdict with the root Ed25519 key and encrypt it with an ephemeral X25519 key and AES-256-GCM. Locks 1 and 2 fail to COUNTERFEIT, Lock 3 fails to HTTP 403, and Lock 4 fails as a tampered response. The mobile client verifies the root signature before it renders any result.

Because the signature has to outlive the pack. NIST finalised ML-DSA under FIPS 204 in August 2024 and advises migration off RSA and ECC by 2030, and a strip signed today can still be on a shelf past that date — which makes a classical signature on long-dated stock a present risk rather than a future one. "Harvest now, decrypt later" applies directly to printed physical packaging, because the code cannot be re-issued once it is printed. A market scan found no publicly documented post-quantum pharmaceutical serialisation offering.

The system runs a thin server model. The central identity registry holds cryptographic identities and public records; operational batch data stays on self-hosted manufacturer infrastructure. Strip HMAC tokens and signatures are not stored anywhere — they are recomputed from batch key references on demand — and master wrapping keys never leave the hardware security module, with plaintexts zeroed in memory immediately after use.

No account and no registration. The public verification endpoints require zero authentication, no consumer PII is requested, and the zero-PII architecture is what the DPDP Act 2023 alignment rests on. A result reads GENUINE or COUNTERFEIT, or shows a yellow partial banner where certificate status could not be checked offline. Every verdict carries the six label fields Rule 96 of the Drugs Rules 1945 makes mandatory.

Yes. On-device verification runs against cached identity-registry snapshots with a 24-hour TTL, with a single OCSP-style certificate check per scan. Where certificate status cannot be reached, the app shows a yellow partial banner rather than reporting a strip as genuine on incomplete evidence.

A REST API over HTTPS with a published OpenAPI specification. Public verification endpoints need no authentication; admin operations are protected with JWT access tokens. Per-brand BATCH_REGISTERED webhooks fire on batch creation, and there are reconciliation CSV exports, invoice submission APIs, and signed registry snapshot and OCSP-style certificate endpoints. Backends run a Python API service with a relational database, manufacturer servers are self-hosted to keep the data boundary, and the HSM integration is standard PKCS#11 in software, simulated or hardware form — with AWS CloudHSM and Thales Luna on the procurement roadmap. The consumer app ships as an Android APK through EAS Build, with iOS App Attest support.

It does not stop physical cloning. Cryptography proves the data on a strip is authentic; it cannot prevent a printed QR being reproduced onto fake packaging. Lock 5 — a high-resolution Copy Detection Pattern printed at press limits, paired with an inner-pack confirmation code — is designed and currently unbuilt, and is the roadmap item that targets that attack. It also does not replace CDSCO, SUGAM, iVEDA or State FDA regulatory portals; the ISO 27001, 27701 and 42001 certifications are roadmap rather than held.