mtnviewpro

<p><strong>ArchivioID</strong> is an add-on plugin for <strong>ArchivioMD</strong> that adds a full cryptographic identity and signature layer to your WordPress site. It manages GPG public keys, verifies detached OpenPGP signatures on posts, supports multi-signer workflows with configurable thresholds, and exposes public proof pages so anyone can verify authenticity without logging in.</p>
<h4>Key Features</h4>
<ul>
<li><strong>Public Key Management</strong>: Store, manage, and rotate GPG public keys with expiry tracking and administrator alerts</li>
<li><strong>Post Signature Verification</strong>: Upload detached .asc signature files for posts — verified automatically using phpseclib v3</li>
<li><strong>Browser-Based Signing</strong>: Sign posts directly in the WordPress admin using a browser-held key — no server-side key material required</li>
<li><strong>Multi-Signature Workflows</strong>: Collect signatures from multiple key holders on a single post; each signer identified by key fingerprint and timestamp</li>
<li><strong>Configurable Signature Threshold</strong>: Require a minimum number of verified signatures before a post displays the verified badge — configurable globally or per post type</li>
<li><strong>Algorithm Enforcement Floor</strong>: Block weak signature algorithms (MD5, SHA-1) and enforce minimum RSA/DSA key sizes at upload, REST submission, and re-verification time</li>
<li><strong>Automated Re-Verification</strong>: Daily WP-Cron job re-verifies all signed posts and flags content that has changed since signing</li>
<li><strong>Key Expiry Notifications</strong>: Email alerts at 30, 14, and 3 days before a key expires, sent to the key owner or site admin</li>
<li><strong>Key Rotation Workflow</strong>: Admin UI for generating replacement keys, migrating existing signatures, and retiring old keys</li>
<li><strong>Bulk Verification</strong>: Verify all signed posts in a single admin action with per-post status reporting</li>
<li><strong>REST API</strong>: Full REST endpoint for programmatic signature submission, key retrieval, and verification status</li>
<li><strong>Key Server</strong>: Publishes active public keys at a stable well-known endpoint for external verifiers</li>
<li><strong>Bundle Download</strong>: Downloadable evidence package (hash, signatures, key fingerprints, timestamps) for any post</li>
<li><strong>Public Proof Pages</strong>: Stable public permalink at <code>/archivio-id/verify/{post_id}</code> — renders full chain of custody without requiring admin access</li>
<li><strong>Audit Logging</strong>: Immutable log of all verification attempts, key changes, and rotation events</li>
<li><strong>WP-CLI Support</strong>: Full CLI interface for batch operations and automated pipelines</li>
<li><strong>Visual Status Badges</strong>: Front-end badge showing verified / unverified / threshold-unmet status on every post</li>
</ul>
<h4>Requirements</h4>
<ul>
<li>WordPress 6.0 or higher</li>
<li>PHP 7.4 or higher (tested up to PHP 8.5)</li>
<li><strong>ArchivioMD plugin version 1.5.0 or higher</strong> (required parent plugin)</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>Upload your GPG public key via the ArchivioID <span aria-hidden="true" class="wp-exclude-emoji">→</span> Key Management admin page</li>
<li>Create or edit a post in WordPress</li>
<li>Upload a detached .asc signature file for the post, or sign directly in the browser</li>
<li>ArchivioID verifies the signature immediately and on every subsequent automated re-verify run</li>
<li>A verification badge appears on the front end; a public proof page is available at a stable permalink</li>
</ol>
<h4>Technical Details</h4>
<ul>
<li>Uses <strong>phpseclib v3</strong> for all cryptographic operations — no system GPG installation required</li>
<li>Uses <strong>OpenPGP-PHP</strong> for packet parsing and key handling</li>
<li>All key material and signatures stored in dedicated WordPress database tables</li>
<li>Algorithm enforcement floor consulted at upload, REST submission, and re-verification time</li>
<li>Multi-signature threshold evaluated before displaying the verified badge</li>
<li>Public proof pages require no admin login — safe to share externally</li>
<li>Fully WordPress coding standards compliant</li>
</ul>
<h4>External Services</h4>
<p>This plugin can make outbound HTTP requests to the following third-party services. <strong>All external lookups are opt-in</strong> and can be disabled under ArchivioID <span aria-hidden="true" class="wp-exclude-emoji">→</span> Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Key Server Lookup.</p>
<p><strong>keys.openpgp.org (VKS API)</strong><br />
When an administrator uses the Key Management page to look up a GPG public key by fingerprint or email address, the plugin sends a GET request to <code>https://keys.openpgp.org/vks/v1/</code>. No personal data beyond the fingerprint or email address entered by the administrator is transmitted. This request is made only on explicit administrator action and only when the “Allow key server lookup” setting is enabled.<br />
* Service: https://keys.openpgp.org<br />
* Privacy policy: https://keys.openpgp.org/about/privacy</p>
<p><strong>WKD — Web Key Directory (user’s email domain)</strong><br />
When an administrator looks up a key by email address, the plugin may also query the Web Key Directory endpoint on the domain portion of that email address (e.g. <code>https://example.com/.well-known/openpgpkey/</code>). This follows the OpenPGP Web Key Directory specification (draft-koch-openpgp-webkey-service). The request is made only on explicit administrator action and only when key server lookup is enabled.<br />
* Specification: https://datatracker.ietf.org/doc/draft-koch-openpgp-webkey-service/<br />
* The domain contacted is determined entirely by the email address the administrator enters; it is not a fixed third-party service.</p>
<p><strong>Identity Proof URLs (user-supplied)</strong><br />
Administrators may optionally store a public identity proof URL alongside each key (for example, a Keyoxide or Keybase profile page). These URLs are stored in the WordPress database and displayed as links in the frontend badge tooltip. The plugin itself makes no outbound request to these URLs; they are rendered as standard hyperlinks for visitors to follow voluntarily.<br />
* Keyoxide: https://keyoxide.org<br />
* Keybase: https://keybase.io<br />
* Any HTTPS URL may be entered; the plugin validates only that the value is a well-formed HTTPS URL.</p>
<h3>Source Code for Bundled Minified JavaScript</h3>
<p>This plugin includes <code>assets/js/openpgp.min.js</code>, the minified build of <strong>OpenPGP.js</strong>.</p>
<ul>
<li><strong>Project home</strong>: https://openpgpjs.org</li>
<li><strong>Source code</strong>: https://github.com/openpgpjs/openpgpjs</li>
<li><strong>License</strong>: LGPL-3.0-or-later</li>
<li><strong>Version used</strong>: 5.x (see <code>assets/js/openpgp.min.js</code> file header for exact version)</li>
</ul>
<p>To reproduce the minified file from source:</p>
<pre><code>`
</code></pre>
<p>git clone https://github.com/openpgpjs/openpgpjs.git<br />
cd openpgpjs<br />
npm install<br />
npm run build          # produces dist/openpgp.min.js<br />
    `</p>
<p>Copy <code>dist/openpgp.min.js</code> to <code>assets/js/openpgp.min.js</code> in this plugin.</p>
<h3>Security</h3>
<ul>
<li>All inputs sanitized and validated; all outputs escaped</li>
<li>Nonce verification on all forms and AJAX handlers</li>
<li>Capability checks (<code>manage_options</code>) on all admin actions</li>
<li>REST API write endpoints require authentication</li>
<li>SQL prepared statements throughout; no raw query interpolation</li>
<li>Algorithm enforcement floor blocks known-weak cryptographic primitives</li>
</ul>
<h3>Support</h3>
<p>For support, please visit: https://mountainviewprovisions.com/archivio-id</p>
<h3>License</h3>
<p>This plugin is licensed under GPLv2 or later.</p>


ArchivioID

OpenPGP signature verification, multi-signer workflows, key lifecycle management, and public proof pages for ArchivioMD.

Daniel Pereyra Costas

<p>This plugin allows you to insert a <em>“secure form”</em> into your website through a simple shortocde. It is usefull when you need to <strong>receive sensitive data of any kind, establishing a <em>“safe channel”</em></strong>.<br />
The data is sent encrypted with your PGP public key.</p>
<h4>Usage</h4>
<p>Just fill in some plugin options:</p>
<ul>
<li>The destination email (your email)</li>
<li>Your PGP public key in ASCII armored version</li>
</ul>
<p>Hint: to see your private key you can enter your computer console and run two commands, one to list and one to export (must have GnuPG):</p>
<pre><code>gpg --list-keys
gpg --armor --export username@email
</code></pre>
<p>Remember your public key needs to be exported in ASCII armored version, this means that will be surrounded with:</p>
<pre><code>-----BEGIN PGP PUBLIC KEY BLOCK-----

your-long-key-string-will-be-here

-----END PGP PUBLIC KEY BLOCK-----
</code></pre>
<p>Once the shortcode is placed into a page or post, it will render a form with the following fields:</p>
<ul>
<li>Message</li>
<li>Subject</li>
<li>Name</li>
<li>Email</li>
</ul>
<h4>How it works</h4>
<p>The <em>message</em> field will be encrypted with your <strong>PGP public key</strong> and sent as an attachment in <strong>ASCII</strong> format to the destination email you have configured.</p>
<p>When creating the plugin logic I have made sure that the <em>message</em> field <strong>is never sent to the web server</strong>, the data is previously encrypted (on the fly) using <em>OpenPGP.js</em> library in the user who is browsing the website.</p>
<p>You will only be able to decrypt the content of the attached file if you have the PGP private key belonging to the public key with which the message was encrypted.</p>
<p><em>Remember that the purpose of the plugin is only to display a form on your website and encrypt the information that is sent through the “message” field. This plugin does not take care of decrypting the attached file, this task is left to each user in the way they want.</em></p>
<h4>Some usage examples</h4>
<ul>
<li>Receive secret messages</li>
<li>Receiving passwords from clients or friends</li>
<li>Reception of sensitive information</li>
</ul>
<h4>Requirements</h4>
<p>In order to use this plugin you need to have or create a <strong>PGP key pair</strong>. If you don’t have your key pair generated you can browse the internet on how to generate it.<br />
There are many ways to generate the key, each have a different impact on security.</p>
<h4>TIP on generating PGP key pair</h4>
<p>One of the best ways of generating your PGP key pair is using a computer witout Internet connection and using <a href="https://tails.boum.org" rel="nofollow ugc">Tails OS</a>.</p>
<h4>Recommended software</h4>
<ul>
<li><a href="https://gnupg.org" rel="nofollow ugc">GNU Privacy Guard (Linux, OS X, Windows)</a></li>
<li><a href="https://gpgtools.org" rel="nofollow ugc">GPG Suite (OS X)</a></li>
<li><a href="https://www.gpg4win.org/" rel="nofollow ugc">Gpg4win (Windows)</a></li>
</ul>
<h4>Support</h4>
<p>When you cannot find the answer to your question on the FAQ section, check the <a href="https://wordpress.org/support/plugin/secure-encrypted-form/" rel="ugc">support forum</a> on WordPress.org. If you cannot locate any topics that solve to your particular issue, post a new topic for it.<br />
Remember this support is offered for free and can take some hours/days to answer and solve your issues.</p>
<h4>Secure Contact Form needs your support</h4>
<p>It is hard to continue development and support for this free plugin without contributions from users like you. <strong>If you enjoy using Secure Contact Form and find it useful, please consider <a href="https://charrua.es/donaciones/" rel="nofollow ugc">making a donation</a></strong>. Your donation will help encourage and support the plugin’s continued development and better user support.</p>
<h4>Privacy notices</h4>
<p>With the default configuration, this plugin, in itself, does not:</p>
<ul>
<li>Track users by stealth</li>
<li>Write any user personal data to the database</li>
<li>Send any data to external servers</li>
<li>Use cookies</li>
</ul>
<h4>Translations</h4>
<p>Actually the plugin ships in English and is translated to Spanish.<br />
You can contribute and <a href="https://translate.wordpress.org/projects/wp-plugins/secure-encrypted-form/" rel="nofollow ugc">translate this plugin to your own language</a>.</p>


Secure Encrypted Form


This plugin is an excellent tool to protect messages that contain passwords, banks data and other sensible information. It is an ideal plugin to share data between partners or collaborators.It is a great step to protect our privacy!


Excelent for privacy protect

This plugin adds a secure form in your website that uses OpenPGP encryption to secure sensitive communications.

ArchivioID vs Secure Encrypted Form