SOURCE_URL: https://majikah.solutions/products/majik-buwiz/docs/buwiz-invoices-signing

---
title: "Signing Invoices with ML-DSA-87"
id: "buwiz-invoices-signing"
group: "majik-buwiz"
type: "products"
version: "0.1.1"
lastUpdated: "2026-05-13T00:00:00.000Z"
difficulty: "Intermediate"
time: "5 minutes"
tags: [signing, ed25519, ml-dsa-87, fips-204, post-quantum, dual-signature, seal, verify, integrity, tamper-proof]
---

# Signing Invoices with ML-DSA-87

> How invoice signing works, what it protects, and how recipients can verify signed invoices

## Overview
Signing is the act of issuing an invoice — it seals the financial content with a tamper-proof dual signature (Ed25519 + ML-DSA-87) and transitions the invoice from Draft to Issued. This doc explains what signing does, what it covers, and how to verify a signature.

### What signing does

When you sign an invoice in Majik Buwiz, two independent digital signatures are computed simultaneously over the invoice's financial content: one using Ed25519 (a classical elliptic-curve algorithm) and one using ML-DSA-87 (CRYSTALS-Dilithium, standardized by NIST as FIPS-204). Both signatures are stored in the invoice's integrity block alongside the signer's public keys, a content hash, and a timestamp. The invoice business status transitions from Draft to Issued at the moment of signing. After signing, the financial content of the invoice is locked — any attempt to alter line items, taxes, parties, amounts, dates, or references will invalidate the signature.

### What the signature covers

The signature does not cover the entire invoice JSON. It covers a deterministic canonical snapshot of the financial fields only: line items, taxes, parties (issuer and recipient), currency, invoice number, issue date, due date, billing period, payment terms, and document references. Fields that legitimately change after signing — business status, notes, tags, metadata, proof-of-payment records, and timestamps — are intentionally excluded. This means a signed invoice can be marked as sent, have payments recorded, and have notes updated without invalidating the original signature. Only changes to the financial content require a reissue.

### How to sign an invoice

1. **Complete the invoice**
   *All required fields must be filled*
   - Ensure the invoice has at least one line item, a valid issuer, and a recipient.
   - Review all amounts, taxes, dates, and references — these cannot be changed after signing without reissuing.

2. **Sign**
   *Your Majik Key must be unlocked*
   - Select Sign Invoice from the invoice actions.
   - Your Majik Key must be unlocked (you entered your passphrase when the app opened). If the key is locked, you will be prompted to unlock it.
   - Majik Buwiz computes the canonical content hash and applies both Ed25519 and ML-DSA-87 signatures. This operation is local — no data is sent to any server.
   - The invoice transitions to Issued status and its integrity status becomes Fully Signed (or Sealed if sealing was applied).


### Sealing a signed invoice

After signing, you can optionally seal the invoice. Sealing permanently prevents any further signatures or modifications to the integrity block. Only the original signer (the issuer) can seal. The seal is computed as a SHA3-512 hash over all attached signatures, the signer's public keys, and a seal timestamp — it is stored alongside the invoice so any party can independently verify it. Once sealed, the invoice's integrity status is Sealed and the invoice is completely immutable from a cryptographic perspective.

### Multi-signature invoices

Majik Buwiz supports multi-signature workflows through an expected signers allowlist. When creating an invoice, the issuer can specify a list of additional required signers — for example, an approver or a countersigning party. Only signers on the allowlist can add their signature. The integrity status shows Partially Signed until all expected signers have signed, then transitions to Fully Signed. Recipients countersign using their own Majik Key. The issuer seals the invoice once all signatures are in place.

### Verifying a signature

Anyone with the invoice file can verify its signatures locally inside Majik Buwiz — no internet connection required. Verification recomputes the canonical content hash from the invoice's financial fields and checks it against each attached signature using the signer's public keys embedded in the signature entry. If any financial field was modified after signing, the hash will not match and verification will fail, flagging the invoice as Invalid.

### Verifying via a public MUID profile

If the issuer has a Majik Universal ID, anyone can verify the invoice against their public profile. Navigate to the issuer's MUID public profile page and drag the invoice file (.mjki) or paste the raw invoice signature string. The profile verifies the signature using the issuer's published public keys and displays the verification result — valid, invalid, or tampered.

> **NOTE:** If you need to correct financial content after signing, use Reissue — this clears all signatures, rebuilds the content hash from the updated invoice, and returns the invoice to an unsigned state ready to be re-signed. Reissuing is not the same as creating a credit note — use a Credit invoice type to formally reverse a previously issued invoice.