The Audit Trail Is a Data Structure, Not a Log Message

Short summary

Hash chains add cryptographic proof to audit trails by storing payloads with SHA-256 hashes and link hashes that detect tampering. The article covers transactional PostgreSQL implementation, preventing rollback desynchronization, and why canonical JSON serialization matters for legal compliance. The tradeoff: operational maintenance weight versus producing evidence rather than just storage.

• •Hash chains detect tampering, deletion, or reordering of audit events by chaining SHA-256 hashes of consecutive entries
• •Transactional consistency between document and chain rows is critical; use database functions to allocate chain indices rather than sequences to prevent rollback gaps
• •Canonical JSON serialization (RFC 8785) is required for hashes to remain valid across code updates; enforce with boot assertions

Generated with AI, which can make mistakes.