Glossary
Hash chain
A hash chain is a list of records in which each record holds the fingerprint of the one before it, so a change to one breaks the rest.
How it works
A hash is a fingerprint: a short code worked out from data, such as the SHA-256 function in NIST’s FIPS 180-4. Change one byte of the data and the code changes completely. In a hash chain, each record stores the fingerprint of the record before it, and its own fingerprint covers that stored value. Change record 3 and its fingerprint changes. Record 4 still holds the old one, so the two no longer match, and every record after that disagrees too. Bruce Schneier and John Kelsey described using this to protect audit logs in 1999, in “Secure audit logs to support computer forensics”.
The same name is also used for repeated hashing of one value, as in some one-time password schemes. That is a different thing.
What it shows, and what it does not
A hash chain does not stop anyone from changing a record. It makes a change visible to anyone who checks, as long as the end of the chain is known. If someone cuts off the last records, the rest still agree with each other, so a note of where the chain should end is kept separately. Anyone who can rewrite the whole chain and that note together gets a chain that passes. A chain also does not say who wrote a record, or when.
Why it matters in an access review
Evidence is worth more when it cannot be changed quietly. A log of what was collected and a log of what was decided can be checked by someone who does not trust the people who handed them over.
How Acciew uses it
Acciew keeps a log for each source it collects from, and one for everything done in a customer’s organization, the review included. Each entry holds a fingerprint of its content and the fingerprint of the entry before it. A note names the last entry. The open-source acciew-verify reads a log and says whether it agrees with itself and with that note. We say “hash-chained, checkable against itself”. No signature is involved, and the checker cannot tell who wrote a log. The technical details say where to find the checker.
Common mistakes
- Expecting a chain to say who changed a record.
- Checking a chain without the note of where it ends.
- Trusting a chain whose end nobody recorded elsewhere.