Provenance Chain – A Lightweight Cryptographic Integrity Verification System

In an era where digital trust is paramount, ensuring the integrity of log files and audit trails is critical for security compliance and operational transparency.

This white paper outlines the architecture, functionality, and use cases of Provenance Chain. It serves as a foundational tool for administrators and developers who need to prove that Server Logs, Revision Logs, or Access Logs have not been tampered with after initial recording.

2. Introduction: The Problem of Log Integrity

Digital logs are often the first line of defense in incident response. However, once a log file is created, it can be silently modified by an administrator or a compromised user. Traditional checksums (like MD5) or simple text comparison fail to detect tampering if the modification occurs after the initial hash was calculated but before verification.

The Challenge:

1. Single-Point Failure: A single file edit invalidates trust in that specific record.
2. Lack of Context: Standard hashes don't account for the order or sequence of data blocks.
3. Complexity: Implementing blockchain-style verification usually requires heavy server-side resources (e.g., Ethereum, Hyperledger).

The Solution:

Provenance Chain provides a lightweight, browser-based solution that links data blocks together using SHA-256 hashing to create an immutable chain of custody for text-based logs.

3. Technical Architecture

3.1 Core Cryptography: SHA-256

At the heart of Provenance Chain is the Secure Hash Algorithm 256-bit (SHA-256). This cryptographic function ensures data integrity through four key characteristics:

• Deterministic: The same input always yields the exact same hash.
• Avalanche Effect: A single character change results in a completely different hash output.
• Irreversible: Original text cannot be derived from the hash.
• Collision Resistant: It is statistically improbable for two different inputs to share the same hash.

Hash = SHA-256(Index + Previous_Hash + Data)

1. Index: The sequential position of the block (0, 1, 2...).
2. Previous Hash: The cryptographic signature of the immediately preceding block.
3. Data: The raw text content entered or imported.

3.2 Implementation: Web Crypto API

To ensure security and privacy, Provenance Chain utilizes the native browser Web Crypto API. All hashing operations occur locally within the user's browser (crypto.subtle.digest), meaning sensitive log data does not necessarily need to be sent over a network during verification.

// Simplified look at our hashing function:
async function calculateHash(index, previousHash, data) {
    const message = index + previousHash + data;
    const encoder = new TextEncoder();
    const msgBuffer = encoder.encode(message);
    
    // Perform the SHA-256 Hash
    const hashBuffer = await crypto.subtle.digest('SHA-256', msgBuffer);
    
    // Convert the buffer to a Hex String
    const hashArray = Array.from(new Uint8Array(hashBuffer));
    return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
}

4. Core Features & User Workflow

Feature	Description
Add Block	Type text into an input box and click "Add Block" to create a new entry in the chain. Ideal for real-time log generation.
Verify & Proof	Drag and drop exported CSV files. The system ignores the "Status" column and manually re-calculates every hash from raw data.
CSV Import/Export	Saves the current chain state (including hashes) to a .csv file for archival. Allows bulk-loading of previously exported chains.
Visual Integrity Feedback	Green/Normal: Block matches expected hash. Red/Corrupted: Block's hash doesn't match previous link (e.g., after manual editing). Status Indicator: Displays "Chain Broken" when a domino effect is triggered.

5. Use Cases: Daily Application of SHA-256

Scenario	Description & Benefit
Server Logs	Monitoring logs from a web server or database. Detects if an admin manually edited the log to hide errors after the fact.
Revision Logs	Tracking changes in document versions (e.g., Git-like text). Proves that Version B is derived directly from Version A without hidden edits.
Access Logs	Recording who accessed a system and when. Ensures an attacker cannot modify their own entry to hide access.
Audit Trails	Financial or compliance records. Provides a "Chain Fingerprint" for third-party verification of record integrity.

5.1 Admin vs. User Edit Detection

In many systems, admins have elevated privileges and can edit logs. Provenance Chain allows users to:

1. Record the initial state (Admin creates Block #0).
2. Allow a User to add subsequent blocks.
3. If an Admin later edits Block #0 manually, the User's view of the chain will show Block #1 as "Red/Corrupted," proving that the foundation was altered.

6. Security & Privacy Model

• No Server Dependency: The verification process does not require a central server to validate the chain; the CSV file itself contains all necessary cryptographic proofs.
• Avalanche Security: Even if an attacker modifies one line of text in a 10,000-line log, the entire subsequent chain will fail verification, making tampering obvious rather than subtle.

7. Conclusion

Provenance Chain represents a practical application of cryptographic theory for everyday digital hygiene. By combining SHA-256 with a linked-list architecture, it transforms simple text logs into cryptographically secure records.

With its ability to export and deep-verify via CSV files, Provenance Chain bridges the gap between complex blockchain technology and simple daily operational needs.

Contact & Support:

For further technical details on the Web Crypto API implementation or CSV schema specifications, refer to the README.md documentation included in the project repository.