What is Hash Chain?

Hash Chains for Audit Log Integrity

Hash chains provide mathematical proof that audit logs have not been tampered with. Each log entry includes the SHA-256 hash of the previous entry, creating a linked sequence where any modification is immediately detectable.

How Hash Chains Work

1. First entry — Hash is computed from the event data

2. Each subsequent entry — Hash is computed from the event data + the previous entry's hash

3. Verification — Recompute all hashes from the beginning; if any hash doesn't match, the chain is broken

Why SHA-256?

SHA-256 (Secure Hash Algorithm 256-bit) is a cryptographic hash function that produces a 256-bit (32-byte) digest. It is:

• Collision-resistant — Computationally infeasible to find two inputs with the same hash
• Pre-image resistant — Cannot reverse-engineer the input from the hash
• Avalanche effect — A tiny change in input produces a completely different hash

Hash Chains vs. Blockchain

Hash chains and blockchains both use cryptographic linking, but they differ:

FeatureHash ChainBlockchain

|---------|-----------|------------|

For audit logging, hash chains provide the same tamper-evidence guarantee without the overhead of blockchain.

How Trailbase Uses Hash Chains

Every event in Trailbase is cryptographically linked in a SHA-256 hash chain. You can verify the entire chain with a single API call (trailbase.verifyChain()). If any log has been modified or deleted, the verification will fail and alert you.