Tamper-evident documents, and their limits

The precise meaning of tamper-evident

Tamper-evident does not mean a document cannot be altered. Digital files can always be copied, opened, and edited. What changes is the consequence: once sealed, a change to the content or history produces a mismatch that surfaces on inspection.

The usual analogy is a physical seal on a package. The seal does not stop someone opening the package, but a broken seal tells you it was opened. In a digital document the seal is a hash and a linked history, not tape or wax.

The layers that make change visible

One hash is not enough. If only the document were hashed, someone could edit the approval history without touching the document itself. The seal therefore uses several layers that hold each other up.

The strength of these layers lies in their clear limits. Each answers one narrow question. Together they make a consistent story hard to maintain once anything is changed.

How changes usually surface

There are a few points where changes most often appear. Knowing them helps when a check returns a mismatch.

1. Document content is edited, for example an amount or vendor name. The document hash no longer matches.
2. The certificate page is removed or replaced. The package hash no longer matches the seal record.
3. One approval step is removed from the history. The audit chain breaks and the audit root changes.
4. The file is reprinted or reprocessed. Its bytes change, so the package hash changes too.
5. The sealing time is backdated. The time authority's token no longer supports that claim.

On a check run through the verification page, a mismatch appears as a failed result, not as a verdict on intent. Your job is to find out why the file differs, not to jump straight to bad faith.

Why a hash alone is not enough

A hash is one-way. The same hash means the same content, and any change produces a different value. But a hash has no time. It also does not say who made it or when.

Without a timestamp from a third party, someone could create a document today and claim it existed last year. A trusted time authority closes that gap by signing that a given value existed at a given time. In Segel the timestamp follows RFC 3161.

Without an audit chain, a document hash protects only one file. The audit chain protects the order of events: submission, review, approval, rejection, and return for changes. Each event links to the one before it, so removing one row breaks the sequence.

What cannot be guaranteed

Segel cannot guarantee that an approved document is factually right. If an invoice carries a wrong amount and every approver signs off, the seal still proves that this version was approved. The seal records decisions. It does not judge them.

Segel also does not guarantee the identity of the person behind an account. If someone's credentials are used by another person, the record shows the account, not the human. Access control, passwords, and internal policy still matter.

Finally, the seal does not replace legal or compliance obligations. It provides technical evidence. Whether that evidence is sufficient for a purpose remains a human judgement and, where needed, a legal one.

How to use the claim honestly

When explaining the seal to an auditor, a client, or your team, use sentences you can defend. Avoid words that promise more than the evidence supports.

• Say: the record is tamper-evident, so changes to the file or its history are detected.
• Say: the record is independently verifiable by anyone holding the file.
• Do not say: this document cannot be forged.
• Do not say: this document is automatically valid in court or meets every legal requirement.

The accurate wording is actually more useful. Auditors rarely ask for an absolute guarantee. They ask for evidence they can check and a consistent account of its limits.

When this approach fits

A tamper-evident approach earns its place when a decision involves several people and evidence is needed after the process ends. Invoice approval, contracts, purchase requests, and internal documents reviewed by an authority all qualify.

It matters less for documents that stay entirely internal and are never checked again. A shared folder may be enough for those. The question to weigh is the cost of rebuilding the evidence when someone eventually asks.