fe5e9cd07b
Three layers of integrity: - Hash chain (SHA-256 chained) catches silent edits - HMAC ratchet rotates keys every N entries with HKDF-style derivation and zeroizes old key bytes from memory - Merkle batch sealing builds tree over content_hashes, signs root with Ed25519 (FFI to libcrypto EVP_PKEY_ED25519 directly since stdlib lacks the high-level OpenSSL::PKey wrapper) AuditLog.append is mutex-guarded for serial writes; verify_chain detects both single-row tampering and structural inconsistency. BatchSealer's pack_message format (BE start_seq || BE end_seq || merkle_root) is shared between signer and verifier so external auditors can validate offline. |
||
|---|---|---|
| .. | ||
| advanced | ||
| beginner | ||
| intermediate | ||