Hash Chain - SHA-256 Append-Only Incident Ledger

A hash chain is a sequence of records in which each record's cryptographic hash incorporates the previous record's hash. Any modification of an earlier record produces a different hash and breaks the chain at every subsequent record. Hash chains are the technical foundation of defensible records and are used in cyber incident response, audit logging, blockchain consensus, and any system requiring tamper-evident logging.

How a Hash Chain Works

Each event in the chain is stored with three core pieces of data: the event payload, a server-side timestamp, and a hash field. The hash field is computed as SHA-256(payload + timestamp + previous_hash). The first event uses a known starting value (the "genesis hash"). To verify the chain, an auditor walks every event, recomputes each hash, and compares it to the stored value. Any post-hoc modification breaks the recomputation.

Properties of a Hash Chain

• Tamper-evident: any modification of any earlier event is detectable
• Append-only: events can be added but not removed or revised without detection
• Deterministic: the same events produce the same chain
• Independent verification: anyone with the chain can verify it without trusting the producer
• Compact: the chain state is reduced to the latest hash, which can be timestamped externally for additional assurance

Hash Chains vs Blockchain

A blockchain is a hash chain with additional properties: distributed consensus among multiple parties, economic incentives for honest participation, and tamper-evidence across many independent nodes. A simple hash chain achieves tamper-evidence within a single producer but does not solve the distributed-trust problem. Most cyber incident response use cases need the single-producer hash chain, not the full blockchain, because the producer is the trusted party making the record.