Glossary
Tamper-Evident Log
A tamper-evident log is structured — typically by chaining each entry cryptographically to the one before it — so that altering any past entry breaks a verifiable chain, making the alteration detectable even to someone examining the log after the fact. An ordinary log file offers no such property: anyone with write access to it can edit history freely, and nothing about the file itself reveals that it happened.
This matters specifically because the party best positioned to want a log altered — someone whose actions the log recorded — is often also the party with legitimate access to where the log lives. Tamper evidence doesn't prevent someone from trying to edit a past entry; it ensures the attempt leaves a detectable trace.