Skip to main content

Ledger Introduction

The Immutable Record Challenge​

Organizations need to maintain records that are provably immutable and verifiable. Traditional databases, even with audit logs, can be altered by administrators or attackers. Regulatory compliance, legal discovery, and trust require stronger guarantees.

Key Challenges​

Database Mutability​

Conventional databases allow updates and deletes. Even with logging, proving that logs weren't altered is difficult.

Timestamp Manipulation​

System clocks can be changed. Without cryptographic timestamps, proving when a record was created is unreliable.

Future-Proof Security​

Today's hash functions and signatures will be vulnerable to quantum computers. Records created now may need to remain valid for decades.

Third-Party Verification​

Auditors and regulators need to verify records independently, without trusting the record keeper.

The Ledger Solution​

QCOS Ledger provides a cryptographically-secured append-only record system:

Record N-2       Record N-1       Record N
┌──────────┐    ┌──────────┐    ┌──────────┐
│ Data     │    │ Data     │    │ Data     │
│ Hash: X  │◄───│ Hash: Y  │◄───│ Hash: Z  │
│ Prev: W  │    │ Prev: X  │    │ Prev: Y  │
│ Sig: ... │    │ Sig: ... │    │ Sig: ... │
│ TS: ...  │    │ TS: ...  │    │ TS: ...  │
└──────────┘    └──────────┘    └──────────┘

Each record contains:

  • Data: The actual record content
  • Hash: SHA3-256 hash of this record
  • Prev: Hash of the previous record
  • Signature: ML-DSA-65 signature
  • Timestamp: Cryptographic timestamp proof

Core Properties​

1. Append-Only​

Records can only be added, never modified or deleted:

# This works
ledger.append(data={"event": "created"})

# This doesn't exist
ledger.update(...)  # ❌ No update operation
ledger.delete(...)  # ❌ No delete operation

2. Hash Chaining​

Each record's hash includes the previous record's hash:

Hash(RecordN) = SHA3-256(
    Data +
    Hash(RecordN-1) +
    Timestamp +
    Metadata
)

This means:

  • Altering any record changes its hash
  • Which breaks the chain for all subsequent records
  • Tampering is immediately detectable

3. Merkle Trees​

Records are organized in a Merkle tree for efficient verification:

                 Merkle Root
                     /\
                    /  \
                   /    \
                  /      \
               Hash       Hash
               /\          /\
              /  \        /  \
           Rec1  Rec2  Rec3  Rec4

Benefits:

  • O(log n) proof size
  • Verify any record without downloading all records
  • Detect tampering at any level

4. Post-Quantum Signatures​

All records are signed with ML-DSA-65:

  • NIST FIPS 204 standardized
  • 128-bit post-quantum security
  • Valid even when quantum computers exist

5. Cryptographic Timestamps​

RFC 3161 compatible timestamps prove when records were created:

  • Independent of system clock
  • Trusted Timestamp Authority
  • Legally recognized

Record Structure​

{
  "record_id": "rec_abc123",
  "sequence": 1523,

  "data": {
    "type": "audit_log",
    "action": "user_login",
    "user_id": "user_xyz"
  },

  "hashes": {
    "data_hash": "sha3-256:abc...",
    "record_hash": "sha3-256:def...",
    "previous_hash": "sha3-256:xyz..."
  },

  "merkle": {
    "root": "sha3-256:ghi...",
    "path": ["sha3-256:...", "sha3-256:..."]
  },

  "signature": {
    "algorithm": "ML-DSA-65",
    "public_key_id": "pk_xyz",
    "value": "base64:..."
  },

  "timestamp": {
    "time": "2026-02-06T12:00:00.000000Z",
    "authority": "softquantus-tsa",
    "proof": "base64:..."
  }
}

Use Cases​

Audit Logging​

Immutable record of all system actions for compliance.

Evidence Preservation​

Store evidence with cryptographic proof of when it was captured.

Regulatory Compliance​

Meet requirements for SOX, GDPR, HIPAA, and other regulations.

Supply Chain Provenance​

Track goods from origin to destination with tamper-proof records.

Provide verifiable records for litigation.

Research Integrity​

Prove when research data was collected.

Verification​

Anyone can verify a record:

from qcos.ledger import LedgerClient

ledger = LedgerClient()

# Verify a specific record
result = ledger.verify("rec_abc123")

print(f"Valid: {result.valid}")
print(f"Checks:")
print(f"  Hash chain: {result.chain_valid}")
print(f"  Signature: {result.signature_valid}")
print(f"  Timestamp: {result.timestamp_valid}")
print(f"  Merkle proof: {result.merkle_valid}")

Third parties can verify using:

  • The record and its Merkle proof
  • The public key for signature verification
  • The TSA certificate for timestamp verification

Integration with Other Modules​

With Evidence​

Evidence bundles are automatically stored in Ledger:

evidence = evidence_client.generate(job_id="...")
# Automatically creates ledger record

With ACOS​

Attestations are stored in Ledger:

cert = attestation.attest(job_id="...")
# Automatically creates ledger record

With NavCore​

Position evidence stored in Ledger:

position = gps.get_position(evidence=True)
# Automatically creates ledger record

Getting Started​

Ready to add immutable records to your application?

  1. Quick Start Guide - Append your first record
  2. API Reference - Explore the Ledger API
  3. Verification Guide - How to verify records
  4. Compliance Guide - Meet regulatory requirements

© 2024-2026 SoftQuantus Innovative OÜ