Last updated:

Integrity

Months later you have to be able to show that the dataset you see again is the same one you handed over. You do that with a hash, not with encryption.

Encryption proves nothing about changes

BitLocker protects against reading, not against changing. Whoever has the key can alter the content and lock the medium again. So do not write in a report that a medium is “protected against tampering” because it is encrypted. That is what a hash is for.

What a hash does

A SHA-256 hash is a 64-character value that follows from the content of a file. If a single message in a mailbox is changed, added or removed, the hash changes. Anyone who has the file and the original value can check that, without having to take your word for it.

A hash says nothing about files that are no longer there: what disappears leaves no deviating hash behind. That is why an inventory belongs with it.

Put the hashes in the signed report

A list of hashes on the medium itself proves nothing. Whoever can change the files can change that list as well. So also put the hashes in the report that you sign digitally. Then they are tied to your signature and to the moment of signing.

If the hash the recipient computes still matches the one in the report, the recipient can be sure that no third party tampered with it on the way.

What a matching hash proves The expert computes the hash on delivery and puts it in the signed report. The file travels by post, link or medium. The recipient computes the hash again. If both are equal, nobody tampered with it on the way. If they differ, the file was changed after delivery. Expert computes the hash on delivery In transit post, link or medium a third party could tamper here Recipient computes the hash again 7F3A…C91E in the signed report 7F3A…C91E ? Equal: nobody tampered with it on the way. Different: the file was changed after delivery.

What is on every medium

  • the data files;
  • MANIFEST.txt: what is in the dataset, what deliberately is not, and why;
  • CHECKSUMS_SHA256.txt: one hash per file.

Also put the hash of MANIFEST.txt in the report. Otherwise the very description of what is in it could change unnoticed afterwards.

Computing and checking hashes

PowerShell is on every Windows computer and computes SHA-256, for a single file or for a whole folder. So you need no extra software, and neither does a party: with the same command they can check a single file.

Also explain how a party checks the whole list. Such a check reports changed and missing files, but not a file that has been added. For that you need MANIFEST.txt, and a comparison of the number of lines in the list with the number of files on the medium.

The scripts to copy, and the pitfalls that come with them, are on Hashes in PowerShell.

Compute the hash on receipt

Compute the hash on receipt, not only on delivery. Then the initial state is fixed, and every later operation is a deliberate step instead of an unexplained difference.

The hashing itself is fast: 2 GB from memory takes a few seconds. From an external drive or a network folder it takes about as long as reading that drive.

Table of contents