Tamper-evident storage

Lens adapted to this topic: Standard definitions, designs, and practical uses

The mainstream technical view treats tamper-evident storage as an integrity and evidentiary control: it preserves signals or records that can reveal later alteration, deletion, truncation, or unauthorized access. Designs may use cryptographic chaining, trusted audit trails, write-once behavior, sensors, encrypted logs, or combinations of these. The goal is detection and accountability, not absolute prevention. More advanced containers can continuously monitor conditions and record a protected integrity history, but their usefulness still depends on appropriate implementation and custody.

• Tamper-evident storage is intended to make later changes or deletion attempts discoverable through integrity checks, chained hashes, write-once features, or trusted audit trails.
• A tamper-evident system is not automatically immutable or tamper-proof; it may detect modification after it occurs rather than prevent it.
• Advanced containers can integrate sensors with encrypted electronics to monitor conditions and permanently record the protected item's security history.
• The approach is useful where records may later be examined during an incident, dispute, investigation, or chain-of-custody process.

Lens adapted to this topic: Limits, attackability, and trust-boundary concerns

A skeptical security view argues that tamper-evident storage can create false confidence if the recorder, installer, inspector, or monitored system controls the evidence. Testing of physical seals found that many could be defeated rapidly and cheaply, while expensive or electronic designs were not inherently more reliable. On this view, a log proves only that a logging function ran unless the observation and evidence channel are sufficiently independent of the system being monitored.

• Testing reported that all 94 studied security seals could be defeated using rapid, inexpensive, low-tech methods, and that cost did not predict security.
• A Los Alamos assessment warned that seals are often easily spoofed in typical use and that better training, seals, and procedures are needed.
• High-tech or electronic seals are not automatically more reliable than simple mechanical seals; operational discipline and inspection can be equally important.
• A log controlled by the monitored agent may show only that a logging function ran; stronger evidence requires an independent trust domain and a channel the agent cannot modify.
• Tamper-detection programs can be undermined by poor training, vague standards, unrealistic assumptions, and one-size-fits-all designs.