Immutable, Tamper-Evident Audit Log

Audit records are written to an append-only, hash-chained store so any alteration or deletion is cryptographically detectable after the fact.

Append-only by construction

The audit log holds the decision lineage, access events, attestation results, and boundary crossings. Its value depends on being trustworthy after an incident, when an attacker or a careless insider might want to rewrite history. Kronos makes the log append-only and tamper-evident: each entry commits to the hash of the previous entry, forming a chain whose head is periodically anchored so that removing or editing any record breaks verification.

# Hash-chained append; verification catches any edit or gap
def append(entry):
    entry['prev'] = head_hash()
    entry['idx']  = next_index()
    entry['h']    = sha384(canonical(entry))
    store.write_wo(entry)          # write-once medium / WORM
    set_head(entry['h'])

def verify(chain):
    for i, e in enumerate(chain):
        assert e['idx'] == i
        assert e['h'] == sha384(canonical({k:e[k] for k in e if k!='h'}))
        assert i == 0 or e['prev'] == chain[i-1]['h']  # unbroken chain

Beyond a single log

• Write-once (WORM) media on the OT side so operators cannot overwrite entries.
• Periodic anchoring: the chain head is co-signed by two custodians and mirrored offsite via the diode, so a local rewrite conflicts with the external anchor.
• Independent from the control plane: an attacker who owns a controller still cannot silently rewrite the log's history without breaking hashes others hold.

What tamper-evident does and does not give

Tamper-evident is not tamper-proof: a sufficiently privileged attacker can still delete forward, but they cannot do so undetectably, and they cannot alter past entries without invalidating every subsequent hash and the external anchors. That detectability is what makes the decision-audit lineage admissible for incident reconstruction and regulatory review.

Design status: hash-chaining, verification, and anchoring are implemented and run against twin-generated audit streams. WORM hardware and the offsite anchor custodianship are provisioned in the FOAK build.