Audit Logging

Audit Logging: Cryptographically Verified Chains

In this lesson, you will learn how to implement an immutable, cryptographically verifiable audit log to ensure the integrity of security-critical operations in your Rust systems.

Standard application logs are prone to tampering; if an attacker gains unauthorized access, they can delete or modify log entries to hide their tracks. To solve this, we implement a Hash-Chained Audit Log. In this pattern, every log entry contains the hash of the previous entry, creating a linked chain where modifying a single byte breaks the validity of all subsequent records.

Implementation Strategy

We treat the log as an append-only structure. Each entry is serialized, hashed (typically using SHA-256), and stored alongside the previous hash.

use sha2::{Sha256, Digest};

struct AuditEntry {
    timestamp: u64,
    operation: String,
    prev_hash: [u8; 32],
}

impl AuditEntry {
    fn hash(&self) -> [u8; 32] {
        let mut hasher = Sha256::new();
        hasher.update(self.timestamp.to_be_bytes());
        hasher.update(self.operation.as_bytes());
        hasher.update(self.prev_hash);
        hasher.finalize().into()
    }
}

By maintaining this prev_hash reference, the system becomes self-validating. To verify the audit integrity, the system iterates through the log, recomputing hashes and ensuring they match the chain. If an entry is modified, the hash chain will mismatch, alerting the security monitor immediately.

Operational Security

For high-assurance systems, the "root of trust" for these logs often involves storing the latest hash in a secure, write-once storage location or signing the hash with a Hardware Security Module (HSM). This ensures that even if an attacker gains root access to the application server, they cannot perform a "rewriting attack" on the history because they lack the cryptographic material to re-sign the modified log chain.

When integrating this into your system, ensure that the serialization format (e.g., Protobuf or JSON) is deterministic; otherwise, the same log entry might produce different hashes due to field ordering, breaking your verification process.

Key Takeaway: By chaining hashes of sequential events, you transform standard logs into a tamper-evident audit trail where any unauthorized modification invalidates the entire subsequent history.