Learning objectives
- Explain hashing, digital signatures, and hash chains in plain language to a non-technical audience
- Correctly state what each guarantees — and what each does not
- Recognize and reject overclaiming by vendors
Content
- Hashing: a fixed-length fingerprint of data. Change one byte, the fingerprint changes completely. Does not encrypt, hide, or protect data — it detects change.
- Digital signatures: proves who produced a record and that it hasn't changed since. Does not prove the record was true when written.
- Hash chains: each record includes the fingerprint of the previous one, so altering any record breaks every record after it. Does not prevent alteration — it makes alteration detectable.
- Hands-on (30 min): participants hash a text file, change one character, hash again, observe. No installation — browser-based.
- The overclaiming section (20 min) — most important part of the module. Common vendor claims and what they actually mean:
| Vendor says | Actually means | Ask instead |
|---|---|---|
| "Blockchain-secured" | Usually: a hash chain. Sometimes: nothing. | "Anchored to what, verifiable by whom?" |
| "Military-grade encryption" | Marketing. Not a technical category. | "Which algorithm, which key length, keys held where?" |
| "Tamper-proof" | Nothing is tamper-proof. | "Do you mean tamper-*evident*? Who detects it?" |
| "Immutable" | Usually: append-only, with administrative override. | "Can anyone delete? Under what process?" |
| "Fully auditable" | Often: has logs. | "Can a third party who distrusts you verify independently?" |
Run the exercise
Assessment
review three anonymized vendor claims and identify what each does and does not guarantee. ---