the ledger

i wanted a way to prove my telemetry hasn't been edited after the fact. including by me. this page walks through how it works using the actual records, so you can poke at it.

a fingerprint1

every record gets a fingerprint, a 64 character code made from its exact text. same text, same code, every time. change one character and you get a completely different code. you also can't go backwards and come up with a different record that lands on the same code.

try it. this is a real chess game from the log, one i lost. change "lost" to "won" and watch the code.

…

a tree2

then the fingerprints get paired up and fingerprinted again. then those get paired. keep going until there's one code left at the top, the root. if anything at the bottom changes, the root changes too.

these are eight real records. tamper with one and watch it climb. tap any record to see what you'd need to check just that one.

its path to the top what you need to check it changed

the real log looks the same, just with all records instead of eight. checking one still only takes about 12 boxes, one per level.

a signature3

every night, after the new records go in, the root gets written down with the date and the record count and signed with a private key only i have. you can check the signature with the public key below. you can't make one without my private key.

the latest signed root

date
…

check a record4

pick any record. your browser fingerprints it, climbs the tree using only the boxes it needs, and checks that it ends up at the signed root.

every night5

each night's root has to contain the night before's, untouched, plus whatever's new. your browser checks every pair. if i went back and edited or deleted an old record, the new root couldn't contain the old one and this would fail.

what it means6

what it proves

  • a record was in the log the night its root was signed
  • nothing signed since has been changed
  • the roots were signed with my key

what it doesn't

  • that a record was true when it was recorded. just that it hasn't changed since
  • that everyone sees the same log. git history and anyone who saved a root are the backup for that

you can run the same checks offline with python3 telemetry/ledger.py verify. it's the same structure certificate transparency logs use (RFC 6962), signed with Ed25519.