Every entry commits to the one before it, unbroken back to genesis. Change a single record and the chain no longer verifies — tampering announces itself.
The chain is anchored at genesis so every later state has a provable origin.
The genesis block fixes the ledger's initial parameters, issuer authority, and cryptographic domain. No valid block can precede it and no rewrite can relocate it.
Blocks carry a strictly increasing height, and the protocol rejects any block that does not extend the current tip. There is no branching or replacement of committed history.
Each hash includes a chain and network identifier. A block from one ledger can never be replayed as a valid block on another.
Backward references make the chain a single cryptographic thread.
Every block header stores the hash of the prior block. Recomputing forward from genesis reproduces the current tip hash exactly, or reveals the precise point of divergence.
Transactions in a block are committed under a Merkle root, so a single header hash binds every entry and the position of each one.
Height, timestamp, previous-hash, and Merkle root all sit inside the hashed header. Altering ordering or timing breaks the link as surely as altering a transaction.
The strength of the chain is the strength of its hash function.
The chain relies on a cryptographic hash where finding two inputs with the same digest is computationally infeasible. No substitute block can present the same fingerprint.
Digest sizes are chosen with quantum search in mind, preserving preimage and collision hardness against an adversary with quantum resources.
Block commitments are signed with ML-DSA-65 (FIPS 204). A verifier confirms not only that history is intact, but that the authorized issuer produced it.
Trust is replaced by recomputation.
A verifier walks from genesis, rehashing each block and checking each backward pointer, ending at the published tip hash — without trusting the operator.
A Merkle path lets a party prove a single transaction is committed at a specific block and position, without revealing or transmitting the whole ledger.
The current tip hash can be published or externally anchored, giving every participant a shared reference against which local copies are checked.
The design assumes an adversary with write access and still detects them.
Changing any historical field changes its block hash, which invalidates every subsequent previous-hash pointer up to the tip. The damage cannot be contained to one record.
Removing or reordering a block breaks height continuity and the backward chain, so omission is as detectable as modification.
Because owners hold verification keys and retain their own copies, no operator can silently rewrite the past without every custodian's copy disagreeing.