d80357cc23be07157410e5131be6e5d07da687a0654039c2afaa884750bf2e5a
01/ 10
A fingerprint for any text
A hash function turns any text, a word or a whole book, into a fingerprint of fixed size. SHA-256 gives 256 bits, written as 64 hexadecimal digits. The stage draws them as 64 ticks round a dial.
The same text always gives the same fingerprint. Type into the box and watch it.
02/ 10
Change one letter
Change a single letter and the fingerprint changes completely, not a little. On average about half of the 256 bits flip. Cryptographers call it the avalanche effect.
So you can't nudge a record and keep its fingerprint. Any change, however small, shows.
03/ 10
You can't work backwards
Going from text to fingerprint is instant. Going back is not: the only known way to find a text with a chosen fingerprint is to guess, again and again.
Try it: ask your own browser to find a text whose fingerprint starts with a few zeros, and watch how fast the work grows.
04/ 10
Receipts in a chain
Now give every receipt one extra line: the fingerprint of the receipt before it. Then fingerprint the whole receipt, that line included.
Each receipt is now tied to everything that came before. Nobody needs to trust the order; it is written into the fingerprints.
05/ 10
Edit an old receipt
Say someone changes receipt 2 after the fact: ₹800 becomes ₹8,000. Its fingerprint changes. Receipt 3 holds the old one, so if you rebuilt the chain, receipt 3's fingerprint would change too, then 4's, then 5's.
One edit moves every fingerprint after it. Edit any receipt on the stage and watch the dials re-cut.
06/ 10
Then rebuild everything after it?
A careful forger would do exactly that: change the receipt, then recompute every later fingerprint so all the links check out again.
It works, with one catch: the chain now ends on a different fingerprint. If a copy of the latest fingerprint was kept somewhere else (sent to the owner each night, or to an auditor), the rewrite shows.
07/ 10
A seal only the business can make
The second defence is a digital signature. The business signs each fingerprint with a private key it never shares. Anyone can check a signature with the matching public key, but nobody can make one without the private key.
The forger can recompute fingerprints, but can't re-sign them. The stage made a real key pair in your browser, just now.
08/ 10
Anyone can check
Verifying needs no trust in whoever stored the receipts: recompute each fingerprint, check each link, check each seal with the public key, and compare the end with the copy held elsewhere.
Run the verifier on the stage, then tamper and run it again.
09/ 10
How INDRA writes its receipts
In INDRA, every action by a person, an agent or the system becomes a receipt. Its fields are written as one line of JSON with the keys in a fixed order, fingerprinted with SHA-256, linked to the receipt before, and signed with the business's Ed25519 key.
An auditor can take an export with the receipts, the public key and the rules for checking, and verify it offline. On screen, gold means one thing: the signature verified. Open the INDRA live demo.
10/ 10
What it can't prove
A chain of signed receipts proves that the record wasn't changed after it was written, and who wrote it. It doesn't prove the record was true. That is what the person's approval, and the evidence beside it, are for.
It is also our name: वृत्तान्त, vṛttānta, means an account of what happened.