Integrity Model
Integrity answers a narrower question than truth or authorization.
It asks whether the artifact being verified corresponds to the artifact that was originally identified or protected.
Integrity statement
Section titled “Integrity statement”Conceptually:
expected identity =computed identityIf the identities differ:
FAILWhat integrity can establish
Section titled “What integrity can establish”Depending on the evidence contract, integrity verification can support claims such as:
- artifact bytes have not changed
- canonical state identity matches
- expected evidence is present
- an ordered chain remains internally consistent
- a signature verifies against a declared public key
What integrity alone cannot establish
Section titled “What integrity alone cannot establish”Integrity alone does not establish:
- factual truth
- actor trustworthiness
- authorization
- intent
- policy compliance
- legal validity
- business correctness
Why this distinction matters
Section titled “Why this distinction matters”An artifact can be perfectly intact and still contain incorrect information.
Secure therefore treats:
integrity
and
truth
as separate concerns.
Failure principle
Section titled “Failure principle”Integrity-sensitive verification should produce an explicit failure rather than silently repairing or accepting unexplained differences.
Continue with Hashing →.