Tamper-evident
Tamper-evident means that any alteration to a record can be detected, which is a different and more achievable property than preventing the alteration in the first place.
Last updated
Detection, not prevention
Tamper-evident means that if something is altered, the alteration can be spotted. It does not mean the alteration can be stopped.
The word is borrowed from packaging, where it is used precisely. A seal on a medicine bottle does not prevent anybody opening it; a determined person opens it in seconds. What the seal guarantees is that you can tell, before you swallow anything, that it has been opened. The security is in the visibility of the interference, not in the difficulty of it.
Tamper-evident is not tamper-proof
"Tamper-proof" claims that alteration is impossible. Almost nothing is tamper-proof, and a certificate is certainly not: anybody can open a PDF and change a name, or retype a document entirely.
Vendors use the two words interchangeably, and the substitution always runs in the same direction, because the stronger word sells better. It is worth being suspicious of it. A claim that a credential cannot be altered is either loose language or a misunderstanding of what the technology does, and the honest version is more useful anyway: the credential can be altered, and the alteration will not survive a check.
How a digital record is made tamper-evident
By computing a value from the exact contents of the record, in a way that cannot be recomputed by somebody who does not hold the issuer's private key. Change any character of the contents and the value no longer matches. That value is a digital signature, and the mechanism is what makes a verifiable credential verifiable at all.
The property this buys is narrow and precise: it establishes that what you are reading is what the issuer signed. It has nothing to say about whether what the issuer signed was true.
What a failed check actually means
Less than people assume, and this is the part worth carrying away. A signature that does not match tells you the signed contents and the presented contents differ. It does not tell you why.
Deliberate alteration is one explanation. Others are ordinary: a record corrected and not re-signed, a system migration that changed how a date or a name is stored, or a field re-encoded somewhere in transit. A failed check is a reason to ask the issuer, not a finding of forgery, and any system that reports it as fraud is overstating its own evidence.
A check that passes is the more definite of the two results. For what this platform's implementation covers, and what it explicitly does not protect against, the security page sets it out in full.
Related terms
- Digital signature
A digital signature is a value computed from a document and a private key, which anyone holding the matching public key can use to confirm that the document has not changed since it was signed and that it was signed by the holder of that key.
- Verifiable credential
A verifiable credential is a digital credential that carries its own cryptographic proof, so its authenticity can be confirmed from the credential itself rather than by contacting whoever issued it.
- Credential verification
Credential verification is the process of establishing that a credential was genuinely issued by the organisation named on it, to the person named on it, and has not been altered since.