Tamper-evident, not tamper-proof

A signed document leaves your building as a file. Somebody can open it, change a figure, and print it.

There is no way to prevent that. Once a copy exists outside your control, it is theirs to modify. The useful goal is not prevention — it is detection: making it so that any alteration can be demonstrated, by anybody, without having to trust the person holding the copy.

That distinction is worth being precise about, because "tamper-proof" is the word people reach for and it promises something no system delivers.

What tamper-evidence actually requires#

Three things, and each one has an obvious wrong implementation.

A fingerprint of the exact bytes. A cryptographic hash of the finished document. Change one character and the fingerprint changes completely. This is the mechanism, and it only works if the fingerprint is of the final document — including every signature mark, every stamp, every appended page.

A way to check that fingerprint against a copy you did not produce. A number printed on the page is useless unless a person holding the paper can verify it against something authoritative. In practice that means a URL, and a QR code so the URL can be reached from a printed page without typing.

A record on your side that says what the fingerprint should be. Kept append-only, because a fingerprint register somebody can edit is a register that certifies whatever the last editor wanted.

Where the marks go, and why the order matters#

There is an ordering constraint here that is easy to get wrong and hard to recover from.

Signature marks have to be drawn first, and the whole document sealed and fingerprinted afterwards. Sealing first and then adding signatures produces a fingerprint of a document that no longer exists.

Stated like that it sounds obvious. It is not obvious when the signing feature and the sealing feature are built at different times by different people, and the natural order of implementation is the reverse of the correct one.

The same applies to every page. Fingerprinting only the last page — the one with the signature on it — leaves every other page of the document unprotected, which is a substantial gap on any document longer than one sheet. A work order whose last page is provably genuine and whose middle pages can be replaced is not tamper-evident in any useful sense.

The strip at the foot of every page#

The practical implementation we settled on puts a reserved strip at the bottom of every page carrying four things: the document number, page N of M, the fingerprint, and a QR code that reaches the verification page.

Each of those four is doing a specific job.

The document number identifies which document this claims to be.

Page N of M is what makes page removal detectable. Without it, deleting a page from the middle produces a shorter document that is otherwise entirely plausible.

The fingerprint is the check itself.

The QR code is what makes the check available to somebody holding paper, which is the only situation in which any of this matters. A verification mechanism that requires the verifier to already be inside your system verifies nothing for the people who need it.

The strip is reserved, visibly, at the point where somebody chooses where a signature goes, and again on the server when the document is produced. A signature laid over that strip would hide the four things that would have to be forged together, and a rule enforced only in the interface is a rule that applies until somebody uses a different route.

Sealed means sealed#

Once a document is signed and sealed, it cannot be overwritten from the editor it came from. Editing hands you a copy, and the original that the verification page vouches for stays byte-for-byte what it was.

This is the part users push back on, and the pushback is reasonable — they want to fix a typo. The answer has to be no, and the reason has to be explained rather than enforced silently: a document whose contents can change after signature is a document whose signature means nothing, including the signatures that were applied in good faith.

Giving them a copy immediately, in one action, removes most of the friction. Refusing without offering the copy is how a control gets routed around.

The awkward details that decide whether it works#

Rotated pages. A page carrying a rotation instruction is rendered one way by the tool that displays it and another way by the library that writes marks onto it. If those two disagree, a signature placed in the right place on screen lands somewhere else in the file. Our picker refuses a placement on a rotated page rather than guessing, because a signature in the wrong place on a legal document is worse than a refusal.

Which page each mark is on. The accompanying record page states where every signature was placed, so somebody holding the last sheet can still find the middle one.

The verification page itself. It has to say what it checked and what the answer means, in plain words. This document matches the record and this document does not match the record, here is what we hold are both useful. A green tick with no explanation teaches people nothing and is trusted for the wrong reasons.

What it does not do#

Tamper-evidence proves that a document is byte-for-byte what was signed. It does not prove the contents were true, that the signatory understood them, or that the signatory was who they said they were. Those are separate questions with separate mechanisms, and conflating them is how people end up over-relying on a technical control. What a signature applied on a phone does and does not prove is one of them — signing a document from a phone.

It pairs with, rather than replaces, a record of what happened — what an audit trail is for. The trail says a signature was applied at a time by a person. The fingerprint says this is the thing that was signed. You need both.

And both depend on the underlying records being append-only, because a fingerprint register that can be revised certifies nothing at all.

The short version#

You cannot stop somebody editing a copy. You can make the edit provable.

Fingerprint the final bytes, after the marks are drawn, on every page not just the signed one. Print the document number, the page count, the fingerprint and a QR code where a person holding paper can use them. Reserve that space properly, on the server as well as in the interface.

Refuse to overwrite a sealed document, and hand over a copy in the same breath so the refusal does not become an obstacle worth defeating.