Immutable Ledgers & Blockchains

From Trees to Chains

A blockchain extends the Merkle Tree concept into a linked sequence of blocks, creating a tamper-evident history. Each block has two key components:

1. The Body: A list of transactions organized into a Merkle Tree. The Merkle Root of these transactions is stored in the block header. This ensures no individual transaction can be altered without changing the block's identity.

2. The Header: Contains metadata including a pointer to the previous block — specifically, the cryptographic hash of the previous block's header.

Block 99 Header:
  prev_hash: 0xAABB...  (hash of Block 98)
  merkle_root: 0x1122...  (root of Block 99's transactions)
  nonce: 48291
  block_hash: 0xFFEE...  ← this becomes prev_hash in Block 100

Block 100 Header:
  prev_hash: 0xFFEE...  (hash of Block 99)
  merkle_root: 0x3344...
  nonce: 91827
  block_hash: 0xDDCC...

Why Tampering is Computationally Infeasible

Suppose an attacker wants to alter a transaction in Block 99:

1. Changing the transaction changes the Merkle Root of Block 99.
2. Changing the Merkle Root changes Block 99's header hash.
3. Block 100's prev_hash field now points to a hash that no longer exists — the chain is broken.
4. The attacker must recompute Block 100 to reference the new Block 99 hash.
5. But recomputing Block 100 changes Block 100's hash, breaking Block 101's link.
6. The attacker must recompute every subsequent block — all the way to the present.

In Bitcoin, recomputing a block requires solving a computationally expensive Proof of Work puzzle. Rewriting history from Block 99 to the current block (hundreds of thousands of blocks) would require more computational power than the entire honest network combined. This is the 51% attack threshold — an attacker needs to control more than half the network's hash rate to rewrite history faster than honest nodes extend it.

Beyond Cryptocurrency: Audit Logs

The tamper-evident property of chained hashes is valuable outside of cryptocurrency. Certificate Transparency (CT) logs use this structure to create append-only logs of SSL certificates. Any attempt by a log operator to delete or modify a historical entry would change the log's Merkle root, which is publicly audited. This prevents certificate authorities from secretly revoking or altering logged certificates.

Similarly, systems like Amazon QLDB (Quantum Ledger Database) use cryptographic chaining to provide verifiable audit trails for financial and compliance records — proving to auditors that no administrator deleted a transaction from the history.

Key Point: Chaining block hashes creates a tamper-evident history where altering any past block requires recomputing all subsequent blocks. In a distributed network where participants hold copies of the canonical chain, a tampered chain is immediately rejected. This principle applies beyond cryptocurrency to any system requiring a verifiable, append-only audit log.