https://github.com/karasz/securelog
Forward-secure Go library for tamper-evident audit logs, implementing Ma–Tsudik’s dual-MAC private-verifiable scheme.
https://github.com/karasz/securelog
audit-logging compliance cryptography forward-security golang log-integrity secure-logging tamper-detection
Last synced: 8 months ago
JSON representation
Forward-secure Go library for tamper-evident audit logs, implementing Ma–Tsudik’s dual-MAC private-verifiable scheme.
- Host: GitHub
- URL: https://github.com/karasz/securelog
- Owner: karasz
- License: mit
- Created: 2025-10-22T14:28:31.000Z (8 months ago)
- Default Branch: master
- Last Pushed: 2025-10-26T08:04:54.000Z (8 months ago)
- Last Synced: 2025-10-26T10:06:31.923Z (8 months ago)
- Topics: audit-logging, compliance, cryptography, forward-security, golang, log-integrity, secure-logging, tamper-detection
- Language: Go
- Homepage:
- Size: 62.5 KB
- Stars: 1
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# securelog — Dual MAC Private-Verifiable Secure Logger (Go)
[](https://pkg.go.dev/github.com/karasz/securelog)
[](https://goreportcard.com/report/github.com/karasz/securelog)
[](LICENSE)
SecureLog is a production-focused implementation of the Dual MAC private-verifiable logging protocol. It keeps audit trails append-only, forward-secure, and verifiable by both semi-trusted auditors and a trusted authority. For the full academic background, see [doc/ACADEMICS.md](doc/ACADEMICS.md).
## Highlights
- Dual MAC chains (`μ_V`, `μ_T`) to catch tampering by compromised verifiers.
- Forward-secure key evolution with per-entry key rotation.
- Pluggable transports (folder, HTTP, local) and storage backends (POSIX files, SQLite).
- Pure Go, no CGO requirements in the default configuration.
## Quick Start
```go
package main
import (
"log"
"time"
"github.com/karasz/securelog"
)
func main() {
store, _ := securelog.OpenFileStore("/var/log/securelog")
logger, _ := securelog.New(securelog.Config{AnchorEvery: 100}, store)
commit, openMsg, _ := logger.InitProtocol("app-log-001")
// transmit commit/openMsg to the trusted server here
_ = commit
_ = openMsg
logger.Append([]byte("user login: alice"), time.Now())
logger.Append([]byte("file access: /etc/passwd"), time.Now())
closeMsg, _ := logger.CloseProtocol("app-log-001")
log.Printf("final tag: %x", closeMsg.FinalTagT)
}
```
For end-to-end examples (including transports) check the `example_*.go` files.
## Storage Backends
- **File store (default)** — append-only binary format with POSIX locks; ideal for production.
- **SQLite store** — ACID semantics and ad-hoc queries via SQLite (`modernc.org/sqlite`).
Both implement the same `Store` interface, so swapping backends is a one-line change.
## Transports
- **Folder transport** for local/offline workflows.
- **HTTP transport** for remote trusted servers.
- **Local transport** for in-process testing.
Detailed diagrams and usage notes live in [doc/TRANSPORT.md](doc/TRANSPORT.md).
## Documentation
- [doc/ACADEMICS.md](doc/ACADEMICS.md) — paper references and detailed research context.
- [doc/TRANSPORT.md](doc/TRANSPORT.md) — transport layer protocol and folder layout.
- `example_*.go` — runnable snippets that stitch storage, transports, and verifiers together.
## Development
```
make fmt # gofmt on the tree
make lint # revive + staticcheck + gosec
make test # go test -race -cover ./...
make check # run the full battery (fmt, vet, lint, spell, test)
```
Go 1.21 or newer is recommended.