Private document
A PDF, contract or piece of evidence stays encrypted in private storage.
content off the chainImplementation guide
Document integrity comparison by hash.
Comparing the hash of a file with a reference record can help check that the bytes match. The record alone does not prove authorship, truthful content, ownership or legal validity of the document.
Animation in code
The document stays private; the blockchain receives only the cryptographic proof.
Conceptual demo. This page sends no transactions and records no documents on the network.
Local hash
The file produces a cryptographic digest for comparison.
0x...Signature
The signature ties the operation to the address that signed it.
0x9D3c...2B11On-chain anchor
In the example, the contract would record a reference to the hash, address and timestamp.
anchor(bytes32)Validation and block
Validators accept the transaction and the event goes into an auditable block.
Later verification
The received file is hashed again and compared with the recorded anchor.
intact or divergentPrinciple
Check for a match without exposing the content.
A cryptographic hash is a deterministic digest, designed to make it computationally infeasible to recover the input or find collisions under the intended security conditions.
Golden rule of the RDE
The design keeps documents off the blockchain and records cryptographic references and minimal metadata. External storage needs its own access and protection controls; hashes, addresses and metadata can also allow linking to people.
Flow
From the private document to auditable evidence.
Off-chain document
The file is stored privately and encrypted. It is never sent to the block.
Hash generation
The SHA-256 of the file is calculated. For case identifiers, a salted commitment is recommended.
On-chain record
In a future implementation, the hash and a time reference may be recorded in an anchor contract, without publishing the content of the document.
Validation
Any authorized party hashes the document again and compares it with the recorded value.
Privacy boundary
What stays private and what can be recorded on the RDE.
Off-chain
- Documents and files.
- Personal data, such as name, CPF/CNPJ and corporate data.
- Biometrics, selfies and detailed verification results.
On-chain on the RDE
- SHA-256 hash of the document.
- Timestamp of the record.
- Signing address involved in the operation.
- Minimal metadata defined for each record.
The design must avoid putting personal data or full documents on-chain. Identity, access and revocation requirements depend on specification and technical validation.
A block timestamp is a time reference of the network. On its own it does not prove when the file was created, nor does it replace a qualified timestamp or an ICP-Brasil signature.
Production checklist
Minimum controls before production.
The technical guide treats these points as required to preserve privacy, traceability and governance.
- Recalculate the hash on the server from the downloaded object.
- Validate size, magic bytes and antivirus scan.
- Use a salted commitment for the caseId.
- Store files encrypted, with short-lived pre-signed URLs.
- Keep the ADMIN or compliance key under multisig.
- Keep an audit trail and a retention/disposal policy.
Blockchain RDE
Need to demonstrate this flow in a PoC?
Use this guide as a technical reference to discuss document integrity, privacy and audit with the Blockchain RDE team.