Cryptographic verification checks a defined property, not every claim in a document.
Different checks answer different questions
A cryptographic hash maps data to a digest used in integrity checking. A digital signature can support authentication and integrity under its cryptographic and key-management assumptions. NIST publishes separate standards for these mechanisms. Neither mechanism independently establishes that a claimed real-world measurement happened as described. A signed false statement remains a false statement with a verifiable signature.
A receipt example
Imagine a service creates a receipt saying a request completed in 120 milliseconds. Recomputing its digest can detect a mismatch with the expected file. Checking its signature can associate it with a trusted public key. Neither step recreates the network conditions or proves the timing instrument was honest. The measurement method and the identity behind the key require their own evidence.
Define the exact bytes
Whitespace, field order and number formatting can affect a file’s digest. Systems need a clear encoding or canonicalisation rule if independently produced representations are expected to match. Save the algorithm and format version with the evidence. An unexplained “hash mismatch” can indicate altered data, an encoding difference or the wrong input; investigation should distinguish those possibilities.
Use precise verification labels
Prefer labels such as “digest matches” or “signature valid for this key” to an unqualified “verified”. Identify the expected signer through a trusted source and retain the original data when appropriate. For an independent reproduction, document the inputs and method separately. This vocabulary makes evidence portable without exaggerating what cryptography can establish about an AI service’s correctness or commercial reliability.
Sources & further reading
Sources checked 7 October 2026. Source-linked explanatory content; not personalised investment advice. Found an error? Request a correction.
