Content addressing

Content addressing derives an identifier from the content of a digital object, usually with a cryptographic hash. Identical bytes produce the same digest under the same algorithm, and changing the bytes ordinarily changes the digest. The algorithm and representation are part of the meaning: a reformatted PDF or re-encoded image can have different bytes while conveying similar information.

In practice, a digest can tie a citation or review decision to a particular file version and detect accidental or unauthorized modification. The file still needs metadata describing its origin, acquisition and interpretation. A digest cannot recover missing content by itself, and it cannot establish who authored the bytes. Long-term records should retain the algorithm name and support migration if an algorithm becomes unsuitable.

For defensible evidence, content addressing helps distinguish a stable version from a mutable URL. A retained source copy supplies the bytes; chain of custody records handling; provenance connects the version to claims and transformations. Content identity is valuable, but it is not the same as factual truth or source authority.

A digest proves that bytes are unchanged; it does not prove that they are true, authentic or complete, and it does not say who made them. A digest also names one serialisation. The same data in JSON with a different key order or whitespace has a different digest, so for structured data one must first canonicalise, for example with the JSON Canonicalization Scheme in RFC 8785, before hashing. And the digest of a rendered page changes with every dynamic element, so a digest of the page is only useful for a stored copy, not for the live URL.

To establish when a digest existed or who vouched for it, add a trusted timestamp or a signature, as discussed under chain of custody. Choose the hash function with an eye to its lifetime: functions weaken over time, so record the algorithm with the digest and be prepared to re-hash retained material with a stronger function while the originals are still available.

Recompute the digest of a sample of stored objects and compare with the recorded value. Confirm that the store rejects overwrites of an existing digest with different bytes. Confirm that the algorithm is recorded with each digest. Confirm that structured data are canonicalised before hashing, by hashing the same data serialised two ways. Confirm that citations carry the digest, and that a citation resolves to the object by digest without relying on the original URL.