# Tiger Tree Checksum in Video: A Tamper-Evident Visible Hash Chain Method

## Abstract

This document describes the *Tiger Tree Checksum in Video* method, a technique for embedding a cryptographically verifiable, tamper-evident chain of hashes directly into video frames. Unlike conventional watermarking or metadata-based approaches, the hash of each frame is visibly displayed on the subsequent frame, creating a linear, self-verifying integrity chain. Any alteration, re-encoding, or frame manipulation breaks the chain and is immediately detectable. The method preserves original audio and works with standard video containers. This manual provides the formal specification, implementation guidance, and security analysis.

---

## 1. Introduction

Digital video integrity is critical for surveillance footage, legal evidence, journalism, and archival systems. Existing solutions often rely on external signatures, sidecar hash files, or hidden watermarks—all of which can be stripped, ignored, or recreated after tampering. The Tiger Tree method introduces a **visible, sequential hash chain** that is part of the video’s visual content. It requires no external metadata and withstands common attacks such as re-encoding, frame insertion, or deletion.

The name “Tiger Tree” reflects two concepts:
- **Tiger**: a fast cryptographic hash function (optionally interchangeable with SHA‑256) that provides collision resistance.
- **Tree**: the linear chain of hashes forms a degenerate tree—a simple, robust structure for sequential verification.

### 1.1 Key Properties

| Property | Description |
|----------|-------------|
| **Visible on screen** | The hash is drawn as text (or a barcode) on each frame. |
| **Self‑verifying** | No external database or signature needed. |
| **Tamper‑evident** | Altering any frame changes its hash, causing mismatch with the next frame’s displayed hash. |
| **Re‑encoding detection** | Any lossy compression changes pixel values→breaks chain. |
| **Audio preserved** | Audio stream is copied unchanged, not part of the hash chain. |

### 1.2 Comparison with Existing Methods

| Method | Ext. metadata | Visible | Resists re‑encode | Resists editing |
|--------|---------------|---------|-------------------|-----------------|
| Sidecar hash file | Yes | No | No | Partial |
| Watermarking | No | No | No | No |
| Frame hash in metadata | Yes | No | No | Yes |
| **Tiger Tree (this method)** | No | Yes | Yes | Yes |

---

## 2. Method Specification

### 2.1 Overview

The method processes a video frame by frame. For a sequence of frames \(F_0, F_1, F_2, \dots, F_{N-1}\):

1. **Initial frame (\(F_0\))**: A fixed *anchor hash* \(H_{anchor} = \mathrm{Hash}(\text{“FIRST\_FRAME\_ANCHOR”})\) is visibly displayed on \(F_0\).
2. **Subsequent frames**: For \(i \ge 1\), frame \(F_i\) visibly displays \(H_{i-1} = \mathrm{Hash}(F_{i-1})\), where \(\mathrm{Hash}\) is a cryptographic hash function (SHA‑256 or Tiger).
3. **Verification**: For each \(i \ge 1\), extract the displayed hash from \(F_i\) and verify that it equals \(\mathrm{Hash}(F_{i-1})\).

The video’s audio is not included in the hash chain; it is copied directly from the original to preserve synchronization and avoid unnecessary re-encoding.

### 2.2 Cryptographic Hash Function

Any collision‑resistant hash can be used. Recommended:
- **SHA‑256** (output 64 hex characters) – standard, widely available.
- **Tiger** (output 48 hex characters) – faster on 64‑bit platforms, optional.

The hash is computed over the **entire decoded frame** (all three color channels, full resolution, as processed by OpenCV in BGR order). This includes any previously drawn hash text, creating a chain where modifying the hash text itself would break the next frame’s verification.

### 2.3 Visual Rendering

The hash is displayed as **monospaced hexadecimal text** at a fixed screen position (e.g., top‑left corner). To ensure reliable optical character recognition (OCR) during verification, the text is drawn with:

- A **solid white background rectangle** (padding 5 pixels)
- **Red text color** (RGB: 0,0,255)
- Font: `FONT_HERSHEY_SIMPLEX`, scale 0.6, thickness 2

Alternative visual encodings (QR codes, Data Matrix) can be used to improve robustness and reduce OCR errors.

### 2.4 Audio Preservation

Because the visual hash chain alters only the video stream, the original audio track can be copied **without re‑encoding** and muxed into the final container. This guarantees that audio integrity is decoupled from video integrity—a design choice: the method focuses on frame tampering. If audio integrity is also required, the audio can be hashed separately and the hash displayed on the first frame or embedded as a visible barcode.

---

## 3. Implementation Guide

### 3.1 Requirements

- Python 3.8+
- FFmpeg (accessible in PATH)
- Python packages: `ffmpegio`, `numpy`, `opencv-python`, `pytesseract` (for verification only)

### 3.2 Encoding Procedure (Streaming)

The encoding must be performed as a **streaming process** to handle arbitrarily long videos without loading all frames into memory.

**Pseudocode**:

```
1. Open input video as a frame iterator.
2. Create a temporary file for video‑only output.
3. Initialize video writer with same resolution, frame rate, and codec.
4. prev_frame = None
5. For each frame in iterator:
     copy_frame = frame.clone()
     if prev_frame is None:
         anchor = SHA256("FIRST_FRAME_ANCHOR")
         draw anchor on copy_frame
     else:
         h = SHA256(prev_frame)
         draw h on copy_frame
     write copy_frame to video writer
     prev_frame = copy_frame
6. Close writer and reader.
7. Use FFmpeg to mux original audio into the temporary video:
     ffmpeg -i temp_video.mp4 -i original.mp4 -c:v copy -c:a aac -map 0:v -map 1:a -shortest output.mp4
8. Delete temporary file.
```

### 3.3 Verification Procedure

Verification reads the video frame by frame (streaming) and uses OCR to extract the displayed hash from each frame \(i \ge 1\), then compares it with the computed hash of frame \(i-1\).

**Pseudocode**:

```
prev_frame = None
for i, frame in enumerate(frame_iterator):
    if i == 0:
        prev_frame = frame
        continue
    # Extract displayed hash from current frame at fixed region
    roi = crop_region(frame, HASH_POS, width=400, height=100)
    displayed = ocr(roi)  # hex string
    actual = SHA256(prev_frame)
    if displayed != actual:
        report_mismatch(i)
    prev_frame = frame
```

### 3.4 Reference Implementation

A full Python implementation is provided in Appendix A. It uses:
- `ffmpegio.video.Reader` for frame‑by‑frame reading.
- `ffmpegio.video.Writer` for incremental writing.
- `ffmpegio.ffmpeg.run` for audio muxing.
- `pytesseract` for OCR (fallback to manual pattern matching possible).

---

## 4. Security Analysis

### 4.1 Attack Vectors and Mitigations

| Attack | Attempt | Detection |
|--------|---------|------------|
| **Frame insertion** | Insert a new frame between \(F_i\) and \(F_{i+1}\). | The displayed hash on original \(F_{i+1}\) will not match the new inserted frame’s hash. |
| **Frame deletion** | Remove \(F_{i}\). | \(F_{i+1}\) displays hash of \(F_i\). After deletion, verification compares \(F_{i+1}\) with \(F_{i-1}\) → mismatch. |
| **Frame reordering** | Swap \(F_i\) and \(F_j\) (i<j). | Hashes chain broken at both positions. |
| **Re‑encoding (lossy)** | Recompress video with different bitrate. | Pixel values change, so hash of any frame changes, causing mismatch on the next frame. |
| **Hash text alteration** | Manually edit the displayed hash text on \(F_i\). | The next frame \(F_{i+1}\) displays the *original* hash of \(F_i\), so verification fails at \(F_{i+1}\). |
| **Rollback** | Replace entire video with an old, valid chain. | Anchor of first frame can be compared with a trusted external reference (e.g., signed timestamp). Without external anchor, previous valid version is indistinguishable from a rollback. |

### 4.2 Limitations

- **Lossless required**: The method assumes no lossy compression after encoding. Legitimate re‑encoding (e.g., for distribution) would break the chain, which is by design: any change to bit‑exact representation is considered tampering.
- **OCR reliability**: Plain text OCR may fail due to compression artefacts, resolution changes, or font rendering. A production system should use **QR codes** or error‑correcting barcodes.
- **First frame anchor**: The anchor must be stored outside the video (e.g., in a secure timestamp log) to prevent rollback attacks.
- **Performance**: Computing SHA‑256 on every frame of a 4K video at 60 fps requires significant CPU. Hardware acceleration or a lighter hash (e.g., BLAKE3) can be used.

### 4.3 Formal Security Guarantee

Given a collision‑resistant hash function \(H\), the Tiger Tree chain ensures that for any two videos \(V\) and \(V'\) that are considered “tamper‑free” (i.e., verification passes), the probability that \(V \neq V'\) except for the anchor is negligible. More formally, if verification succeeds for all frames, then every frame \(F_i\) (for \(i \ge 1\)) must be identical to the original frame at that position, up to the unavoidable modifications of drawing the hash text itself. The hash text is immutable after encoding; any change to it breaks the chain at the next step.

---

## 5. Operational Manual

### 5.1 Encoding a Video for Integrity Protection

**Command**:
```bash
python tiger_video.py encode input.mp4 output.mp4
```

**Steps**:
1. Ensure `input.mp4` exists and is readable.
2. The script reads the video, overlays the hash chain, and saves `output.mp4` with original audio.
3. **Anchor**: The first frame’s displayed hash (anchor) should be recorded separately (e.g., appended to a log file with a timestamp). This anchor is the root of trust.

**Example output**:
```
Processing frames (streaming)...
  Processed 100 frames...
  Processed 200 frames...
Video processing complete. Total frames: 1234
Copying audio stream...
Final video with audio saved to output.mp4
```

### 5.2 Verifying a Video

**Command**:
```bash
python tiger_video.py verify output.mp4
```

**Verification steps**:
1. Extracts the displayed hash from each frame and computes the actual hash of the previous frame.
2. Reports `OK` for each matching frame, `MISMATCH` for any failure.
3. Returns exit code 0 if verification passes, non‑zero otherwise.

**Example output**:
```
Verifying output.mp4...
  Verified 100 frames...
  Verified 200 frames...
Frame 145: MISMATCH!
  Displayed: a1b2c3...
  Actual:    d4e5f6...
Verification FAILED after 1234 frames
```

### 5.3 Integrating with a Trusted Timestamp Service

To prevent rollback attacks, the anchor hash of the first frame should be sent to a trusted timestamping authority (e.g., RFC 3161) or recorded in a blockchain. During verification, the anchor extracted from frame 0 is compared against the timestamped record.

### 5.4 Batch Processing

For large collections, the same encoding and verification operations can be parallelized. Use separate instances per video file; the streaming implementation ensures low memory usage.

---

## 6. Conclusion

The Tiger Tree method provides a simple, robust, and visible integrity verification system for video. By embedding a hash chain directly onto visual frames, it eliminates reliance on external metadata and makes tampering immediately detectable. The method is easy to implement, works with any video codec (provided no re‑encoding occurs after finalization), and preserves original audio.

This method is recommended for forensic video, evidence handling, and any application where video authenticity must be verifiable without specialised infrastructure.

---

## Appendix A: Complete Python Implementation (Streaming)

*(The code is provided separately as a listing; included in the delivered manual.)*

---

## Appendix B: Test Vectors

| Frame | Content (raw hash) | Displayed hash on next frame |
|-------|--------------------|------------------------------|
| 0 | anchor: `e3b0c442...` | - |
| 1 | actual content | `e3b0c442...` (hash of frame 0) |
| 2 | actual content | `(hash of frame 1)` etc. |

---

## References

1. Schneier, B. (1996). *Applied Cryptography*. Wiley.
2. Tiger Hash Algorithm – [https://www.cs.technion.ac.il/~biham/Reports/Tiger](https://www.cs.technion.ac.il/~biham/Reports/Tiger)
3. FFmpeg Documentation – [https://ffmpeg.org](https://ffmpeg.org)
4. OpenCV – [https://opencv.org](https://opencv.org)

---

*Document version 1.0 – Tiger Tree Video Integrity Method*