Planisphere Download for Mac

Question · SHA-256 / FIPS 180-4

How does SHA-256 pinning make an AI audit record tamper-evident?

FIPS 180-4 specifies the approved secure hash algorithms, including SHA-256, which turns any input into a fixed 256-bit digest so that any change to the input produces a different value.

AboutSHA-256 / FIPS 180-4
Legal forceMandatory for federal agencies needing an approved hash; widely used voluntarily
Applies from4 Aug 2015
Checked21 Oct 2026

01 / The answer

The short answer

SHA-256, specified in FIPS 180-4, turns any input into a fixed 256-bit digest, and changing even one bit of the input produces a different digest. Recording the digest of each artifact, such as model weights, the test set and the results, lets anyone recompute the hashes later and see whether a file changed. Combining the digests into a signed manifest or Merkle root extends the check to the whole record. Because finding two inputs with the same SHA-256 digest is computationally infeasible, a match shows the files are the ones originally recorded.
SHA-256 / FIPS 180-4 · checked 21 Oct 2026

02 / The rule

What SHA-256 / FIPS 180-4 requires

FIPS 180-4 specifies the approved secure hash algorithms, including SHA-256, which turns any input into a fixed 256-bit digest so that any change to the input produces a different value. It underpins digital signatures, file integrity checks, content addressing and Merkle trees used in software and AI provenance.

  1. 01Use a FIPS-approved hash algorithm (SHA-2 family; SHA-3 is in FIPS 202) where federal rules require one.
  2. 02Compute digests exactly as specified, including message padding and parsing into 512-bit blocks for SHA-256.
  3. 03Do not use SHA-1 for new applications; NIST plans to remove it by December 31, 2030.
  4. 04Use CAVP-validated implementations inside validated cryptographic modules for federal systems.

03 / Records

Records to keep

  1. 01Recorded SHA-256 digests of released artifacts
  2. 02CAVP algorithm validation certificate for the implementation
  3. 03Signed manifests or Merkle roots binding digests together

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES

Go back to the source

RELATED

Related: SHA-256 / FIPS 180-4: the full guide