[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: md5sum / sha1sum for XML?

• To: <davep@d...>,"Mitch Amiano" <mitch.amiano@a...>
• Subject: Re: md5sum / sha1sum for XML?
• From: "Pete Cordell" <petexmldev@t...>
• Date: Sat, 15 Jul 2006 13:14:39 +0100
• Cc: "Richard Salz" <rsalz@u...>, <xml-dev@l...>
• References: <OFFF1B9043.9E169A3B-ON852571AB.001645E6-852571AB.00179B5E@u...> <1152886416.32747.33.camel@marge> <44B7D280.6010703@a...> <1152901489.32747.52.camel@marge> <44B80928.7000908@a...> <1152962451.7159.8.camel@marge>

----- Original Message ----- 
From: "Dave Pawson" <davep@d...>
>
> On Fri, 2006-07-14 at 17:14 -0400, Mitch Amiano wrote:
>> An encrypted file need not be signed at all, and a signed file need not
>> be encrypted.
>> The two things - signing and encrypting - are distinct operations.
> Yes. I'm happy with that.
>
>
>> One you do to ensure no one can read the data that shouldn't be reading 
>> it.
>> The other you do to ensure that no one has tampered with data that
>> shouldn't be tampered with, while not necessarily encumbering the
>> ability to read it.
>
> I'd like both, hence the need to get them in the right order!


I think the answer to that is "It depends."  If you don't want the person to 
know who signed it until they've decrypted it (i.e. who signed it is a 
secret), then sign and then encrypt.  If you need to know who encrypted 
before you can decrypt it (i.e. to select the right key or maybe just to 
decide whether to decrypt it or not) then encrypt and then sign.

My recollection is that cryptographically one scheme is not necessarily 
weaker than the other.

HTH,

Pete.
--
=============================================
Pete Cordell
Tech-Know-Ware Ltd
                         for XML to C++ data binding visit
                         http://www.tech-know-ware.com/lmx
                         (or http://www.xml2cpp.com)
=============================================

• References:
  • Re: md5sum / sha1sum for XML?
    • From: Richard Salz <rsalz@u...>
  • Re: md5sum / sha1sum for XML?
    • From: Dave Pawson <davep@d...>
  • Re: md5sum / sha1sum for XML?
    • From: Mitch Amiano <mitch.amiano@a...>
  • Re: md5sum / sha1sum for XML?
    • From: Dave Pawson <davep@d...>
  • Re: md5sum / sha1sum for XML?
    • From: Mitch Amiano <mitch.amiano@a...>
  • Re: md5sum / sha1sum for XML?
    • From: Dave Pawson <davep@d...>

• Prev by Date: Re: md5sum / sha1sum for XML?
• Next by Date: Re: RE: The Best Technologies Don't Win
• Previous by thread: Re: md5sum / sha1sum for XML?
• Next by thread: Re: md5sum / sha1sum for XML?
• Index(es):
  • Date
  • Thread