Re: Hash for data in transit

Richard Moore <[email protected]>
Newsgroups gmane.comp.security.web-applications
Message-ID <[email protected]>
On 21/07/2010 03:21, Nikhil Wagholikar wrote:
> Hi Richard,
>
> CRC is one of the best methods for integrity checking (more
> precisely 'detection') of data between web server and web browser.

If the intention is to protect against malicious changes (as the
reference to tripwire suggests) then CRCs would be a very poor choice.
They are vulnable to a range of attacks that allow the data to be
modified whilst the CRC remains valid. If a secure hash is required
then something like SHA-1 or SHA-256 should be used.

>
> In any case, like Robert said, HTTPs will do integrity check for the
> data.

This is also true.

Cheers

rich.

>
> --- Nikhil Wagholikar Senior Consultant Ernst and Young (India) Web:
> http://www.ey.com/India
>
> On 21 July 2010 01:33,<[email protected]>  wrote:
>>
>> Does anyone know of any tools out there that can be used to ensure
>> the integrity of data while in transit from a web app and a user
>> using a website to enter information?
>>
>> I've heard of Tripwire and ossec but those more for OS or for files
>> at rest.
>>
>> Any ideas are welcomed. Thanks.
>>
>>
>>
>> This list is sponsored by Cenzic
>> -------------------------------------- Let Us Hack You. Before
>> Hackers Do! It's Finally Here - The Cenzic Website HealthCheck.
>> FREE. Request Yours Now!
>> http://www.cenzic.com/2009HClaunch_Securityfocus
>> --------------------------------------
>>
>
>
>
> This list is sponsored by Cenzic
> -------------------------------------- Let Us Hack You. Before
> Hackers Do! It's Finally Here - The Cenzic Website HealthCheck.
> FREE. Request Yours Now!
> http://www.cenzic.com/2009HClaunch_Securityfocus
> --------------------------------------
>
>


-- 
Richard Moore, Principal Software Engineer,
Westpoint Ltd,
Albion Wharf, 19 Albion Street, Manchester, M1 5LN, England
Tel: +44 161 237 1028
Fax: +44 161 237 1031



This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now! 
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.