Fwd: Hash for data in transit
Saleh <[email protected]>
| Newsgroups | gmane.comp.security.web-applications |
|---|---|
| Message-ID | <[email protected]> |
---------- Forwarded message ---------- From: Voulnet <[email protected]> Date: Fri, Jul 23, 2010 at 7:51 PM Subject: Re: Hash for data in transit To: Saleh <[email protected]> That is wrong in a security perspective. The initial asker asked about using it for data integrity between a web app and a browser, a path that is filled with perils and dangers, hence CRC is not really the best option. Using CRC, there is absolutely no way to tell if the message and a newly calculated CRC was created. Actually, if you want to change a little part of the message (such as changing $1,000 to $10,000) the changes to the corresponding CRC are so easy to make and calculate. CRC is better used to check for errors when moving files between hard drives, for example, but for use in a web app, there many better alternatives. When used on the web, a difference of nanoseconds is nothing. You can be sure of that. On Fri, Jul 23, 2010 at 7:27 PM, Saleh <[email protected]> wrote: > > > ---------- Forwarded message ---------- > From: Andrew Auernheimer <[email protected]> > Date: Wed, Jul 21, 2010 at 4:08 PM > Subject: Re: Hash for data in transit > To: Saleh <[email protected]> > Cc: Nikhil Wagholikar <[email protected]>, [email protected] > > > Saleh, > Your friend is wrong. CRC is absolutely fine for data integrity, which is why SSH uses it. The place where it fails is that it has no way to prevent malicious, engineered data alteration. Which is why you use it with a strong underlying cryptography (just like how SSH does it). > Assuming the underlying hash function isn't broken, CRC is just fine. > > On Wed, Jul 21, 2010 at 3:57 AM, Saleh <[email protected]> wrote: >> >> According to one of my friends ([email protected]) >> CRC is not that good in data integrity (errors can be masked) >> HTTPS will do good =D >> >> On Wed, Jul 21, 2010 at 5:21 AM, Nikhil Wagholikar >> <[email protected]> wrote: >> > >> > Hi Richard, >> > >> > CRC is one of the best methods for integrity checking (more precisely >> > 'detection') of data between web server and web browser. >> > >> > In any case, like Robert said, HTTPs will do integrity check for the data. >> > >> > --- >> > Nikhil Wagholikar >> > Senior Consultant >> > Ernst and Young (India) >> > Web: http://www.ey.com/India >> > >> > On 21 July 2010 01:33, <[email protected]> wrote: >> > > >> > > Does anyone know of any tools out there that can be used to ensure the integrity of data while in transit from a web app and a user using a website to enter information? >> > > >> > > I've heard of Tripwire and ossec but those more for OS or for files at rest. >> > > >> > > Any ideas are welcomed. Thanks. >> > > >> > > >> > > >> > > This list is sponsored by Cenzic >> > > -------------------------------------- >> > > Let Us Hack You. Before Hackers Do! >> > > It's Finally Here - The Cenzic Website HealthCheck. FREE. >> > > Request Yours Now! >> > > http://www.cenzic.com/2009HClaunch_Securityfocus >> > > -------------------------------------- >> > > >> > >> > >> > >> > This list is sponsored by Cenzic >> > -------------------------------------- >> > Let Us Hack You. Before Hackers Do! >> > It's Finally Here - The Cenzic Website HealthCheck. FREE. >> > Request Yours Now! >> > http://www.cenzic.com/2009HClaunch_Securityfocus >> > -------------------------------------- >> > >> >> >> >> -- >> Saleh Alsanad >> http://www.google.com/profiles/q8mosfet >> >> >> >> This list is sponsored by Cenzic >> -------------------------------------- >> Let Us Hack You. Before Hackers Do! >> It's Finally Here - The Cenzic Website HealthCheck. FREE. >> Request Yours Now! >> http://www.cenzic.com/2009HClaunch_Securityfocus >> -------------------------------------- >> > > > > > -- > Saleh Alsanad > http://www.google.com/profiles/q8mosfet -- Saleh Alsanad http://www.google.com/profiles/q8mosfet This list is sponsored by Cenzic -------------------------------------- Let Us Hack You. Before Hackers Do! It's Finally Here - The Cenzic Website HealthCheck. FREE. Request Yours Now! http://www.cenzic.com/2009HClaunch_Securityfocus --------------------------------------