RE: Compression Order

From:           	Christian Putnam <[email protected]>
> However, I believe it would be utterly foolish to support anything other
> than "compress first and then sign" for the AS2 standard.  Why? First,
> the obvious performance gain. 

I respectfully disagree. I believe compression should be part of the 
encoding and transport process-- added independently of the 
signatures used for non-repudiation. This allows the data to be stored 
in different forms while retaining the signature with data. It might be 
stored compressed, uncompressed, or re-compressed in a different 
format (zip/jar). Signing compressed data prevents people from passing 
around the signatures in back-end applications.

If you sign before compression, you can compress, transmit, copy, 
etc. the data in various formats and places and always retain the ability 
to authenticate a signature. Compressing first, mean you cannot 
maintain other representations and the single compressed form must 
be maintained.

It also makes sense to me people (or a machine) should sign original 
plain-text data, not data after encoding, compressing, etc.

The performance difference is negligible in comparison to compression. 
The compression algorithms thenselves compute a checksum as well 
as compressing the data. Computing an MD5 or SHA hash over 
uncompressed data is fast and insignificant in comparison to the time 
for compression, encryption, RSA operations, etc.

--------------------------------------------------------------------------
Carl Hage                                              C. Hage Associates
<mailto:[email protected]> Voice/Fax: 1-408-244-8410      1180 Reed Ave #51
<http://www.chage.com/chage/>                          Sunnyvale, CA 94086