2007-05-25
Digitally signing files
When you want to digitally sign a file, you can either make an embedded signature or a detached signature. The disadvantage of the embedded signature is that the original format is mangled. You have to "unpack" the file to another file (the process of verification does this) to be able to use it. Not very convenient. Detached signature preserves the original format, but stores the signature in a separate file. Unless you have a convention and hold firmly to it, you will have problems with pairing up signatures and their corresponding files. Modern filesystems open up a third possibility: a signature can be placed into a file's extended attribute. This solves both problems: the file's original format is preserved, and the signature is still attached to the file.
Subscribe to:
Post Comments (Atom)
2 comments:
I would question this.
A file is a sequence of bytes. No structure is imposed on a file by the system, and no meaning is attached by the system to its contents.... [Kernighan-Pike]. When this principle is observed, a file is a trans-OS object; as it should be; a file with a "resource fork", "extended attribute", "system area", (these abominations have as many names as there are misguided OS vendors :) ceases to be a trans-OS object; and it is this that "modern" data processing abhors: operating system specific objects that are used in exchange of information between different operating systems. If we are moved to sign a file, it is very likely such file would change hands; it is wrong to assume, at the time of the signing, that whoever is verifying the signature will use the same operating system as the one that signs it.
hl
I agree that this breaks the "unstructured sequence of bytes" view. However, the problem exists "only" when the file is transported to another machine; in this case it can be still linearized into a single "stream".
But maybe it's better to start with something portable in the first place, as eg. signed java JARs do it. Zip together data and signature in a single file and be done with it :)
Post a Comment