550Part IIIAdvanced Features and TechniquesWhat you need is (Secure web hosting)

January 4, 2007 on 6:10 am | In php |

550Part IIIAdvanced Features and TechniquesWhat you need is a digital fingerprint for a large file. What if we treat the binary data of thefile as a list of integers, add them all together, then chop off all but 128 bits of the sum? Wecall the final 128-bit number the checksum.The author of the file then encrypts the checksumwith his or her secret key and attaches the result to the file as a signature. Assume a cracker makes modifications to the file. He or she can then calculate the sum Cofthe changes and put the number Cat the end of the file, creating a file that he or she knowsto have the same checksum as the original. The cracker then appends the same encryptedchecksum to the file as its signature. When some unsuspecting user downloads the modified file, the user calculates the new check- sum, decrypts the signature to find the original author s checksum, and sees that they match. The user proceeds to use the modified file, incorrectly assuming that it was written by thestated author. Of course, the cryptographers are right on the spot with a solution. It should be very difficultto make changes to a file to produce a certain fingerprint. To ensure this, many hashingalgo- rithms have been developed. Hashing algorithms are generally modifications of single-keyencryption algorithms to make them create a ciphertext of a specific length, from which it isnot possible to reconstruct the original message. As you would expect, PHP provides a set of functions for hashing. These functions depend on the publicly available mhashlibrary. You can find the latest version of the mhashlibrarythrough a link in the PHP manual. The function mhash(type, input)computes the hash value of input,using the methodspecified by type.Common values for this argument are MCRYPT_MD5and MCRYPT_SHA1. For a complete list of possibilities, see the PHP manual. Digitally signing filesNow let us present a PHP program to accept uploaded files only when they are correctly signed. We assume that our site is equipped with a list of usernames and Blowfish keys, where eachuser has a key known only to that user and our site. The function get_user_key(username) retrieves these keys for us. The uploader generates the signature for an upload by first hash- ing the upload file with the MD5 hashalgorithm and then encrypting the resulting hash valuewith her Blowfishkey.

Upload a file

Upload the file:
With this signature:
For user

Note: If you are looking for cheapest and affordable webspace to host and run your servlet application check Astra j2ee hosting services