Can an XML file be signed in this way?

Question

I need the checksum of an XML file in order to verify that no changes have been made to the file.

Once I have created the MD5 checksum is it possible to 'embed' the MD5 checksum inside the very same file. I guess not but perhaps if it is possible to make a partial checksum not based on the first X characters of the file.

Thank you very much...

in cryptography course, there was a topic on "self-signing" hashes (not md5 and not xml). meaning, it is possible — , Jan 18 '11 at 06:28
@What is the Question: Question is: how to sign the xml file, ("self-signed" hashes is from another task) — Alan Turing, Jan 20 '11 at 01:51
So are you going to do something with the question? I answered it already — Alan Turing, Jan 20 '11 at 02:06
If you need a checksum of an xml file, it is not possible to possible to make a partial checksum not based on the first X characters of the file, and if so, to "embed" it into the very same file, because it will breaks the "checksum". You answered yourself in your question. Phanx. So -1 ;) — Alan Turing, Jan 20 '11 at 12:37
Related: http://stackoverflow.com/questions/2193993/are-there-algorithms-for-putting-a-digest-into-the-file-being-digested — Mechanical snail, Sep 15 '12 at 00:25

score 0 · Accepted Answer · answered Jan 18 '11 at 06:25

You can embed an MD5 hash in the file. This will change the hash of the file, but this can be overcome by reversing the modification before verifying the hash, being very careful of course to exactly reverse the operation.

However this doesn't offer any real security because if someone changes the file they just need to remember to change the hash value too.

You should instead generate a keypair and use a digital signature.

Can an XML file be signed in this way?

1 Answers1