Re: md5 checksum or gpg signature

• To: netcdfgroup@xxxxxxxxxxxxxxxx
• Subject: Re: md5 checksum or gpg signature
• From: Reimar Bauer <R.Bauer@xxxxxxxxxxxxx>
• Date: Sat, 5 Feb 2005 18:57:05 +0100

Probably a global attribute could be used to assign the checksum file. Or s
ome 
other trick to get the right checksum file.
Then it is nearly the same if the data is inside the netCDF file or in a 
separate file.

Reimar

Am Samstag, 5. Februar 2005 17:38 schrieb Gerry Creager N5JXS:
> It can go both ways.  If the file's corrupt because either the hash was
> modified and the data were intact, OR if the data (plus/minus the hash)
> were modified, it's still bad.
>
> Then again, keeping an external hash in another file may allow one to
> determine whether the data, or the hash were modified.
>
> The benefits derive, IMO, from the point of view of data source.  If you
> control the data, and you're concerned about programmatical mods causing
> problems, the external method has benefits.
>
> If you're concerned about data security and integrity, the former
> approach, allowing you to simply say, "It's bogus, let's attempt to get
> it from another source," has promise.
>
> For simplicity, I'd agree that a separate file approach is an acceptable
> one.
>
> gerry
>
> Russ Rew wrote:
> > I wrote:
> >>I think there are some good reasons to keep hashes such as MD5 or
> >>SHA-1 external to files they are intended to check, rather than
> >>embedded in the files:
> >>
> >> - If the digest is external, then something that corrupts the file
> >>   might also corrupt the digest.
> >
> > which makes no sense.  What I meant to say was
> >
> >   - If the hash is embedded in the file and doesn't agree with the
> >     file contents, it's not clear whether the file or the hash or both
> >     were corrupted.
> >
> > This is fairly minor, since a mismatch would tell you not to trust the
> > data in any case.  But I still think keeping the hash separate from
> > the original file makes it easier to compute.
> >
> > --Russ

-- 
Forschungszentrum Juelich
email: R.Bauer@xxxxxxxxxxxxx
http://www.fz-juelich.de/icg/icg-i/
=========================
=========================
================
a IDL library at ForschungsZentrum Juelich
http://www.fz-juelich.de/icg/icg-i/idl_icglib/idl_lib_intro.html

Attachment: pgpgWdFKykDWU.pgp
Description: signature

• References:
  • Re: md5 checksum or gpg signature
    • From: Russ Rew
  • Re: md5 checksum or gpg signature
    • From: Gerry Creager N5JXS