0

I am trying to implement e-signature + digital signature to secure the e-signed document from altered, something like Docusign. I am using AWS s3 to store the documents.

My question are:

  1. Is MD5 (checksum) enough to track if the signed document is altered? or I need Sha256?
  2. Every time when the file is uploaded to etag (MD5) checksum is generated automatically, Can I use this value to verified if the document is altered?
2

1 Answer 1

0

Is MD5 (checksum) enough to track if the signed document is altered?

MD5 is a weak hash vulnerable to practical collision attacks, i.e. an attacker could create two different documents with the same MD5. This means that you cannot not use MD5 to detect if a document was altered if your (unknown) threat vector includes an attacker trying to bypass your detection.

I need Sha256?

Sha256 is considered safe against such attacks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .