1

Certificates are a fantastic way to prove the integrity of a file - provided that they have been signed from the beginning. This methodology can prove the files authenticity, in addition proving it's source.

My question is how would you prove the integrity of a file is in tact that has not been signed? Say, for instance, someone has been given a file or even access to an email box - how, if at all, can it be proven that the file or mailbox has not been altered from it's original state?

  • That question makes no sense: if someone wants to prove he had access to a file or some data at any given point in time, then he can perform a (timestamped) digital signature on that data. Nobody can prove that the document they sign hasn't been modified prior to their signature, though: it only works forward in time. – Stephane Mar 4 '14 at 15:02
4

Technically speaking, certificates don't prove the integrity of a file - hashes do. The certificate signature is a way of proving that the hash hasn't been altered.

Therefore, the answer to your question is - you prove that a file has not been changed by taking a hash and comparing against the hash later. In order for this to work, you need some way to authenticate that those hashes are valid. Signing with a certificate is the standard method on a computer. You could print them out, get a notarized signature on them, and stick them in a safe. You could print them in a newspaper (put it in a classified ad, the difficulty of forging a newspaper and the timestamped nature of the newspaper provide authenticity). You could email the hashes to 3 people whom you trust and ask them to provide them for comparison at a later date.

  • Can you elaborate on why certificates don't prove file integrity? If I had signed a file, and an attacker tries to modify it, any modifications would be apparent when I unsign it isn't it? – Pacerier Jun 5 '14 at 8:00
  • It's a technicality - certificates aren't used to sign file contents; a hash of the file is taken and the certificate is used to sign that hash. The hash of the file can be recalculated at any time and compared to the signed hash, and if they differ, well, the signature on the original hash is what provides the authority. It's a pedantic point... unless someone is asking about how to prove integrity without certificates. Then understanding the distinction between the two steps is important. – gowenfawr Jun 5 '14 at 11:40
2

There is no way to prove that data wasn't tampered with just based on the data alone.

But a simpler method than digital signing with a private key is just creating a cryptographic hash of a file with an algorithm like SHA-512. You can then compare the hash with a hash calculated for an older version of the file and see if they match. This, of course, requires that a hash was calculated from the file in its original state and that you obtained that hash via a trustworthy channel.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.