What are the security checks that I can make on a PDF file being transferred between server and the client?

  • Is this specifically for PDF files, or general in-transit security? – ndrix Mar 12 '14 at 8:18
  • 1
    Define security. – deed02392 Mar 12 '14 at 9:05
  • Perhaps you should elaborate on the problem you are trying to solve. – GdD Mar 12 '14 at 9:20
  • it might be worth you reading more about Alice and Bob – daark Mar 12 '14 at 11:56

"Security" is a bit too broad here.

If you're looking for integrity checks -- that is, "has the file been altered in transit?" -- then what you need is a checksum. Just about any cryptographic hash will do (except MD5 and older, maybe avoid SHA-1 as well for new projects), so SHA-256 for example is a fine choice.

Of course, if you want the recipient to be able to crypographically verify the checksum, then what you're after is a digital signature. Roughly: you checksum the file, you then you encrypt the checksum with your private key, which means anyone in possession of your public key can decrypt the checksum, compare the checksum against the file, and verify that it's the one you signed.

Don't implement this yourself directly; use GnuPG or PGP. They've worked out the details that I glossed over.

If by "security" you mean "secrecy" -- if instead you want to guarantee that the file is only readable by the person you intend to send it to, then you encrypt the file using the person's public key (using the standard combination of asymmetric and symmetric ciphers), which means that only the intended recipient can decrypt it.

Again; use GPG or PGP. They do it right.

If you want to have both, then do both. The combination is also supported.

| improve this answer | |

File integrity check, use either MD5 or SHA256

| improve this answer | |
  • Depends if he wants more than just integrity checks, such as confidentiality. – ndrix Mar 12 '14 at 9:05
  • 1
    When giving an answer try to provide some context so it actually makes sense. – kiBytes Mar 12 '14 at 11:13

If you are worried about the file being the same as the one you requested from the server, you may want to look into Checksums. These can tell you if the file has been altered in any way between server and client. A good example of this is that when a server allows mirroring of files. A checksum is usually shared on the mirror that will match the checksum of the original file that was served on the main web server. You can also use it to see if someone got ahold of your file and altered it between server and client by calculating the checksum locally and matching it to the one provided by the server.

| improve this answer | |
  • If someone is able to modify the file in transit, they would also be able to modify the checksum file you match against. Signatures must be they answer – Dog eat cat world Mar 12 '14 at 22:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.