What the most trustworthy way to demonstrate digital File Integrity?

Question

I'm looking for ensure the integrity of uploaded files and demonstrate this integrity to a user.

In my current scenario, a user sends multiple files in several different formats, these files are transported to a storage device or location. I need to create a report provider a container with these files(eg. Zip), but on this report I must print a visual and effectively reference as a "seal", "mark", "hash" or something else that's proof the following files are integrate;

The following is a list of some of the more common methods of demonstrating integrity:

• Hashing function: An established mathematical calculation that generates a numerical value based on file content data. This alpha-numerical value is referred to as the hashhash value. Hashing computes a number using a complex formula and is very sensitive to changes in the file content.
• Digital signature: This process is used along with a hash process. The resulting hash is encrypted with a specific private key. File integrity can be verified using the hash value, and the source of the signature is validated using the public key.
• Checksums/Cyclical redundancy check (CRC): Checksums are often used in file transfer to verify that the data transfer was successful. Some checksums are as powerful as hashes. It is recommended that those checksums that are not as powerful as hashes be used in concert with other methods (such as hashing or visual verification) to the degree possible. Eg. MD5Checksum.
• Encryption: This process modifies the content of the files and does not in and of itself demonstrate that the file has not been altered. Encryption can be used in concert with other methods.
• Watermarks: This process modifies the content of the files and can persist as a part of the file. This method is not recommended.
• Proprietary methods: Methods offered for sale or license by a vendor that controls the source code may not be independently verifiable. Likewise, it may not be possible to validate the methodology independently. Therefore, this method is not recommended.

After demonstrate the digital File Integrity, the user should be able to validate the authenticity of it when they wish.

Answer 1

You already have your answer on methods to demonstrate integrity.

Any of those techniques are as "trustable" as the entity implementing them is.

Perhaps what you meant to say was "most appropriate"?

Assuming this is your homework question:

A user transfers several files to a destination, and wants to prove that the files have not been altered in transit. What is the most appropriate technique? ...

The answer I would choose is the first: Using a hash to verify that the files are unaltered. If the user compares the hash of the file from the origin to the hash of the file at the destination and they are the same, then they can be sure* they files are the same.

*returning, of course, to the question of "most trustable".

Answer 2

It depends on what whether you really mean the "most trustworthy". As with many aspects of digital security, there is a sliding scale of strength / reliability vs usability / feasibility. I think some important questions to consider are:

• Who are your users? To what extent do they care about proof of file integrity?
• Even if the users don't care, how important is it to you or your service that files are transferred completely and unaltered?
• How can you balance the usability of such a system with security? (If the users have to go through some elaborate private key / certificate generation hoop jumping process, this might not be worth it for the added security, or it may well be depending on sensitivity)

Verifying the integrity of transferred data is an incredibly involved science, and it scales from the most basic checksum all the way up to the most complex methods. It all depends on what your needs are.