How to edit PDF?

[Colin Watson]

On Sun, Nov 27, 2005 at 11:18:02AM -0500, David Teague(T-bird acct) wrote:
> Tristan Wibberley wrote:
> >David Teague(T-bird acct) wrote:
> >>That is one use for MD5 check sums. It doesn't make the file
> >>inviolable, but it gives the recipient an almost unbreakable check
> >>against tampering.
> >
> >MD5 based signatures probably don't do that anymore.
> >[...]
> 
> Well Dang! Is there a mechanism that is better
> than MD5 (i.e. that is 'almost' unbreakable) ??
> 
> A slightly different way might be to encrypt. There is
> 128 bit encryption .... is it any good for this purpose?

Almost certainly not.

Since anyone can encrypt a document using a public key, the only
protection that public-key encryption can possibly provide against
tampering is that it makes it harder to get at the original document to
figure out what might plausibly be substituted. That's very weak,
though. Don't use public-key encryption if you want tamper-resistance.

Symmetric encryption requires a secret to produce the ciphertext, so you
could conceivably use it for tamper-resistance. However, this is
inconvenient if you're sending the document to somebody else, as you
then need to send the secret over some secure channel, and you're
probably back to exactly the same problem. There's a good reason most
applications use at least some component of public-key cryptography
these days!

I'd recommend reading the advice in the GNU Privacy Handbook (in the
gnupg-doc package) and generating a suitable signing key. You can then
distribute the public half of that key and give the fingerprint to your
intended recipients so that they can verify it; this does require a
secure channel (such as meeting them in person), but you aren't putting
any trust in the recipients the way you would be by giving them an
important symmetric encryption key. Modern signing keys generated by
GnuPG use SHA-1 by default internally, although it's possible to tweak
that.

Cheers,

-- 
Colin Watson                                       [cjwatson at ubuntu.com]