RE: Encryption and digital signatures

On Wed, 11 Jan 2006, Bob Cozzi wrote:
> Digital signature are basically this:

"Digital signature" could mean a few things. MD5 and SHA1 produce what
could be thought of as digital signatures that can be used to verify
data integrity. HMAC produces digital signatures that can be used to
verify integrity and authenticity. Integrity is about whether the data was
transmitted correctly; authenticity is about whether it came from the
source you think it did.

If the original poster just wants to ensure that the data was transmitted
correctly, MD5 or SHA1 hashes and file sizes will do a good job. If he
wants to ensure that not only was the data transmitted correctly, but that
it came from a particular source, then he should probably use HMAC and
establish some big random key with the other party. (HMAC is just another
hash function, except that it takes a key in addition to just the data).