Authenticating an XML file

Question

I am in a situation where my application has to read an XML file that another application will drop onto a specific location on the file system (on multiple platforms). I control the contents of this document. The other application is simply providing transport.

I'd like to ensure that the document hasn't been modified in transit or forged in any way. Currently, we're simply writing a salted hash of the document string to the start of the file before the XML document itself. When we parse the document, we simply strip out the hash, compare it to a hash of the remainder of the document, and then send it to the parser.

Does anyone have any experience with this kind of scenario that they'd like to share? Are there any flaws or easier ways I'm missing?

Answer 1

We encrypt the whole xml file and decrypt it to use. This way we know for sure if it has been modified ;)

Answer 2

The most secure thing you will be able to do is encrypt the network traffic in between the two applications. You can definitely hash the file though but something like an MD5 hash ought to do the trick.

Answer 3

You should sign the message by encrypting the salted hash with an asymmetric encryption algorithm and send it along the document. Just using a hash doesn't enforce security as some intruder might generate a different message with the same hash.

Answer 4

Depending on how critical these documents are a hash may be sufficient. However a more bullet proof mechanism would be to use something asymmetric like PGP signing if you have PGP support at both ends.

Answer 5

There is a standard for signing xml documents: http://www.w3.org/TR/xmldsig-core/

If you don't want to implement everything yourself, I suggest you use the XML security library.