a kind of digital signature for a record in a table ....

[Guest]

hello,

i have a kind of workflow like:

enter data in a form
aprove data by person 1
aprove data by person 2

data are saved in a sqldatabase

What is the best way to check if data in the table was modifyed after the
aprove of person 2 was made.
I mean to be sure that not somebody has modified the table manually -
I think i must use a field and there store a hash of all fields - with a
signature of person2

thanks

Has
somebody tryed to modify th

 

[Scott Allen]

Who do you need to protect the data from?

Someone in the sysadmin role (I'm assuming SQL Server, but the same
would go for any database) will be able to circumvent almost any
scheme.

 

[Guest]

Hello Scott,

yes he could - but he did not know how to calculate and set corectly that
extra field.
So after a recheck the calculated value and the stored value had not the
same value(that means the values were modified!!!)

For example :if the table has for example 5 fields: f1,f2,f3,f4,f5 and the
extra fsig (the calculated signature fiield - where we store the calculated
value )

after a update from "aprove data by person 2" than we can calculate the
value for the extra field with a call to a functian:

CalculateSignature(f1,f2,f3,f4,f5,privatkey)

and set the extra field - fsig with the return value of that function

My question is - what is the best algorytm for the function
"CalculateSignature" .
All 5 parameters for the function stringvalues with a lenght of 5 - 100
characters

best regards

 

[Scott Allen]

Oh, from .NET code? The best best is the RSACryptoService provider.
Once you have all of your data encoded into a byte array you can use
SignData or SignHash to get a digital signature (and there are
corresponding verification methods). The trickiest part is managing
the keys, which you'll need to generate and bring in with
ImportParameters.