Re: Is this unsecure?

What you are doing is what banks have been doing for ages with wire transfers and it is called MAC, Message Authentication Code (not related to an Ethernet MAC address at all). Wire transfers are sent in clear text amongst banks. Each bank has set a 'signature' (a code) with each other. They use an algorithm which includes the message itself and that code. Notice that the message is send in clear text. It doesn't matter that MD5 is not secure or that it can be decripted (which, in fact, it cannot, since it is a one-way code), the important point here is that the extra code appended to the clear message is never found. Actually, amongst banks not only the message is sent in clear text but the algorith is well know, the only thing that is not known is the validation code, which is changed every so often so that even if found out, it cannot be used for long. Just make sure that you have a safe means of exchanging keys in between the servers every now and then. Banks usually send a book of keys for a certain period physically amongst them and only when they are received and it is certain they have not been intercepted or tampered with they get used. Satyam ----- Original Message ----- From: "Peter Lauri" <lists@dwsasia.com> To: <php-general@lists.php.net> Sent: Tuesday, September 05, 2006 11:04 AM Subject: [PHP] Is this unsecure?

Hi, I have bumped into a problem. I need to use a web service that is located on server B from server A. The server B will execute a script when the web service is accessed and an email is sent as an parameter. The problem is, if I only have the email as incoming parameter, anyone can just figure out the url for the web service, the name, and then just send the email to that address. To make this a little bit secure I setup so two parameters are sent, the email and a confirmation code. First I was just thinking to basically have a password sent with, and if that is correct just execute the script. However, due to server restrictions I can not run it on HTTPS, so that also looses value. So this is how I solved it: I send a parameter with the request that is the email, some extra characters and then MD5 on that. I do this on server A and then server B just checks if it is the same resulting string. If so, we know it comes from server A because that server is the only one that knows the extra characters used. $authstring = md5("asdf".$email."fdsa"); Would this be hard to crack assuming that the one who cracks does not know the characters that are used to generate the $authstring? Maybe someone have experience with this? Or just a comment? Best regards, Peter Lauri www.lauri.se <http://www.lauri.se/> - personal web site www.dwsasia.com <http://www.dwsasia.com/> - company web site