2
$\begingroup$

I want a script that is running on the client to compute a collision resistant hash and send it to a server. I need to ensure that the script which performs this hash is not altered in any malicious way. Is there any protocol that exists which can ensure that the client script that calculates the hash has not been altered.

I have an idea whereby the script sends back an HMAC signature of itself, but on second thoughts, this would not stop an attacker from fooling the server if the code is altered.

Improve this question
$\endgroup$
2
  • 7
    $\begingroup$ Impossible. It's just another variant of the DRM problem, where you don't trust the computer you're running on. Best you can do is throwing lots of obfuscation at it, and then pray that nobody bothers to break it. $\endgroup$
    – CodesInChaos
    Commented Dec 2, 2012 at 8:42
  • $\begingroup$ Do you assume attacker is on channel or a client can be attacker too? In first case you can use something like SSL to protect the channel. $\endgroup$
    – Pavel Ognev
    Commented Dec 3, 2012 at 6:38

1 Answer 1

Reset to default
2
$\begingroup$

In short any proposed solution to this problem would be a violation of CWE-602: Client Side Enforcement of Server Side Security.

Even if what you are suggesting where possible in some bizzaro universe it would be insecure. A client (or an attacker) doesn't just execute scripts, they are able to view and modify everything in memory, as well as intercept, modify and create any request transmitted over the network. Thus checking the integrity of the script doesn't even close to solving the root of the problem. In short this proposal is a fundamental violation of modern security and there never will be a solution to this problem. (And no one should need to do this)

Improve this answer
$\endgroup$
3
  • $\begingroup$ Thanks for the answer. I knew this to be so, but I thought it could have been otherwise. Actually, an interesting project would be to make a environment whereby trusted sources could upload code that would run and guarantee that no client tampering would take place. But this would be a big project... $\endgroup$
    – Barry Steyn
    Commented Dec 5, 2012 at 19:09
  • $\begingroup$ @Barry Steyn Well people try, look at the xbox... and look at all of the pirated games for the xbox. $\endgroup$
    – Rook
    Commented Dec 5, 2012 at 19:10
  • $\begingroup$ Yeah, and look what happened to Sony Play Station as well :) Still, I think it would be an interesting academic project... $\endgroup$
    – Barry Steyn
    Commented Dec 5, 2012 at 19:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.