Both the <EncryptionMethod> and <KeyInfo> are optional i.e. the sender and receiver may agree on the encryption method and key in advance. Several elements use the definitions from the DSIG.

If the recipient does not know the decryption key in advance, then the sender generates and sends it. The key can be protected in transit by encrypting method or key agreement.

If the plaintext data to encrypt is an XML element or content, you encode it using UTF-8 and perform any necessary transforms to it, otherwise, if it is an external resource, you simply consider it as an octet sequence. You then encrypt the data, creating CipherValue, which you place in EncryptedData.

Care must be taken when signing content that may later be encrypted; clearly; the content must be restored to exactly the original plaintext form for the signature to validate properly. To restore the plaintext in the signed content, use the decryption transform method for XML signature defined by the XML encrypt joint W3C and IETF working group.

This transform also allows specifications of XML fragments that were encrypted and then signed with rest of the document and, therefore, are not decrypted to validate the signature. Often, encrypted fragments are removed from the signed information by using the XPATH transform in the reference element, since the meaningful information is the plaintext.

We can sign the plaintext version of an encrypted element by including the appropriate reference element pointing to it. When the signed document is confidential and encrypted after being signed, you should also protect against surreptitious forwarding in which the recipient forwards the signed confidential document to a competitor, encrypted by the competitor public key, trying to make it look as if the sender sent the confidential information. To prevent surreptitious forwarding, the signer should append the recipient identities to the document being signed.

If the recipient does not know the decryption key in advance, then the sender generates and sends it. The key can be protected in transit by encrypting method or key agreement.

If the plaintext data to encrypt is an XML element or content, you encode it using UTF-8 and perform any necessary transforms to it, otherwise, if it is an external resource, you simply consider it as an octet sequence. You then encrypt the data, creating CipherValue, which you place in EncryptedData.

Care must be taken when signing content that may later be encrypted; clearly; the content must be restored to exactly the original plaintext form for the signature to validate properly. To restore the plaintext in the signed content, use the decryption transform method for XML signature defined by the XML encrypt joint W3C and IETF working group.

This transform also allows specifications of XML fragments that were encrypted and then signed with rest of the document and, therefore, are not decrypted to validate the signature. Often, encrypted fragments are removed from the signed information by using the XPATH transform in the reference element, since the meaningful information is the plaintext.

We can sign the plaintext version of an encrypted element by including the appropriate reference element pointing to it. When the signed document is confidential and encrypted after being signed, you should also protect against surreptitious forwarding in which the recipient forwards the signed confidential document to a competitor, encrypted by the competitor public key, trying to make it look as if the sender sent the confidential information. To prevent surreptitious forwarding, the signer should append the recipient identities to the document being signed.

Post from: Hot Scripts Blog

Overview XML encryption

Related posts:

1. Digital Signatures in XML
2. HTML with XML Data Binding
3. Smarty vs. XML/XSLT

You go through your web statistics and find a website that has not only stolen your images, but in fact simply linked right to them, on your server.

The problem with this is not just the theft of your images, but it runs up your bandwidth as well. This is known as “Leeching”.

A few options to choose from
When using htaccess to protect your images, you have a few options. These options determin who can and who cannot link to your images.

I will cover a few of them here.

Creating the htaccess file (some things to remember)
A few things to remember about htaccess, is that any folder you place the htaccess file in, it will affect that folder, and any folder beneath it.

The first thing you will want to do is open a text editor, I prefer Crimson Editor or Notepad.

The first basic bit of code will be used to turn on mod_rewrite, and tell the server which domains will be allowed to link to your files.

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?yourdomain.com(/)?.*$ [NC]

Line one turns on the mod_rewrite engine. The second and third line is telling the server to look for referrer strings that are not left blank. The third line is telling the server which domains are allowed to link to your files.

If you want to allow more than your domain to link to your files, you can add them by adding more RewriteCond lines. For example:

RewriteCond %{HTTP_REFERER} !^http://(www\.)?seconddomain.com(/)?.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(www\.)?thirddomain.com(/)?.*$ [NC]

Which file extensions do you want to protect?
The following code, added to the bottom of the above code, will tell the server which file extensions you want to protect. Using the the F and NC flags basically tell the server that it’s Forbidden from accessing the files, and the NC flag means No Case, telling the server to ignore the case (i.e. bmp and BMP will be treated the same):

RewriteRule .*\.(gif|jpe?g|png|bmp)$ [F,NC]

The completed code
When you compile al of this code thus far, you will have enough to protect your images, and bandwidth:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?yourdomain.com(/)?.*$ [NC]
RewriteRule .*\.(gif|jpe?g|png|bmp)$ [F,NC]

Displaying an image of your choice
Keep in mind that this option will not protect your bandwidth, but more so allow you to control it better, as well as display a humiliating image on the leecher’s site.

The RewriteRule that we used above, to determine the file extensions you want to protect, can be added to, to display your own image on the leecher’s site. You can change the line to:

RewriteRule \.(gif|jpe?g|png|bmp)$ /images/humiliatingimage.gif [L,NC]

Like I said however, this will not save your bandwidth as it is still displaying the “humiliating” image from your server.

The completed code would then look like this:
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?yourdomain.com(/)?.*$ [NC]
RewriteRule \.(gif|jpe?g|png|bmp)$ /images/humiliatingimage.gif [L,NC]

Saving your file
Now save your htaccess file as .htaccess. Make sure there is no .txt extension on it, as this will not function properly.

Upload the htaccess file to the folder of your choice, and there you have it!

Post from: Hot Scripts Blog

Prevent Hotlinking With htaccess

Related posts:

1. .htaccess Wrappers with PHP

Removing attributes and contents in the notation it becomes an example of signature object using three of its four elements.

The signature object contains the cryptographic hash of any signed information, and a reference to the information itself. The signed information may be an arbitrary document. However, often, it will be an XML object. The ability to sign only specific elements of XML documents is one of the most important features of DSIG. It lets the unsigned parts of the XML document is enhanced, modified, or removed for privacy or efficiency, keeping the signature valid.

DSIG signatures may contain either the signed XML object contained in the XML object, or detached from the signed object or document. When the signed XML object envelops the signature, the enveloped signature value itself is not included in the signature calculation and validation computation. For this you use the enveloped-signature transform, removing the whole signature element in which it is contained from the digest calculation.

Public key digital signatures that provide nonrepudiation, such as RSA, are computationally intensive operations; therefore, DSIG also allows shared-key authentication that provides authentication but nonrepudiation.
Collision resistant hashing of the signed content is also used to save computational requirements.

Generating DSIG signatures:

1. Identity resources to be signed.
2. Calculating the digest value and composing reference elements for each resource.
3. Composing the signed info element from all references.
4. Computing value of signature method over identity resources to be signed element by applying algorithms like DSA, RSA-SHA1, etc
5. Composing the signature elements with signedInfo, signature value, identity key used to sign, and other optional objects like signature properties.

An XML DSIG may contain multiple reference elements in the same document

DSIG signatures may contain either the signed XML object contained in the XML object, or detached from the signed object or document. When the signed XML object envelops the signature, the enveloped signature value itself is not included in the signature calculation and validation computation. For this you use the enveloped-signature transform, removing the whole signature element in which it is contained from the digest calculation.

Public key digital signatures that provide nonrepudiation, such as RSA, are computationally intensive operations; therefore, DSIG also allows shared-key authentication that provides authentication but nonrepudiation.
Collision resistant hashing of the signed content is also used to save computational requirements.

Generating DSIG signatures:
1. Identity resources to be signed.
2. Calculating the digest value and composing reference elements for each resource.
3. Composing the signed info element from all references.
4. Computing value of signature method over identity resources to be signed element by applying algorithms like DSA, RSA-SHA1, etc
5. Composing the signature elements with signedInfo, signature value, identity key used to sign, and other optional objects like signature properties.

An XML DSIG may contain multiple reference elements in the same document

Post from: Hot Scripts Blog

Digital Signatures in XML

No related posts.

“Hello World!” Program:

1 //my first C++ program
2 #include<iostream>
3 using namespace std ;
4 main()
5
6 {
7 cout<<“Hello World!\n” ;
8 system(“pause”) ;
9 return 0;
10 }

Tearing apart the, “Hello World!” Program:

1 //my first C++ program * This is a comment. Comments do not appear on the program when it runs. As long as you have // in front of words, it is classified as a comment, and will turn blue.

2 #include<iostream> * This line of code is known as the, preprocessor. This line of code, tells the computer which other algorithm it should look from. In this example, the program, needs the assistants of the algorithm, iostream to run. Without this line of code, the program will not run.

3 using namespace std ; * This is what is known as a directive. The root of this term is direct. So, the application is directing the computer to do a process.

4 main() * main() is the center point of the application. The main part is telling the computer that this is the starting point of the application itself. The parenthesis are where the declared integers would go. Because there aren’t any in this application, only the main part is needed.

5 * This is just a blank line. The computer needs its space, so this is a line, where the computer can take a break when compiling.

6 { * This bracket is used to show where all the work is starting. In this case, the bracket is used for showing that the text is going to be printed.

7 cout<<“Hello World!\n” ; * This is a line of code, where all the work is being done. This line will print a string across the screen. The \n part tells the computer, that anything printed after this string, must go to the next line. You can go without having the \n in this line, but anything else, and the program will not compile.

8 system(“pause”) ; * If you are compiling and then trying to run a program in Windows, it won’t work. The moment you think it will work, it won’t. It will terminate itself. With this command in your application, it will stay open, so you can watch everything that is happening.

9 return 0; * You need the computer to know what to do, when all the processes are done. So, that’s where this line of code comes in. When all the processes and commands are finished running, this line of code tells the computer to terminate once a key is pressed. You need this line of code in your application.

10 } * You also need this last bracket. It closes off the application.

Ending Comments: Congratualtions! You have just written and compiled your own application. I had a great time writing this tutorial, and I intend on writing a follow-up on variables, arrays, and other features. If you have any comments, please feel free to make me aware of them.

Post from: Hot Scripts Blog

Structure of a C++ Program

No related posts.

This paper summarises the basics of using RSS to provide syndicated content. I will be using the RSS 2.0 specification simply because that is my personal preference. There are a number of alternative specifications available, but I will not be looking that those.

The author, Peter Cowburn, has been working with XML in conjunction with a variety of other web technologies for over 6 years.

RSS is XML

That’s correct! Building on the amazingly versatile eXtensible Markup Language, RSS is a useful application of XML. This explains the way RSS is marked up in XML style tags.

The Structure of RSS

All RSS documents absolutely must contain the root element <rss> within which there can only be a single <channel> element. Do not do it any other way! The basic meaning when ‘reading’ the RSS file is that first we are actually in an RSS document (the “rss” tag) and have a channel (the “channel” tag). Only three other tags are 100% necessary in any RSS document, namely; <title>, <link> and <description>.

There are a whole host of other tags which can optionally be used within the “channel” which are:
category, cloud, copyright, docs, generator, image, item, language, lastBuildDate, managingEditor, pubDate, rating, skipDays, skipHours, textInput, ttl and webMaster. Details of these are listed in the specification.  The commonly used ones are pubDate and lastBuildDate as they are of use to RSS Feed Aggregator programs.  However the most important is the item tag!

The item tag

The channel can contain any number of items (though having none would be silly); think of them as stories in a newspaper or entries in a blog. The available tags which can be used within an item tag are author, category, comments, description, enclosure, guid, link, pubDate, source and title.  Note that all of the tags are optional individually but the item tag must contain at the very least either a description or title tag.

A bare-bones example

Below is an example of a minimal RSS feed, note that this is not the absolute minimum required in an RSS document but just contains the most commonly used tags. Note: required tags are coloured green.

<rss version=”2.0″>
<channel>
<title>My Personal Blog</title>
<link>http://www.mypersonalblog.com</link>
<description>A small web log all about me.</description>
<pubDate>Tue, 2 Nov 2004 14:48:32 GMT</pubDate>
<lastBuildDate>Tue, 2 Nov 2004 14:48:32 GMT</lastBuildDate>
<item>
<title>The Weather Today</title>
<link>http://www.mypersonalblog.com/the-weather-today/</link>
<description>
I looked out of the window this morning and it was
pouring with rain. Obviously my first reaction
was to turn over and go back to sleep.
</description>
</item>
</channel>
</rss>

More real-world example

Most commonly RSS documents are used for news/blog feeds, so I will give you a quick example (modified from my own web log). Note the various groups of tags are coloured to distinguish groups.

<rss version=”2.0″>
<channel>
<title>cowburn</title>
<link>http://blog.cowburn.info/</link>
<description>Web, Life and Photography</description>
<language>en-us</language>
<pubDate>Tue, 2 Nov 2004 14:48:32 GMT</pubDate>
<lastBuildDate>Tue, 2 Nov 2004 14:48:32 GMT</lastBuildDate>
<item>
<title>So you want a photolog?</title>
<link>http://blog.cowburn.info/archives/2004/11/2/photolog/</link>
<description>
I have been working on re-arranging this site so that the different
areas (Blog, Photos, etc) will all appear consistantly, styled along
the same theme.
</description>
<pubDate>Tue, 2 Nov 2004 14:48:32 GMT</pubDate>
</item>
<item>
<title>Got Logo?</title>
<link>http://blog.cowburn.info/archives/2004/11/1/logo/</link>
<description>
Out of the goodness of my heart, I have decided to help those
designers out who are non-logoly gifted in a contest which is
going on over at yaXay currently.
</description>
<pubDate>Mon, 1 Nov 2004 19:12:02 GMT</pubDate>
</item>
<item>
<title>Birnie 2004</title>
<link>http://blog.cowburn.info/archives/2004/10/30/birnie/</link>
<description>
For those of you wondering where on earth I have been for the
past month or so, fear not for I am about to enlighten you.
I have been digging up in the North East of Scotland excavating
the lovely settlement site of Birnie in Moray.
</description>
<pubDate>Sat, 30 Oct 2004 22:19:58 GMT</pubDate>
</item>
</channel>
</rss>

Summary

So, essentially we have covered the very basics of what RSS is all about and what the documents look like.  In the real world RSS documents are generally generated on-the-fly whenever a new news article or blog entry is published.  This is an area not to be covered in this paper but there are many methods of achieving this to be found around the internet.

Happy publishing!

Post from: Hot Scripts Blog

RSS: Really Simply Syndication

No related posts.