I don't see the point of having a digital signature in a cookie under normal circumstances. Granted, you can verify the signature to ensure that the server signed the cookie. But, most often, the only purpose of the cookie is to point to a persistent file on the server. If the files are named randomly and the users can't get a list of the names of the files, they can't just make up cookie values anyway.

If you need to sign the cookies because you are going to store actual data in the cookie itself, instead of having the cookie point to a file on the server that contains the data, then you will need to sign them. But that's not commonly done. Would it matter to you that the users can just delete the cookies?

A digital signature is just a hash digest (sha1 or md5 usually) that has been encrypted. Cpan has lots of hash and encryption packages. I'm partial to OpenSSL, which seems to have a fairly large user base, so I would try the Crypt::OpenSSL::* modules first.

Good luck. You will need it. Remember that cryptography has a long sad history of systems that went into production and were then found to be startlingly weak due to minute flaws in the design. There is no substitute for careful design, and also no substitute for adequate peer review.

In reply to Re: Digitally Signed Cookie by quester
in thread Digitally Signed Cookie by toronto75

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.