electronic signature with php [closed]

Question

Closed. This question needs to be more focused. It is not currently accepting answers.

---

Want to improve this question? Update the question so it focuses on one problem only by editing this post.

Closed 9 years ago.

Improve this question

In my app, clients agree to contracts.

I need some way of ensuring that their approval of a contract cannot be interfered with even if one has access to the mysql database.

In other words, their approval can be linked to the terms they have approved.

It has to be legally binding so if the data in the db is tampered with, the signature would no longer be valid.

Has anyone accomplished this?

Answer 1

If you're asking questions about cryptography on Stack Overflow, you're in over your head and will undoubtedly make a minor but important mistake that renders your work completely invalid. Cryptography is very hard to get completely correct, and even then you will have to keep your application up-to-date as various new techniques to circumvent things are discovered.

Use an off-the-shelf solution that's proven to work like GnuPG to handle your signing. Even then you'll need to ensure it's installed correctly, that you're handling the data correctly and calling the correct functions to validate the signatures.

Long story short: Find someone qualified and/or certified to do this and follow their advice to the letter. Get their solution vetted by a third party that can be trusted.

What you want to do here in general terms is get both parties to cryptographically sign the contents of the original message. That way in order to change the contents, both parties would have to "collude", something that's not likely if one party is trying to sabotage the other.

This requires both parties to have a secured, unknown private key that's used for these operations. Managing these is considerable overhead for your application unless you have a way of installing client software that does it for them. Even then, generating and protecting keys is anything but fun.

If you want to learn more about the nuances of cryptography, you will need to read The Book.