Re: Authenticating a program
Possible solution:
The MD5 is just not good enough for authentication.
You could try the HMAC-MD5, which is much more secure.
Of course you could always go the certificates route, but I personally prefer to use a secure hash.
This doesn't guarantee where the file came from, but it should be enough to guarantee that it is the right file.
Keep in mind - No Secure Hashing is foolproof - but you can get pretty close.
I hope this helps.
Re: Authenticating a program
That doesn't really solve the MitM attack problem. It is just an MD5 that is encrypted. The encryption doesn't buy you anything in this case (for files, not passwords).
For example:
A new version of App.dll is available. MyApp.exe downloads the new DLL and lets say it uses HMAC-MD5. Anyone intercepting the data stream can't see the real MD5 hash that App.dll is supposed to have right?
Well Mr. Hacker just downloads the REAL App.dll, computes its REAL MD5 hash, and makes Trojan.dll. Now he does a MitM attack, incercepts the download of app.dll and replaces it with Trojan.dll. MyApp.exe downloads the file, decrypts the HMAC-MD5, then does the MD5 compare, and they match.
Re: Authenticating a program
Store the file on the server as a password protected zip file.
Download, try to unzip with password. Should be secure enough.