How to add hash to MS Word documents?

Question

I'd like to add a SHA, or some other kind of a hash to a Word (for Windows) document.

Is there a good program / macro that would help me with that? Or some kind of a tutorial somewhere on the net? Google didn't help.

Solution 1

Despite the naysayers, this is actually a reasonable and useful thing to do. In fact, as @nik points out, it is already built in to MS Word; Insert → Signature Line.

However, the MS way requires obtaining a digital certificate from a certification authority. Those things cost money. You can easily create your own hashes without a certificate.

First download a hash generator like HashCalc.

Now a problem with generating hashes of MS Word documents is that Word constantly changes the document data for things like autosave, timestamps, the undo buffer, et al. You have to checksum the readable data, not the Word file. Do this:

1. Save your Word document as text, selecting UTF-8 as the encoding if you use any non-ASCII characters.
2. Run HashCalc on the .txt file, then copy the SHA1 or whatever hash.
3. Open the Word (not .txt) document and add the hash to the end of the document.
4. Send the hash-appended document.
5. The recipient can cut the hash from the document, save it as UTF-8-encoded text, then calculate the hash. It should be the same as what you sent.
6. The recipient sends you the payment or contract or whatever, plus the hash.
7. To verify the document, delete the hash and recalculate it as before. It must be the same as the recipient's.

One problem with this method is that it only considers the text, not things like graphics or formatting. If you need to hash those you will have to use a digital certificate in Word.

Solution 2

I guess what you want to do is digitally sign the document.
Here is one reference -- Digital Signing of Microsoft 2007 Office System Documents

_{also see, Using an Electronic Signature in Word.}

Solution 3

Sorry, but I cannot comment on this site, yet, but I think what you are trying to do has no point, because: they can still change the document, the fact that you can put a hash in your document doesn't change that, and you cannot prove to any court that they didn't print the exact electronic copy that you sent them.

Why don't you send them the hard/paper copy for them to sign, in snailmail? While that may or may not work for you, the hashing won't help...

Comments

[Mike Insch]

Are you trying to add a hash of the document to the same document, or are you trying to add the hash of document X to document Y?

[Aboc]

To the same document. It's a legal document I'm sending to someone to print, sign and send back to me via post. I want to make sure that the person doesn't change anything on the document. If I add a hash, if the person changes something, and I discover it after the fact, I may be able to prove in court that a change occured.

[Mike Insch]

The problem is that the very act of adding the hash will change the value of that hash - adding the hash will itself change the content of the document.

[tomconte]

What kind of "document" are you talking about? Also, you do not include the hash itself when you calculate the hash as that would indeed be pointless. Excluding the hash when you recalculate is not pointless.

[Darius]

Why not saving the document as a PDF file which cannot be changed unless someone has a full blown Adobe Acrobat but even then it is possible to secure your PDF.

[Aboc]

@Darius - if someone would be malicious enough to change the deal without our knowledge, I'm sure he wouldn't have too much trouble with changing even the most protected PDF. You just give the task to your IT guy, he takes one hour, finds a cracking website and cracks the PDF. Or prints that PDF to another PDF, and changes that one.

[Aboc]

To verify the document I can't delete the hash, because the document "to be verified" will be on paper :) But aside from that - this is the method I also discovered... I just hoped there would be an easier one. Thanks!

[Aboc]

Your points are right. But sometimes the time is short and we don't want to waste it by sending them a copy to sign.