On 30 Apr 2013, at 04:19, David Strauss <david_at_davidstrauss.net> wrote:

> We're trying to implement this for our own server/client communication and our communication with S3, so the set of implementations needing to interoperate is pretty limited. The goal is to checksum, not to avoid attacks. MD5 is quite adequate for that. I would like to use a standard rather than rolling our own method, though.

TCP already has checksums… would those be enough?

Content-MD5: will help to detect data corruption that has got past TCP's error correction mechanisms. However, I would keep this separate from libcurl because very few people would need or use it.

Depending on your application, you might like to look into support for HTTP trailers. Putting Content-MD5: into a trailer could avoid the need to buffer the whole response.

-- 
Tim Bannister – isoma_at_jellybaby.net
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette:  http://curl.haxx.se/mail/etiquette.html