For me, one of the main use cases for IOTA regarding IOT was to be able to send data and funds in an atomic, immutable way.
E.g. sending a bundle including parameters, transferred in the signatureMessageFragment, and the required funds to a service provider in order to invoke the respective action. Therefore a bundle containing some value and 0-value (for the data payload) transactions is composed. As asked in a previous question, the data transferred in the signatureMessageFragment is not part of the bundle-hash and therefore not signed by the funds transferring tx. A malicious attacker could replay the bundle using different data in the signatureMessageFragment. If his replayed bundle would be confirmed, the service would only see the modified command.
So, how can one send data and funds without anyone being able to change the data. Since the obsoleteTag is part of the bundle-hash, I can only think of the putting all data in the tags, which would lead to many transactions in a bundle, even for little payload. Is there another method? Am I missing something? Wich also poses the question, why the signatureMessageFragment isn't part of the bundle-hash in the case a tx is not transferring funds?
UPDATED according to replies
Invoke a service by sending funds and data in an IOTA bundle.
Create a bundle including multiple input tx an output tx and multiple tx carrying data in their signatureMessageFragment.
SingnatureMessageFragment is not part of the bundle-hash and can thus be changed by an attacker until the bundle is confirmed.
Storing a hash of the signatureMessageFragment in an area which is part of the bundle-hash, such as the obsolete tag. This enables the receiver to verify if the signatureMessageFragment has been changed.
If the signatureMessageFragment has been modified, the receiver can’t execute the respective action. The funds have already been spent though. The initial data can’t be restored easily. The tangle has to be searched for the original transaction. If a snapshot occurred between sending the initial bundle and the confirmation of the modified bundle, data would only be available by querying a perma-node.
After all, data in a mutable part of a value bundle can always be modified. This this approach doesn’t seem viable to me. In a worst case scenario the data could never be transferred.