3

Often software sites would offer signatures and checksum for integrity check after software download. How crucial is checksum(e.g md5) verification process and what other sort of security does or can these process offer?

  • 1
    How "crucial" it is, depends on how... paranoid you are. The security offered by it is verification that the file you download is the file you intended to download; this is much more of a concern if you're downloading it from a mirror site that may not be controlled by the authors of the software. – TZHX Aug 16 '18 at 7:11
  • Depends on the level of security (what your company does). But, in general, you should always check the checksum, otherwise symantec.com/connect/blogs/… – randomness2077 Aug 17 '18 at 8:03
6

In terms of security, what it offers is that, MD5 collisions aside, the file you got is the file which wasn't tampered. As stated in a comment, this could be useful when downloading the file from a mirror or through an unsecure FTP connection.

Note that if the file is downloaded from the same site as the one which shows the hash, the match of a MD5 or a SHA1 doesn't mean anything, security wise. In a case where the site is exposed through HTTP (as opposed to HTTPS), MITM can change both the file and the hash down by the website; in this case, the hash is only misleading as it gives you a false sense of security.

Another use of a hash is to determine whether you got the entire file or not as well as make sure the file didn't get corrupted (in a case of a network issue or when your PC crashed). This is not the sort of situations which occur on regular basis.

A much more frequent situation, however, is that you downloaded a file long ago, and you're not sure it's the same one as the one you see on the website. A simple hash comparison may make all the difference between re-downloading a 5 GB file for the next twenty minutes, wasting server's resources, and knowing that you don't need to, because the file you have is the same one.

  • Isn't data transfer integrity already taken care of by TCP itself? – Samuel Aug 16 '18 at 8:52
  • It is. That's why I told that this is not something which should happen frequently. It happened more often twenty years ago where both software and hardware wasn't particularly reliable. – Arseni Mourzenko Aug 16 '18 at 8:55
  • @Samuel TCP checksum is only 16 bits, so every 65536th packet with significant data corruption is going to have same checksum (it should still protect against single bit flips well). – hyde Aug 16 '18 at 10:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.