Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Many websites offering downloads also provide the MD5 or SHA1 hashes of the files which are available for download.

An example-

List of MD 5 hashes

What is the security purpose behind providing such a facility to the end-user?

share|improve this question

4 Answers 4

up vote 1 down vote accepted

A cryptographic hash function is a function which everybody can compute efficiently (there is nothing secret about it), and which offers some interesting characteristics:

  • It accepts as input a sequences of its (or bytes) of arbitrary length (in practice without any upper bound).
  • Its output has a fixed, small size (128 bits for MD5, 160 bits for SHA-1).
  • It is deterministic (hash the same input twice, possibly with different machines or implementations, and you will still get the same output twice).
  • It is so much entangled that it resists collisions, preimages and second preimages.

For the scenario at hand, collisions are not an issue. Preimage resistance is about the impossibility of finding a message m which, when hashed, yields a given output. Second preimage resistance is similar: you know a message m, which, when hashed, yields some output x, and you cannot find another message m' (distinct from m) which yields the same output. How this impossibility is achieved is a rather complex subject (see this).

The small output size is the reason we use them for downloads. If you obtain the MD5 hash from a reputable source (the SSL-enabled Web site of the publisher), then you can download the actual data from anywhere, e.g. a P2P network like BitTorrent. Once you have the data, you hash it (on your machine) and then check that the MD5 or SHA-1 hash value matches the one you got from the reputable source. On match, you know that you have the right file, down to the last bit, because, in order to feed you an altered file while keeping the correct hash value, an ill-intentioned attacker would have to break second preimage resistance of the hash function -- and, right now, nobody knows how to do that.

If you download the file from the same source as the hash value, then the hash value is kind of useless. The added value for security of the published MD5 or SHA-1 is in the situation where the bulk data is obtained through a "weak" medium, while the hash value is transferred securely.


Hash values are also great for detecting errors. They are meant to resist modifications of the data by intelligent attackers who know what they are doing; this also makes them robust against random alteration from a mindless universe. Hash functions are very good checksums. If you download a big file, say an ISO image, burn it on a DVD, then read back the DVD on some other machine, then there is ample room for non-malicious alterations, in particular bad RAM on either machine (flipped bits occur more often than usually assumed). At any time, you can recompute the hash on the data, and see if it matches the expected value.

share|improve this answer

The MD5/SHA1 hash being provided serves as a checksum to verify the integrity of the file. Especially on Linux/Unix systems, the md5sum and sha1sum utilities provide a convenient means to verify that the file has not been tampered with.

Of course, the hashes provided are only useful IF you can ascertain that the the hash has not been tampered with. This means that the hashes should be transmitted to the end-user in a secure fashion, perhaps over HTTPS or a different channel altogether.

share|improve this answer
4  
Ideally the hashes should also be signed. Transferring them over HTTPS only ensures that they don't get modified during transfer but they could already have been modified before. –  scai Mar 25 '13 at 7:11
3  
Really? Rofl, that would end up being a recursive thing then. Signing the hash of the hash of the software. –  Rohan Durve - Decode141 Mar 25 '13 at 8:05
    
@scai How's that better than signing the software? –  Luc Mar 25 '13 at 8:34
4  
@Luc: I never said that. If you sign the software in the first place you don't need to hash it afterwards because the signature already contains a hash. –  scai Mar 25 '13 at 9:27
2  
@scai Signing is only useful if you already have the public key of the signer. Otherwise, you get at best a signature from an unknown party which is pointless. –  Gilles Mar 25 '13 at 10:48

The point of a hash is that if the data changes, the hash changes. So if you know that the hash is correct (i.e. hash(data_you_have) = announced_hash), and if you know that the hash is good (i.e. announced_hash = hash(genuine_data)), then you know that you have the right data (data_you_have = genuine_data).

So why would you send a hash separately? In case someone could modify the data but not the hash. This makes sense if you send the data through a channel that has a high bandwidth but may be subject to data corruption, and the hash through a channel that is more reliable but has little bandwidth.

Torrents are a good example. The .torrent file contains a hash of each file in the torrent. It's only a few kilobytes and can be downloaded easily over the web. The pieces of the torrent, on the other hand, are downloaded from random unknown machines somewhere on the Internet, which you have no reason to trust. So once the data has been downloaded, your torrent software will verify that the hashes match and reject any piece whose hash doesn't match.

Here, providing the hashes separately on the web page is an additional convenience if you get the .torrent file from the same source: in that case there is no need to verify the hash separately. If you get the .torrent file from a different source (such as a tracker), that source may itself be corrupted or malicious, and the hashes let you verify that what you downloaded is the genuine data.

If you download the hashes from a website over HTTP, then you need to trust the following parties:

  • the site you're downloading from (to provide “good” data and matching hashes);
  • your ISP, the site's host, and more generally any Internet infrastructure in between;
  • anyone who might have installed software (malware) on your machine, on the site or in the Internet infrastructure.

You do not need, however, to trust anyone involved in getting the actual data to you: only the hashes.

It's up to you to decide whether to trust the site (both to serve useful data and not to be affected by malware) and whether to trust that your own computer is free of malware. As for the Internet infrastructure, that's a very very low risk in practice unless you're using public wifi.

If you download the hashes over an HTTPS website whose certificate is good, this removes the risk from the Internet infrastructure. You still need to trust the website owner, your own machine, and the part of the Internet infrastructure involved in providing the certificate (browser provider, certification authority).

share|improve this answer
1  
One additional use: they can be used as file "fingerprints", for both good and bad files. –  mr.spuratic Mar 25 '13 at 11:38
  1. It simply helps you to verify the integrity of the file that you are downloading.
  2. The hashes are calculated using "good data" and it helps you to check for file corruption. Files may be corrupted due to bad storage media or errors in transmission.

What is the security purpose behind providing such a facility to the end-user?

There is a possibility that when you are trying to download a file/software some bad guy may be successful in doing a Man In The Middle attack and replace the real software with a malicious version. The hashes help you make sure that you have downloaded the original software.

In linux based environments you have md5sum and sha1sum utilities. In case you are using windows you can use something like cryptool.

share|improve this answer
    
The concept of "good data" when the data is malware samples seems... interesting. :) –  Michael Kjörling Mar 25 '13 at 12:03
    
:-) good data = unaltered data –  Shurmajee Mar 25 '13 at 13:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.