I was downloading Kali Linux (via direct download) and noticed that the SHA1 checksum during download was different to the official values provided. However, after the download was completed, the checksum changed to that of the official value. Can anyone please provide some information regarding why it may have changed on this one occasion?

SHA1 during download: da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA1 after download: 25cc6d53a8bd8886fcb468eb4fbb4cdfac895c65

Ordinarily, I would have thought that this is simply due to the download not being complete, however, in the past I have performed this same check when downloading Kali Linux and the checksum has been the same on all occasions.

I have searched for an answer, but could not find anything conclusive. I am now going to re-download via a torrent to see if the same occurs.

  • Yes, but specifically why it was different on this occasion but was not different when performing the same check in the past. – user141100 Mar 13 '17 at 9:20
  • 3
    It might have been because you started to compute the checksum while downloading and completed the computation once the download ended. Checksum are made to check the integrity of your file, thus an incomplete file cannot have the same checksum as a complete file. The real question is: why did you even try to compute the checksum of an incomplete file? – A. Hersean Mar 13 '17 at 10:02
  • 2
    The value during download is for a windows DLL. How did you get this value? virustotal.com/en/file/… – TheJulyPlot Mar 13 '17 at 10:15
  • 1
    @TheJulyPlot Another Practical SHA1-Collision confirmed. The key is to download Kali Linux. We are all doomed. – FMaz Mar 13 '17 at 18:04
  • @Fynn Mazurkiewicz unless that is the file that that the value was mistaking derived from. Which is probably more likely. Either that or we have just stumbled onto another nation state programme. – TheJulyPlot Mar 13 '17 at 18:07

The official hash sum is the one of the complete file. During the download the file is not complete, so the calculated hash sum, represents the current state of the file (e.g. 50%; 1GB/2GB).

It simply is not possible for a file to have the correct hash sum, whilst downloading.

For example:

If the complete file was a simple text file containing 10 as and it's hash sum is 2ee3ace5cfab0b5dee7ba84fc09dc3c459c34f0b.

An incomplete file, for example only containing 5 as, differs from the complete file and therefore the hash sum differs as well (5cafdebe4e78588628681c0fa5fda8a410ccd966).

If they were the same, that would mean that the complete file is available for you locally, to calculate the hash sum.

  • then why was it correct during download previously? – schroeder Mar 13 '17 at 9:40
  • I can not explain this and assume that this was a misunderstanding on OP's side. For example OP checks the browser and sees the ongoing download, then goes to a terminal and starts the hash sum calculation. Whilst switching from browser to terminal the download finished. – SaAtomic Mar 13 '17 at 9:45

First of all you need to understand how checksum or Hashing function works. In order to get a hash of a file or folder, you need to input the complete file or folder into the hashing function and then do the computing.

In your case, since the download was not complete, the hash function generated the hash on the basis of parts that were completely downloaded.

The official website for Kali Linux states the SHA1 hash wherein the input is a complete KaliOS setup, so when you complete the download, the hash function should be the same as the one mentioned on the website. But if you compute a hash while it is downloading, it won't be the same ever as the file is not completely downloaded. If you get the same hash for an incomplete download, it may be due to hash collision( But its impossible to get that )

  • 1
    SHA1 hash collisions are not impossible, but for this case not really relevant. – SaAtomic Mar 13 '17 at 9:27
  • 1
    @SaAtomic yeah I know its the impossible to get collisions in SHA1, I was referring to this particular case only, as it will be impossible to get a collision in the mentioned case – Skynet Mar 13 '17 at 9:34
  • why was it correct during download previously? – schroeder Mar 13 '17 at 9:41
  • 1
    @schroeder its not possible that that an uncompleted download of a software will have the same hash as that of a completed download. The only possible explanation is that the download might be almost complete and when you compiled the hash, the download was just completed. That's the only possible scenario I can think of. – Skynet Mar 13 '17 at 11:26
  • @Skynet I get that, but that;'s the question being asked – schroeder Mar 13 '17 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy