0

I am new to Information Security. I can find many websites asking to verify the checksum of the files. It's logical if the file is exposed to modification while transmission. HTTPS addresses this issue and guarantees the integrity of the file.

According to this article by IBM,

SSL provides data integrity by calculating a message digest

So, again, what's the reason behind verification of the digest of a file served over HTTPS?

Assume that no mirror server is involved.

Improve this question
3
  • 1
    I assert that it is not a duplicate of that question and it does not answer what I asked for. @Steffen Ullrich
    – ryanafrish7
    Aug 25, 2017 at 15:42
  • The first handles about the purpose of hashing and the second one about purpose of hashing when both the webpage and file is served over http (without s)
    – ryanafrish7
    Aug 25, 2017 at 15:45
  • It already explicitly says about file being served over HTTPS. @SteffenUllrich
    – ryanafrish7
    Aug 25, 2017 at 15:46

1 Answer 1

Reset to default
0

HTTPS protects file against modification during transmission. But, HTTPS does not protect against file corruption in all cases: if the transmission is aborted early or of the server has problems in transmitting the file you will not notice. In these cases a checksum might help. Also, in case the download site is just a mirror of another site provides both file and checksum makes it possible to detect errors during the mirror process.

Improve this answer
2
  • Won't Content-Length be preventing corruption or how can it get past from being noticed?
    – ryanafrish7
    Aug 25, 2017 at 16:14
  • 1
    @OutOfRange: Most browser don't even complain if the content if shorter than the advertised length. Apart from that there might not even a length advertised (i.e. close on end of TCP connection).
    – Steffen Ullrich
    Aug 25, 2017 at 16:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .