0

Suppose I have a file and that I want to confirm that this file is the same as the original (IE: it has not been altered in any way) using hashing.

If I were to use a hash function that has no known collisions (such as SHA-256 or SHA-512, according to this post: https://crypto.stackexchange.com/questions/3049/are-there-any-known-collisions-for-the-sha-1-2-family-of-hash-functions) and I confirmed that the checksum posted by the author was legitimate, would it be reasonable to assume that the file is authentic if it's checksum matches the one released by the author? Or would there possibly be a way to circumvent this protection?

  • How are you confirming that the checksum matches the one that was originally released by the author? More to the point, how are you obtaining the original hash? An HMAC may be more of what you are looking for, depending on your threat model. – user52472 Nov 19 '18 at 22:56
  • Throw in encryption as well, it is tremendously harder to tamper with encrypted data. There are many scenarios in which the attacker can simply replace the hash with that of the tampered data, and there you have it - the tampered data is seen as "safe" for all intents and purposes. – dtech Nov 24 '18 at 11:58
3

Yes! This is absolutely a valid method of ensuring files have not been tampered with.

For some background, cryptography as a field provides a handful of useful services when applied. The low-level details of what these are changes depending on who you ask, but they all center around 4 key things:

  • Confidentiality (so only the correct parties can view the data)
  • Authentication (so we know who the correct parties are)
  • Non-repudiation (so the correct parties can't say they didn't do it)
  • Integrity (so the correct parties get the correct data)

Sometimes availability (making it so the data can be accessed whenever it's needed) is also included in there. (Here's a Microsoft reference on cryptographic services for the curious.)

Different types of cryptography provide different levels of service. Asymmetric key cryptography provides all of them: using (secure) asymmetric key cryptography, only the known correct parties can get the correct data and can't say they didn't make the data. If you don't have the key, you can't get the data, and you can't the key unless you're the correct party.

Hashing is an interesting case, where it's extremely valuable as a concept and a practice but is very limited in what it can do. Of the 4 cryptographic services, hashing only provides integrity. It provides nothing by way of confidentiality, authentication, or non-repudiation, but cryptographically secure hashing is a fantastic way of ensuring that everything about 2 pieces of content are exactly identical. In fact, in some ways that's the only thing hashing can do.

2

Yes, this is one use of hashes. Even better if you verify multiple different hashes - as a collision in one of them will not automatically lead to a collision in others.

Considder the following for instance:

curl https://www.mscs.dal.ca/~selinger/md5collision/erase | md5sum
curl https://www.mscs.dal.ca/~selinger/md5collision/hello | md5sum
curl https://www.mscs.dal.ca/~selinger/md5collision/erase | sha256sum
curl https://www.mscs.dal.ca/~selinger/md5collision/hello | sha256sum

This will show identical md5sums, yet separate sha256-sums.

If the hashing algorithm is deemed secure, you can more or less rely on it. Note that you also have to verify the channel over which you get the hash number. An attacker that can replace the file on the webserver you're fetching it from can probably alter the checksum displayed next to the download link as well...

If the download of the checksum is performed over plain text http, an attacker may replace the check sum in transit.

  • 3
    For those who might not know, the reason the two MD5 digests are the same is because of an attack against MD5 called a collision attack, which does not work against SHA256. – forest Nov 18 '18 at 1:46
  • Sha256 has collisions for sure, but there's no trivial known way of finding them, making such attacks unfeasible. – vidarlo Nov 18 '18 at 1:48
  • 4
    You're right. Collisions must exist due to the pigeonhole principle, but we currently have no way of producing them, so it's safe to say that SHA256 is still fully collision resistant. – forest Nov 18 '18 at 1:52
  • Awesome :D That's what I was thinking as well @forest but I just wanted to confirm that my understanding was correct. Thanks a ton for the discussion! – beepboop Nov 18 '18 at 23:17
  • Also even if there is some method to find sha256 collisions in the future, it will still be much harder, if possible at all, to create a file which results in a known md5 hash and a known sha256 hash at the same time. – Josef Nov 19 '18 at 10:25
-1

short answer: yes, you can safely use good (sha256, sha512) hash function for this. It's close to impossible to craft 2 files with same hash.

long answer: First of all do your research and choose wisely. sha256 seems to be fine for now, but sha-1 was hacked. Look at publications. Don't trust a random guy from stackoverflow. Also I would take a look at digital signature (gpg and so on), As an attacker I would start with attempt to fake the hash in this scenario. and only then sending you wrong file.

  • 3
    SHA-1 was not "hacked". It was simply discovered that it was easier to generate collisions with than we had previously speculated. – forest Nov 18 '18 at 9:05
  • Agree. the point here is that not all hashes are equal. Sha-1 is insecure and there's no guarantee that sha256 is secure, we just don't know all vulnerabiliries. And it's topicstarter's responsibility to choose correct algo – Dmitry Lavochkin Nov 18 '18 at 9:12
  • 1
    As it is now, SHA-256 is known to be sufficiently secure against collisions. Note that SHA-1 is still secure from preimage attacks, just not against collision attacks. – forest Nov 18 '18 at 9:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.