1
  1. Http sites like OpenSSL provide checksum for each source code tarball available for download

  2. HTTPS sites like GitHub usually do not provide checksum with 'download zip' option.

  3. Some sites although HTTPS do provide checksum.

So if one has HTTPS, is checksum not necessary for file downloads?

Please help me with some explanation.

0

A checksum can be provided for the following reasons:

  1. to validate that the download is complete;
  2. to validate that you are looking at the correct download (later in time);
  3. to make sure that a third party download service (proxy, torrent etc) provides you with a valid download.

HTTPS helps you with two things: to make sure you connect to the right server in the first place and to provide transport security.

The checksum is not going to help you if an attacker impersonates a server, which is why HTTPS can provide additional security. Furthermore it protects you from an attacker changing the data in transit.

TCP already checksums. The chances that a packet is damaged during transport is negligible for stable connections. I would say that neither HTTPS or a secure hash is required to detect damanged packets.


With regards to 1: Usually a browser or HTTP client already uses a temporary file while it is downloading. If it just downloads directly or if the move to the real file name is stopped prematurely then a hash can show you that the data is not fully copied.


With regards to 2: Checksums were very useful for slow connections. Now for smaller programs I just download again sometimes. You should however recognize that downloads cost money for the one providing the service. If you can avoid a download by validating a checksum please do so.

It could also protect you against service providers that just offer setup.exe as download although it is unlikely that organizations like that (hi Microsoft!) provide any kind of checksum.


With regards to 3: if the checksums are provided on the original site (they usually are) then you can use the checksums to check if the software you downloaded from a mirror site can be trusted. If the mirror is out of date, has made an error copying files or if it is hacked then the MD5 will tell you if the file you just downloaded is correct or not.

This even works if the hash is MD5 as attacks on MD5 require a precalculated hash.

This is probably why sites like GitHub don't provide checksums; if the download is not mirrored then there is less need to provide a checksum


Notes:

  • checking a hash may be too much work for consumers, hence the many installers that perform the download and checksumming themselves (probably using a mirror)
  • a hash is not a signature: if the original site is hacked then you are out of luck
  • Of course: "we have always provided checksums" and "we don't trust CRC of TCP" may be reasons as well, if not particularly good ones. – Maarten Bodewes Aug 4 '15 at 13:04
2

Checksums are there just to inform you that nothing has been damaged during download process. You must know that checksums have nothing to do with security features such as encryption. They are there just to be sure with a certain degree that what you got is what you expected. A more secure and better solution is to check the PGP signature as when you try to download a Kali Linux ISO image file.

As for HTTPS, there is the famous MITM attack performed practically for example using the notion of SSL striping developed by Moxie Marlinspike.

What I want to say is that when it comes to security you can never be safe 100%, but in your case it is better to download something from a website that combines reliability (checksums) and trust/security (HTTPS)

  • You must know that checksums have nothing to do with security features such as encryption. If you mean that checksum does not provide confidentiality (expected from encryption) that yes, but there is more to the security than that - integrity is one of the security concepts, and checksum provides that. In fact, integrity is the only security aspect required by public distributions. – Cthulhu Aug 4 '15 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.