Skip to main content

Questions tagged [checksum]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
0 answers

How to verify the downloaded Mozilla Firefox binary? [duplicate]

I'm wondering about the correct steps when you want to download Firefox from their server and validate it has not been tampered with. Assume you download the latest Firefox tar-bz2-package from https:/...
Gere's user avatar
  • 147
15 votes
6 answers

Is it possible to generate a file with a given sha256sum checksum?

Is it possible to generate a file with a given sha256sum checksum? That is, reverse the process of a sha256sum checksum. That is, if we have a checksum, can we generate txt file data (need not be ...
Amruth A's user avatar
  • 223
0 votes
3 answers

Avoid checking passwords for dos attacks

A server gets requests with a username and password. Checking the password can be expensive, so a hacker can do a DoS attack by sending lots of requests with random passwords. No attempt to break in, ...
gnasher729's user avatar
  • 2,459
11 votes
5 answers

Can the secret be derived from the checksum? Should the checksum be encrypted?

Assuming I have secret data that is encrypted (using sops for example) and a checksum of the secret data for change detection: Is it possible to derive secret information from the checksum or should ...
mxcd's user avatar
  • 213
-2 votes
1 answer

Bulletproof Way of Ensuring the Integrity of Base OS Images [closed]

is it practically possible to ensure that the integrity of an ISO image for an OS is legit with 99.999% certainty? I was thinking of buying a bunch of DVDs of Ubuntu 22.04 on eBay and comparing the ...
ChaseLouisPowers's user avatar
1 vote
1 answer

Good checksum algorithm for backup / cloud sync system

I am writing a cloud backup system, and want to use a checksum to know if a file has been modified, and accordingly sync it with the server. This question shows that xxHash is super fast, and this ...
t348575's user avatar
  • 113
20 votes
4 answers

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

Alternatively, the question could be asked: Does issuing a checksum for a file we sign anyways just duplicate work? Use case: Firmware sent to an IoT device. We sign it, and form a separate checksum ...
kmfsousa's user avatar
  • 311
0 votes
2 answers

How do IoT devices know the checksum of firmware upgrades?

As I understand, some IoT devices verify the integrity of firmware updates downloaded from the internet using the checksum of the file before installing the update, making it impossible for attackers ...
jweik's user avatar
  • 3
0 votes
1 answer

Is there a way for a file/binary/exexutable to verify it's own integrity?

So I'm making a distributed recovery system which consists of a bunch of hidden usb sticks. I plan to have the file be an executable, probably in the form of a appimage, which will contain my ...
Procapagana's user avatar
0 votes
0 answers

use of md5 for protecting file integrity over http/https call [duplicate]

A common way to ensure integrity of a file uploaded from a client is to include the md5 header in the request which can be used by the server for the same. I would like to know that if a file can be ...
user2599052's user avatar
1 vote
0 answers

When file hash not available, how to best check authenticity of a file?

Normally, The Document Foundation (TDF) publishes the SHA-256 and SHA-1 hashes, along with the MD5 checksum, for all LibreOffice releases. For example, see this. However, for their current release (...
End Antisemitic Hate's user avatar
0 votes
2 answers

Why aren't installer isos gpg signed?

When downloading a Linux installer iso, the user is supposed to check the iso with sha or m5sum and compare the result against a checksum file, and then check the gpg signature of the checksum file. ...
Benchukee's user avatar
1 vote
1 answer

Do all files downloaded from the web, come with a checksum to verify the file?

Pretty straightforward question. Take the image here: Does it come with a checksum, which I can verify against after I have fully downloaded the file? This question ...
Jannies - They do it for free's user avatar
2 votes
1 answer

Why there is nothing that automatically checks signatures of files downloaded in browsers? [duplicate]

When downloading files (mainly software/installers) from pages in browsers, sometimes it comes also with a cryptographic hash or a signature to verify the authenticity of a file against data ...
Gabriel Maia Gondim's user avatar
2 votes
1 answer

What do algorithms `128000` and `256000` do in `sha3sum`?

I wanted to try new sha3sum so I installed libdigest-sha3-perl on Debian 10. After reading man page I quickly realized that: sha3sum --algorithm 256 test.txt produces similar output to sha256sum and ...
Ben Hoven's user avatar
0 votes
2 answers

How do I know that the ISO image of the Linux distribution I have downloaded does not contain the NSA backdoor?

I have downloaded the ISO image of Kubuntu 20.10 and installed it. I am afraid that the ISO image may have been tainted (for example, by the NSA) to insert a backdoor into it. As I see it, there are ...
robertspierre's user avatar
1 vote
0 answers

How Should Multiple Checksums Be Performed On the Same Data? [closed]

I am using CRC32 to verify the integrity of received UDP packets. Along with the generator polynomial, the sender will also specify how many checksums to perform on the sent data, as well as what ...
Justin Marinelli's user avatar
12 votes
4 answers

What's the point of providing file checksums for verifying downloads? [duplicate]

Many projects offering binaries, also offer hashes (e.g. SHA256) of those binaries, wither as .ASC files, or directly on the web page near the binary. This isn't to protect against network-caused ...
Dan Dascalescu's user avatar
1 vote
1 answer

If site provides MD5 to check file, can't the comparison string also not be modified? [duplicate]

I am new to this so please bear with me. I was downloading a VM image and I was told to check the MD5. Naturally, I did but wondered, If a hacker would change the file to be downloaded from the ...
heretoinfinity's user avatar
3 votes
2 answers

tcpdump packets have bad and incorrect checksums on localhost, how to investigate further?

Am investigating a macOS Catalina machine that is believed to be infected with malware. Have been viewing packets with tcpdump and noticed, on connecting to any web address, there are legit packet ...
lancealittlebit's user avatar
2 votes
1 answer

Were software "CD key" schemes backdoored or simply misdesigned?

Back in the day, retail software was shipped on physical CDs that often had a printed "CD key" label affixed. The (usually alphanumeric) key on the label was unique to that particular copy of the ...
smitelli's user avatar
  • 2,085
2 votes
5 answers

Prove log files weren't tampered with?

Say I have some Apache logs that show brute force attempts on a login page. I've singled out the IP, and found out who the culprit was. How can I show to a third party that I didn't makeup the entries ...
TACO's user avatar
  • 23
1 vote
1 answer

Why do some websites have their hashes on the same area as the download link? [duplicate]

Some sites allow us to use hashes to make sure that the file we download is what it should be and that it is not tampered with. Some sites may have their hashes on a different domain probably on a ...
Henry WH Hack v3.0's user avatar
0 votes
2 answers

Deploy verifiable webapp source code

Recently there have been quite some discussions about the security approach of ProtonMail. Since it do crypto stuff at client-side, loading the javascript code in the user's browser, as far as i know, ...
hwktest's user avatar
20 votes
2 answers

Which hashing algorithm shoud I use for a safe file checksum?

For my work I'll need to provide my customer a specific file which will be the result of the work I have done for them. To protect the integrity of the work I have done and to guarantee it has never ...
gouaille's user avatar
  • 303
5 votes
3 answers

Why verify a file / firmware downloaded online against a checksum? [duplicate]

When ever there is a file / firmware to download online and they provide a checksum to check the file against, i always confirm the check sum of the downloaded file matches the checksum posted online. ...
sam's user avatar
  • 566
0 votes
1 answer

Standard ways that sites use Base64 hash/checksum for security/authorization

I saw a few website APIs that use a checksum as a GET parameter. For example:{28 character Base64-like string}. The hash relies on all ...
Joan Clark's user avatar
30 votes
4 answers

Checksum vs. Hash: Differences and Similarities?

What are similarities and differences between a "checksum" algorithm and a "hash" function? Can they be used instead of each other? Or their usage are different? For example, for verifying the ...
Questioner's user avatar
  • 1,317
4 votes
2 answers

How does file hashing works?

When you run sha256sum filename OR md5sum filename, does it generate hash based on the file size or the whole contents of a file? Is it different from password hash? Given a string, the program uses ...
John Doe's user avatar
  • 167