Let's say I would like to get the ISO images for CentOS. If instead of directly downloading the ISO images from a mirror server, I just download the .torrent file from the same server and then use a BitTorrent client, are there any chances that the images could be corrupted on purpose?
As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.
So long as you obtain the torrent file from a trusted source, it is not possible to corrupt the images.
The torrent file contains sufficient information to securely validate each chunk of the final image. As your client receives each chunk of the image file, it validates it against the hash set (or Merkle tree) in the torrent file. Invalid chunks are discarded and fetched again from a different source. Sources that continue to send you invalid data are blacklisted.
It is, however, possible to make it very hard for someone to download the torrent file by creating a large number of bogus clients that serve corrupt chunks. The client will throw each corrupt chunk away and blacklist the bogus clients as fast as it can. But this can still make downloading the torrent file impractically slow if an attacker is determined enough.
See the Wikipedia article on Torrent files, particularly the
Advantage of torrent is that 512byte chunks may be corrupted, but because it is sources from different sources, one bad 512 byte chunk will not cause the whole file of 600MB to get corrupted. Rather, the bad MD5 sum of the bad 512byte is trashed, and sourced from alternate routing peer. This allows the inherent advantage of torrent to download, accurately the large files.
This means, from authentically source torrent server list (especially through HTTPS) is always going to have trust value of 1:1.
Of course, you must always check the MD5 or SHA1 (or other hashes) to verify the true accuracy of the downloaded file.
According to Tails Linux (tails.boum.org) recommendation, you should (if absolutely paranoid about it) download same file repeatedly to make sure you are able to generate same MD5/SHA1 hashes, to TRUST the servers from where you have downloaded the Torrent action file.