What hash should be used to ensure file integrity? [closed]

Question

It's no secret that large files offered up for download often are coupled with their MD5 or SHA-1 hash so that after you download you can verify the file's integrity. Are these still the best algorithms to use for this?

Obviously these are very popular hashes that potential downloaders would have easy access to. Ignoring that factor, what hashes have the best properties for being used for this?

For example, bcrypt would be horrible for this. It's designed to be slow. That would suck to use on your 7.4 GB dual layer OS ISO you just downloaded when a 12 letter password might take up to a second with the right parameters.

Answer 1

Do you want to generate the hashes for your personal use only (i.e. for files on your local system)? If so, although collision vulnerabilities have been discovered in the MD5 algorithm, and SHA-0/SHA-1 are known to have weaknesses as well, the probability of such a collision happening at random with your files would IMO be so small as to be easily ignored. I don't think there's any problem at all using either of these two to ensure the integrity of your files. By the end of this year though you can expect to see which of the 5 finalists in NIST's competition emerges as the winner, and then you can start using SHA-3 instead if you're that paranoid. :)

Answer 2

If you want to detect manipulations of the file, neither MD5 nor SHA-1 will suffice as both algorithms are broken. To protect against that scenario you will have to use something like SHA-256. Even MD5 will suffice, though, if you only want to detect "transport damage", i.e. accidental errors introduced during file transfer.

Answer 3

Nearly all hashes, even simple checksums, can detect a corrupted file transfer, but the transmission control protocol, often used in downloads, ensures integrity anyway, at least to a point where failure to detect possible errors is highly theoretical. Against an attacker trying to find a collision and pass a bogus file as legitimate, you would have to stick with more secure options. MD5 is generally considered broken, but SHA-1 and SHA-2 are relatively safe and common choices. SHA-1 has known weaknesses that can be exploited to find collisions in far fewer attempts than the algorithm is designed to withstand, but these exploits still require an impractical amount of computational effort. Moreover, these algorithms are sufficiently common to allow the client to easily calculate the hash of his download for comparison.