2

In this page I saw the SHA1 checksum.

I know it's a hash algorithm, but I don't know why we need it for download code. So I clicked "what's this?" but got no any more information.

It's hash, so what? Why we should know it's hash when we download a file?

Improve this question

3 Answers 3

Reset to default
3

You'll be able to compute the SHA1 checksum of the downloaded file to see whether it was downloaded successfully, or if network issues or disk issues (or even attackers) prevented you from doing that.

$ sha1sum recaptcha-dotnet-1.0.3.0-binary.zip 
bfb3397d27c95e152d80529bd11dfdde35efdddd  recaptcha-dotnet-1.0.3.0-binary.zip

It's not that useful for a single file you're going to unzip (and get errors) immediately anyway, but it could be useful if you host your own repository of downloaded files.

From experience, I can tell you how not fun it is to find the few broken files in a (Java) Maven repository of several thousand files without checksums.

Improve this answer
3

The hash is created of the file that is on the server. You create a second sha1 of the file you have downloaded.

Compare the two hashes.

If they are equal: No one has tinkered with the bytes from the server to your machine and all is good.

If they are not equal:

  • Hardware failure
  • Someone is tinkering with the bytes coming in
  • Broken server
Improve this answer
2
  • So, does it mean i can use it to check if someone edited my file after i upload it on server?
    – Sisir
    Jun 20, 2012 at 9:17
  • yes. thats the 2nd bullet point of the list.
    – akira
    Jun 20, 2012 at 12:20
1

Short answer: cryptographic checksums are a lightweight and convenient way to do file integrity checking. A further step would be to check out files signed with GPG keys.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .