20

How can a zero byte text file generate a hash when hashed with sha1sum, sha256sum etc? What data are the programs hashing to generate a hash value?

Ta

QuickHash in Linux

Terminal Commands

21

Hash algorithms read the input and process it, no matter if there's data at all. This is a valid and wanted behaviour and is even used to verify if a certain implementation is correct. This leads to "null-hashes" for all major algorithms.

To sum it up: da39a3ee5e6b4b0d3255bfef95601890afd80709 is the sha1-hash for an empty file everywhere, the same is true with the null-hashes of other alrogrithms.

  • 1
    Well you learn something new everyday! I didn't know there was a "null value" for every algorithm. Many thanks. – Gizmo_the_Great Feb 26 '13 at 23:28
  • 2
    The hash algorithms have a predetermined initial condition - kind of like a number which they start with and mutate as they read in data. If there's no data to read, the hash is just a result of that preset initial condition. – Kevin Feb 26 '13 at 23:31
  • The reason is also because the sha1 algorithm appends the length of the data (in this case: zero) and there is some flags and padding added into the message as well. So even "no data" will still result in some data being processed. – user92979 Dec 1 '16 at 13:47
14

All hash algorithms in Quick Hash are Merkle–Damgård constructions. As such, they pad the message to a multiple of the block size.

Quick Hash's algorithms achieve this by appending a 1 bit, as many 0 bits as needed, and finally the message length.

This allows hashing messages of arbitrary length, including zero-length messages.

  • If my edit reason is confusing, I initially misread your answer and reworded it "for clarity", then realized my edit was wrong and went back and fixed it. The system consolidated the two explanations because it was within the same time window. – fixer1234 May 3 '15 at 21:57
1

(Add-on to Dennis and fixer1234's answer?)

Succinctly:

$ shasum -a 256 /dev/null e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 /dev/null

All 0-byte files will have the same checksum.

$ shasum -a 512 /dev/null cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e /dev/null

$ shasum /dev/null da39a3ee5e6b4b0d3255bfef95601890afd80709 /dev/null

$ md5 /dev/null MD5 (/dev/null) = d41d8cd98f00b204e9800998ecf8427e (note: MD5 is broken; it's not a 'secure hash'. This is documented in the MD5 entry in Wikipedia.)

Thus, for example, if you're trying to verify the innocuousness of files at virustotal.com with one of the secure hash values listed here, e.g. da39a3ee5e6b4b0d3255bfef95601890afd80709 then you can be confident that the file was indeed 0 bytes (or was a folder, which virustotal, confusingly, hashes as if it's a 0-byte file.)

  • How this adds to current answers? – Máté Juhász Mar 29 '18 at 19:11
  • By providing a direct way for a skeptic to verify that it is the case that All 0-byte files will have the same checksum Several people were skeptical of this when discussing the innocuousness of 0-byte files at virustotal.com. So I think it adds to the solution a way for someone who comes to this question not sure if it's true that if the checksum is cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e, then the file was 0 bytes. – Matthew Elvey Apr 4 '18 at 21:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.