Has this download been changed?
A hash is a short fingerprint of some data, worked out by a hash function. It lets you check that a file has not changed, without comparing every byte.
A software site publishes the fingerprint of its installer. You work out the fingerprint of the file you downloaded. If the two match, nothing was altered on the way.
By the end of this lesson
Note
I can use a hash to check that data has not changed.
Key words
| Word | What it means |
|---|---|
| Hash | a short fixed-size fingerprint of some data, also called a digest |
| Hash function | a rule that turns any data into a hash |
| Checksum | a hash used to spot a file that has changed |
| Integrity | data is exactly as it was meant to be |
| Avalanche effect | a tiny change in the data changes the whole hash |
| Collision | two different inputs that give the same hash |
The cells students fill in are left blank in this preview.
A hash function gives data a fixed-size fingerprint
A hash function takes any amount of data and gives back a hash of one fixed size. SHA-256 always gives 256 bits, which is 64 hexadecimal characters.
The same input always gives the same hash. You cannot work backwards from a hash to the input. Run the next two and compare the answers.
Hash the word hello
printf 'hello' | sha256sumShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Hash one letter different
printf 'hellp' | sha256sumShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: one letter changes everything
| Input | What sha256sum prints before the two spaces and the dash |
|---|---|
| hello | 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 |
| hellp | fdd7585e08c4e2afd71dcabdb4636c89d557a3f42db9e2040c8bbd1708aa4ce7 |
The cells students fill in are left blank in this preview.
A common mistake
Warning
Many people think a hash locks data away, like encryption. It does not. A hash has no key and nothing to unlock. You use it to check data, not to hide it. A short or guessable input can still be found by trying guesses.
A checksum file shows whether a download changed
A checksum file lists a hash for each file. To check a download, you hash your copy and compare. sha256sum -c does the comparing for you.
Run these five in order. They copy a report, record its hash, check it, then add a line and check again.
Copy the lab's report
cp /srv/lab-web/report.csv report.csvShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Record its hash in a list
sha256sum report.csv > sums.txtShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Check the file against the list
sha256sum -c sums.txtShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Add one line to the report
echo 'Saturday,300' >> report.csvShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Check the file again
sha256sum -c sums.txtShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Use SHA-256, not MD5 or SHA-1
A collision is two different inputs with one hash. A good hash makes a collision impossible to find on purpose. MD5 and SHA-1 are broken: attackers can make two different files with the same hash.
Use SHA-256, SHA-512 or SHA-3. Remember that a hash shows the data is unchanged. It does not show who made it.
Worked example: which hash to use
| Hash | Size in bits | Hex characters | Use it to check data? |
|---|---|---|---|
| MD5 | 128 | 32 | No, collisions can be made |
| SHA-1 | 160 | 40 | No, collisions can be made |
| SHA-256 | 256 | 64 | Yes |
| SHA-512 | 512 | 128 | Yes |
| SHA3-256 | 256 | 64 | Yes |
The cells students fill in are left blank in this preview.
The length of a hash
import hashlib
text = "hello"
digest = hashlib.sha256(text.encode()).hexdigest()
# Change text to "hello world", then press Run.
# The length stays the same. Then change sha256 to md5.
print(len(digest))
Hash hello with MD5, to compare lengths
printf 'hello' | md5sumShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.