Cyberstudy
Supplementary — not from your PDF Beginner ~15 min

Verify a download with a hash

Check that a file you downloaded is exactly what the publisher released by comparing SHA-256 digests.

Environment

Your own computer. Windows PowerShell (Get-FileHash) or a Linux/macOS terminal (sha256sum / shasum -a 256).

Before you start

  • Read Hashing (p.54).

You will

  • Compute a SHA-256 digest
  • Compare it with a published checksum
  • See how a one-byte change alters the hash

Steps

  1. 1

    Pick an official download that publishes a SHA-256 checksum, such as a Linux distribution ISO or a VirtualBox installer. Download the file and note the published checksum.

  2. 2

    On Windows run Get-FileHash .\yourfile -Algorithm SHA256. On Linux run sha256sum yourfile.

  3. 3

    Compare your result with the published value, character by character, or paste both into a text editor search.

  4. 4

    Create a small text file, hash it, change one letter, and hash it again. Notice the digests are completely different.

  5. 5

    Try -Algorithm MD5 (or md5sum) on the same file and compare the digest length with SHA-256.

Check your understanding

  • ?What does a matching hash prove, and what doesn't it prove about who made the file?
  • ?Why is the published checksum only useful if you get it over a trusted channel?
  • ?How long are MD5 and SHA-256 digests in bits?