I often see a checksum given next to a file available for download. The purpose of this practice eludes me. It is obviously to detect corrupt files, but what could be the cause of this corruption and is it at all likely?Surely the file will not be damaged by transmission errors since those are detected by the network protocol. And surely any attacker who could alter the file for malicious purposes could likewise alter the given checksum. Are we checking for hard drive errors? Are those more likely to happen when writing then when reading? Am I missing something important?
Why compute checksums of downloaded files?
networking;files;checksum
To detect corruption is not entirely correct. To ascertain the integrity of the software would be a more correct usage. Normally a software is not distributed from a single server. The same software may be distributed from many servers. So when you download a particular software, the server closest to your destination is chosen as the download source to increase the download speed. However, these 'non-official' (third party) servers cannot be always trusted. They might/can include trojans/viruses/adware/backdoors into the program which is not good. So to ensure that the software downloaded is exactly same as that of the 'official' software released by the concerned organisation, the checksum is used. The algorithms used for generating checksums are such that even a slight change in the program results in an entirely different checksum.Example taken from Practical Unix and Internet SecurityMD5(There is $1500 in the blue box.) = 05f8cfc03f4e58cbee731aa4a14b3f03MD5(There is $1100 in the blue box.) = d6dee11aae89661a45eb9d21e30d34cbThe messages, which differ by only a single character (and, within that character, by only a single binary bit), have completely different message digests. If the downloaded file has the same checksum as the checksum given on the 'official' website, then the software can be assumed to be not modified.Side Note: In theory, two different files CAN have the same hash value. For the Hash/checksum algorithm to be considered secure, it should be computationally very expensive to find another file which produces the same checksum.