Hashes, passwords, and MACs
Use hashes for fingerprints
Use a modern cryptographic hash to identify bytes and detect accidental or adversarial changes when the expected digest is trusted.
8 minute lesson
A cryptographic hash turns any input into a fixed-size digest. A small input change produces a very different result.
Hashes help identify files, content, and structured messages. A plain downloaded checksum does not authenticate a file if an attacker can replace both file and checksum. The expected digest needs a trusted channel or signature.
shasum -a 256 app.zip
shasum -a 256 -c app.zip.sha256A download page serves app.zip and its SHA-256 checksum from the same compromised server. The attacker replaces both, and the user sees a successful comparison.
The digest detects accidental changes only when the expected value has an independent trusted path. A signature can supply that path when its verification key is already trusted.
Hash a small file, save the digest through a separate trusted channel, and verify it from a clean copy. Change one byte and capture the failed check. Then replace both the file and its adjacent checksum and explain why the command succeeds but authenticity still fails.
Lesson completed