-1
$\begingroup$

To valiate integrity or To verify if the software is digitally signed

The question seems wrong to me. I do not see any reason to publish(make public) a hash. But it is in the material I am studying.

Improve this question
$\endgroup$
1
  • $\begingroup$ Signatures don't need the hash of the message, they need the message itself. $\endgroup$
    – kelalaka
    Sep 14, 2022 at 19:27

3 Answers 3

Reset to default
0
$\begingroup$

Hashes are routinely made public. Either of the given reasons can be correct depending on the exact scenario. Here I assume a cryptographically secure unkeyed hash (so it has preimage resistance, second preimage resistance and collision resistance).

A one way hash can be used to validate integrity (if a file is changed a well designed hash (say SHA2) of the file will change, and typically it will change in approximately half of its bit values--this is called the avalanche effect).

Hashes are also used for digital signatures, since one can digitally sign the hash (which is fixed length) of the file instead of the file itself.

For a different example, in login servers there usually is a public file of usernames and hashes of passwords. This enables remote login where the client machine applies the (unkeyed) hash to the input password and this is compared to the hash stored in the public file.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Aren't the verifier hashing the message to verify the signature? I don't know any signature scheme that sends the hash of the message to verify. Indeed this is problematic since the one can send the (m',hash,signature) to fool the verifier. $\endgroup$
    – kelalaka
    Sep 14, 2022 at 19:25
0
$\begingroup$

Hashes can be made public to verify the integrity of the data or verify that a program or file was made by the valid author. You see integrity checks on programs with MD5 or SHA- hashes. If a bit flips or many bytes are corrupted when you download or write the program onto your computer, the hash will change dramatically. This is known as the Avalanche Effect in cryptography.

When you see a programmer or an author of a Email or text file "digitally sign" the file, this is usually done with versions of RSA and it is the modern base for verifying the sender of an Email. Outside the Email World, you will see this used for privacy-centric programs like Tor Browser, Monero GUI and CLI and others as the userbase of those programs are concerned about malicious actors masquerading as the original authors.

It is a very useful tool to validate that what the person sending it to you was messaging you what they wanted. You know that what you got was both sent by the actual person and is the data in the purest form.*

  • *Obviously not all data is pure after install. See Data Corruption on Wikipedia.
Improve this answer
$\endgroup$
0
$\begingroup$

Common Scenario: I do it all the time with Ansible.

  1. You download an Apache web server file httpd-2.4.54.tar.bz2
  2. You want to make sure the fire you downloaded was not tampered with
  3. You go onto Apache's website and compare the published SHA256 or SHA512 hash for the file.

PS. Some certification DUMP SITES mark incorrect answers as correct. I know the exact question you are referring to ;)

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.