# Checking a file for integrity and authentication

A checksum is a small-sized datum derived from a block of digital data for the purpose of detecting errors which may have been introduced during its transmission or storage. It is usually applied to an installation file after it is received from the download server. By themselves, checksums are often used to verify data integrity but are not relied upon to verify data authenticity.
[wikipedia]

1. How would you verify data authenticity then? Would transferring a file through the https protocol and then comparing it's hash confirm that it's genuine, or is there more to it than that?

2. And how would you hash a big 40+gb zip file, would you have to hash the entire contents of the file and, each file within the zip file?

I couldn't find any good resources on how to hash verify big files.

This relate to the difference between authenticity and integrity.

• Authenticity:
you are sure of the identities involved:
Where does the data come from?

• Integrity:
you are sure that the content has not been modified:
Was there an error during the transmission?

The second is usually provide through a Checksum (such as any hash function) e.g. $$SHA-3(\ M\ )$$

while Authenticity requires a MAC (Message Authentication Code), often in a form of a HMAC or KMAC e.g. $$SHA-3(\ K\ ||\ M\ )$$ or a signature e.g. $$Sign_{K_{priv}}(\ SHA-3(\ M\ )\ )$$

Remark:$$\textbf{Authenticity} \implies \textbf{Integrity}$$

You have to hash the whole file, hashing sub contents will increase the workload but will provide you integrity over small part and allow you to detect which part has been corrupted.

Note:
To hash big files you might want to have a look this article: Is SHA-3 slow ?