Cómo a Verificar Archivo Integrity

问题

You downloaded un large archivo y querer a confirm it es identical a el original, con no corruption o modification.

Requisitos previos

• Understanding of hash functions
• Ability to run a hashing tool

Pasos

1. 1. Obtain the expected hash

   Download the official hash value from a trusted source, typically published alongside the file on the official website. The hash is usually SHA-256 or SHA-512. Verify that the hash itself comes from a trusted channel (HTTPS, signed page).

   entrada

   official SHA-256: a1b2c3...

   输出

   expected hash recorded

2. 2. Compute the hash of your file

   Run a SHA-256 hash tool on the downloaded file. The tool reads the file and produces a 64-character hex digest. Even a single bit change in the file produces a completely different hash.

   entrada

   downloaded-file.iso

   输出

   computed: a1b2c3...

3. 3. Compare the hashes

   Compare the computed hash with the expected hash. If they match exactly, the file is intact. If they differ, the file is corrupted or tampered with; delete it and re-download. Use a constant-time comparison in code to avoid timing attacks.

   entrada

   expected: a1b2... | computed: a1b2...

   输出

   MATCH ✓

Resultado esperado

Confirmation ese el downloaded archivo es byte-para-byte identical a el original.

Errores comunes

Comparing only part of the hash

Compare the entire hash string. A partial comparison can miss differences in the unchecked portion.

Getting the hash from the same server as the file

If the server is compromised, both the file and the hash could be tampered. Get the hash from an independent trusted source or a signed release.

Solución de problemas指引

• If hashes differ, re-download the file. If they still differ, the source may be corrupted.
• Use SHA-256 or stronger; MD5 and SHA-1 are broken for integrity against intentional tampering.

Límites de seguridad

• Hash verification detects accidental corruption and non-targeted tampering. For adversarial tamper detection, the hash must come from a trusted independent source.
• All hashing is local.