ファイル整合性を検証する方法
暗号学的ハッシュを使って、ファイルが破損や改ざんを受けていないことを検証します。
问题
大きなファイルをダウンロードし、破損や改変なくオリジナルと同一であることを確認したい状況です。
前提条件
- ハッシュ関数の理解
- ハッシュツールを実行できること
ステップ
-
1. Obtain the expected hash
Download the official hash value from a trusted source, typically published alongside the file on the official website. The hash is usually SHA-256 or SHA-512. Verify that the hash itself comes from a trusted channel (HTTPS, signed page).
入力official SHA-256: a1b2c3...输出expected hash recorded -
2. Compute the hash of your file
Run a SHA-256 hash tool on the downloaded file. The tool reads the file and produces a 64-character hex digest. Even a single bit change in the file produces a completely different hash.
入力downloaded-file.iso输出computed: a1b2c3... -
3. Compare the hashes
Compare the computed hash with the expected hash. If they match exactly, the file is intact. If they differ, the file is corrupted or tampered with; delete it and re-download. Use a constant-time comparison in code to avoid timing attacks.
入力expected: a1b2... | computed: a1b2...输出MATCH ✓
期待される結果
ダウンロードしたファイルが元のファイルとバイト単位で同一であることの確認。
よくあるエラー
- Comparing only part of the hash
- Compare the entire hash string. A partial comparison can miss differences in the unchecked portion.
- Getting the hash from the same server as the file
- If the server is compromised, both the file and the hash could be tampered. Get the hash from an independent trusted source or a signed release.
トラブルシューティング指引
- If hashes differ, re-download the file. If they still differ, the source may be corrupted.
- Use SHA-256 or stronger; MD5 and SHA-1 are broken for integrity against intentional tampering.
セキュリティ上の制限
- Hash verification detects accidental corruption and non-targeted tampering. For adversarial tamper detection, the hash must come from a trusted independent source.
- All hashing is local.