如何Verify File Integrity
Use cryptographic hashes 到验证该 file 有不 是 corrupted 或 tampered 具有.
问题
你 downloaded 大 file 和 want 到 confirm 它是 identical 到原始, 具有否 corruption 或 modification.
前置条件
- Understanding 的 hash 函数
- Ability 到运行哈希 tool
步骤
-
1. Obtain the expected hash
Download the official hash value from a trusted source, typically published alongside the file on the official website. The hash is usually SHA-256 or SHA-512. Verify that the hash itself comes from a trusted channel (HTTPS, signed page).
输入official SHA-256: a1b2c3...输出expected hash recorded -
2. Compute the hash of your file
Run a SHA-256 hash tool on the downloaded file. The tool reads the file and produces a 64-character hex digest. Even a single bit change in the file produces a completely different hash.
输入downloaded-file.iso输出computed: a1b2c3... -
3. Compare the hashes
Compare the computed hash with the expected hash. If they match exactly, the file is intact. If they differ, the file is corrupted or tampered with; delete it and re-download. Use a constant-time comparison in code to avoid timing attacks.
输入expected: a1b2... | computed: a1b2...输出MATCH ✓
预期结果
Confirmation 该 downloaded file 是字节-为-字节 identical 到原始.
常见错误
- Comparing only part of the hash
- Compare the entire hash string. A partial comparison can miss differences in the unchecked portion.
- Getting the hash from the same server as the file
- If the server is compromised, both the file and the hash could be tampered. Get the hash from an independent trusted source or a signed release.
排障指引
- If hashes differ, re-download the file. If they still differ, the source may be corrupted.
- Use SHA-256 or stronger; MD5 and SHA-1 are broken for integrity against intentional tampering.
安全限制
- Hash verification detects accidental corruption and non-targeted tampering. For adversarial tamper detection, the hash must come from a trusted independent source.
- All hashing is local.