MD5 Hash (Checksum)

[Steve21]

Silly question, but how does MD5 hashing work in terms of what does the function base it on? Does it base it on name/size? Or is it supposed to work on actual file coding, and if so how would checking it client side work?

 

If it's just name/size etc, isn't it possible for files to have the same hash but be totally different?

 

Or have I missed something

 

Many thanks,

Steve

[glennda]

my understanding of it (although limited through moodle) was that for passwords anyway - it is only reversible if you have the correct salt key which can decode the hash

 

but i might be completely wrong!

[Steve21]

my understanding of it (although limited through moodle) was that for passwords anyway - it is only reversible if you have the correct salt key which can decode the hash

 

but i might be completely wrong!

 

That's more hash keys, but same kind of thing. It's used a lot for checking integrity when files are downloaded (example: > Ubuntu > Ubuntu 11.04 - LQ ISO )

 

The idea being, once downloaded you can do a MD5Hash of the file, and if it's the same as the key on the website it means it's a proper, legal download, with no errors/bits missing etc.

 

Just trying to work out, what details of the original ISO would be the same once you downloaded it. Name obviously, Things like dates wouldn't? etc etc.

 

Steve

[dhicks]

Silly question, but how does MD5 hashing work in terms of what does the function base it on?

 

The MD5 (or any checksum) algorithm works with whatever data you feed it. When you say "MD5" you might well mean a specific function in a particular language's library, in which case you're best off checking what, exactly, that function does with whatever data you give it. I think it's normal for most languages to have both an MD5 function to take a file handle, read all data from that file handle, and return an MD5 checksum value, and to have another funtion that just takes arbitary data as a string or similar and return the MD5 checksum of that (Python's standard library has both functions). The read-whole-file method might, obviously, take a while if it's a large file so you could speed things up by just giving the MD5 algorithm a string formatted with the file's name, size, maybe the modification date and so on, and get an MD5 checksum back from that, or maybe just read chunks of the given file, not the whole thing.

 

If it's just name/size etc, isn't it possible for files to have the same hash but be totally different?

 

It's possible for files to have the same hash, yes - a "collision" in the hashing algorithm. The MD5 algorythm is designed to minimise this happening - the chances of two files producing the same hash are something like one in several billion. However, bear in mind that that's for the contents of whole files - hashing different data (i.e. strings representing file modification and size data) might cause more potential collisions. Wikipedia's MD5 page would probably be a good place to start reading up.

 

MD5 is a cryptographic hash, used for file verification and to produce near-garunteed non-identical hash values. Some hashing algorithms are simpler and designed for things like placing items in hash tables, where collisions are to be expected. Those types of hashing algorithm will be considerably quicker to run. Is there something particular you're trying to do?

[Steve21]

Is there something particular you're trying to do?

 

Lets just say it's part of my "annoy the lovely little darlings" projects

 

Just trying to forsee any simple avoidance methods on checks for files.

 

Steve

[dhicks]

Just trying to forsee any simple avoidance methods on checks for files.

 

You mean for the only-allow-these-checksumed-executables feature in Active Directory? That should examine the contents of the file itself, changing the modified date and so on won't produce a different checksum. Note that simply appending a few bytes to the end of an executable will produce a different checksum, so the feature's only really useful when use as only-allow-these-checksums, not dissalow-these-particular-checksums.