You may have seen MD5 hashes listed next to downloads during your internet travels, but what exactly are they? Let’s take a look at what these cryptic strings are and how you can use them to verify your downloads.
What Are Hashes and What Are They Used For?
Hashes, “digests,” are the products of cryptographic algorithms(in short, they’re a set of instructions used by computers to manipulate data). Many hash functions are designed to produce a fixed-length digest, regardless of the size of the input data. Take a look at the above chart and you’ll see that both “Fox” and “The red fox jumps over the blue dog” yield the same length output.
MD5, the Message-Digest Algorithm, has been used in multiple types of security-based programs in the past, but it’s also widely employed for another purpose: data verification. These types of algorithms work great to verify your downloads. Imagine, if you will, you’re online trying to grab the latest Ubuntu release from BitTorrent. Some horrible troublemaker starts distributing a version of the .iso you need but with malicious code embedded into it. Not just that, he’s clever, so he makes sure the files are exactly the same size. You would’t know you had the bad file until you tried to boot the CD, and by then, permanent damage could have already occurred!
This comes in handy not just for Linux distros, but for other things like BIOS files, third-party Android ROMs, and router firmwares – all things that could potentially “brick” your devices if the data is tainted. In general, large files have a larger risk of data corruption, so you may want to run your own checksums if your archives are important.
MD5 is no longer considered completely secure, and so people have started to migrate to other commonly used hash algorithms like SHA-1. This last one in particular is used for data verification more and more often so most tools will work with both of these algorithms. SHA1 is a cryptographic hash function. It's result is usually expressed as a 160 bit hex number. SHA1 was developed by the NSA. SHA1 is widely considered the successor to MD5. SHA-1 is the most widely used of the existing SHA hash functions, and is employed in several widely used applications and protocols.