How long do you predict before sharing hash sums alongside file attachments become a norm?

SGT Private RallyPoint Member — Sat, 23 Sep 2017 13:40:28 -0400

I share md5 hash sums with my music downloads. They should be at least sha256 now that I think about it. Luckily, I can easily do this is Linux with md5sum, etc..

Response by SGT Jim Arnold made Sep 23 at 2017 1:45 PM

SGT Jim Arnold — Sat, 23 Sep 2017 13:45:02 -0400

it really depends on how well people adapt to certain platforms I just started using Linux but i am more familiar with the windows version

Response by SSG Derek Scheller made Sep 23 at 2017 2:43 PM

SSG Derek Scheller — Sat, 23 Sep 2017 14:43:38 -0400

I don’t necessarily share any files except through my Google Drive so maybe I should start doing it myself as it will show proof of file integrity.

Response by SPC(P) Private RallyPoint Member made Sep 23 at 2017 2:52 PM

SPC(P) Private RallyPoint Member — Sat, 23 Sep 2017 14:52:26 -0400

Well md5 is weak from a security stand-point and maybe over-strength from an error detection stand-point .

For security you want sha256, sha384, sha512 or sha3(keccak). However merely having the hash sitting next to the real thing might not provide that much protection from tampering. If an attacker can alter the file, then he can surely alter the hash to match. You need a digital signature backed by a public-key cryptography as well.

From an error detection stand-point a 32bit crc will only match one in 4 billion from accidental changes. There are also standards for a 64 bit crc. A 64bit crc should protect against all accidental errors to a very high degree of probability, but for many file formats an attacker could create a substitute file that collides.

So longer time frames I think that having digital signatures that use secure hash functions will become more and more of a norm. In many cases they will be embedded into the file itself, but ways to exist along-side or wrapping particular files should also become more common.

Response by Maj Private RallyPoint Member made Sep 23 at 2017 5:52 PM

Maj Private RallyPoint Member — Sat, 23 Sep 2017 17:52:27 -0400

It'll probably never be a manual thing people do. The best we can reasonably hope for is a browser that verifies it for us.

Response by PO3 Phyllis Maynard made Sep 24 at 2017 5:50 AM

PO3 Phyllis Maynard — Sun, 24 Sep 2017 05:50:48 -0400

My understanding of this is very weak. I'll stay tuned.