5

I want to check the authenticity of a zip package downloaded.Is it enough to only create the checksum of the zip package and check it in local? Do i need to create the checksum of each file included?

    m = hashlib.md5()  
    file = io.FileIO('test.zip','r')  
    bytes = file.read(1024)  
    while(bytes != b''):  
        m.update(bytes)  
        bytes = file.read(1024)   
    file.close() 
1
  • I'm not familiar enough with python specifically to know this for sure, but i'd guess that they likely have some variation of SHA hashing built in. If so, it's a much better idea to use that as opposed to md5, as md5 is in fact considered to be insecure. Jun 21, 2015 at 4:03

2 Answers 2

3

I assume you are questioning the scope of the MD5 hash, not the checksum (two very different things). Because ZIP is a lossless compression algorithm, taking the hash of the whole ZIP archive (and checking it against the expected value) should provide identical "authenticity" information as checking the hash of each uncompressed internal file individually. If the ZIP archive hash matches the expected value, you don't even need to worry about the checksum values. The hash is a far more robust mechanism than the checksum(s).

As just one example of the hash's power, each object (ie, file) is identified by a SHA-1 hash of its contents in the Git source control system. This is the only mechanism Git considers to see if a file has been altered.

2
  • Well, be careful. Git identifies files by their SHA-1 hashes but it doesn't mean that no collisions exist for SHA-1. It only means that Linus has decided to ignore them. Please refer to his explicit confirmation.
    – dlask
    Jun 21, 2015 at 4:25
  • @dlask True, collisions are an inherent part of hashing, but of such negligible impact in most use cases (assuming a proper / balanced hasing algorithm) they can be effectively ignored. If you were designing a life support system, or rocket navigation system, then maybe not so much. Jun 21, 2015 at 4:29
0

The ZIP file format already contains checksums of individual files.

See does .zip compression internally maintains checksum .

2
  • mind you, CRC32 is HORRIBLY insecure. It might be good enough for a basic check, but if something more secure is needed, then what's built in simply isn't sufficient. Jun 21, 2015 at 4:13
  • @user2366842 You are right, of course. However, if you also add the hash of the whole file (as proposed by the OP) you obtain a reasonable security. In other words: You can easily find a collision of CRC32 but it would hardly result in the whole file checksum collision at the same time.
    – dlask
    Jun 21, 2015 at 4:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.