Step-by-step: Generating and Checking MD5 & SHA1 Hashes
1. What these hashes are
- MD5 and SHA1 are cryptographic hash functions that produce fixed-length digests from input data.
- They’re used for file integrity checks: identical files produce identical hashes; changed files usually produce different hashes.
- Note: Both MD5 and SHA1 are considered cryptographically broken for security purposes (collision attacks). They remain useful for simple integrity checks where strong collision resistance is not required.
2. How to generate hashes (common platforms)
Linux / macOS (Terminal)
- MD5:
Code
md5sum filenameor on macOS:
Code
md5 filename - SHA1:
Code
sha1sum filenameor on macOS:
Code
shasum -a 1 filename
Windows (PowerShell)
- MD5:
powershell
Get-FileHash -Algorithm MD5 -Path “C:\path\to\file” - SHA1:
powershell
Get-FileHash -Algorithm SHA1 -Path “C:\path\to\file”
Python (cross-platform)
python
import hashlib def hash_file(path, algo=‘md5’): h = hashlib.new(algo) with open(path, ‘rb’) as f: for chunk in iter(lambda: f.read(8192), b”): h.update(chunk) return h.hexdigest() print(hash_file(‘file.bin’, ‘md5’)) print(hashfile(‘file.bin’, ‘sha1’))
3. How to check a file against a known checksum
- If you have a checksum string (e.g., from a download page), generate the hash for your downloaded file using one of the commands above and compare the output string to the known checksum exactly (case-insensitive hex match).
- On Linux, you can place the expected checksum in a file (e.g., file.iso.md5) and verify:
Code
md5sum -c file.iso.md5For SHA1:
Code
sha1sum -c file.iso.sha1
4. Interpreting results
- Match: file is very likely unchanged since the checksum was produced.
- Mismatch: file was altered, corrupted, or downloaded incorrectly — do not trust the file.
- If the checksum source might be compromised (e.g., provided on the same server as the file), prefer stronger methods (signed checksums, SHA-256+, or PGP/GPG signatures).
5. When to avoid MD5/SHA1
- Do not use MD5 or SHA1 for security-sensitive tasks (password hashing, code signing, critical package verification). Use SHA-256 or SHA-3 and verify signed digests for higher assurance.
6. Quick checklist
- Use platform command or script to generate hash.
- Compare exact hex string to trusted value.
- If verification fails, re-download and verify source integrity.
- For security-sensitive use, use stronger hashes and signature verification.
Leave a Reply