为什么各种项目的下载都有哈希码或校验和？
从 Internet 下载各种可执行文件或 zip 文件时，我从未使用过校验和。 我知道它用于检查一致性并增加一点安全性。 但是，当您从 Apache 或 Microsoft 等受人尊敬的项目下载时，有必要这样做吗？ 我们中有多少人实际上使用校验和或哈希码来验证内容？
仅供参考，如果我偏离 StackOverflow 可接受的内容太远，请告诉我。
I've never used the checksum when downloading various executables or zip files from the Internet. I know it is used to check for consistency and add a bit of security. But is it necessary for when you download from a respectable project like Apache or Microsoft. How many of us actually use the checksums or hashcodes to verify the contents?
FYI, please let me know if I have strayed too far from StackOverflow's acceptable content.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（8）
当下载完整性至关重要的文件（例如 Linux 发行版的 iso）时，我倾向于对下载进行 md5sum 以防万一。
来源可能是可信的，但您永远不知道您自己的 NIC 硬件何时会开始出现故障。
When downloading files where integrity is critical (an iso of a linux distribution for example) i tend to md5sum the download just in case.
The source may be trusted, but you never know when your own NIC's hardware may start to malfunction.
另一个用途是验证您已有的文件是否与可从可信源下载的文件相同（即未更改、未损坏且为最新）。
如果
Another use is to verify that a file that you already have is the same (i.e. unaltered, uncorrupted and as current) as the file available for download from the trusted source.
This might occur if
尽管您选择从可信来源（例如 Apache.org）下载，您的下载请求可能会由 镜像站点。 所涉及的受信任站点确实拥有满足所有请求的资源，因此镜像具有重要的功能。 但是，受信任的站点不一定能够完全控制镜像站点，并且镜像的所有者（或第三方）可能会用恶意代码替换镜像的可执行文件。 通过根据下载的文件验证可信源的哈希值，您可以确保它在传输过程中没有发生变化（无论出于何种原因）。
Although you are choosing to download from a trusted source (e.g. Apache.org) your download request will likely be served by a mirror site. The trusted site in question does have the resources to serve all requests so mirrors serve a valuable function. However, the trusted site does not necessarily have full control over the mirror site and it's possible that the mirror's owner (or a third party) could replace the mirrored executable with malicious code. By verifying the trusted source's hash against the downloaded file you insure that it has not changed in transit (for whatever reason.)
这样您就可以检查文件的完整性。 我用它所有的时间。 您基本上只需运行一些程序，该程序将在文件上生成 MD5 校验和或使用任何散列方法，然后查看两个校验和是否匹配。 如果不是，则文件不同。 但是，请注意，两个文件可能会产生相同的校验和，但比较两个相同大小的文件时遇到这种情况的可能性非常低，除非您正在设计示例。
这非常有用。 我最近在一个 CD 刻录程序中发现了一个错误； 我一直遇到特定计算机上的特定文件的问题。 最后我只是比较了CD上的文件和原始计算机上的文件的校验和，它们是不同的，并且我能够解决问题！
This is so that you can check the integrity of the file. I use it all the time. You basically just run some program that will produce a MD5 checksum, or whatever hashing method is used, on the file and see if the two checksums match. If not, then the files are different. However, note, that it is possible to have two files that yield the same checksum, but the likelihood you will run into this comparing two files of the same size is pretty low, unless you are contriving the example.
This is very useful. I found a bug in a CD burning program recently; I kept having a problem with a particular file on a particular computer. I finally just compared the checksums of the file from the CD and the one on the original computer, they were different, and I was able to solve the problem!
恕我直言，它仅在您下载了大文件并想在重新下载之前检查它是否已损坏（即应用程序是否未正确安装）时才有用。
Imho it's only useful if you have downloaded a large file and want to check if it's corrupted before re downloading it (i.e. if application is not installing correctly).
确保您下载的文件是正确的文件，而不是其他人恶意修改的文件。 正如 Apache 中的此信息所述：
“任何攻击者都可以创建公钥然后，他们可以创建由该假密钥签名的恶意版本。然后，如果您尝试验证该损坏版本的签名，则会成功，因为该密钥不是“真实”密钥。因此，您需要验证此密钥的真实性。”
要验证您可以按照以下步骤
To be sure that the file you download is the good one file and no other modified by some others with malicious intentions. As this information in Apache says:
"Any attacker can create a public key and upload it to the public key servers. They can then create a malicious release signed by this fake key. Then, if you tried to verify the signature of this corrupt release, it would succeed because the key was not the 'real' key. Therefore, you need to validate the authenticity of this key."
To verify you can follow the steps here.
它的使用出于两个完整性原因（特别是在 ftp 站点上，您可能错误地以 ascii 模式下载）。 此外，它还可用于验证下载内容是否未被更改，假设您从位置 a 下载并从位置 b 获取校验和（通常下载来自镜像，哈希来自官方网站）。
不过，出于完整性目的，对文件进行签名比仅仅对文件进行哈希处理更有用。
It's used for both integrity reasons (particularly on ftp sites, where you may have mistakenly downloaded in ascii mode). Additionally, it can be used to verify the download has not been altered, assuming you download from location a and get checksum from location b (often download is from mirror, and hash from official site).
For integrity purposes, though, signing a file is going to be more useful than just hashing it.
我在 Mac OS X 上使用 MacPorts，这是一个基于源代码的包管理器； 每个 Portfile 都包含如何在 Mac OS X 上下载、修补、编译和安装软件的说明。Portfile 中包含要下载的特定版本的 tarball 的校验和。 这有助于确保文件的完整性，避免出现许多可能出现的问题； 有时，人们会在不增加版本号的情况下更新 tarball，这可能会导致补丁无法应用或代码在某些情况下被破坏，或者有时包可能会损坏，或者攻击者可能会篡改软件以期达到目的您将安装它。
所以，我不得不说，是的，我每次安装软件时都会使用校验和（尽管我的包管理器会自动为我执行此操作，但我不会直接执行此操作）。 即使您是从一个受人尊敬的项目手动下载，您也可能希望从更快、更近的镜像下载代码本身，然后对照从更可信的主服务器下载的副本验证校验和； 这有助于提高攻击的难度，因为必须危害多台服务器而不仅仅是一台镜像。
I use MacPorts on Mac OS X, which is a source based package manager; each Portfile contains a description of how to download, patch, compile, and install a piece of software on Mac OS X. Included in the Portfile is the checksum of the particular version of the tarball to download. This helps ensure the integrity of the file from many possible problems; sometimes, people will update a tarball without incrementing the version number, which may cause patches to fail to apply or the code to break under certain conditions, or sometime the package may become corrupted, or an attacker may be tampering with the software in the hopes that you will install it.
So, I will have to say that yes, I use the checksums every time I install software (though my package manager does it automatically for me, I don't do it directly). And even if you are downloading manually from a respectable project, you many wish to download the code itself from a faster, closer mirror, and then verify the checksum against a copy downloaded from the more trusted master server; that helps keep it more difficult to attack as multiple servers would have to be compromised rather than just one mirror.