why are downloads sometimes tagged md5, sha1 and other hash indicators?

Question

I've seen this all over the place:

Download here! SHA1 = 8e1ed2ce9e7e473d38a9dc7824a384a9ac34d7d0

what does it mean? how does a hash come into play as far as downloads and... what use can I make of it? Is this a legacy item where you used to have to verify some checksum after you downloaded the whole file?

Just curious, Cheers,

/mp

Answer 1

It's a security measure. It allows you to verify that the file you just downloaded is the one that the author posted to the site. Note that using hashes from the same website you're getting the files from is not especially secure. Often a good place to get them from is a mailing list announcement where a PGP-signed email contains the link to the file and the hash.

Since this answer has been ranked so highly compared to the others for some reason, I'm editing it to add the other major reason mentioned first by the other authors below, which is to verify the integrity of the file after transferring it over the network.

So:

• Security - verify that the file that you downloaded was the one the author originally published
• Integrity - verify that the file wasn't damaged during transmission over the network.

Answer 2

It's to ensure that you downloaded the file correctly. If you hash the downloaded the file and it matches the hash on the page, all is well.

Answer 3

A cryptographic hash (such as SH1 or MD5) allows you to verify that file you have has been downloaded correctly and has not been tampered with.

Answer 4

SHA1 and MD5 hashes are used to verify the integrity of files you've downloaded. They aren't necessarily a legacy technology, and can be used by tools like those in the openssl to verify whether or not your a file has been corrupted/changed from its original.

Answer 5

When downloading larger files, it's often useful to perform a checksum to ensure your download was successful and not mangled along transport. There's tons of freeware apps that can be used to gen the checksum for you to validate your download. This to me is an interesting mainstreaming of procedures that popular mp3 and warez sites used to use back in the day when distributing files.

Answer 6

With a has (MD5, SHA-1) one input matches only with one output, and then if you down load the file and calculate the hash again should obtain the same output. If the output is different the file is corrupt.

If (hash(file) == “Hash in page”)
    validFile = true;
else
    validFile = false;

Answer 7

To go along with what everyone here is saying I use HashTab when I need to generate/compare MD5 and SHA1 hashes on Windows. It adds a new tab to the file properties window and will calculate the hashes.