Verifying download integrity

From MozillaZine Knowledge Base
Jump to navigationJump to search
Up to Downloads - Firefox; Configuration (Thunderbird)

Sometimes when you download a file, it gets altered in the process of transfer over the network, sometimes resulting in non or malfunctioning file. Mozilla.org provides MD5 and SHA1 sums for Firefox and Thunderbird to verify your download integrity on it's FTP server.

E.g. http://releases.mozilla.org/pub/mozilla.org/firefox/releases/2.0/MD5SUMS

Note that "MD5 was designed by Ronald Rivest in 1991 to replace an earlier hash function, MD4. In 1996, a flaw was found with the design of MD5; while it was not a clearly fatal weakness, cryptographers began to recommend using other algorithms, such as SHA-1. In 2004, more serious flaws were discovered making further use of the algorithm for security purposes questionable." So that means MD5sum only protects against random changes in transfer and not against file tampering. Only download from trusted sources.

see http://en.wikipedia.org/wiki/Md5

Keywords: md5, SHA1, md5sum, SHA1sum, cryptographic hash function, checksum, CRC