frustrated777

I'm aware now that file download verification have been widely implemented. However, verification detail permananetly published on the website is still not safe. As far as I know, md5 checksum and other digital signature can also be hacked. I'm wondering if it is possible for IT people to generate md5 checksum online of which Nero's approch is improvable - try to visit

http://www.nero.com/ena/downloads-linux3-trial.php

For the time being, every time one puts email in the box, the page is just generate the same md5 checksum. How easy is it to generate different one using the same mode?

Could another approach be to use double digital signatures with different application clients?

frustrated777

Could another approach be to use double digital signatures with different application clients, or use the same application client but one signature is permanent and another is on-fly?

Done_Fishin

the md5 checksum is exactly that .. for a given digital content regardless of size the checksum WILL ALWAYS BE THE SAME PROVIDING THAT THE CONTENT HASN'T CHANGED
any single bit of change , regardless of the size of the original file will change the checksum. Checksums have been used to locate (and try to correct .. [do a google on CRC]) errors in data for the last 35 years that I have been working in the Electronics / Computing Industry. If it was possible to spoof we wouldn't be able to recover, repair and re-allocate faulty sectors on hard disk drives .. which is one place that md5 and error correction are playing a major everyday role in the life of your PC today.

Cellus

While it is theoretically possible to have the same checksum for two different pieces of data, the chances are fairly remote.

Checksums are useful for establishing known-good baselines, to tell easily and quickly if something has changed. It does not tell you how it has changed, or even specifically in the output what has changed, only that it has changed. Checksums are used not only for error correction but also security. The same checksums used to check and see if, for example, a file is damaged (data is corrupted, ergo changed, resulting in a different checksum being calculated) can also be used to see if, for example, a file has been tampered with (data is manipulated, ergo changed, resulting in a different checksum being calculated).

Done_Fishin

Totally correct .. I just took it for granted that using an md5 implied that if the sums were equal that it could be assumed 99.9999999999999999% secure ...