[Motorola Atrix 2] PRichardson:
Greetings Dear Friends,:highfive:

This will be a short tutorial on (1) WHY? , and (2) HOW? , GREAT ROM developers (and software programmers in general) post the cryptographic file hash values, along with the download links to their files.:confused:

This can easily become a LaBrea Tarpit (pun, haha), if you get 'stuck' on the word Crypto. But the sense that the word Crypto applies to this tutorial, has absolutely NOTHING to do with encryption, and nothing to do with signing any files, and nothing to do with X.509, or SSL, or anything related to non-repudiation, authentication, or secrecy. The methods of verifying the hash values described in this tutorial, are but one small area within the much broader field of Cryptography. The algorithms used to derive the digest values (aka, checksums) , and they only refer to the techniques and algorithms, which are similar (and to an extend, to some of the data standards), between those activities, and the primary activity that this tutorial is concerned with, namely, determining the identity of a file copy, matches the identity of the original file it was copied from.

To put it another way, let me quote my friend Jim Bridgman here, "We have both SHA-512 and Md5 going on, on the Atrix2 [for example, in the signed bootloader]. I don't want people becoming confused and thinking that the fxz and roms are signed with a "pure" crypto SHA-3 hash, when it is a cheksum derived from a crypto style hash." --- so, before going any further, please understand that this is not the top-secret spy type of stuff. As Jim points out, the hash functions that create the hash values in this tutorial are used as just plain ol' "typical... checksum{s}, and not the secure signature that most think of and understand from things like SSL, and RSA in thier VPN software".

This OP here is perhaps already longer than it truly needs to be, but it will also perhaps grow over time. That is because I do not currently have easy access to an Apple Mac computer, so I will begin with instructions focused on Windows users, then Linux, and lastly the Mac platform (I'm sort of hoping someone will help me out by posting some original screen caps and some basic instructions for Mac Users). In order to keep this tutorial to within some reasonable length, I am not going to try and describe how a message digest algorithm works (actually, they all works slightly different). But for the truly hard-core nut, here are some links to make you happy, if you wish to know more:

http://en.wikipedia.org/wiki/Md5

http://en.wikipedia.org/wiki/SHA-1

http://en.wikipedia.org/wiki/CRC32

http://en.wikipedia.org/wiki/Checksum

http://en.wikipedia.org/wiki/Cryptographic_hash_function

Thus, let us begin then...

(1) WHY should this behavior separate the GREAT DEV'S :angel: from the CRAPPY DEV'S :cyclops: ? The answer to this question is 2-fold, and includes a technical answer, as well as a philosophical one. First, you WILL eventually come to understand that many technical factors can result in a file downloaded that is not a perfect copy of the original. Network congestion, ISP Nazi-Proxies, failure to use Google DNS, hard-drive and other hardware/wire intermittent instabilities, human error, and many other problems can corrupt or cause loss of bits and packets in files. A cryptographic hash, is a VERY reliable way to positively identify the file, as a nearly exact copy (as near you will ever need). If a dev is egotistical (enjoys posting as showing-off primarily), is slightly sadistic (enjoys causing frustration), lacks empathy (never sympathizes with others), or is just plain sloppy and error-prone (makes more mistakes), they are less likely to take the extra time and effort to post any hash values. If a dev is detail oriented, cares about others (that social investments come back), has integrity (takes the honorable route), and take pride in their work (wants to pursue excellence), they are more likely to post hash values. :victory:

==========================================================

WINDOWS USERS

(2) HOW: There are a number of software applications that are totally FREE, that can make it a trivial (easy) task to obtain the hashes of a file. The program I use most often is called "HashTab" and it can be found here. Hashtab essentially adds a tab to the 'properties' of files, inside Windows explorer.

STEPS: So after you install HashTab, then right-click any file, select 'properties' and then the 2nd or 3rd tab over will be a tab labeled "File Hashes", which you can open, and then right-click again on one of the 3 default hashes (the most commonly used hash algorithms, CRC, MD5, and Sha-1), and select "Copy All" as you see in the screencap below:

TYPICAL HASH VALUES:

CRC32: 0ED8B0A6

MD5: 7F9790B04684DA66222A4EAFE323CB2E

SHA-1: F839029742F73E508557E7B0674C5CE0B06AD815

There are other ways to also click both files and then do a comparison, so by all means, feel free to experiment with other methods and/or other applications. :cool:

==========================================================

LINUX USERS

(below commands, and screen capture image, compliments of Jim Bridgman --- thanks Jim!!)

Above image illustrates checking the md5, by using the proper command like this:

$ md5sum system.img
f9a74ca080a8ea2badb09c6d06badc42 system.img

EXPLANATION: In the above screen image, you can see that Jim was in the directory listed to the left of the $ sign, which is his 'prompt'. So he typed "md5sum system.img" (without the quotes), and the operating system then returned the result of that, which was the digest (basically, the hash value or checksum), and the name of the file that hash value corresponds to, which was "system.img". It is obvious that Jim perhaps ran the ls command (equiv. to dir in *nix), or he already knew that the system.img file was there. The first part he typed, aka, "md5sum" is the keyword for the function (or program application) that runs the command, and in this case, accepted the 'argument' which was the name of the file whose identity (checksum) is being checked.

==========================================================

APPLE MAC LION USERS

(coming soon, I hope?... with help?)

(below are some basic screenshots, from the HashTab website, used in accordance with "Fair Use" principles for non-profit, educational use only):good:

Apple Mac File Hashes (menu selection)

Apple Mac File Hashes (computing)

Apple Mac File Hashe (values displayed)

==========================================================

Hopefully, I have cleared up a little bit of confusion for someone new to the scene, or who may simply have never had the time to really research and understand a bit more about these hash values and why they are used the way they are (or how).

Best Regards,

Paul

ps. For easy reference, if you want to find this post again in the future, you can simply go here: links.PJR.bz/HashTabTutorial