15

Why we need two tools for verifying ISO . is there any specific things to consider between them ?

Improve this question

4 Answers 4

Reset to default
15

Short answer: For verifying ISOs, there is no practical difference, use whichever you want, as long as you trust the source providing the sums. MD5 is/used to be the standard, but the computing world is moving towards adopting SHA since it is newer and "better" for the future; hence, SHA sums are often provided as an alternative.

  • md5sum and sha256sum are programs which implement the MD5 and SHA-256 hash algorithms respectively
  • In general, a hash algorithm takes an input of any (arbitrary) length and runs mathematical computations on it to produce a relatively small, fixed-length output, called a "hash" (or "sum")
  • Verifying data integrity (e.g. ISOs) is only one of the many uses for hashes
  • The primary difference between the older MD5 and the newer SHA-256 hashes is that MD5 produces a 128-bit output while SHA-256 produces a 256-bit output
  • For verifying data (ISOs) to work, the hash of the data must effectively be unique, so that no other data produces the same MD5 sum or SHA-256 sum.
    • In theory, this is possible, i.e. two sets of input data produce the same output hash, called a "collision".
    • The chance of such collisions is lower with SHA-256 compared to MD5 because its 256-bit hash is double the size of MD5's 128-bit hash.
    • In practice, the chance of a collision when verifying ISOs, even with MD5 is zero given the 100+ MB size of ISOs.
  • Still, since the computing world is moving towards SHA because it is a newer and "better" hash for the future, ISO checksums are often provided in multiple formats.
Improve this answer
1
  • 6
    For the record, it's somewhat misleading to say SHA is just "newer and 'better'". MD5 is considered utterly cryptographically insecure due to how easy it is to produce collisions (which also makes it arguably less useful for verifying ISOs). MD5 should no longer be used, period, for anything. The Wikipedia page has a good summary of what's wrong with MD5 right now, in practice.
    – chazomaticus
    Aug 9, 2012 at 19:48
6

From How To SHA256 SUM page

The program sha256sum is designed to verify data integrity using the SHA-256 (SHA-2 family with a digest length of 256 bits). SHA-256 hashes used properly can confirm both file integrity and authenticity. SHA-256 serves a similar purpose to a prior algorithm recommended by Ubuntu, MD5, but is less vulnerable to attack. In terms of security, cryptographic hashes such as SHA-256 allow for authentication of data obtained from insecure mirrors.

From How to MD5SUM

The program md5sum is designed to verify data integrity using the MD5 (Message-Digest algorithm 5) 128-bit cryptographic hash. MD5 hashes used properly can confirm both file integrity and authenticity. The MD5 hash must be signed or come from a secure source (an HTTPS page) of an organization you trust. While security flaws in the MD5 algorithm have been uncovered, MD5 hashes are still useful when you trust the organization that produces them.

Basically it is measure of security concern. If you are using Unofficial Mirrors for downloading the ISO's then probably both can be used to make sure the integrity of file.

Improve this answer
0

MD5 and SHA-2 are different hashing algorithms. Its up to the developer(s) to decide what they want to use as an easy way to check data integrity.

In this case they are used to 'achieve' the same thing however the results (the hash) are completely diferent.

Improve this answer
0

An alternative to md5sum validation is the sha1 and sha256 sums as explained above.

Suppose you download or torrent the latest ISO from the releases site, say Raring. Notice at the top there's a file called SHA1SUMS as well as a SHA256SUMS, each with a long number for each .iso file.

Once your download of the .iso file is complete, you can calculate the sha1 or sha256 sum for it to make sure it matches the value in the SHA1SUMS file. You can do this with rhash.

First install it. If on Ubuntu:

sudo apt-get install rhash

For other operating systems, you can download it here.

Then calculate the sha1 or sha256 sum for the file you downloaded. For example for the ubuntu-13.04-desktop-amd64.iso I downloaded:

$ rhash --sha1 ubuntu-13.04-desktop-amd64.iso
ffed440f1dc1b43d9c170bd21e5ff669a59447f8  ubuntu-13.04-desktop-amd64.iso
$
$ rhash --sha256 ubuntu-13.04-desktop-amd64.iso
b4b20e0293c2305e83a60c605d39cabf43115794d574c68f1492d49fee0ab3d8  ubuntu-13.04-desktop-amd64.iso
$

The values respectively match the ones in the SHA1SUMS and SHA256SUMS files, validating the download.

You can also run rhash --md5 ubuntu-13.04-desktop-amd64.iso and compare to the MD5SUMS file.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .