Using hashes to check data integrity

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A student downloads a file and its hash matches the hash published by the website. What does this show?

A The file is unchanged, so its integrity is intact

B The file has been encrypted during the download

2. A file's hash before sending is different from its hash after it arrives. What is the most likely cause?

A The file was altered or corrupted in transfer

B The file arrived exactly as it was sent

3. Which step is needed to check a file's integrity using a hash?

A Hash the file before and after transfer, then compare the two

B Hash the file once and assume it is safe

4. What is a file checksum?

A A password that locks the file

B A hash value calculated from a file's contents

5. An attacker changes one number in a spreadsheet during transfer. What happens to its hash?

A It stays the same, so the tampering is hidden

B It changes, so the tampering can be detected

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1sha256(before) == sha256(after)		ADifferent hashes mean the file has changed. It may have been tampered with or corrupted, so it should not be trusted.
2sha256(before) != sha256(after)		Bchecksum = sha256(file)
3A file checksum is the hash of a file, published by the sender so the receiver can check the download		CWith no hash from before the transfer there is nothing to compare against, so tampering cannot be detected. The file must be hashed before and after.
4After a transfer, the receiver hashes the received file and compares it with the sender's hash to detect tampering		Dif sha256(received) == sentHash
5Only hash the file after transfer, then assume it is unchanged		EThe two hashes match, so the file has not changed during transfer and its integrity is intact
6Hashes differ, so the file is unchanged and safe to use		FThe hashes differ, so the file was altered, corrupted or tampered with and its integrity is lost

Definitions

hash comparison

Fill in the Blanks

Complete each line of code by filling in the missing parts.

hashBefore ← ____(file)

IF hashBefore _ hashAfter THEN OUTPUT "Data unchanged" ENDIF

IF hashBefore _ hashAfter THEN OUTPUT "File was tampered with" ENDIF

received ← download(url) hashAfter ← hash(________)

IF checksum = published THEN OUTPUT "Safe" ____ OUTPUT "Altered" ENDIF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A before ← HASH(file)

B after ← HASH(before)

C IF before = after THEN

D OUTPUT 'Unchanged'

E ELSE OUTPUT 'Tampered'

Question 2

A sent ← SHA256(report)

B got ← MD5(download)

C IF sent = got THEN

D OUTPUT 'Integrity kept'

Question 3

A expected ← 'a94f3c'

B actual ← CHECKSUM(expected)

C IF actual = expected THEN

D OUTPUT 'File is intact'

Question 4

A h1 ← COUNT(contract)

B SEND contract TO client

C h2 ← HASH(received)

D IF h1 ≠ h2 THEN ALERT

Question 5

A before ← file

B UPLOAD file

C after ← HASH(file)

D IF before ≠ after THEN

E OUTPUT 'Altered'

Answer Key

Using hashes to check data integrity

Section A: Quick Questions

A — The file is unchanged, so its integrity is intact

A — The file was altered or corrupted in transfer

A — Hash the file before and after transfer, then compare the two

B — A hash value calculated from a file's contents

B — It changes, so the tampering can be detected

Section B: Match the Pairs

sha256(before) == sha256(after) → The two hashes match, so the file has not changed during transfer and its integrity is intact

sha256(before) != sha256(after) → The hashes differ, so the file was altered, corrupted or tampered with and its integrity is lost

A file checksum is the hash of a file, published by the sender so the receiver can check the download → checksum = sha256(file)

After a transfer, the receiver hashes the received file and compares it with the sender's hash to detect tampering → if sha256(received) == sentHash

Only hash the file after transfer, then assume it is unchanged → With no hash from before the transfer there is nothing to compare against, so tampering cannot be detected. The file must be hashed before and after.

Hashes differ, so the file is unchanged and safe to use → Different hashes mean the file has changed. It may have been tampered with or corrupted, so it should not be trusted.

Section C: Definitions

hash comparison — Hash the file before and after transfer. If both hashes (checksums) match, the data is unchanged. A different hash shows the file was altered or tampered with, so its integrity is lost.

Section D: Fill in the Blanks

hashBefore ← hash(file)

IF hashBefore = hashAfter THEN
  OUTPUT "Data unchanged"
ENDIF

IF hashBefore ≠ hashAfter THEN
  OUTPUT "File was tampered with"
ENDIF

received ← download(url)
hashAfter ← hash(received)

IF checksum = published THEN OUTPUT "Safe"
ELSE OUTPUT "Altered"
ENDIF

Section E: Spot the Error

B — The hash after transfer must be calculated from the received copy of the file, not from the earlier hash. It should be after ← HASH(copy).

B — Both hashes must use the same algorithm. A different algorithm gives a different value even for an identical file. It should be got ← SHA256(download).

B — The checksum must be calculated from the downloaded file. Calculating it from the expected value tells us nothing about the file. It should be actual ← CHECKSUM(file).

A — A hash function is needed to create a fingerprint of the data. Counting does not detect small changes. It should be h1 ← HASH(contract).

A — The variable must store the hash of the file, not the file itself. Otherwise a hash is compared with a whole file and the check is meaningless. It should be before ← HASH(file).