Hacker News new | ask | show | jobs
by kbirkeland 2617 days ago
A hash only provides integrity. A signature provides integirty and authentication.
1 comments

Integrity is all you need as long as you have verified the original image that you have saved the hash for.
Is your argument that you only need integrity if you verified the authenticity out of band?
No, I'm saying you only need integrity to validate you are getting the same thing each time. If I checked and made sure an image is safe, then I can save that hash and know that as long as the has matches, I'm always getting that same safe image.
This is useless without authentication though. You're opening yourself up to attacks on the first retrieve. Sure, you can make sure you're getting the file they want you to have, but you don't know _who_ is giving you that file.