3 ms·
A hash only provides integrity. A signature provides integirty and authentication.
by kbirkeland 7y ago
A hash only provides integrity. A signature provides integirty and authentication.
- jjeaff 7y agoIntegrity is all you need as long as you have verified the original image that you have saved the hash for.
- kbirkeland 7y agoIs your argument that you only need integrity if you verified the authenticity out of band?
- jjeaff 7y agoNo, I'm saying you only need integrity to validate you are getting the same thing each time. If I checked and made sure an image is safe, then I can save that hash and know that as long as the has matches, I'm always getting that same safe image.
- kbirkeland 7y agoThis is useless without authentication though. You're opening yourself up to attacks on the first retrieve. Sure, you can make sure you're getting the file they want you to have, but you don't know _who_ is giving you that file.