3 ms·

You do not need to send the additional data out of band unless you are claiming that sha-2 (the hash function used in ipfs) is vulnerable to second preimage att

You do not need to send the additional data out of band unless you are claiming that sha-2 (the hash function used in ipfs) is vulnerable to second preimage attacks.

jmillikin 4y ago
It's not possible to verify a file downloaded from IPFS using only its CID, because an IPFS CID does not contain a checksum of the file content. It contains the checksum of a meta-file, which contains the hashes of further meta-files. For example, debian-10.7.0-amd64-netinst.iso has SHA256 checksum b317d87b0a3d5b568f48a92dcabfc4bc51fe58d9f67ca13b013f1b8329d1306d. Here are two example CIDs generated from that file: https://cid.ipfs.tech/#bafybeihjy54iyvheotna2aeqmzhqnro6yot4mfayzn3yn3xh4chifay4bm https://cid.ipfs.tech/#bafybeihjy54iyvheotna2aeqmzhqnro6yot4... https://cid.ipfs.tech/#bafybeihfqpypuhmtyzazrj3g4b4f4nqk2ziyvy5b3oooayb3k3inpvu6nq https://cid.ipfs.tech/#bafybeihfqpypuhmtyzazrj3g4b4f4nqk2ziy... Notice that neither one contains the original checksum.