When we download an ISO image or a DMG file to install software on macOS, Windows, or Linux, it's not enough for it to "look" like everything went well. We need to make sure that the data is identical to what the developer published.that have not been corrupted along the way and that no one has manipulated them with bad intentions.
In this context, checksums, cryptographic hashes, and, in the case of macOS, come into play. digital signatures and certificate validationUnderstanding how all this works is key to trusting an installer, validating an ISO that you're going to burn to a USB drive with balenaEtcher or Ventoy, and, in general, moving important files without surprises.
What exactly is a checksum and what role does it play?
A checksum is, essentially, a string of alphanumeric characters that summarizes the contents of a fileIt is obtained by applying a mathematical algorithm (a cryptographic hash function) to the bits of the file, and serves as a unique fingerprint to verify its integrity.
When a software vendor releases an installer, ISO, or major update, it usually includes its checksum. The user downloads the file, calculates the same type of hash locally, and compares both values.If they match, it is extremely likely that the file is identical to the original; if not, something has gone wrong (corruption in the download, malicious manipulation, storage errors, etc.).
These sums are also known as hash values, hash codes, hash sums, or simply, hashTheir usefulness goes far beyond downloads: they are used to check packets on networks, to securely store passwords in databases, to sign emails, or to guarantee the integrity of forensic images of entire disks.
How a hash function works: from file to fingerprint
Cryptographic hash functions are one-way algorithms: They take an input of any size and produce an output of fixed length.It doesn't matter if the input file is a few kilobytes or several gigabytes; the result of SHA-256, for example, will always be a 256-bit sequence (64 hexadecimal characters).
A key property is the so-called avalanche effect: A minimal change in the input data results in a completely different hashIf you calculate the MD5 hash of the phrase "This is a test." and then remove the period, the resulting value will be completely different, allowing you to detect even minute changes.
Furthermore, a good hash function is designed to result in Computationally infeasible to reconstruct the original content from the hashand also to make it extremely difficult to find two different inputs that produce the same value (a collision). When practical collisions are discovered in an algorithm, as has happened with MD5 or SHA-1, it is considered to be unsafe for certain uses.
Types of checksum algorithms and how they differ
Behind every checksum there is a specific algorithm. Not all of them serve the same purpose or offer the same level of guaranteeAnd it's useful to know at least the most common categories to know what we're using at any given time.
Simple error-control algorithms
Lightweight mechanisms that are not truly cryptographic, but do help detect transmission errors, have been used for decades in basic networks and systems. A classic example is the longitudinal parity word or byte, which groups the data into n-bit words, applies an XOR operation between all of them and adds the result as an extra word at the end.
At reception, the XOR is recalculated including the sum word, and If the result is not all zeros, it is assumed that there has been a failure.It is a cheap method in computing and reasonably effective against single-bit or odd-number-bit errors, but it does not detect certain patterns well (such as symmetric changes in two words or block reordering).
The algorithm of complement of sum It was an attempt to improve upon the previous method. It sums the words as unsigned binary integers and adds the two's complement of that sum as a checksum. At the destination, everything is summed again, including the checksum, and if the result is not a word of zeros, we know something has gone wrong. It remains simple, and like parity, It detects simple errors but is not robust against intentional manipulation..
Position-dependent checksums
To reduce the number of instances where an error goes unnoticed, algorithms emerged that take into account not only the values ​​of the words, but also their order. Position-dependent checksums assign a different weight to each block depending on its location in the sequence.
Examples of this family are Adler-32, the different types of CRC (cyclic redundancy check) or the Fletcher checksum. They are very common in network protocols, compressed files, and storage systems, as they significantly improve the detection of repeated errors, block insertions or deletions, although they are still not cryptographically strong algorithms.
Fuzzy checksum
Different techniques are used in the world of spam filtering and collaborative spam detection: fuzzy checksumsInstead of seeking that any small change completely alters the value, the opposite is sought: that very similar emails generate identical or very similar hashes.
To achieve this, the message content is normalized and reduced to a minimal version (eliminating variable parts, formats, etc.) and then the checksum is calculated. Services like DCC receive millions of these hashes from various email providersand they flag patterns as potentially spam when the same value is repeated above a certain threshold.
modern cryptographic hash functions
When we talk about verifying ISO images, installers or firmwareIt is common to encounter cryptographic hash algorithms such as MD5, SHA-1, SHA-2 or SHA-3. Its goal is not only to detect accidental errors, but also to resist specific attacks. that intend to generate malicious files with the same hash as a legitimate original.
MD5, for example, was for years the de facto standard for validating downloads, with 128-bit hashes. However, practical collisions have been demonstrated and Today it is considered insecure for protecting integrity against attackers, although it is still used in contexts where only the detection of accidental damage matters.
SHA-1 (160 bits) followed a similar path: widely adopted in certificates, signatures and file validation, but currently discouraged for new systems due to vulnerabilities. The SHA-2 family (SHA-224, SHA-256, SHA-384, SHA-512) It has largely replaced MD5 and SHA-1, and SHA-256 has become the standard recommended by NIST and used in browsers, protocols such as TLS, VPNs, or even in networks such as Bitcoin.
SHA-3 is the latest standardized generation, with output lengths similar to SHA-2 but a different internal design. Modern algorithms such as BLAKE2 or BLAKE3 also offer high speed and high securityTherefore, they are common in bulk file verification tools and applications that require extreme performance.
How to check checksums in Windows
In Windows you don't need to install anything to calculate basic file hashes. You can use the certutil command in Command Prompt or PowerShellor use the Get-FileHash cmdlet in PowerShell for more convenient use.
With certutil, you would simply open a command window and run something like certutil -hashfile "path\to\file.iso" SHA256The tool will generate the checksum using the algorithm you specify (MD5, SHA1, SHA256, SHA384, SHA512, etc.), and you just have to compare it with the one offered by the developer on their page.
In PowerShell, the command Get-FileHash C:\path\to\file.iso It returns a SHA-256 hash of the file by default, although you can specify other algorithms with the -Algorithm parameter (MD5, SHA1, SHA384, SHA512, RIPEMD160, MACTripleDES…).
If the displayed value matches character for character with the one published on the official website, you can assume that the file is intact. If it differs, the reasonable thing to do is delete it and download it again.because you could be dealing with a corrupt file or one manipulated by a third party with malicious intentions.
How to validate checksums in macOS: Terminal, ISO, and DMG
macOS includes everything you need to generate and compare file hashes, for ISO, DMG, and other formats. No additional software installation is required; simply use the Terminal app..
The most versatile command is `shasum`, which allows you to select different algorithms from the SHA family. For example, if you've downloaded an installer like `vlc-3.0.6.dmg` and the project website publishes its SHA-256 hash, on macOS you can do the following:
shasum -a 256 vlc-3.0.6.dmg
The terminal will display a line with the hash value and the file name, and you just have to place it next to the one that appears on the web and check that there is no difference. For other algorithms, you have direct commands available.: md5 for MD5, shasum -a 1 for SHA-1, -a 384 for SHA-384, -a 512 for SHA-512, etc.
In the case of ISO images that include an md5sum.txt file or similar, it is normal for this file to contain the hash of each internal file of the ISO, not just of the image itself. Once the ISO is burned to the USB drive, you can mount the drive and use md5sum -c md5sum.txt in Linux or equivalent commands in macOS to verify file by file, although in macOS it is more common to verify the hash of the entire ISO before copying it to the USB drive.
Signatures and certificates in macOS: beyond the hash
In addition to hashes, macOS relies heavily on a system of digital signatures, certificates, and trust policies which are managed through Keychain Access and Gatekeeper. The mere fact that an installer has the correct hash does not guarantee that it comes from a legitimate developer; that's what code signatures are for.
With the Keychain Access app you can use the Certificate Assistant To examine a specific certificate, review its trust policy and determine its validity, macOS checks that the certificate was issued by a trusted root authority, has not expired, and has not been revoked, and based on that, allows or blocks the execution of certain binaries.
In everyday life, when you open a DMG file or run an app downloaded from the internet, macOS combines the developer signature verification with mechanisms such as Gatekeeper and notarizationThe hash part focuses on the integrity of the file; the signature and certificate part takes care of the authenticity of the issuer.
How do tools like balenaEtcher or Ventoy validate the contents of the USB drive?
When you use utilities like balenaEtcher or Ventoy to make a bootable USB drive, you don't just copy bytes and cross your fingers. These tools perform a post-validation to verify that what is written on the drive matches the source., usually by comparing the content read from the device with that of the original ISO.
The typical workflow is very similar to what you would do manually with dd: download the ISO, clean the drive, write the data, and then read it again. balenaEtcher, for example, usually reads blocks from the USB drive and compares them directly with the same blocks in the disk image.If it detects any difference, it marks the process as failed without requiring an md5sum.txt file in the ISO.
Ventoy follows a different strategy, as it does not "burn" the ISO onto the drive, but copies it as is to a special partition and It starts by displaying a menu from which you choose which ISO to use.In this case, integrity can be verified by comparing the hash of the ISO file stored on the USB drive with the hash it had on the source computer, without needing to inspect the internal contents of the image.
If a Linux distribution's ISO includes files like md5sum.txt or SHA256SUMS, and the installation bootloader is prepared for them, The internal files of the image can be validated during the boot process itself.But the recording utilities do not depend on these files: their verification is based, above all, on comparing written data with source data at the block level.
What to do when the ISO does not include an internal checksum file
Not all ISO images include an md5sum.txt or similar file with hashes of their contents. What you should always demand is that the official website provides at least a hash of the complete ISO. (usually SHA-256) on the downloads page or in a separate file (SHA256SUMS, CHECKSUMS, etc.).
If there is no internal file with sums per file, the validation is reduced to comparing the ISO hash. You calculate the SHA-256 hash of the downloaded file in your system and compare it with the published value.If they match, you know that the complete image is the same as the one generated by the developer, and from there you can burn it to the USB drive with complete confidence.
If the supplier does not publish any type of checksum or signature, things get complicated. You could compare the hash of your ISO with that of another copy downloaded from a different network or by a different personBut you would still lack official reference. In these scenarios, it's prudent to be wary if the software is sensitive (operating system, security tool, cryptocurrency wallet, etc.) and seek a more reliable source.
Remember that even with a published hash, security depends on obtaining it from [source missing]. a trusted source and through a secure connection (HTTPS)An attacker could create a fake website with a malicious ISO and their own hash, so verification is only meaningful if you are actually on the project's official site.
Specific tools for working with hashes and verifying integrity
In addition to the utilities built into each operating system, there are many specialized programs that facilitate the handling of hashes, especially when you need calculate sums for many files, compare entire folders, or automate verified copies.
Applications like QuickHash They offer a very complete graphical interface for Windows, Linux and macOS, with support for MD5, SHA-1, SHA-2 (256 and 512), SHA-3, BLAKE2, BLAKE3 and othersThey allow you to generate text hashes, single file hashes, multiple file hashes, compare two files or even two directories, as well as make hash-verified copies.
Other tools such as HashMyFiles, MultiHasher, or MD5 & SHA Checksum Utility focus on Windows and allow Generate hashes in bulk for entire folders and subfolders, and even be integrated into the Explorer's context menu to invoke them with a right click.
There are also lightweight or portable solutions (HashCalc, MD5 Hash Check, Hasher Lite, DeadHash, Hash Generator, FCIV, Checksum Control…) that cover more specific needs, such as quickly checking a downloaded installerwithout having to remember commands or open the terminal.
Risks, attacks and security limits of hashes
Although hashes are often described as "unbreakable", it is important to understand that there are techniques to try to defeat them. The most direct is a brute force attack, testing all possible input combinations until finding one that generates the desired hash, something unrealistic for long passwords with modern algorithms.
Dictionary attacks and rainbow tables speed up the process when the attacker suspects the type of input (e.g., typical human passwords). Instead of testing random strings, it works with precompiled lists and precalculated hashes., greatly reducing the time needed to uncover weak keys.
Collision attacks exploit the fact that, since there is a finite space of outputs, there must be distinct inputs that generate the same hash. If an algorithm has mathematical weaknesses, it is possible to find collisions relatively efficiently.This would allow the creation of two different files with the same hash. This is precisely what has happened with MD5 and SHA-1, which have become unreliable for critical uses.
To mitigate many of these risks, several strategies are used: Use strong and up-to-date hashes, add random "salts" to the inputs before hashing them, and use specific algorithms for passwords. (bcrypt, scrypt, Argon2) designed to be deliberately slow and expensive to parallelize.
Best practices for verifying ISO and DMG images on macOS
If you're going to download an ISO or DMG to use on macOS, especially if you're going to install a sensitive system or tool, it's advisable to follow a clear routine. First, always download from the project's official website, making sure the URL and HTTPS certificate are correct..
Next, locate the section where the checksums or associated PGP signatures are published. Give preference to modern algorithms such as SHA-256 or higherand avoid MD5 or SHA-1 unless you only care about detecting accidental corruption in non-sensitive files.
With the ISO or DMG file already in your Downloads folder, open Terminal, navigate to that folder and Calculate the hash using shasum or md5 as appropriateCompare the result with the official value, taking care not to omit any digits or confuse similar characters. If they don't match, delete the file immediately.
If you're going to use balenaEtcher, Ventoy, or another tool to burn the image to a USB drive, make sure that The application offers a post-write validation phaseThis way, you not only trust that the ISO is correct, but also that the copy on the flash drive faithfully reproduces the source data.
Although it may seem like a little more work, this verification process saves you headaches and reduces the risk of running corrupt or tampered code. Understanding how checksums, signatures, and certificates work in macOS allows you to use your ISO and DMG files with much greater peace of mind.knowing that what you install is exactly what the developer intended to deliver and nothing else.
