1

Is it possible to calculate a file's checksum without possessing the file?

Background

I'm interested in creating some software that would be used to download external files. I must be careful, because the files can be altered by the file owners.

I would like to keep a list of checksum values inside the software, to allow the software to validate that the external file is what it claims to be.

I believe this is easily possible once the external file is stored locally (i.e. after it has been downloaded), but I would ideally like to calculate the checksum for the file before downloading. Is this possible?

Essentially I'm tying to get a file's checksum without actually possessing the file. I think that sounds impossible, but I'm new to checksums and may be missing obvious techniques.

Community
  • 1
  • 1
stevec
  • 41,291
  • 27
  • 223
  • 311

1 Answers1

1

I'm not an expert, but here's an idea.

Make your file owners' clients (or the server that receives the files) upload the checksums (and any other metadata you need) of the files separately (as a different file, or a database entry). Then your software can download the checksum and verify it before downloading the bigger file.

Stratubas
  • 2,939
  • 1
  • 13
  • 18
  • 1
    Good idea. I think that may be the only way. I learned earlier today that AWS do exactly that through something they call an [ETag](https://stackoverflow.com/a/59833028/5783745), which can be retrieved easily via a simple `HEAD` request on the S3 object's url – stevec Jan 21 '20 at 11:17