Software Download Hash Verification
When you download software from a vendor's website, they often provide a SHA-256 hash alongside the download link. After downloading, you run a hash check on the file. If your calculated hash matches the published hash, the file is exactly what the vendor distributed — it wasn't corrupted or tampered with during transit. This is proof of integrity via hashing. Note: it does NOT prove the vendor — that requires a code-signing certificate (digital signature).
Email Digital Signatures in Business
Many organizations use S/MIME or PGP to digitally sign emails. The sender's email client automatically signs outgoing messages with their private key. Recipients with email clients that support signature verification can confirm: (1) the email content hasn't been altered since it was sent (integrity), and (2) the email genuinely came from the sender's key (origin). In legal disputes, digitally signed emails can be used as evidence that the sender cannot repudiate.
The Gutenberg Encyclopedia Hash Example
Prof. Messer's classic example: Volume 1 of the Gutenberg Encyclopedia is 8.1 megabytes of text. Run a SHA-256 hash on it — you get a specific 64-character hash value. Now change exactly one character anywhere in the 8.1MB file. The new hash is completely different, even though the file size barely changed. This demonstrates how hashing provides a sensitive, reliable integrity check — even a single invisible change is detected immediately.
Which Provides BOTH Integrity AND Origin?
A question asks: "Which mechanism provides both proof that data was not altered AND proof of who sent it?"
- Hashing → Integrity only ❌
- Encryption → Confidentiality ❌
- Digital Signature → Integrity + Origin ✅
- Access Control → Confidentiality ❌
Answer: Digital Signature. It hashes for integrity AND uses the private key for origin authentication.
Legal E-Signatures vs. Digital Signatures
Important distinction: a legal e-signature (like DocuSign) is a legal concept — a record that someone agreed to a document. A cryptographic digital signature is a technical mechanism using asymmetric keys. Both provide non-repudiation, but in different ways. DocuSign creates an audit trail (who clicked, when, their IP address). A PKI digital signature uses mathematical proof via hash + private key. The exam focuses on the cryptographic digital signature.