Re: Uploading to Asimov

[Andy McFadden <fadden@fadden.com>]

In comp.sys.apple2 Paul Schlyter <pausch@saaf.se> wrote:
>> The real advantage of the compressed formats, IMHO, is less about
>> compression and more about having a CRC on the files.  That takes
>> the guesswork out of whether or not the images are damaged.
> 
> You don't need a compression program for that!  Instead you could
> use an MD5 utility, which produces MD5 hashes from the file contents.
> The MD5 hashes are then put in a separate ASCII file.  This method is
> used on many other web sites.

I dislike this approach, for the following reasons:

 - Separate files can be lost.
 - Separate files aren't always updated when the main file is updated.
 - People may not check them.  If somebody downloads a file and it doesn't
   work, they're more likely to post a "does this work" message than
   go back and look for an MD5 file.  Having it checked automatically by
   the unpacking program makes it impossible to avoid/ignore.

> MD5 also provides better detection than CRC - not only because it has
> more bits (MD5 has 128 bits, compared to 16 or 32 bits for the most
> common CRC's), but because it detects not merely accidential
> corruption but also deliberate modification of the files.

My concern in an Apple II archive isn't for deliberate corruption.

I agree that this is a general concern, and a cryptographically secure
hash certainly beats a CRC.  If that's a real worry, though, MD5 gets
you nothing by itself, because if I can replace the main file then I can
also replace the MD5 file.  You need a digital signature.

> For ensuring the integrity of the files, MD5 is much superior to CRC.

Perhaps, but in this case it seems inconvenient and excessive.  If it
were added to the Zip format that would be a good thing, but if all you're
trying to detect is somebody using an ASCII transfer mode, a 16-bit CRC
is probably good enough.

-- 
Send mail to fadden@fadden.com (Andy McFadden) - http://www.fadden.com/
CD-Recordable FAQ - http://www.cdrfaq.org/
CiderPress Apple II archive utility for Windows - http://www.faddensoft.com/
Fight Internet Spam - http://spam.abuse.net/spam/ & http://spamcop.net/