Need

You need to deliver individual file(s) to the customer. You need a mechanism to be certain that the file(s) provided by you are the same file(s) that the customer downloads at their end.

Solution

Create Checksums for the file(s). The customer downloads the file(s) and verifies the checksum supplied by you.

What exactly is a checksum and why do you need it?

A checksum is a way to ensure that the file provided is the correct file.  Checksum acts like a ‘biometric match’ of a file, if a file gets corrupted or is of a different version the biometric match will fail and help the user identify that the file being used is not the correct one. A HASH is generated for the file(s). This method of validation will make sure that the file(s) provided by you are the same file(s) that the customer downloads at their end.

MD5 is the most widely used checksum algorithm to generate a HASH for the files.

Example of a MD5 checksum:

c728b4eefda87e3efce436f021564a8c *testApplication.exe

The long string at the front of the file is the MD5 Hash for the testApplication.exe

CheckSum Generation and Validation Process

Process for generating checksums

There are various utilities available to generate MD5 checksum. Some of the well known utilities are listed below:

1. Microsoft’s FCIV (File Checksum Integrity Verifier): This is a command line utility with no graphical interface.
2. MD5Summer: MD5Sums is a simple GUI tool to generate checksums. One can download it from http://www.md5summer.org/download.html

For the purpose of explanation I am using the MD5Summer tool.

The next sections will explain how to generate and verify checksums using the MD5Summers tool.

Steps to Create Checksum using MD5Summers

Download the tool and install it to c:\MD5 folder.

Once the installation is completed, launch MD5Summers using the md5Summer.exe

The following screen will appear:

Highlight the folder that contains the files you want to generate checksums for. In my example, I want to send files under “MessengerFiles” folder

and click Create sums button to generate the MD5 hash value. When you click the Create Sums button the following screen will pop up.

Select the file(s) and click Add.

Click OK to generate the checksum, depending on the size of the file it could take from a few seconds to a few minutes for larger files.  It will ask you to save the generated file.

The file gets saved as MD5.

Example: testApplication.MD5.

The contents of the file are as below:

# MD5 checksums generated by MD5summer (http://www.md5summer.org)

# Generated 6/22/2009 11:49:18 AM

754b9db19f79dbc4992f7166eb0f37ce *testApplication.exe

The final screen shows the checksum and the files

You will send the file(s) and the generated Checksums (MD5 Hash value) to the customer. The customer needs to validate the checksum at their end.

CheckSum Validation Process

The Customer would have to verify the HASHes provided by you.

They would use MD5Summers to generate the checksums at their end and verify it with the checksum provided.

After a gruesome visual string comparison, it can be validated that the two MD5 hash values are equal and the files provided are legit.

Conclusion

By using the above MD5 Checksum generation and validation process you will be certain that the file(s) provided by you are the same files that the customer downloads at their end.