SHA-256 is a standardized cryptographic hash function that turns any input—a file, message, or video—into a fixed 256-bit digest. The same input produces the same digest, while a tiny input change produces a dramatically different result. section 2.1 section 2.5.1
Its practical job is checking whether a downloaded file is the intended file. Hash the download, compare the result with the published SHA-256 digest, and treat a mismatch as a warning that the content differs. section 2.1
The useful properties are:
- Determinism: identical input produces an identical digest. section 2.1
- Fixed size: SHA-256 always produces 256 bits, regardless of input length. section 2.1
- Second pre-image resistance: finding a different file with the same digest should be infeasible. section 2.1
- Standardization: SHA-256 belongs to SHA-2, standardized by NIST in 2001. section 2.5.1
Verify a downloaded file
Run `openssl dgst -sha256 downloaded_file`, then compare the displayed digest with the value published on the download page. For example, the command may produce `f63e68ac0bf052ae923c03f5b12aedc6cca49874c1c9b0ccf3f39b662d1f487b`. section 2.1
$ openssl dgst -sha256 downloaded_file f63e68ac0bf052ae923c03f5b12aedc6cca49874c1c9b0ccf3f39b662d1f487b
Use the command listing as a compact reference for computing a SHA-256 digest with OpenSSL. section 2.1
