SHA-3 is a cryptographic hash family that turns any input into a fixed-size, deterministic digest. The same file always produces the same digest, while changing the file changes the result. SHA3-224, SHA3-256, SHA3-384, and SHA3-512 provide different output sizes. SHA-3 is suitable for new applications, unlike deprecated MD5 and SHA-1. section 4.3 section 4.8
Hashing a file in Java
A Java service can read refunds.json, obtain a SHA3-256 MessageDigest, calculate the digest, and encode it as hexadecimal. The sample produces the same value every time for the unchanged file: 542b49a04073502046b0de5751d5f7a9afe7c1ff2d63524c0863233a53de0c14. MessageDigest supplies the standard API, while a provider supplies the algorithm implementation. section 4.3
Listing 4.3 The refunds endpoint
@RestController
@RequestMapping("/api/refunds")
@AllArgsConstructor
public class RefundController {
private final RefundService refundService;
@PostMapping(consumes = MediaType.APPLICATION_JSON_VALUE,
produces = MediaType.APPLICATION_JSON_VALUE)
public List<Refund> uploadRefunds(
@RequestHeader("X-Content-SHA3") String sha3, #1
@RequestBody byte[] body) {
return refundService.verifyAndReturnRefunds(body, sha3); #2
}
}
A refunds endpoint receives the file and an X-Content-SHA3 header, then delegates verification before processing the data. section 4.4
Integrity checking works by recalculating the received file's digest and comparing it with the supplied value. A modified refunds.json therefore fails validation and is rejected. A plain hash detects accidental corruption, but it cannot stop an attacker from changing both the file and its hash. Use HMAC when authenticity and protection against active tampering are required; do not substitute a simple key-and-message concatenation. section 4.4 section 4.8 section 4.7
