Question

Simplest case: You want to make a text file which says “The MD5 hash of this file is FOOBARHASH”. How do you embed the hash, knowing that the embedded hash value and the hash of the file are inter-related?

eg, Cisco embeds hash values into their IOS images, which can be verified like this:

cisco# verify s72033-advipservicesk9_wan-mz.122-33.SXH7.bin

Embedded Hash MD5 : D2BB0668310392BAC803BE5A0BCD0C6A
Computed Hash MD5 : D2BB0668310392BAC803BE5A0BCD0C6A

Maybe I’m mistaken, but trying to figure out how to do this blows my mind.

Originally, I stated that Ubuntu ISOs have a text file containing the MD5 hash of the entire ISO file. This was not correct: on second look, the md5sum.txt file contains hashes for individual files.

Answer 1

You don’t. The hash value is computed by putting a “dummy” or an empty string where the signature should be, hashing that document, and then inserting the signature value into the text. To verify the signature of the document, you strip the signature out, hash the document without the signature, and compare the result to the signature you stripped out.

If you like that sort of challenge though, consider writing a program to produce self-describing pangrams:

This Pangram contains four as, one b, two cs, one d, thirty es, six fs, five gs, seven hs, eleven is, one j, one k, two ls, two ms, eighteen ns, fifteen os, two ps, one q, five rs, twenty-seven ss, eighteen ts, two us, seven vs, eight ws, two xs, three ys, & one z.

Have fun!