A hash proves the bytes, not the source
The article explains that a cryptographic hash verifies only the content of data (the bytes), not its origin or authenticity. Hashing alone cannot prove who created or sent the data, as it only ensures data integrity. Additional methods like digital signatures are needed to verify the source.
Background
- A **cryptographic hash** (e.g. SHA-256) is a fixed-length fingerprint of a data file. Two identical files produce the same hash; even a single changed bit produces a completely different hash.
- People often appeal to a hash as proof that a file came from a particular source ("I hashed the download and it matched the one on the official site"). The article argues this is a category error: a hash only proves byte-for-byte identity between two pieces of data, not the provenance, authenticity, or trustworthiness of either.
- The distinction matters because an attacker can serve you a malicious file whose hash matches a different malicious file elsewhere — nothing in the hash itself tells you *who* produced the data or whether it's safe.
- The piece fits into a broader technical conversation about **supply-chain security** (e.g. the 2024 XZ Utils backdoor) and **verifiable builds**, where developers are rethinking what cryptographic primitives actually guarantee.