Inconsistent SHA256 checksums

randmin

5/21/24, 3:56 AM

I encounter an odd issue when I calculate SHA256 checksums in Javascript. I use the following code:

const hashBuffer = await window.crypto.subtle.digest("SHA-256", arrayBuffer)
const hashArray = Array.from(new Uint8Array(hashBuffer));
const hashHex = hashArray
    .map((b) => b.toString(16).padStart(2, "0"))
    .join("");

Afterwars I transfer the data to a server, that calculates the checksum for the data to check integrity, using the same code. Both client and Server run on the same machine. Here is the issue:

On the client, for some files, the checksum changes upon every calculation, whereas for others the checksum stays consistent. On the server, the calculations are all consistent.

I do not change the files during calculations. I do not even touch them. I was thinking that maybe the metadata could change upon calculations, that when the file gets 'touched' by the browser/javascript FileReader, but then again for many files the checksum is consistent, and I transfer the full data to the server, so it would include the metadata (as both are running on the same system, that is).

I wonder what could be the cause. Maybe there are weired security mechanisms in browsers that obscure the file in a way? Or maybe any other reason... I would like to keep the integrity check, as it is crucial for security and stability, but as for now, this is a big issue.

I have found different information on the internet, e.g. someone encountered this issue with a corrupted memory. But again, the calculations happen on the same machine, and the checksums are consistent on the server after the transfer (as in "the data did not change between runs", but the checksum does..)

I hope this is the right place to ask. This may be more a developers/javascript issue. However.. If you have any ideas what the reason could be, or how to debug this, please let me know.

0 + 5

sha-256

mentallurg

5/21/24, 4:51 AM

Programming questions are off-topic even if you are writing or debugging cryptographic code.

Jörg W Mittag

5/21/24, 8:15 AM

The #1 reason in 99.999% of all programming questions of the type "why are the two hashes of this same data different" is "it's *not* the same data". In other words, your `arrayBuffer` most likely doesn't contain what you think it does.

fgrieu

5/21/24, 8:57 AM

The question is not answerable from the code we see and the other information we have. As pointed in above comment, the most probable is that whatever generates `arrayBuffer` has not generated it consistently at the moment the hash is computed.

Maarten Bodewes

5/21/24, 6:03 PM

Partial downloads could be an issue. A problem with line ending or zero byte handling in the code (i.e. handling the file as text instead of binary) etc..

randmin

5/22/24, 5:56 AM

Thank you for the comments. They indeed help me in that way that I decided to make comparisons of the binary data upon runs and isolate the bits that change. Apologies for my confusion to post this question in the wrong place.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Inconsistent SHA256 checksums

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.