SHA256 hash calculation

Question

for my employer I have to present customers of a web-app with checksums for certain files they download.

I'd like to present the user with the hash their client tools are also likely to generate, hence I have been comparing online hashing tools. My question is regarding their form of hashing, since they differ, strangely enough.

After a quick search I tested with 5:

Entering the value 'test' (without 'enter' after it) all 5 give me the same SHA256 result. However, and here begins the peculiar thing, when I enter the value 'test[enter]test' (so two lines) online tool 1, 2 and 3 give me the same SHA256 hash, and site 4 and 5 give me a different one (so 1, 2 and 3 are equal, and 4 and 5 are equal). This most likely has to do with the way the tool, or underlying code handles \r\n, or at least I think so.

Coincidentally, site 1, 2 and 3 present me with the same hash as my C# code does:

    var sha256Now = ComputeHash(Encoding.UTF8.GetBytes("test\r\ntest"), new SHA256CryptoServiceProvider());

    private static string ComputeHash(byte[] inputBytes, HashAlgorithm algorithm)
    {
        var hashedBytes = algorithm.ComputeHash(inputBytes);
        return BitConverter.ToString(hashedBytes);
    }

The question is: which sites are 'right'?

Is there any way to know if a hash is compliant with the standard?

UPDATE1: Changed the encoding to UTF8. This has no influence on the output hash being created though. Thx @Hans. (because my Encoding.Default is probably Encoding.UTF8)

UPDATE2: Maybe I should expand the question a bit, since it may have been under-explained, sorry. I guess what I am asking is more of a usability question than a technical one; Should I offer all the hashes with different line endings? Or should I stick to one? The client will probably call my company afraid that their file was changed somehow if they have a different way of calculating the hash. How is this usually solved?

Which line ending do you consider to be right? Choose from \r, \n or \r\n. Fret about text encoding while you are at it. — Hans Passant
A hash algorithm works on bytes. There are lots of different ways to convert strings to bytes, all of them are 'right'. You like Encoding.Default for some reason, you'll regret that some day when your code runs on another machine with a different default. There are a hundred more to choose from. As long as you have to pick one that doesn't depend on a machine setting then you can't really go wrong with Encoding.UTF8. — Hans Passant
Then I'll use UTF8. Especially since you're guaranteeing I won't get fired. — Gerben Rampaart

ken2k ken2k · Accepted Answer · 2013-12-26T12:10:45

All those sites return valid values.

Sites 4 and 5 use \n as line break.

EDIT

I see you edited your question to add Encoding.Default.GetBytes in the code example.

This is interesting, because you see there is some string to byte array conversion to run before computing the hash. Line breaking (\n or \r\n) as well as text encoding are both ways to interpret your string to get different bytes values.

Once you have the same bytes as input, all hash results will be identical.

EDIT 2:

If you're dealing with bytes directly, then just compute the hash with those bytes. Don't try to provide different hash values; a hash must only return one value. If your clients have a different hash value than yours, then they are doing it wrong.

That being said, I'm pretty sure it won't ever happen because there isn't any way to misinterpret a byte array.

SHA256 hash calculation

1 Answers