Why are message digests needed?

Message digests have many applications. The most obvious one is data integrity verification.

Data integrity verification

When you’re downloading software from the internet, you will often find the message digest of the distribution package close to the download link. As an example, look at the OpenSSL download page at https://www.openssl.org/source/:

Figure 3.1 – The OpenSSL download page fragment

Next to the download link, you will see links called SHA256 and SHA1. These contain the message digests for the corresponding .tar.gz files. When the required .tar.gz file is downloaded, the digest of the downloaded file can be calculated and compared to the expected digest. If the digests match, then the file may not have been corrupted or otherwise changed while being transmitted and saved. If the file was changed, the calculated digest would look very different from the expected digest, because of the avalanche...