Compare exact bytes without confusing integrity with truth

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Public activity · 30d

—Participating browsers

—Page views

—Reading sessions

—Exercise opens

Counts reflect browsers that allowed analytics. A reading session requires 30 seconds on a visible page. Browsers are not people.

Day 18 — Compare exact bytes without confusing integrity with truth

Theory and mechanism. A cryptographic digest is computed from an exact byte sequence. Verification requires identifying the checked object, algorithm, reference digest and origin of that reference, measurement method/time, comparison result and response to a mismatch. A digest supplied by a custodian and a digest independently recomputed over received bytes are different observations. Without the bytes or a trustworthy comparison baseline, an integrity check is not performed, not automatically failed. NIST SP 800-86 supplies forensic context; the demonstrations here concern artificial bytes only.

Worked contrast. The retained V4/C4 programs hash a 34-byte classroom payload. Changing idp-export to idp-Export changes one byte without changing length and produces a different digest. Identical length therefore does not establish identical bytes. Conversely, obtaining the expected V4 digest twice verifies reproducibility for that payload, not the source authenticity, complete event coverage or approved acquisition of C09. Never insert V4's digest into C09's missing field.

A representation change creates another useful boundary. The same visible two lines may use LF or CRLF terminators. A CSV parser might present equal field values from both, while the bytes differ. Preserve the received representation and document conversion as a derivative; do not “repair” an original's line endings to make a hash match. A mismatch calls for object/version, transfer and transformation checks. It does not by itself identify a malicious actor or show where the discrepancy arose.

Offline W4-BYTES control — separate from CTN. Run with Python 3 standard library in memory. Inputs are the exact V4 classroom bytes and a CRLF derivative; no source or user file is read or written. Compare the lines logically before running. The purpose is to distinguish an equal parsed representation from equal raw bytes, not to validate CSV completeness.

import hashlib

preserved = b"case=CTN-IR-014\nsource=idp-export\n"
crlf_derivative = preserved.replace(b"\n", b"\r\n")
baseline = hashlib.sha256(preserved).digest()
print("W4|lengths", len(preserved), len(crlf_derivative))
print("W4|same_lines", preserved.splitlines() == crlf_derivative.splitlines())
print("W4|same_bytes", preserved == crlf_derivative)
print("W4|repeat_digest", baseline == hashlib.sha256(preserved).digest())
print("W4|derivative_matches", baseline == hashlib.sha256(crlf_derivative).digest())
assert preserved != crlf_derivative
assert baseline != hashlib.sha256(crlf_derivative).digest()

Executed output for these exact inputs:

W4|lengths 34 36
W4|same_lines True
W4|same_bytes False
W4|repeat_digest True
W4|derivative_matches False

Equal parsed lines and unequal bytes coexist without contradiction. The repeat check is a positive control; the derivative is a negative comparison against the original baseline. A recipient who sees only the line display cannot infer which byte representation was received. A trustworthy source path is still required even when two hashes agree; an attacker-controlled file and attacker-supplied digest are not independent corroboration.

Decision, practice and limit. Complete EX018 with the exact V4 digest, C4 mutation and W4-BYTES transcript. State how a missing reference differs from a measured mismatch, and what evidence would let a later C09 check proceed. Compare the worked answer. All three programs test local representations, not actual CTN collection. Keep them separate from source authenticity, completeness and business meaning.

Continue studying — course Day 18: Previous: Day 17 · Week 4 index · Course index · Next: Day 19.

Exercise for this lesson

EX018 — Hash verification. Objective: reproduce a byte comparison and delimit its claim. Input: exact V4 bytes and expected digest in §4.4, C4 in §4.8 and W4-BYTES on Day 18; Python 3 standard library or an equivalent documented offline method. Report V4's exact count/digest, reproduce the one-byte mutation and five-line representation control, and explain equal length versus equal parsed lines versus equal bytes. State one supported claim, two unsupported source claims, and the difference between a missing baseline and a measured mismatch. Do not alter any source artifact or populate C09 from a fixture. Rubric: 0 = wrong bytes/digest or claimed C09 verification; 1 = correct V4 result but incomplete control/limit explanation; 2 = reproducible results, diagnosed differences and a source-specific boundary. Worked answer.

Practice the exercises

Open a prompt, write your response, then compare it with the worked answer. Five-choice practice appears where a reviewed question is available.

EX018

Open the prompt →Compare with the worked answer →

Opens in 30 days: — · browsers: —

Checking for a reviewed five-choice question…

Worked answers

EX018 — Model hash result. The exact V4 payload has 34 bytes and SHA-256 1407e98f466990ff5aa4eee42cd30291826490e2c910ee57887824e6946136cc. Recomputing this on the stated bytes verifies that the local fixture and published expected digest agree. It does not show that C09's CSV has those bytes, was completely collected, or contains true IdP events. A different digest after changing one byte in a copy demonstrates sensitivity to byte changes, not authenticity of an external system.

Additional worked reasoning (EX018 — V4 digest and its boundary.): The published V4 payload has 34 bytes, with SHA-256 1407e98f466990ff5aa4eee42cd30291826490e2c910ee57887824e6946136cc. A second digest after a one-byte mutation differs despite equal byte length. This checks the chosen classroom strings only; nothing in the 34-byte fixture can authenticate C09's actual source export. Award the integrity point for reproducible bytes and a clear statement that source authority and coverage remain separate.

Week 4 Day 18 — worked representation control. The original V4 count/digest and C4 one-byte variant above remain unchanged. W4-BYTES prints:

W4|lengths 34 36
W4|same_lines True
W4|same_bytes False
W4|repeat_digest True
W4|derivative_matches False

Replacing two LF bytes with two CRLF pairs adds two bytes, yielding 36. splitlines() removes those terminators, so equal returned lines do not imply equal raw bytes. The repeated original digest is a positive control; the derivative fails comparison with the original baseline as expected. A missing C09 baseline/byte sequence means no comparison was performed, not an observed mismatch. A future actual mismatch would require retaining the discrepant objects and checking identity, version, transfer and transformations through the authorized custodian. None of these local outputs establishes C09 authenticity or completeness. Two points require the original V4 digest and C4 mutation as well as this transcript and its interpretation.