[Elecraft] K3 problem with logging program after download upgrade

[David Woolley]

Julian G4ILO wrote:

> Surely the uploader should do some kind of integrity check, instead of
> attempting to upload a duff file to the radio? It's not exactly rocket
> science. There's a thing called MD5 that's very good for this...

MD5 is overkill.  It's intended to detect deliberate tampering, although
it's also useful as a fast way of comparing multiple files, as there is 
a high level of confidence that files with the same MD5 digest have the
same content, given the presumption that they might.  It's origins are 
in encryption, rather than in error detection.  CRC codes are faster to 
compute and give good protection against random errors.

In general, all the high risk steps in getting the firmware from 
Elecraft to the K3 are protected by error detection codes already, with 
the exception of the final hop, over the serial link.  Typically the hex 
file is going to be processed incrementally as it arrives over that 
link, so most of the protection at that stage has to by short check 
codes that can be applied frequently, not a long one for the whole file.

The other high risk area is probably the PC memory, if it doesn't have 
parity, which most, for cost, and speed reasons, doesn't.  However, if 
the PC memory unreliable, you cannot trust that error detection code is 
being run correctly, or that errors won't be introduced after the check. 
     Similarly for CPU faults, although these should be less likely for 
a system running within specification.

Incidentally, there are known problems in MD5's tamper detection 
credentials and best current practice, at least in the open literature, 
is to use both MD5 and another cryptographic checksum algorithm called 
SHA (secure hash algorithm).
> 


-- 
David Woolley
Emails are not formal business letters, whatever businesses may want.
RFC1855 says there should be an address here, but, in a world of spam,
that is no longer good advice, as archive address hiding may not work.