1 Prerequisite Knowledge🔗ℹ

To understand this reference, you should have a working understanding of cryptographic hash functions, or CHFs. A CHF turns a variable-length value into a fixed-length value called a message digest, a.k.a. digest, checksum, or hash. All terms refer to the output of a CHF in Denxi’s documentation.

Sometimes download links have a “SHA-256” or some such name by a digest. Before version 8.2, Racket installers come with with SHA-1 digests as hex strings. If you download one of those installers, you should create your own digest using SHA-1 using the installer’s contents. If the digests match, you have reason to believe the installer has not been altered in transit. In other words, it maintained its integrity.

There’s a caveat. Even when digests match, we can only assume the installers has good integrity if we trust the CHF. Smart people induced a collision in SHA-1, meaning that it is possible to trick you into thinking that a harmful file is safe when you check integrity using SHA-1. This is why the word “cryptographic” in “cryptographic hash function” carries a lot of weight. If a CHF works well, it is hard to reproduce a known digest with doctored content.

When CHFs aren’t good enough, Denxi uses asymmetric cryptography to verify that a file came from a trusted party. Assymetric cryptography involves two keys. One key is public, and the other is private (that is, known only by you). The public key can scramble a message such that only the private key holder can read it.

Private keys can also sign data, such that only the corresponding public key can verify that the holder of the private key created the signature. That way, if you trust the private key holder, you can trust the signed data. Denxi verifies signatures this way.

All of this only works if your private key stays secret, and we know it was you who shared your public key. There are gatherings for that, if you are inclined to attend.

As you read this reference, you can assume that any abstractions that mention CHFs or signatures are intimately tied to Denxi’s trust model.