FTP - Interoperability - Integrity Check How-To

In version 3.3 MOVEit DMZ opened up its FTP integrity check protocol to allow non-MOVEit FTP clients to begin to perform cryptographic integrity checks as well. (SmartFTP was the first non-MOVEit FTP client to take advantage of the open protocol.)

SHA-1 Cryptographic Integrity Check

Using integrity checks with MOVEit DMZ requires sending three short commands from the client to the server:

INTEGRITY H - tells MOVEit DMZ that this client knows how to do integrity checking (pass this command once per session)
XSHA1 [FileName] - asks MOVEit DMZ for the SHA-1 hash of a particular file (it is usually most efficient to ask for this information immediately after transferring that file)
HASH OK/BAD - tells MOVEit DMZ that a locally calculated SHA-1 matches the XSHA1 hash was requested (only send this command after an XSHA1 command)

The local FTP client must be able to calculate SHA-1 hashes, of course. MD5 hashes MAY be allowed in the future, but only to support legacy FTP clients. CRC values will NEVER be allowed as they lack any cryptographic value and are thus almost useless in situations where "non-repudiation" is required.

Sample FTP Session

The following FTP session shows an FTP client session working with variations of the commands discussed above. A complete, successful integrity check has been highlighted in green.

ftp> QUOTE INTEGRITY H
200 Integrity mode selected
ftp> get HomePage.php
200 PORT command successful
150 RETR command started
226 Transfer complete. Integrity check pending.
ftp: 4890 bytes received in 0.70Seconds 6.79Kbytes/sec.
ftp> QUOTE XSHA1
500 XSHA1: parameters are incorrect
ftp> QUOTE XSHA1 HomePage.php
250 d6f63471acd1ab7dd647c86e6eea91d09f0fbb70
(at this point the FTP client calculates a SHA-1 hash
against the file it just downloaded and gets a
value of "d6f63471acd1ab7dd647c86e6eea91d09f0fbb70")
ftp> QUOTE HASH OK
200 Downloaded file has passed integrity check.
ftp> get HomePage.php
200 PORT command successful
150 RETR command started
226 Transfer complete. Integrity check pending.
ftp: 4890 bytes received in 0.64Seconds 7.45Kbytes/sec.
ftp> QUOTE XSHA1 HomePage.php
250 d6f63471acd1ab7dd647c86e6eea91d09f0fbb70
(at this point the FTP client calculates a SHA-1 hash
against the file it just downloaded and gets a
value of "c86e6eea91d09f0fbb70d6f63471acd1ab7dd647")
ftp> QUOTE HASH BAD
500 Downloaded file integrity check FAILED!