Md5 in http with a range

Question

Imagine a user requesting a Rage: bytes=2-510-byte file. What amount of MD5 must be provided to the user? The sum of MD5 of all 10 bytes or only partial content, bytes 2-5?

RFC2616 Section 14.15 states:

The MD5 compilation is computed based on the content of the subject’s body, including any encoding of the content that has been applied, but not including the transmission encoding, applied to the message body. If the message is received with transmission encoding, that encoding MUST be deleted before checking the Content-MD5 value against the received object.

How should I interpret this? I ask about this because I would refrain from adding md5sums to partial content if it should be generated for each range request.

Answer 1

This is: http://trac.tools.ietf.org/wg/httpbis/trac/ticket/178 .

Thus, there is no simple answer, the Working Group will gladly accept feedback.

Answer 2

If you use HTTP over a very unusual network protocol, what do you get using MD5 checksums? TCP handles integrity checking , the HTTP header is optional and is not intended to provide integrity from malicious attacks.