Why is it necessary to match the checksum of a download with another file provided by the same server?

Really, when they are on the same site, there is no real security value. It is only of a security value when trying to verify that a file from another source is the same file (though even that may be dubious thanks to success of collision attacks against a lot of typical error detection hashes.) The primary reason, as you mentioned, is simply to make sure that you can validate the transmission was ok.


The MD5 checksum is about downloading the big archive through HTTP (possibly from a mirror) while obtaining the MD5 value from a "secure" Web site (HTTPS). This way you just need to concentrate on obtaining the right MD5 value, but you could get the archive from any source over any medium (download from a fishy-looking mirror, p2p network, CD/DVD, avian carrier... it does not matter as long as the hash value matches). The hash value is just a way to concentrate the security requirements, on a value which is small enough to (supposedly) make security easier. Of course, this does not make the issue go away: you still have to worry about whether the hash value is genuine and unaltered.

The MD5 checksum is also good at detecting non-malicious alterations, e.g. a bit flip because of bad RAM on your computer (a much more common occurrence than usually assumed).