
_Verifying the SHA-256 checksum of a Kali Linux ISO download against the hash
published on kali.org, using macOS's built-in `shasum` command_

Before installing any security tooling, I want to know two things: that the
file I downloaded is actually the file the distributor built, and that
whatever I do with it next stays isolated from my main system. This project
covers both: verifying a Kali Linux `.iso` with a SHA-256 checksum on macOS,
then installing it into an isolated virtual machine.

## Verifying the download

macOS ships with `shasum` built in, so no third-party tools are needed to
check a download's integrity. Running `shasum -a 256` against the downloaded
`.iso` produces a SHA-256 hash, a fixed-length "fingerprint" of the file.
It gets compared against the checksum kali.org publishes for that same
build. A match means the file wasn't corrupted or tampered with in transit;
any change to the file, even a single bit, produces a completely different
hash.

## Installing in an isolated VM

Verifying the download is only half the job. The other half is making sure
that running security tools like Wireshark, or testing anything exploit- or
protocol-related, stays contained to a disposable environment instead of
touching the host Mac. I used [UTM](https://mac.getutm.app/) (free,
QEMU-based) to run Kali on Apple Silicon, which is a straightforward path but
comes with a handful of ARM64/QEMU-specific quirks: a CD/DVD drive reference
that doesn't fully clear via the UI, a graphical installer that can go
visually blank (worked around with a Serial console device), and a LUKS
disk-encryption prompt that renders invisibly at early boot due to a
keyboard-layout mismatch between typed and pasted input.

## More on this project

This isn't a step-by-step install tutorial. Plenty of those already exist.
The checksum verification steps, SHA-256 background, and the specific UTM
quirks and fixes above are written up in full in the
project README on GitHub.


Verifying a Kali Linux ISO download with a SHA-256 checksum on macOS using shasum, then installing it into an isolated UTM virtual machine on Apple Silicon.

Checksum Verification: Kali Linux Download


_[Photo](https://www.pexels.com/photo/woman-standing-near-old-stone-wall-with-carved-images-4577718/)
by [Rachel Claire](https://www.pexels.com/@rachel-claire/) on
[pexels.com](https://www.pexels.com/)_

## Overview

A comparison of two approaches to encrypting and decrypting data: a modularized
Python application using the Fernet symmetric encryption method, and the GnuPG
(`gpg`) command-line tool. The project covers both file encryption and string
encryption, with each task split into its own single-purpose file.

## Task Modularization

The Python approach splits encryption and decryption into individual files by
responsibility:

- `create_key.py` — generates a 128-bit AES encryption key
- `get_key.py` — loads the generated key for use in the other scripts
- `encrypt_file.py` / `decrypt_file.py` — encrypt and decrypt a file
- `encrypt_string.py` / `decrypt_string.py` — encrypt and decrypt a string

The string-based functions required a bit more care: the encrypted message
generated in `encrypt_string.py` has to be imported into `decrypt_string.py` so
the correct token gets passed to `message_decrypt`, avoiding an `InvalidToken`
error from the `cryptography` package.

## Command Line Alternative

The same encrypt/decrypt tasks are also carried out using GnuPG, comparing the
tradeoffs of a programmatic approach against a quicker, less structured
command-line workflow using AES256 symmetric encryption.

## Related Resources

- [Encrypting and Decrypting Files and Strings](/blog/encrypting-and-decrypting-files-and-strings):
  companion post covering both approaches in full detail


A Python encryption/decryption toolkit comparing Fernet symmetric encryption in Python against GnuPG on the Command Line, for encrypting and decrypting both files and strings.

projects tag: security

Checksum Verification: Kali Linux Download

Encrypting/Decrypting Files and Strings