Install ssdeep with Homebrew

Project links

• Homepage
• Repository

Commands and aliases

• ssdeep

Project history

Jesse Kornblum introduced context-triggered piecewise hashing in the 2006 Digital Investigation/DFRWS paper 'Identifying Almost Identical Files Using Context Triggered Piecewise Hashing.' The ssdeep project documentation says the program was originally written by Kornblum and based on Andrew Tridgell's spamsum code.

The modern ssdeep project moved to GitHub under ssdeep-project in 2017. Its NEWS file records a line of 2.x releases adding signature comparison modes, API documentation, C++ compatibility, clustering, thread-safe fuzzy hashing, large-file/stdin support, and 2.14 performance optimizations.

Adoption history

The official ssdeep site lists packages for Ubuntu, Fedora, Debian, CentOS/EPEL, Arch Linux, FreeBSD, and Windows binaries. It also states that ssdeep hashes became widely used for simple identification, including VirusTotal basic properties, and that ssdeep remained a de facto standard despite newer fuzzy-hash alternatives.

How it is used

Package users run ssdeep to hash files, recursively hash directory trees, compare files against known signature sets, or compare signature files. Developers can link libfuzzy and call the fuzzy_hash_* and fuzzy_compare APIs.

Why package nerds care

ssdeep is a package-manager classic because it bridges command-line forensics and linkable library packaging. Distros often split it into runtime, library, and development packages, and security tooling frequently treats its output format as a lingua franca for quick similarity checks.

Timeline

• 2006: Kornblum's CTPH paper introduced the technique and proof-of-concept ssdeep program.
• 2010: ssdeep 2.5 added API documentation and C++ compatibility.
• 2013: ssdeep 2.10 rewrote the fuzzy hashing engine to be thread safe.
• 2017-06: ssdeep-project GitHub repository created.
• 2017-11: ssdeep 2.14.1 released.

Related projects

• Related tools and algorithms include spamsum, libfuzzy, TLSH, sdhash, VirusTotal similarity workflows, and digital-forensics hash-set tooling.

Sources

• https://api.github.com/repos/ssdeep-project/ssdeep
• https://dfrws.org/presentation/identifying-almost-identical-files-using-context-triggered-piecewise-hashing/
• https://raw.githubusercontent.com/ssdeep-project/ssdeep/master/NEWS
• https://ssdeep-project.github.io/ssdeep/index.html
• https://ssdeep-project.github.io/ssdeep/usage.html