attachment hash verification