Ok, I'm addressing a few different issues here. The differences (and which there isn't enough detail for a determination yet), and whether this is an integrity check, or whether there are any requirements for cryptographic security here.
XOR can easily report duplicates, and it's trivial to create cases where it will return dups; to adjust the XOR value to match rwhatever you want.
MD5 is better than XOR against "innocent" and against accidental changes. It's a decent integrity check.
The MD5 digest is not cryptographically secure, having been broken some years ago. This security as differentiated from integrity.
http://www.kb.cert.org/vuls/id/836068As for (better, more secure) alternatives, OpenVMS has an OpenSSL port installed as part of the CDSA component, and that offers the SHA1 digest.
OpenSSL is expressly intended to create and to later verify cryptographic signatures; it's intended to create and sign and verify and perform related security tasks.
(The VMS OpenSSL documentation is a tad cryptic, no pun intended. But I digress.)
The command to create a digest (on Unix) is:
openssl dgst -sha1 {file}
There's probably also a sha1sum port around for VMS, and that and OpenSSL are intended to produce identical results.
Getting back to the underlying question from the stock exchange, the checksum and MD5 stuff being discussed here akin to the "check engine" light on the dashboard of a car. It tells the driver that there's something out of spec or wrong, but not what.
As for the details of this case and of the files involved, a hexadecimal file dump and a careful look at the byte-level differences will be warranted. This could well be a file transfer error, for instance. But without seeing what the file construction and the data and the history of the data (eg: network ftp transfers, etc) might be, the immediate trigger for the differences isn't clear.
That there's good reason here for the digests to be different is adamantly clear.
