Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [integrity]

Integrity is the property of preventing unauthorized modifications of an asset. In other words, integrity protects against the threat of tampering. It is one of the three key security properties of an asset, along with confidentiality and availability.

1
vote
1answer
83 views

How secure is a Mac if it passes Apple Diagnostics?

Recently I brought my MacBook Air to a Genius Bar to perform a clean MacOS installation. For security purposes, I asked for a hardware check as well. The Genius Bar technician ran Apple Diagnostics, ...
0
votes
1answer
44 views

If a site includes the header 'HTTP Content-Security-Policy require-sri-for' then does this include all nested scripts?

If I'm using subresource integrity on a web page and a script that I import then itself imports a further script, will the CSP 'require-sri-for' also include those subsequent, nested, imported scripts?...
0
votes
2answers
67 views

How to keep track of file authenticity while offline

I have an application running the client/server model and offering an online and an offline mode. Each user can read, create or modify text files (even in offline mode) that will be present on his ...
0
votes
1answer
104 views

Ways to verify Data Integrity

I've had looks to existing subjects but it usually gets heavily complicated while I'm new to this kind of stuff and I'd prefer to understand concepts first in order to understand better concrete ...
0
votes
0answers
32 views

Protect transaction counter agains roll-back attack

I am designing a application which should be used for transaction processing so required very good performance. There are requirements that transactions originating from the same client must have ...
-1
votes
1answer
60 views

How secure is virtualization against breaking out of the box [closed]

How secure are all currently used virtualization technologies (containers - BSD Jail, OpenVZ, Hypervisors - Hyper-V, KVM etc)? I heard about one vulnerability in VMware software, which lets you ...
1
vote
1answer
62 views

How to protect file integrity and history containing counters

I would like to create a solution that would sign the data and will have a increasing counter so I can track the number of signatures. One of the requirement is to have an increasing order of ...
2
votes
2answers
83 views

File integrity assurance

I have the following scenario : Two parties want to exchange files. First party publishes a file on a secure server First party sends to the second, a hash of the file in order to be able to verify ...
4
votes
6answers
748 views

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives. I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider ...
1
vote
1answer
52 views

How reliable is rpm --verify when auditing package integrity and what alternatives are there?

Currently to verify package integrity, the command rpm --verify is run. In reading the rpm manual (http://ftp.rpm.org/max-rpm/s1-rpm-verify-output.html), there is no indication as to the veracity of ...
1
vote
1answer
79 views

Persistent Bootable USB with Write Protection?

I am developing a series of extraction scripts (currently python 2.7) for a university project - these tools will be provided on a bootable USB for use by first responders when encountering a suspect ...
1
vote
1answer
78 views

Why do some websites have their hashes on the same area as the download link? [duplicate]

Some sites allow us to use hashes to make sure that the file we download is what it should be and that it is not tampered with. Some sites may have their hashes on a different domain probably on a ...
1
vote
1answer
82 views

Why “ Simple Integrity Property” axiom of Biba model protects data integrity?

I am reading CISSP and more specifically the Biba model. Biba has some basic properties: The Simple Integrity Property states that a subject cannot read an object at a lower integrity level (no read-...
1
vote
1answer
66 views

Does the file encryption of Microsoft Office guarantee integrity?

I stumbled upon Microsoft Office's feature of file encryption. For storing sensitive data in the cloud, e.g. DropBox, this sounds like a nice feature. Reading that the encryption is AES-128 in CBC ...
1
vote
1answer
176 views

Error detection capability of SHA-256

If we use SHA-256 checksum to detect corruptions to a file, what is its capability in terms of missed errors? For example, reading the page about error correction and detection here, under the ...
1
vote
3answers
191 views

Why is it required to HMAC riv in HDCP 2.3?

In HDCP 2.3 (pdf) during the Session Key Exchange, the HDCP transmitter sends also the 256-bit HMAC of riv (HMAC-SHA256(riv, kd)). Why is it required? Does it prevent any attack?
0
votes
3answers
201 views

Are hashes a reliable method of ensuring a file has not been tampered with?

Suppose I have a file and that I want to confirm that this file is the same as the original (IE: it has not been altered in any way) using hashing. If I were to use a hash function that has no known ...
1
vote
0answers
38 views

Provide email author origin integrity [closed]

If i receive an email, how does my computer verify the author origin integrity using the digital certificates? Does it use any specific protocol for this?
1
vote
1answer
60 views

Ensuring key integrity

I have encrypted AES key stored in the database with the encrypted data. AES key is encrypted with a key derived from the passphrase. I want to ensure the integrity of the stored AES key. Is the ...
1
vote
2answers
152 views

Is it secure to interact with a web page before it has fully loaded?

Web pages are often displayed in the browser before they have finished fully loading (i.e. the loading indicator is still spinning, etc). Usually this is caused by a slow advert or a video, etc. But ...
2
votes
1answer
79 views

How is compiling a program from source more secure?

When downloading compiled binaries for programs it is very important to check GPG signatures, Authenticode, hashes, etc. However, I often see people who say that compiling the code from source is the ...
1
vote
0answers
84 views

What is a trans-cipher?

While discussing archive authenticity/integrity for long term and the problem of potentially re-keying in case of compromise, someone came up with the term "trans-cipher" (or "trans-ciphering"). I ...
31
votes
2answers
3k views

How does subresource integrity actually help?

Subresource integrity basically lets me know that a resource I'm about to download is valid, because the hash of its contents matches what I expect. But this assumes that I'm already running on some ...
0
votes
0answers
94 views

How can a JWT token have multiple secrets?

I'm using the jwtcrack utility to attempt and crack an issued JWT token. I think just the following output should explain what's going on pretty well: [0] % ./jwtcrack [token] Secret is "P" joseph@...
1
vote
1answer
981 views

How to check hardware integrity?

When we download an ISO or any file we can hash it to ensure that the downloaded file has not been tempered i.e integrity of that file is preserved. But when I am buying a hardware device (monitor, ...
2
votes
1answer
862 views

LUKS2 dm-integrity

I am using Debian 9.5, Linux Kernel 4.16, I would like to use the dm-integrity feature with cryptsetup. cryptsetup luksFormat --type luks2 <device> --cipher aes-gcm-random --integrity aead ...
0
votes
1answer
101 views

Comparison of signature algorithms HMACSHA1 and RSASHA1

Compare and contrast the signature algorithms HMACSHA1 and RSASHA1. Assume that the aim here is to make it infeasible to generate valid message+sig pairs without knowing a certain private token/key (...
2
votes
4answers
396 views

How to ensure file integrity cryptographically?

Problem: I have a collection of files (source code for example) whose integrity has to be ensured. I don’t care if the files are corrupted (I can easily multiple backups). I just want to make sure ...
9
votes
2answers
18k views

How to verify the checksum of a downloaded file (pgp, sha, etc.)?

Maybe I have been negligent towards the verification of software I download over the Internet, but I (or anybody I ever met) have never tried to verify the checksum of the contents I download. And ...
-1
votes
2answers
73 views

App to prove that an image is not edited

I want to prove that a photo I will take has not been edited. So I am planning to implement an open source app which uses a "strict image authentication" technique using private key cryptography as ...
1
vote
1answer
73 views

What probability of injecting invalid data is considered safe?

I encrypt some sensitive data with AES128 and I use custom method (encrypted CRC) for providing data integrity. I have calculated the probability of successful injection of invalid data that equals 4....
3
votes
1answer
322 views

Providing data integrity with AES

A question for an exam asks me to provide data integrity of a file F with AES and a shared secret key between Alice and Bob, if there is a way. The message is sent by Alice to Bob. I thought of the ...
1
vote
1answer
393 views

Can I trust a ubuntu repo mirror in a less 'free' country?

For example, if I install Ubuntu in Dubai or in Saudi Arabia, I'll probably get a local mirror. Is there a way I can make sure that the ubuntu packages I get when I do apt-get update are the 'real' ...
2
votes
1answer
311 views

How should I verify a backup has not been tampered with?

I have a NAS with some files that total up to 2TB in size. I suspect I could shrink this because there are possibly duplicate files. I plan on making a second backup by sending what I have to Google ...
3
votes
1answer
750 views

Are Bell-LaPadula and Biba models used in real big software security design?

I am currently studying both Bell-LaPadula and Biba models, I found this models too theoretical as I see the examples and I can see that there are used for designing particular services that needs ...
8
votes
5answers
896 views

Why don't websites provide a checksum of their downloadable files?

I very rarely see websites provide a SHA-2 hash that's signed to ensure file integrity for the user downloaded side file, and show that the file has not been manipulated or out right replaced with a ...
0
votes
1answer
156 views

How does Github preserve versioning integrity?

Given that a malicious party gains access to a GitHub repository, would it be possible for the adversary to delete or modify versioning information / history after she altered code stored on the repo? ...
1
vote
2answers
255 views

How to protect the Shadow Stack?

I found out that many protection mechanisms are used in computer security to ensure control-flow integrity, one of these mechanisms is the Shadow stack: The principal is very easy it ensure the ...
1
vote
2answers
58 views

Ideas for storing documents and hash values

Scenario is I received documents as a PDF along with an MD5 hash. Problem is how do I store these? Thought is to store the document and MD5 separately so that anyone with access to the document does ...
1
vote
1answer
272 views

Do symmetric cryptographic primitives provide both integrity and confidentiality?

I understand that symmetric cryptographic algorithms provide confidentiality through the use of a key to encrypt plain text to cipher text but how can they provide for integrity as well? Would it not ...
1
vote
2answers
135 views

Do software do an integrity check before executing?

I am testing a software that I need to install on my computer locally. It seems I can modify one of the .exe or .dll using msfvenom to include a malicious payload, like a reverse shell. From there, I ...
1
vote
0answers
28 views

GPG RSA Authenticity Mechanism Minimum Requirement

The GPG/PGP based RSA authenticity signing mechanism is based on 3 parts to ensure authenticity: the public key the signature the fingerprint of the public key Assuming that the author keeps his ...
17
votes
4answers
3k views

Where does authenticity fit into the CIA Triad?

Consider a chat application where an attacker is able to send messages in any user's name. This obviously violates the message's authenticity. But what aspect of CIA would be violated? Integrity ...
0
votes
1answer
77 views

ensuring integrity of a sequence of jpeg files

How do I ensure that a sequence of files is very hard to alter, either altering the content or removing whole files? I'm thinking some kind of rolling checksum that also relies on the sum total of ...
2
votes
2answers
118 views

How can I verify that network calls to my API come only from my C# program?

I have a desktop application build on the .Net framework. If I obfuscate the code, even if somebody reverse-engineers the code and tries to call my API using the altered source, can I know if the API ...
2
votes
2answers
101 views

Should I be thinking about security at the database row/document level?

Suppose I have a web application that is a social network. In order for two people to have access to eachother's content they must become friends. There is logic in the application to ensure both ...
0
votes
1answer
231 views

NodeJs app files integrity security check [closed]

What are the recommended methods or approaches to check NodeJs application (hosted on Linux server) files integrity check for security check? There are usually huge number of files in node_modules/, ...
2
votes
2answers
87 views

What is the boundary between Information Security and Quality Control regarding Integrity?

I was in a recent dispute with the CIO regarding this (I work as an InfoSec Officer). There was an issue when one of our devs published erroneous code in production due to user error (copy-paste sort ...
1
vote
2answers
84 views

Possible setup for a direct democracy voting system to prevent fraud

My Government is designing a direct democratic voting system and would like the system to be open sourced and unable to be corrupted by individuals and other stakeholders. Some requirements as of now:...
4
votes
1answer
1k views

Authentication as CIA triad

As we all know, information security principles are stated as CIA triad, i.e., confidentiality, integrity, and availability. I wonder why authentication is not a part of CIA triad as being an ...