Integrity is the property of preventing unauthorized modifications of an asset. In other words, integrity protects against the threat of tampering. It is one of the three key security properties of an asset, along with confidentiality and availability.

learn more… | top users | synonyms

1
vote
0answers
38 views

Which is the correct algorithm while checksumming a portion of code?

As part of my research, I came across a technique in a paper which applies checksumming on a portion of code. I want to implement it. Here is the research paper which talks about the checksumming ...
4
votes
2answers
63 views

Signature that can only be verified by author and recipient - without pre-shared key

Desiderata: Alice wants to send a message to Bob for him to keep and to be able to refer to, such that Bob can be certain that the message came from Alice and was not tampered with. Alice also ...
2
votes
0answers
41 views

NIST SI-7 experience

On a recent project we have been asked to implement NIST SI-7 parts 1, 3 and 4. I have looked for a full software solution, but cannot find anything like that. Does anyone have any experience on ...
1
vote
0answers
19 views

Are there any specific advantages of using a BLOCKCHAIN tech in the data tier of an organization from a information security perspective?

BLOCKCHAIN seems to be the most talked about tech topic in 2016. A cryptography powered distributed computing technology that has many potential applications. Are there any specific ways / ...
1
vote
1answer
80 views

Fast data integrity protection

I have a small device with a 16-bit (embedded) architecture, which transmits 1500 bytes every 3 milliseconds. This device has no built-in integrity protection, and it is possible to manipulate the ...
15
votes
1answer
2k views

Download an OS image via torrent [duplicate]

If you take the Ubuntu alternative download page for example, there, you have the possibility to download the OS also via torrent. Being a peer to peer where files are stored on anyone's machine got ...
0
votes
1answer
70 views

FileVault 2 FDE and BoxCryptor are safe to use together or they have conficts?

Assuming that someone has a Mac and uses FileVault 2 FDE (256-bit AES key) and uses the BoxCryptor (256-bit AES key) for the clouds like Dropbox/GDrive/etc and or some other folders. FileVault 2 uses ...
5
votes
2answers
87 views

Effective File Integrity Monitoring (FIM)

I have hundreds of windows servers in my environment that I need to monitor using FIM. I am afraid that after every patch (each patch might affect and change the hash of hundreds of sensitive files) ...
1
vote
0answers
65 views

What are the appropriate steps to take after installing a questionable Android app?

Situation: User installed an Android app from the Google Play Store. User's device is rooted, but that app does not have root privileges. XPrivacy reveals that the app is trying to make IPC ...
0
votes
0answers
11 views

What integrity does the TLS Record Protocol actually provide?

In TLS the "base" protocol is the "TLS Resource Protocol". This protocol is responsible for: securing application data and verifying its integrity and origin. It also uses a HMAC. However this ...
0
votes
0answers
15 views

message integrity under ssl connection [duplicate]

I read this article which is a great article to everyone wants to know how SSL works but still I have one other thing which I want to know about the communication using the SSL layer, my question is ...
6
votes
3answers
955 views

Verifying android application integrity from server side

I have android applications (Mobile banking) that connect to my server and do online transactions (via Internet/USSD/SMS), I want to make sure those clients are not tampered with and are the original ...
0
votes
1answer
60 views

Sample attack scenarios on file downloads over HTTP

The websites that serve files over https, can it be considered overkill? or is it a best practice everyone has to follow? The downside to serving files over HTTPS is that you will lose the caching as ...
0
votes
2answers
117 views

Does SSL/TLS (https) reveals your IP address? [duplicate]

Because the NSA monitors traffic going through the major nodes of the internet, they can know which IP address does what on your website, even if you are using HTTPS. Is this true or false?
3
votes
2answers
85 views

Use password to calculate checksum for API requests

I was wondering if it would be an effective way of securing an API by requiring all requests to be checksummed, salted with the users password (or a hashed version)? With securing I mean making it ...
17
votes
4answers
2k views

Why would a website serve different versions of a file over HTTP and HTTPS?

Here is a link given on curl's official website: (prefix omitted) bintray.com/artifact/download/vszakats/generic/curl-7.46.0-win64-mingw.7z When I downloaded it with prefixes http:// and https:// I ...
3
votes
0answers
64 views

How does a Sign tool work?

My basic understanding about sign tool is: 1.It loads the zipfile(may be exe,jar,ddl,apk..) which has to be signed to its memory(cache memory of the sign tool). 2.It will verify it, and unzip the ...
7
votes
1answer
71 views

Subresource Integrity versus signing

The draft spec for subresource integrity is straightforward: This document specifies such a validation scheme, extending two HTML elements with an integrity attribute that contains a ...
6
votes
2answers
946 views

Can a faked iPhone SMS log be detected

SMS messages received by an iPhone is stored unencrypted in an SQLite database, which may be extracted by backing up the phone. You can manipulate (tamper with, e.g: replace the text of a message ...
1
vote
3answers
212 views

Why would a replay attack be considered a threat to integrity and not confidentiality?

I came across a test where the instructions were to circle all the correct answers. I'm looking for an explanation to the answer for this question: Question: a replay attack is a threat against ...
2
votes
3answers
76 views

Can a file get accidentally corrupted while downloading?

I read an answer here about websites providing downloadable files together with their hashsums. It contained a sentence I'm thinking about whenever I download something, but I never really understood ...
4
votes
3answers
145 views

integrity and consistency

This confuses me sometimes, I just need to know what is meant by integrity and consistency just in simple terms or in computer security. will it be wrong to say:- someone who gain an unauthorised ...
0
votes
3answers
82 views

does validating MAC of individual packets validates the integrity of whole file?

When transferring a large file over network, its likely that the file is broken into packets and then transferred. The underlying network protocol, lets consider the case of TLS/SSL, it generates MACs ...
1
vote
0answers
52 views

Purpose of MAC when encrypting? [duplicate]

Really basic question, but what is the purpose of using a MAC/HMAC when you are encrypting using a symmetric key algorithm? It is my understanding that the purpose of a MAC is to authenticate the ...
4
votes
2answers
143 views

What is the difference between the “sig” files and the checksum files, such as on the PuTTY download page?

This is about the functional differences between sig files and checksum files and how they can be used by a user downloading some software. For example, on the PuTTY download page both sig files and ...
2
votes
1answer
77 views

Protecting a database against insiders

Consider a network for a web-application with 1 webserver and 1 MySQL database, both on physically different servers and both running Linux. The database stores mission critical data and this data is ...
5
votes
2answers
89 views

Data Integrity in PKCs

This is a simple question but one which greatly confuses me. When you have a PKC, the public key can be accessed by anyone. Therefore, doesn't this mean that anyone can encrypt data? My question is ...
3
votes
2answers
94 views

Does MDC integrity protection matter in symmetric encrypt/decrypt of local files?

I'm configuring scripts etc. to use GPG's symmetric mode to encrypt some files on my home desktop system. When I want to edit one of the encrypted files I decrypt it and pipe it into my editor and ...
1
vote
1answer
60 views

Denial of Service during scanning [closed]

As I know you can do Denial of Service when footprinting with scanners, like nmap or Maltego. But is it legal? As I know, scanning isn't illegal but doing DoS attacks is. EDIT I meant if you scan ...
3
votes
3answers
418 views

Message Authentication Codes (MACs)

What is the main difference between Message Authentication Codes (MACs) and hash function? Is there any difference regarding their usage domains?
1
vote
2answers
98 views

Confidentiality and integrity

Users permissions and privilege should be considered as a part of confidentiality (specifically access control) or integrity? And I'm also wondering if we can categorize Accountability, Authenticity ...
0
votes
2answers
165 views

What the most trustworthy way to demonstrate digital File Integrity?

I'm looking for ensure the integrity of uploaded files and demonstrate this integrity to a user. In my current scenario, a user sends multiple files in several different formats, these files are ...
7
votes
3answers
140 views

Automatic detection of a compromised web server

I'm trying to figure out if it is possible to automatically detect the the fact that the HTML or javascript files on a server have been tampered with or changed by an attacker. Our website, say ...
4
votes
2answers
204 views

Can TLS provide integrity/authentication without confidentiality

It was a bit surprising that Wikipedia has switched to TLS because we all know it's public information available to anyone, but I suppose that the real purpose for that is to provide ...
1
vote
1answer
76 views

Best way to ensure integrity of encrypted data which is kept in a public place

I need to keep sensitive data in a de fact public place (i.e. with a user, e.g. in a cookie) and only there (no copy or hash of that data should be kept on the server). The data was encrypted AES/CBC ...
-1
votes
1answer
88 views

Why do browsers have no built-in features to verify the integrity of downloads? [closed]

I just started a download of a large file. Checksums were placed prominently on the download page. But I just realized that I actually never made use of any of the checksums provided for download ...
1
vote
2answers
127 views

How to detect if file is being modified while my program reads it?

I'm writing an auto-updater tool that is run with admin permissions. It's job is to download and install files from a tat archive. The problem is solved to the point where I can verify identity of ...
2
votes
2answers
100 views

Authenticated encryption (Symmetric encryption) for .NET applications [closed]

Is there an implementation of Authenticated encryption for .NET applications? The AES API from .NET does not include mode such as GCM. In the documentation, I can only see insecure modes (ECB, CBC, ...
3
votes
2answers
38 views

Standard (or solution) for securing files in a point-to-point integration

I'm looking for a relatively light weight way to secure both integrity and confidentiality for files being uploaded in a point-to-point integration. The use case is uploading batch files for ...
1
vote
1answer
2k views

Difference between authentication, integrity and data origin authentication

I first thought all these terms were synonyms, but I sometimes see those terms used in the same document. For instance, on MSDN: data origin authentication, which enables the recipient to verify ...
1
vote
2answers
72 views

Methods to keep an autonomous log with high integrity

I'm writing a .NET desktop application that is used to send orders to a server via a REST API. To avoid leaking of our authentication token I have made it so that, when used for the first time, the ...
0
votes
1answer
65 views

Is this a secure hash “Function” for integrity?

I was wondering what were the posible security (not efficieny) issues with this hash "function": Although not an actual function, this method turns a message of any length into a message of fixed ...
2
votes
1answer
114 views

How easy is it to hide adding a file to a git repository

Here's the scenario... I have a git repository on a server that may have been compromised. My development team say that they can trust the files in the directory that houses the git repository ...
0
votes
0answers
41 views

How to properly store result of AEAD encryption

So for AEAD we have this scheme: encrypt(AD, Data) -> [key, cipher, tag] What if I want to provide some external identifier as an additional data (to be able to prove ext_id to get data back is ...
1
vote
1answer
88 views

Virtual Machine Integrity Hash Check

If I used virtualbox to create a snapshot template of a preconfigured linux machine and wanted to ensure that no one has tampered with my snapshot, could I simply keep a comparable hash of the VDI ...
7
votes
2answers
177 views

Can BTRFS provide authentication on an encrypted disk?

One of the problems of disk encryption is providing authentication. An attacker with access to the ciphertext can modify the ciphertext at will without consequence. Given, this isn't a likely attack, ...
2
votes
0answers
78 views

If someone hacks our server, how can we prevent them from decrypting data stored in Vault?

I have been tasked with evaluating Vault in our company and the first question asked by an architect was: If someone hacks our server, how can we prevent them from decrypting data stored in Vault? ...
0
votes
1answer
55 views

Would Poly1305-PBKDF2 be secure

I have a Poly1305-implementation (not Poly1305-AES) in my library. The difference: Poly1305-AES uses a key and a nonce and then uses AES to generate a one-time-key from key + nonce. This is ...
4
votes
1answer
159 views

Does LUKS protect the filesystem integrity?

I have read in: http://css.csail.mit.edu/6.858/2013/readings/bitlocker.pdf that Bitlocker does not provide data integrity since it takes more space in the disk. The PDF says also that drive ...
4
votes
1answer
3k views

JSON Web Tokens - How to securely store the key?

I was building a RESTful Web Service when I came across JSON Web Tokens as an alternative to traditional cookies for authentication. The concept core of this method is that the server is the only ...