Questions tagged [integrity]
Integrity is the property of preventing unauthorized modifications of an asset. In other words, integrity protects against the threat of tampering. It is one of the three key security properties of an asset, along with confidentiality and availability.
298
questions
0
votes
0
answers
20
views
Ways to implement data integrity measures on static and non static data
I would like to know is there a need to implement data integrity measure given the scenario?
Clients send data/files (may or may not contain public keys) to the server via server side CA cert. The ...
- 3
1
vote
0
answers
44
views
Sign vs hash HTTP body request
I use OAuth2 private_key_jwt authentication scheme to authenticate clients. Also, I need to be sure that request body isn't modified.
I see two ways:
In token which I use to authenticate client I can ...
- 307
4
votes
0
answers
169
views
Secure boot + full disk encryption, should I sign the kernel?
I'm redoing my laptop installation from scratch, and this time I want a full secure boot chain.
Here's what I did so far :
Enroll my own keys in the UEFI firmware
Sign my grub bootloader
Full disk ...
- 140
1
vote
0
answers
37
views
Does Firefox's addon/extension installer provide cryptographic authentication and integrity validation?
Does Firefox's built-in installer for addons/extensions validate its payload's authentication and integrity for all files it downloads before actually installing them?
I avoid in-app updates because, ...
- 886
1
vote
1
answer
327
views
Is there any danger in refreshing JWT tokens directly without a refresh token?
So I wrote the following logic for my web app:
When a user interacts with the website it initiates a Backend call. In the backend every endpoint has multiple middlewares, of which there is a JWT ...
- 234
0
votes
1
answer
21
views
validating the authenticity of messages from public client without authentication
Say I have a game, when you finish playing you put your name in and your score is synched with a public scoreboard. Assume also that I own the server and its code. How can I verify that the scores ...
- 123
0
votes
1
answer
123
views
Is there any security technology/technique beside tpm/secure boot which can verify the integrity of the bios or bootloader?
For any file on your OS you can get a md5 or sha256 value and if you suspect anything you get it again and compare. I was wondering if there is any way to do the same with the bios and bootloader and ...
- 31
1
vote
0
answers
108
views
How do in-memory unrandomizers (like in Cheat Engine) work?
Cheat Engine is a rather known memory editing and manipulation tool for Windows.
It has this feature to screw up your randomness generation, how does it achieve it?
My guess would be that it makes the ...
- 1,542
1
vote
1
answer
88
views
How message authentication code (MAC) works?
Let's suppose I'm uploading some website to website example.com, and I'm signing every single file with MAC which is shared by users of my website to verify that me (the admin) uploaded that file.
It'...
- 13
0
votes
0
answers
104
views
Risk to perform a Penetration Testing in production environment
Let's say I have a web server exposed on Internet that deals with confidential data and it has high requirements in terms of integrity and availability.
What are the risks to perform a penetration ...
- 101
19
votes
4
answers
4k
views
Is signing a file better than issuing a checksum, and does it render a separate checksum useless?
Alternatively, the question could be asked: Does issuing a checksum for a file we sign anyways just duplicate work?
Use case: Firmware sent to an IoT device. We sign it, and form a separate checksum ...
- 301
-1
votes
1
answer
43
views
Can I use the CIA triad as a sliding scale wrt complexity?
I am looking for a device to explain the compromises that we make for extra layers of security.
For example wrt extra layers: communication like JWT encryption/signing and other sorts of encapsulation ...
- 129
1
vote
0
answers
21
views
Can I trust a hash commit for integrity of the entire repository? [duplicate]
Sometimes there's no tar release for some repo in github, and the download as zip button only generates a random zip with random hash. So, in my Dockerfile, I want to clone a repo but be able to check ...
- 415
0
votes
1
answer
139
views
How to securely hash sensitive data and make the hash public, while preventing an attack by someone who know the structure or some part of the data?
In a nutshell, I need:
to hash a file and to make this hash public, to be able to prove data integrity when sharing the data privately with a trusted third party.
to choose the right hashing method ...
- 103
0
votes
1
answer
102
views
Is it possible to enumerate thru all the hardware IDs?
I am thinking of developing of a rather primitive CLI program for the sole purpose of detecting rootkits/bootkits/firmware modifying advanced malware.
Can you iterate thru all all hardware IDs (CPUID,...
- 1,542
0
votes
1
answer
95
views
Is there a way for a file/binary/exexutable to verify it's own integrity?
So I'm making a distributed recovery system which consists of a bunch of hidden usb sticks. I plan to have the file be an executable, probably in the form of a appimage, which will contain my ...
1
vote
3
answers
160
views
Verifiable alternative to screenshots for web browsers
Screenshots are generally held to be dubious evidence when presented in court because they are susceptible to alteration, especially when it comes to pages rendered in web browsers. You can use the ...
- 1,323
1
vote
0
answers
98
views
Does flatpak enforce cryptographic authentication and integrity validation by default for all packages? (fedora)
Does the flatpak package manager in Fedora-based systems require successful cryptographic authentication and integrity validation for all packages?
I know that software downloaded with apt-get ...
- 886
0
votes
2
answers
221
views
I invoked undefined behaviour. Do I need a new computer?
Suppose I'm working on a computer and write a C program which invokes undefined behaviour. Since anything may have occurred, a (perhaps paranoid view) would be that anything the computer does ...
- 101
0
votes
1
answer
3k
views
Is enabling software flow-offloading in OpenWRT's firewall settings dangerous?
First of all, I did ask this on OpenWrt Forums already, I thought maybe someone here knows this.
I noticed that my internet speed gets limited when this feature is not enabled, this feature is also ...
- 1,542
0
votes
0
answers
73
views
double hashing for code signing and verification
I have environmental constraints where the cyber and safety functions are segregated such that safety operations are handled by one unit and cyber operations such as firewall, HIDS, secure storage etc....
1
vote
1
answer
135
views
Does rust's Cargo provide cryptographic authentication and integrity validation?
Does rust's cargo package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them?
I see a lot of guides ...
- 886
-1
votes
1
answer
105
views
Consider a Fraudulent bank website, would it violate all the aspects of the CIA triad or any one? [closed]
I believe it would violate all the three aspects due to following reasons:
Confidentiality: Since the website is obviously a scam, in case any person/user registers it, the data of the user would not ...
- 3
0
votes
1
answer
389
views
How hard is to reverse engineer a signature for a given message?
Given the following situation:
User makes a request for temporary access to a video
Backend responds with a json file containing timeAllowedInSeconds: 5
Backend also responds with the signature of ...
- 101
2
votes
1
answer
289
views
Does gpg (or openpgp in general) authenticate symmetrically-encrypted data?
When using gpg --symmetric to encrypt a file/message with a passphrase, is there any cryptographic integrity check to prevent an attacker from modifying the ciphertext? E.g. does gpg (or any other ...
- 42.8k
0
votes
1
answer
129
views
Does pacman enforce cryptographic authentication and integrity validation by default for all packages? (arch linux)
Does the built-in pacman package manager in Arch-based systems require successful cryptographic authentication and integrity validation for all packages?
I know that software downloaded with apt-get ...
- 886
2
votes
1
answer
324
views
How does validating the PGP signature of a downloaded executable against the publisher's public key show that the binary has not been tampered with?
Websites that host downloadable executables often provide measures to confirm the integrity of the data that is available to download. Such measures include:
Hosting the website under HTTPS;
...
- 5,667
1
vote
1
answer
105
views
E2E-Encrypted Storage: How to detect that data has been rolled back?
I am aware that it is possible to use a block cipher with the GCM-mode to provide authenticity, but this does not completely do what I need.
I have a cloud storage provider I do not completely trust, ...
- 707
0
votes
2
answers
203
views
Why aren't installer isos gpg signed?
When downloading a Linux installer iso, the user is supposed to check the iso with sha or m5sum and compare the result against a checksum file, and then check the gpg signature of the checksum file.
...
1
vote
2
answers
133
views
Can a meltdown attack also violate data integrity of other processes or is it just violating data secrecy?
Can a meltdown attack also violate data integrity of other processes by obtaining different passwords or is it just violating data secrecy by reading data it is unauthorized to do?
4
votes
3
answers
2k
views
Open-Source Hardware Security Modules (HSM)
Are there any Open-Source Hardware Security Modules (meeting OSHWA requirements)?
I've worked with Utimaco HSMs, but I'm not a big fan of closed-source hardware -- especially when it comes to security ...
- 886
1
vote
0
answers
82
views
Does snapd enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)
Does the snapd package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages?
I know that software downloaded with apt-get packages ...
- 886
1
vote
1
answer
273
views
What config files and logs files of a Linux system (CentOS 7) deserve to be monitored by a SIEM?
I am not a security expert (I am more a software developer) and I am working on a project related to a SIEM installation (Wazuh). This installation is only a demo for a customer, in a second time a ...
- 235
2
votes
1
answer
340
views
Authenticate-then-Encrypt: does the authenticity provide a benefit?
First off: I know that encrypt-then-authenticate is better, however I want to understand the following for authenticate-then-encrypt. The underlying cipher is AES-CTR or AES-CBC for this consideration....
- 151
0
votes
3
answers
255
views
How to verify integrity of software when the download provider doesn't publish hashes?
I noticed that certain software does not provide hash anymore nowadays.
E.g.
Zoom
https://zoom.us/download
wolf@linux:~$ ls -lh zoom_amd64.deb
-rw-rw-r-- 1 wolf wolf 44M Jan 1 00:00 zoom_amd64....
- 357
0
votes
0
answers
25
views
Does TLS provide data integrity? [duplicate]
I've looked around on this site and I've not seen a clear answer on this question.
From what I've read TLS does not provide data integrity unless specific ciphers are used which use HMAC'ing as part ...
- 159
0
votes
0
answers
89
views
Does yarn (Node.js package manager) provide cryptographic authentication and integrity validation?
Does the yarn package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them?
I see a lot of guides providing ...
- 886
2
votes
1
answer
219
views
Why there is nothing that automatically checks signatures of files downloaded in browsers? [duplicate]
When downloading files (mainly software/installers) from pages in browsers, sometimes it comes also with a cryptographic hash or a signature to verify the authenticity of a file against data ...
0
votes
2
answers
281
views
How do I know that the ISO image of the Linux distribution I have downloaded does not contain the NSA backdoor?
I have downloaded the ISO image of Kubuntu 20.10 and installed it.
I am afraid that the ISO image may have been tainted (for example, by the NSA) to insert a backdoor into it.
As I see it, there are ...
- 515
0
votes
3
answers
794
views
Different SHA256 checksum of same version of ssh binary on different machines
I was wondering if I compare SHA-256 of two binaries with same version on different machines, results will be two identical checksums.
I tried this on ssh on macOS (Catalina). (I checked that ssh -V ...
- 1
1
vote
0
answers
107
views
How Should Multiple Checksums Be Performed On the Same Data? [closed]
I am using CRC32 to verify the integrity of received UDP packets. Along with the generator polynomial, the sender will also specify how many checksums to perform on the sent data, as well as what ...
0
votes
1
answer
107
views
How to ensure integrity of program execution on foreign(someone else's) computer?
I want to run my computer program(or code) on someone else's computer(with permission from the owner of the computer) and get the results back. How can I make sure the owner is running my program only,...
7
votes
2
answers
207
views
How should backups be tested in large offices?
I always hear people say "test your backups", but I have no idea how that is done in practice when you have to deal with complex infrastructures.
For personal backups it's easy to rely on ...
- 15.6k
2
votes
1
answer
245
views
what is the appropriate data integrity check control for the data at rest?
An application does encrypt the data using a secrete key before the data is being written to the database to prevent the disclosure attack.
However how do we verify the integrity of such data when ...
- 177
4
votes
2
answers
750
views
How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change?
To help ensure authenticity of packages some projects on GitHub and on GitLab add hashsums to the descriptions of the release on the Releases page.
Sometimes, at least here, the hashsum are made part ...
- 349
0
votes
1
answer
297
views
How are Android's native libraries protected against tampering?
On Android it is possible to add native libraries provided by the system (/system/lib/) or the vendor (/vendor/lib/) to a system app. For example, the libandroid_runtime.so is loaded with System.load(&...
- 83
0
votes
0
answers
147
views
Cryptographic way to detect deleted rows in a database table
I have a web application talking to a PostgreSQL database.
My threat model is the following:
Attacks must not occur at rest. What i'm afraid of is unwanted deletion of data on a specific table, let's ...
2
votes
1
answer
693
views
Is there any point in using PGP or S/MIME when your receipients mostly don't use it?
For an company with sensitive customer relations and above average secrecy how much does it make sense to implement S/MIME or PGP for providing their E-mails the verification functionality (please ...
- 234
0
votes
1
answer
143
views
How to validate the integrity of a back end?
I just read following statement in a technical guideline about network-accessible mobile devices with medical applications (BSI TR 03161):
The application MUST verify the integrity of the back end ...
- 422
1
vote
0
answers
84
views
Signing event-stream responses
I am working on an application where the general approach is signing most response payloads with HMAC, but there are a couple of endpoints that return text/event-stream in the response. What is the ...
- 11