Questions tagged [integrity]

Integrity is the property of preventing unauthorized modifications of an asset. In other words, integrity protects against the threat of tampering. It is one of the three key security properties of an asset, along with confidentiality and availability.

Filter by
Sorted by
Tagged with
1
vote
2answers
130 views

Protecting against planted evidence

This question was motivated by this 2018 article by the Electronic Frontier Foundation that discusses the findings from the Mark Rettenmaier case. For a bit of background on that case, this article ...
1
vote
0answers
49 views

x.509 certificate chain verification in Linux kernel prior to 4.12

I am trying to use certificate chain verification in Linux kernel. The purpose is to use IMA/EVM with public keys that are included in x.509 certificates signed by an own root CA. For this purpose I ...
0
votes
0answers
69 views

How to Use the Carter-Wegman MAC

I have a block of ciphertext, only two hundred characters long, and I want to give it authentication and proof of data integrity. I have decided upon the Carter-Wegman MAC because I like its ...
1
vote
1answer
106 views

How secure is a Mac if it passes Apple Diagnostics?

Recently I brought my MacBook Air to a Genius Bar to perform a clean MacOS installation. For security purposes, I asked for a hardware check as well. The Genius Bar technician ran Apple Diagnostics, ...
0
votes
1answer
71 views

If a site includes the header 'HTTP Content-Security-Policy require-sri-for' then does this include all nested scripts?

If I'm using subresource integrity on a web page and a script that I import then itself imports a further script, will the CSP 'require-sri-for' also include those subsequent, nested, imported scripts?...
0
votes
2answers
70 views

How to keep track of file authenticity while offline

I have an application running the client/server model and offering an online and an offline mode. Each user can read, create or modify text files (even in offline mode) that will be present on his ...
0
votes
1answer
131 views

Ways to verify Data Integrity

I've had looks to existing subjects but it usually gets heavily complicated while I'm new to this kind of stuff and I'd prefer to understand concepts first in order to understand better concrete ...
0
votes
0answers
35 views

Protect transaction counter agains roll-back attack

I am designing a application which should be used for transaction processing so required very good performance. There are requirements that transactions originating from the same client must have ...
-1
votes
1answer
69 views

How secure is virtualization against breaking out of the box [closed]

How secure are all currently used virtualization technologies (containers - BSD Jail, OpenVZ, Hypervisors - Hyper-V, KVM etc)? I heard about one vulnerability in VMware software, which lets you ...
1
vote
1answer
67 views

How to protect file integrity and history containing counters

I would like to create a solution that would sign the data and will have a increasing counter so I can track the number of signatures. One of the requirement is to have an increasing order of ...
2
votes
2answers
85 views

File integrity assurance

I have the following scenario : Two parties want to exchange files. First party publishes a file on a secure server First party sends to the second, a hash of the file in order to be able to verify ...
5
votes
6answers
1k views

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives. I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider ...
1
vote
2answers
99 views

How reliable is rpm --verify when auditing package integrity and what alternatives are there?

Currently to verify package integrity, the command rpm --verify is run. In reading the rpm manual (http://ftp.rpm.org/max-rpm/s1-rpm-verify-output.html), there is no indication as to the veracity of ...
1
vote
1answer
88 views

Persistent Bootable USB with Write Protection?

I am developing a series of extraction scripts (currently python 2.7) for a university project - these tools will be provided on a bootable USB for use by first responders when encountering a suspect ...
1
vote
1answer
87 views

Why do some websites have their hashes on the same area as the download link? [duplicate]

Some sites allow us to use hashes to make sure that the file we download is what it should be and that it is not tampered with. Some sites may have their hashes on a different domain probably on a ...
1
vote
1answer
126 views

Why “ Simple Integrity Property” axiom of Biba model protects data integrity?

I am reading CISSP and more specifically the Biba model. Biba has some basic properties: The Simple Integrity Property states that a subject cannot read an object at a lower integrity level (no read-...
1
vote
1answer
71 views

Does the file encryption of Microsoft Office guarantee integrity?

I stumbled upon Microsoft Office's feature of file encryption. For storing sensitive data in the cloud, e.g. DropBox, this sounds like a nice feature. Reading that the encryption is AES-128 in CBC ...
1
vote
1answer
256 views

Error detection capability of SHA-256

If we use SHA-256 checksum to detect corruptions to a file, what is its capability in terms of missed errors? For example, reading the page about error correction and detection here, under the ...
1
vote
3answers
218 views

Why is it required to HMAC riv in HDCP 2.3?

In HDCP 2.3 (pdf) during the Session Key Exchange, the HDCP transmitter sends also the 256-bit HMAC of riv (HMAC-SHA256(riv, kd)). Why is it required? Does it prevent any attack?
0
votes
3answers
240 views

Are hashes a reliable method of ensuring a file has not been tampered with?

Suppose I have a file and that I want to confirm that this file is the same as the original (IE: it has not been altered in any way) using hashing. If I were to use a hash function that has no known ...
1
vote
0answers
49 views

Provide email author origin integrity [closed]

If i receive an email, how does my computer verify the author origin integrity using the digital certificates? Does it use any specific protocol for this?
1
vote
1answer
62 views

Ensuring key integrity

I have encrypted AES key stored in the database with the encrypted data. AES key is encrypted with a key derived from the passphrase. I want to ensure the integrity of the stored AES key. Is the ...
1
vote
2answers
153 views

Is it secure to interact with a web page before it has fully loaded?

Web pages are often displayed in the browser before they have finished fully loading (i.e. the loading indicator is still spinning, etc). Usually this is caused by a slow advert or a video, etc. But ...
2
votes
1answer
84 views

How is compiling a program from source more secure?

When downloading compiled binaries for programs it is very important to check GPG signatures, Authenticode, hashes, etc. However, I often see people who say that compiling the code from source is the ...
1
vote
0answers
87 views

What is a trans-cipher?

While discussing archive authenticity/integrity for long term and the problem of potentially re-keying in case of compromise, someone came up with the term "trans-cipher" (or "trans-ciphering"). I ...
31
votes
2answers
3k views

How does subresource integrity actually help?

Subresource integrity basically lets me know that a resource I'm about to download is valid, because the hash of its contents matches what I expect. But this assumes that I'm already running on some ...
1
vote
1answer
1k views

How to check hardware integrity?

When we download an ISO or any file we can hash it to ensure that the downloaded file has not been tempered i.e integrity of that file is preserved. But when I am buying a hardware device (monitor, ...
3
votes
1answer
1k views

LUKS2 dm-integrity

I am using Debian 9.5, Linux Kernel 4.16, I would like to use the dm-integrity feature with cryptsetup. cryptsetup luksFormat --type luks2 <device> --cipher aes-gcm-random --integrity aead ...
0
votes
1answer
144 views

Comparison of signature algorithms HMACSHA1 and RSASHA1

Compare and contrast the signature algorithms HMACSHA1 and RSASHA1. Assume that the aim here is to make it infeasible to generate valid message+sig pairs without knowing a certain private token/key (...
2
votes
4answers
522 views

How to ensure file integrity cryptographically?

Problem: I have a collection of files (source code for example) whose integrity has to be ensured. I don’t care if the files are corrupted (I can easily multiple backups). I just want to make sure ...
16
votes
2answers
31k views

How to verify the checksum of a downloaded file (pgp, sha, etc.)?

Maybe I have been negligent towards the verification of software I download over the Internet, but I (or anybody I ever met) have never tried to verify the checksum of the contents I download. And ...
-1
votes
2answers
75 views

App to prove that an image is not edited

I want to prove that a photo I will take has not been edited. So I am planning to implement an open source app which uses a "strict image authentication" technique using private key cryptography as ...
1
vote
1answer
74 views

What probability of injecting invalid data is considered safe?

I encrypt some sensitive data with AES128 and I use custom method (encrypted CRC) for providing data integrity. I have calculated the probability of successful injection of invalid data that equals 4....
3
votes
1answer
377 views

Providing data integrity with AES

A question for an exam asks me to provide data integrity of a file F with AES and a shared secret key between Alice and Bob, if there is a way. The message is sent by Alice to Bob. I thought of the ...
1
vote
1answer
464 views

Can I trust a ubuntu repo mirror in a less 'free' country?

For example, if I install Ubuntu in Dubai or in Saudi Arabia, I'll probably get a local mirror. Is there a way I can make sure that the ubuntu packages I get when I do apt-get update are the 'real' ...
2
votes
1answer
409 views

How should I verify a backup has not been tampered with?

I have a NAS with some files that total up to 2TB in size. I suspect I could shrink this because there are possibly duplicate files. I plan on making a second backup by sending what I have to Google ...
3
votes
1answer
934 views

Are Bell-LaPadula and Biba models used in real big software security design?

I am currently studying both Bell-LaPadula and Biba models, I found this models too theoretical as I see the examples and I can see that there are used for designing particular services that needs ...
8
votes
5answers
1k views

Why don't websites provide a checksum of their downloadable files?

I very rarely see websites provide a SHA-2 hash that's signed to ensure file integrity for the user downloaded side file, and show that the file has not been manipulated or out right replaced with a ...
0
votes
1answer
167 views

How does Github preserve versioning integrity?

Given that a malicious party gains access to a GitHub repository, would it be possible for the adversary to delete or modify versioning information / history after she altered code stored on the repo? ...
1
vote
2answers
301 views

How to protect the Shadow Stack?

I found out that many protection mechanisms are used in computer security to ensure control-flow integrity, one of these mechanisms is the Shadow stack: The principal is very easy it ensure the ...
1
vote
2answers
64 views

Ideas for storing documents and hash values

Scenario is I received documents as a PDF along with an MD5 hash. Problem is how do I store these? Thought is to store the document and MD5 separately so that anyone with access to the document does ...
1
vote
1answer
306 views

Do symmetric cryptographic primitives provide both integrity and confidentiality?

I understand that symmetric cryptographic algorithms provide confidentiality through the use of a key to encrypt plain text to cipher text but how can they provide for integrity as well? Would it not ...
2
votes
1answer
944 views

Nmap scan for Operational Technology devices

I want to scan a range of network with nmap to discover hosts but I know that depending on the scan, it can affect the integrity of OT (Operational Technology) devices, industrial devices like PLCs (...
1
vote
2answers
141 views

Do software do an integrity check before executing?

I am testing a software that I need to install on my computer locally. It seems I can modify one of the .exe or .dll using msfvenom to include a malicious payload, like a reverse shell. From there, I ...
1
vote
0answers
29 views

GPG RSA Authenticity Mechanism Minimum Requirement

The GPG/PGP based RSA authenticity signing mechanism is based on 3 parts to ensure authenticity: the public key the signature the fingerprint of the public key Assuming that the author keeps his ...
17
votes
4answers
3k views

Where does authenticity fit into the CIA Triad?

Consider a chat application where an attacker is able to send messages in any user's name. This obviously violates the message's authenticity. But what aspect of CIA would be violated? Integrity ...
0
votes
1answer
77 views

ensuring integrity of a sequence of jpeg files

How do I ensure that a sequence of files is very hard to alter, either altering the content or removing whole files? I'm thinking some kind of rolling checksum that also relies on the sum total of ...
2
votes
2answers
119 views

How can I verify that network calls to my API come only from my C# program?

I have a desktop application build on the .Net framework. If I obfuscate the code, even if somebody reverse-engineers the code and tries to call my API using the altered source, can I know if the API ...
2
votes
2answers
102 views

Should I be thinking about security at the database row/document level?

Suppose I have a web application that is a social network. In order for two people to have access to eachother's content they must become friends. There is logic in the application to ensure both ...
0
votes
1answer
260 views

NodeJs app files integrity security check [closed]

What are the recommended methods or approaches to check NodeJs application (hosted on Linux server) files integrity check for security check? There are usually huge number of files in node_modules/, ...