Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [integrity]

Integrity is the property of preventing unauthorized modifications of an asset. In other words, integrity protects against the threat of tampering. It is one of the three key security properties of an asset, along with confidentiality and availability.

1
vote
0answers
4 views

Persistent Bootable USB with Write Protection?

I am developing a series of extraction scripts (currently python 2.7) for a university project - these tools will be provided on a bootable USB for use by first responders when encountering a suspect ...
1
vote
1answer
48 views

Why do some websites have their hashes on the same area as the download link? [duplicate]

Some sites allow us to use hashes to make sure that the file we download is what it should be and that it is not tampered with. Some sites may have their hashes on a different domain probably on a ...
0
votes
0answers
32 views

lightweight techniques to protecting the integrity and confidentiality of mobile code

I have a code that I want to execute on probably more than one machine. To provide confidentiality, we can use cryptographic algorithms to encrypt the code during "migration". For code integrity, I ...
1
vote
1answer
28 views

Why “ Simple Integrity Property” axiom of Biba model protects data integrity?

I am reading CISSP and more specifically the Biba model. Biba has some basic properties: The Simple Integrity Property states that a subject cannot read an object at a lower integrity level (no read-...
1
vote
1answer
48 views

Does the file encryption of Microsoft Office guarantee integrity?

I stumbled upon Microsoft Office's feature of file encryption. For storing sensitive data in the cloud, e.g. DropBox, this sounds like a nice feature. Reading that the encryption is AES-128 in CBC ...
1
vote
1answer
104 views

Error detection capability of SHA-256

If we use SHA-256 checksum to detect corruptions to a file, what is its capability in terms of missed errors? For example, reading the page about error correction and detection here, under the ...
1
vote
3answers
118 views

Why is it required to HMAC riv in HDCP 2.3?

In HDCP 2.3 (pdf) during the Session Key Exchange, the HDCP transmitter sends also the 256-bit HMAC of riv (HMAC-SHA256(riv, kd)). Why is it required? Does it prevent any attack?
0
votes
3answers
168 views

Are hashes a reliable method of ensuring a file has not been tampered with?

Suppose I have a file and that I want to confirm that this file is the same as the original (IE: it has not been altered in any way) using hashing. If I were to use a hash function that has no known ...
1
vote
0answers
26 views

Provide email author origin integrity [closed]

If i receive an email, how does my computer verify the author origin integrity using the digital certificates? Does it use any specific protocol for this?
1
vote
1answer
44 views

Ensuring key integrity

I have encrypted AES key stored in the database with the encrypted data. AES key is encrypted with a key derived from the passphrase. I want to ensure the integrity of the stored AES key. Is the ...
1
vote
2answers
139 views

Is it secure to interact with a web page before it has fully loaded?

Web pages are often displayed in the browser before they have finished fully loading (i.e. the loading indicator is still spinning, etc). Usually this is caused by a slow advert or a video, etc. But ...
2
votes
1answer
73 views

How is compiling a program from source more secure?

When downloading compiled binaries for programs it is very important to check GPG signatures, Authenticode, hashes, etc. However, I often see people who say that compiling the code from source is the ...
1
vote
0answers
57 views

What is a trans-cipher?

While discussing archive authenticity/integrity for long term and the problem of potentially re-keying in case of compromise, someone came up with the term "trans-cipher" (or "trans-ciphering"). I ...
31
votes
2answers
3k views

How does subresource integrity actually help?

Subresource integrity basically lets me know that a resource I'm about to download is valid, because the hash of its contents matches what I expect. But this assumes that I'm already running on some ...
0
votes
0answers
28 views

How can a JWT token have multiple secrets?

I'm using the jwtcrack utility to attempt and crack an issued JWT token. I think just the following output should explain what's going on pretty well: [0] % ./jwtcrack [token] Secret is "P" joseph@...
1
vote
1answer
425 views

How to check hardware integrity?

When we download an ISO or any file we can hash it to ensure that the downloaded file has not been tempered i.e integrity of that file is preserved. But when I am buying a hardware device (monitor, ...
2
votes
1answer
414 views

LUKS2 dm-integrity

I am using Debian 9.5, kernel 9.16, I would like to use the dm-integrity feature with cryptsetup. cryptsetup luksFormat --type luks2 <device> --cipher aes-gcm-random --integrity aead ...
0
votes
1answer
61 views

Comparison of signature algorithms HMACSHA1 and RSASHA1

Compare and contrast the signature algorithms HMACSHA1 and RSASHA1. Assume that the aim here is to make it infeasible to generate valid message+sig pairs without knowing a certain private token/key (...
2
votes
4answers
172 views

How to ensure file integrity cryptographically?

Problem: I have a collection of files (source code for example) whose integrity has to be ensured. I don’t care if the files are corrupted (I can easily multiple backups). I just want to make sure ...
6
votes
2answers
4k views

How to verify the checksum of a downloaded file (pgp, sha, etc.)?

Maybe I have been negligent towards the verification of software I download over the Internet, but I (or anybody I ever met) have never tried to verify the checksum of the contents I download. And ...
-1
votes
2answers
72 views

App to prove that an image is not edited

I want to prove that a photo I will take has not been edited. So I am planning to implement an open source app which uses a "strict image authentication" technique using private key cryptography as ...
1
vote
1answer
72 views

What probability of injecting invalid data is considered safe?

I encrypt some sensitive data with AES128 and I use custom method (encrypted CRC) for providing data integrity. I have calculated the probability of successful injection of invalid data that equals 4....
3
votes
1answer
241 views

Providing data integrity with AES

A question for an exam asks me to provide data integrity of a file F with AES and a shared secret key between Alice and Bob, if there is a way. The message is sent by Alice to Bob. I thought of the ...
0
votes
1answer
213 views

Can I trust a ubuntu repo mirror in a less 'free' country?

For example, if I install Ubuntu in Dubai or in Saudi Arabia, I'll probably get a local mirror. Is there a way I can make sure that the ubuntu packages I get when I do apt-get update are the 'real' ...
2
votes
1answer
201 views

How should I verify a backup has not been tampered with?

I have a NAS with some files that total up to 2TB in size. I suspect I could shrink this because there are possibly duplicate files. I plan on making a second backup by sending what I have to Google ...
3
votes
1answer
376 views

Are Bell-LaPadula and Biba models used in real big software security design?

I am currently studying both Bell-LaPadula and Biba models, I found this models too theoretical as I see the examples and I can see that there are used for designing particular services that needs ...
8
votes
5answers
587 views

Why don't websites provide a checksum of their downloadable files?

I very rarely see websites provide a SHA-2 hash that's signed to ensure file integrity for the user downloaded side file, and show that the file has not been manipulated or out right replaced with a ...
0
votes
1answer
115 views

How does Github preserve versioning integrity?

Given that a malicious party gains access to a GitHub repository, would it be possible for the adversary to delete or modify versioning information / history after she altered code stored on the repo? ...
1
vote
2answers
166 views

How to protect the Shadow Stack?

I found out that many protection mechanisms are used in computer security to ensure control-flow integrity, one of these mechanisms is the Shadow stack: The principal is very easy it ensure the ...
1
vote
2answers
56 views

Ideas for storing documents and hash values

Scenario is I received documents as a PDF along with an MD5 hash. Problem is how do I store these? Thought is to store the document and MD5 separately so that anyone with access to the document does ...
1
vote
1answer
200 views

Do symmetric cryptographic primitives provide both integrity and confidentiality?

I understand that symmetric cryptographic algorithms provide confidentiality through the use of a key to encrypt plain text to cipher text but how can they provide for integrity as well? Would it not ...
1
vote
2answers
123 views

Do software do an integrity check before executing?

I am testing a software that I need to install on my computer locally. It seems I can modify one of the .exe or .dll using msfvenom to include a malicious payload, like a reverse shell. From there, I ...
1
vote
0answers
28 views

GPG RSA Authenticity Mechanism Minimum Requirement

The GPG/PGP based RSA authenticity signing mechanism is based on 3 parts to ensure authenticity: the public key the signature the fingerprint of the public key Assuming that the author keeps his ...
17
votes
4answers
3k views

Where does authenticity fit into the CIA Triad?

Consider a chat application where an attacker is able to send messages in any user's name. This obviously violates the message's authenticity. But what aspect of CIA would be violated? Integrity ...
0
votes
2answers
73 views

ensuring integrity of a sequence of jpeg files

How do I ensure that a sequence of files is very hard to alter, either altering the content or removing whole files? I'm thinking some kind of rolling checksum that also relies on the sum total of ...
2
votes
2answers
117 views

How can I verify that network calls to my API come only from my C# program?

I have a desktop application build on the .Net framework. If I obfuscate the code, even if somebody reverse-engineers the code and tries to call my API using the altered source, can I know if the API ...
2
votes
2answers
96 views

Should I be thinking about security at the database row/document level?

Suppose I have a web application that is a social network. In order for two people to have access to eachother's content they must become friends. There is logic in the application to ensure both ...
0
votes
1answer
171 views

NodeJs app files integrity security check [closed]

What are the recommended methods or approaches to check NodeJs application (hosted on Linux server) files integrity check for security check? There are usually huge number of files in node_modules/, ...
2
votes
2answers
76 views

What is the boundary between Information Security and Quality Control regarding Integrity?

I was in a recent dispute with the CIO regarding this (I work as an InfoSec Officer). There was an issue when one of our devs published erroneous code in production due to user error (copy-paste sort ...
1
vote
2answers
81 views

Possible setup for a direct democracy voting system to prevent fraud

My Government is designing a direct democratic voting system and would like the system to be open sourced and unable to be corrupted by individuals and other stakeholders. Some requirements as of now:...
4
votes
1answer
754 views

Authentication as CIA triad

As we all know, information security principles are stated as CIA triad, i.e., confidentiality, integrity, and availability. I wonder why authentication is not a part of CIA triad as being an ...
5
votes
1answer
160 views

Is using desktop 2FA clients like Authy Desktop a good practice?

Basically 2FA relies on the idea that instead of just something you know, using a service also requires something you own. I am quite confident, especially when used on iOS (which has a better system ...
12
votes
4answers
3k views

Why is it impossible to verify whether a file has been modified since creation?

From what I understand, it is impossible to verify whether a file has been modified since its creation. Specifically, I was wondering whether it was possible to verify whether a photo was modified ...
0
votes
1answer
49 views

Can I add hashes and a digital signature to a compressed file, and is it necessary in this situation? [closed]

I am wanting to create a project for a Linux Desktop environment and was curious about a certain subject. I plan to add all the files of the project and compress it into a .zip file. Is is possible ...
4
votes
0answers
156 views

Security of TPM 1.2 for providing tamper-evidence against firmware modification

I would like to use a TPM for providing tamper-evidence to my workstation, using SRTM (Static Root-of-Trust for Measurement). Currently, I plan to have the TPM seal a one-time value which only I know, ...
0
votes
1answer
82 views

What's the possiblity of my ISO being compromised? [duplicate]

This has concerned me for awhile. I had downloaded and installed many different operating systems and have always verified the integrity and authenticity of the ISO files by checking the hashes and ...
0
votes
1answer
208 views

KeepassXC gpg verification with sig file

I downloaded the KeepassXC .AppImage file and was verifying it using first the .DIGEST file and then .sig file. While I was verifying the download using the .sig file I noticed something strange as I ...
3
votes
1answer
150 views

Question about potential ISO infection and ISO verification

I was downloading a ISO file from Ubuntu and was just curious on some security questions concerning this process and after the download process. If I'm downloading a file can my file be infected while ...
1
vote
1answer
633 views

OSSEC - Can i centralize what file to check with centralized agent config?

I am starting with OSSEC for file integrity check in a bunch of Windows servers and CentOS. And I would like to keep a centralized configuration of what to check for all my agents, based on they OS. ...
0
votes
0answers
48 views

File Integrity Manager vs OS ACL+Auditing+MD5 Hash

As per my limited understanding about the FIM(File Integrity Manager) solutions goes, I'm wondering why anybody would need it. If one can properly configure their File system ACLs + Maintain and ...