Questions tagged [integrity]

Integrity is the property of preventing unauthorized modifications of an asset. In other words, integrity protects against the threat of tampering. It is one of the three key security properties of an asset, along with confidentiality and availability.

Filter by
Sorted by
Tagged with
0
votes
2answers
77 views

Why aren't installer isos gpg signed?

When downloading a Linux installer iso, the user is supposed to check the iso with sha or m5sum and compare the result against a checksum file, and then check the gpg signature of the checksum file. ...
0
votes
1answer
50 views

Can a meltdown attack also violate data integrity of other processes or is it just violating data secrecy?

Can a meltdown attack also violate data integrity of other processes by obtaining different passwords or is it just violating data secrecy by reading data it is unauthorized to do?
2
votes
2answers
174 views

Open-Source Hardware Security Modules (HSM)

Are there any Open-Source Hardware Security Modules (meeting OSHWA requirements)? I've worked with Utimaco HSMs, but I'm not a big fan of closed-source hardware -- especially when it comes to security ...
1
vote
0answers
38 views

Does snapd enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)

Does the snapd package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get packages ...
1
vote
1answer
59 views

What config files and logs files of a Linux system (CentOS 7) deserve to be monitored by a SIEM?

I am not a security expert (I am more a software developer) and I am working on a project related to a SIEM installation (Wazuh). This installation is only a demo for a customer, in a second time a ...
2
votes
1answer
237 views

Authenticate-then-Encrypt: does the authenticity provide a benefit?

First off: I know that encrypt-then-authenticate is better, however I want to understand the following for authenticate-then-encrypt. The underlying cipher is AES-CTR or AES-CBC for this consideration....
0
votes
3answers
107 views

How to verify integrity of software when the download provider doesn't publish hashes?

I noticed that certain software does not provide hash anymore nowadays. E.g. Zoom https://zoom.us/download wolf@linux:~$ ls -lh zoom_amd64.deb -rw-rw-r-- 1 wolf wolf 44M Jan 1 00:00 zoom_amd64....
0
votes
0answers
21 views

Does TLS provide data integrity? [duplicate]

I've looked around on this site and I've not seen a clear answer on this question. From what I've read TLS does not provide data integrity unless specific ciphers are used which use HMAC'ing as part ...
0
votes
0answers
46 views

Does npm (Node.js package manager) provide cryptographic authentication and integrity validation?

Does the npm package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides providing ...
0
votes
0answers
32 views

Does yarn (Node.js package manager) provide cryptographic authentication and integrity validation?

Does the yarn package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides providing ...
0
votes
0answers
23 views

How to ensure authenticity of photographic evidence and derived work?

Photographic evidence is not what it used to be before generative ai, reface, deepfake, live deepfake, etc. Is there a way to ensure authenticity of photos/videos, as well as derived work? For example:...
2
votes
1answer
100 views

Why there is nothing that automatically checks signatures of files downloaded in browsers? [duplicate]

When downloading files (mainly software/installers) from pages in browsers, sometimes it comes also with a cryptographic hash or a signature to verify the authenticity of a file against data ...
0
votes
2answers
148 views

How do I know that the ISO image of the Linux distribution I have downloaded does not contain the NSA backdoor?

I have downloaded the ISO image of Kubuntu 20.10 and installed it. I am afraid that the ISO image may have been tainted (for example, by the NSA) to insert a backdoor into it. As I see it, there are ...
0
votes
3answers
172 views

Different SHA256 checksum of same version of ssh binary on different machines

I was wondering if I compare SHA-256 of two binaries with same version on different machines, results will be two identical checksums. I tried this on ssh on macOS (Catalina). (I checked that ssh -V ...
1
vote
0answers
39 views

How Should Multiple Checksums Be Performed On the Same Data? [closed]

I am using CRC32 to verify the integrity of received UDP packets. Along with the generator polynomial, the sender will also specify how many checksums to perform on the sent data, as well as what ...
0
votes
1answer
62 views

How to ensure integrity of program execution on foreign(someone else's) computer?

I want to run my computer program(or code) on someone else's computer(with permission from the owner of the computer) and get the results back. How can I make sure the owner is running my program only,...
8
votes
2answers
153 views

How should backups be tested in large offices?

I always hear people say "test your backups", but I have no idea how that is done in practice when you have to deal with complex infrastructures. For personal backups it's easy to rely on ...
2
votes
1answer
85 views

what is the appropriate data integrity check control for the data at rest?

An application does encrypt the data using a secrete key before the data is being written to the database to prevent the disclosure attack. However how do we verify the integrity of such data when ...
0
votes
2answers
180 views

How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change?

To help ensure authenticity of packages some projects on GitHub and on GitLab add hashsums to the descriptions of the release on the Releases page. Sometimes, at least here, the hashsum are made part ...
0
votes
1answer
81 views

How are Android's native libraries protected against tampering?

On Android it is possible to add native libraries provided by the system (/system/lib/) or the vendor (/vendor/lib/) to a system app. For example, the libandroid_runtime.so is loaded with System.load(&...
0
votes
0answers
82 views

Cryptographic way to detect deleted rows in a database table

I have a web application talking to a PostgreSQL database. My threat model is the following: Attacks must not occur at rest. What i'm afraid of is unwanted deletion of data on a specific table, let's ...
1
vote
1answer
172 views

Is there any point in using PGP or S/MIME when your receipients mostly don't use it?

For an company with sensitive customer relations and above average secrecy how much does it make sense to implement S/MIME or PGP for providing their E-mails the verification functionality (please ...
0
votes
0answers
70 views

LUKS2 confidentiality+integrity

I would need some advice on LUKS2 cryptsetup (confidentiality + integrity). I would like to include crypsetup integrity feature with --cipher aes-gcm-random --integrity aead on xfs formatted Raid. Few ...
0
votes
1answer
65 views

How to validate the integrity of a back end?

I just read following statement in a technical guideline about network-accessible mobile devices with medical applications (BSI TR 03161): The application MUST verify the integrity of the back end ...
1
vote
0answers
47 views

Signing event-stream responses

I am working on an application where the general approach is signing most response payloads with HMAC, but there are a couple of endpoints that return text/event-stream in the response. What is the ...
0
votes
1answer
83 views

Is using full TLS suite in all communication scenarios a defacto standard?

Its usually recommended that 'don't use your own system of Crypto' rather use standard SSL/TLS! I understand that SSL/TLS is a complete protocol suite that addresses all three elements of CIA triad. ...
2
votes
1answer
162 views

Understanding Secure Boot

I'm trying to understand the secure boot process of an OS but there are few points I can't wrap my head around. At a high level, afaik, secure boot ensures that the loaded OS is authenticated by its ...
1
vote
0answers
163 views

Secured data upload to Aircraft over ARINC 615A

We have a requirement for Data loading function to Aircraft. There is Avionics standard termed as ARINC 615A and ARINC 665. 615A specifies high speed Ethernet based data load operation; where POINT-TO-...
0
votes
1answer
126 views

Checking system integrity after clicking scam email link on Linux

Earlier today, my mother opened an email thinking it was from my sister-inlaw, then clicked on the shortened link. The link loaded a page of fairly nonsensical text. The source of the page had no ...
9
votes
3answers
654 views

Does python's pip provide cryptographic authentication and integrity validation?

Does python's pip package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
1
vote
1answer
79 views

Comparing two Linux system clones - what about non-regular files?

Could you please help me to understand the best approach to compare two filesystems / hard disks? As a practical learning exercise I created a clone of whole hard drive a month ago and again ...
4
votes
1answer
102 views

Practice question for Security+ that I think is wrong. Integrity vs availability

There is the following question on a practice test: Which service are you addressing by installing a RAID array and load balancer? A. Confidentiality B. Availability C. ...
0
votes
1answer
51 views

How do you securely give access to a Java App interactive console (Linux/GNU)?

I have a Java App running, which prints out messages into STDOUT and also has an active interactive console (also accepts STDIN), when the server has started up. How do I securely give access to an ...
0
votes
0answers
57 views

How to measure security level of digital signature?

I want to measure the guarantee of integrity of a digital signature. I use RSA with a 4096 bit key, and SHA 256, and a passphrase. The level of security is going to depend on these three factors, ...
0
votes
0answers
41 views

Possible to verify the integrity of AIDE itself?

I recently installed the package AIDE (Advanced Intrusion Detection Environment) on my Linux server. This is a web server installed about a year ago. Since no integrity checks have been done before on ...
1
vote
1answer
240 views

Integrity Check on power on VS. Secure boot

Can we consider the Integrity Check on power-on and the secure boot equal from security point of view? Secure boot is about allowing only a trusted SW to boot on the processor. A chain of trust can ...
1
vote
2answers
130 views

Detecting/preventing rollback of encrypted data on a server

I need to store a frequently-changing set of encrypted data in a database. This can be encrypted and decrypted with an internal key. The data is based upon other metrics within the system, mostly the ...
2
votes
1answer
202 views

How to ensure authenticity and integrity of a directory

I want to do something similar to Ubuntu's signed checksums in distribution and I'm currently stuck on the integrity part. The tutorial here covers most of what I'd like the process to look like (I've ...
3
votes
1answer
551 views

HMAC and integrity

I'm studying network security and I found this question in my slide, but don't have an answer. Discuss the use of keyed HMACs for guaranteeing the integrity of a file being transmitted over the ...
1
vote
0answers
80 views

How can I maintain and automate a list of download URLs with known hashes? [closed]

I'm familiar with the concept of downloading a file and manually checking it against a published checksum. See How to verify the checksum of a downloaded file (pgp, sha, etc.)? and Is there a command ...
1
vote
0answers
46 views

What does jarsigner verify in the first place (integrity or authenticity)?

I was reading sth about android code signing and have run into this statement: The second jarsigner command at v in Listing 3-7 first verifies the signature block and signing certificate, ...
3
votes
3answers
509 views

Do integrity and authentication always come together?

I cannot come up with a case where there is only one of them. When there is integrity, a random person cannot modify the message without being noticed. That is, an unauthenticated user cannot modify ...
1
vote
1answer
103 views

Does Integrity assures protection from unauthorized read, without any modification?

I'm not quite sure if I understood integrity deep enough. Let's suppose that Alice and Bob are using a public-key algorithm and using signatures to assure their data integrity. A hacker was able to ...
0
votes
3answers
2k views

Can importing an .ics file be dangerous?

Can there theoretically be any possible malicious code hidden in .ics files, which would steal your calendar data or something similar? For an example case, we'd be importing the .ics file into Google ...
1
vote
2answers
190 views

Protecting against planted evidence

This question was motivated by this 2018 article by the Electronic Frontier Foundation that discusses the findings from the Mark Rettenmaier case. For a bit of background on that case, this article ...
1
vote
0answers
158 views

x.509 certificate chain verification in Linux kernel prior to 4.12

I am trying to use certificate chain verification in Linux kernel. The purpose is to use IMA/EVM with public keys that are included in x.509 certificates signed by an own root CA. For this purpose I ...
0
votes
0answers
92 views

How to Use the Carter-Wegman MAC

I have a block of ciphertext, only two hundred characters long, and I want to give it authentication and proof of data integrity. I have decided upon the Carter-Wegman MAC because I like its ...
1
vote
1answer
129 views

How secure is a Mac if it passes Apple Diagnostics?

Recently I brought my MacBook Air to a Genius Bar to perform a clean MacOS installation. For security purposes, I asked for a hardware check as well. The Genius Bar technician ran Apple Diagnostics, ...
1
vote
1answer
309 views

If a site includes the header 'HTTP Content-Security-Policy require-sri-for' then does this include all nested scripts?

If I'm using subresource integrity on a web page and a script that I import then itself imports a further script, will the CSP 'require-sri-for' also include those subsequent, nested, imported scripts?...
0
votes
2answers
78 views

How to keep track of file authenticity while offline

I have an application running the client/server model and offering an online and an offline mode. Each user can read, create or modify text files (even in offline mode) that will be present on his ...

1
2 3 4 5 6