Questions tagged [integrity]

Integrity is the property of preventing unauthorized modifications of an asset. In other words, integrity protects against the threat of tampering. It is one of the three key security properties of an asset, along with confidentiality and availability.

Filter by
Sorted by
Tagged with
0
votes
1answer
63 views

How are Android's native libraries protected against tampering?

On Android it is possible to add native libraries provided by the system (/system/lib/) or the vendor (/vendor/lib/) to a system app. For example, the libandroid_runtime.so is loaded with System.load(&...
0
votes
0answers
71 views

Cryptographic way to detect deleted rows in a database table

I have a web application talking to a PostgreSQL database. My threat model is the following: Attacks must not occur at rest. What i'm afraid of is unwanted deletion of data on a specific table, let's ...
1
vote
1answer
107 views

Is there any point in using PGP or S/MIME when your receipients mostly don't use it?

For an company with sensitive customer relations and above average secrecy how much does it make sense to implement S/MIME or PGP for providing their E-mails the verification functionality (please ...
0
votes
0answers
42 views

LUKS2 confidentiality+integrity

I would need some advice on LUKS2 cryptsetup (confidentiality + integrity). I would like to include crypsetup integrity feature with --cipher aes-gcm-random --integrity aead on xfs formatted Raid. Few ...
0
votes
1answer
54 views

How to validate the integrity of a back end?

I just read following statement in a technical guideline about network-accessible mobile devices with medical applications (BSI TR 03161): The application MUST verify the integrity of the back end ...
1
vote
0answers
47 views

Signing event-stream responses

I am working on an application where the general approach is signing most response payloads with HMAC, but there are a couple of endpoints that return text/event-stream in the response. What is the ...
0
votes
0answers
39 views

need to address a subset of CIA triad elements and not in entirety

Its usually recommended that 'don't use your own system of Crypto' rather use standard SSL/TLS! I understand that SSL/TLS is a complete protocol suite that addresses all three elements of CIA triad. ...
2
votes
1answer
113 views

Understanding Secure Boot

I'm trying to understand the secure boot process of an OS but there are few points I can't wrap my head around. At a high level, afaik, secure boot ensures that the loaded OS is authenticated by its ...
1
vote
0answers
79 views

Secured data upload to Aircraft over ARINC 615A

We have a requirement for Data loading function to Aircraft. There is Avionics standard termed as ARINC 615A and ARINC 665. 615A specifies high speed Ethernet based data load operation; where POINT-TO-...
0
votes
1answer
61 views

Checking system integrity after clicking scam email link on Linux

Earlier today, my mother opened an email thinking it was from my sister-inlaw, then clicked on the shortened link. The link loaded a page of fairly nonsensical text. The source of the page had no ...
8
votes
3answers
282 views

Does python's pip provide cryptographic authentication and integrity validation?

Does python's pip package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
1
vote
1answer
74 views

Comparing two Linux system clones - what about non-regular files?

Could you please help me to understand the best approach to compare two filesystems / hard disks? As a practical learning exercise I created a clone of whole hard drive a month ago and again ...
4
votes
1answer
95 views

Practice question for Security+ that I think is wrong. Integrity vs availability

There is the following question on a practice test: Which service are you addressing by installing a RAID array and load balancer? A. Confidentiality B. Availability C. ...
0
votes
1answer
50 views

How do you securely give access to a Java App interactive console (Linux/GNU)?

I have a Java App running, which prints out messages into STDOUT and also has an active interactive console (also accepts STDIN), when the server has started up. How do I securely give access to an ...
0
votes
0answers
24 views

iOS 11+ settings migration to a second-hand device

When you receive a new iPhone running iOS 11+, the setup process allows you to migrate settings and content from your old phone (assuming it is also running iOS 11+). The migration is initiated by a ...
0
votes
0answers
50 views

How to measure security level of digital signature?

I want to measure the guarantee of integrity of a digital signature. I use RSA with a 4096 bit key, and SHA 256, and a passphrase. The level of security is going to depend on these three factors, ...
0
votes
0answers
32 views

Possible to verify the integrity of AIDE itself?

I recently installed the package AIDE (Advanced Intrusion Detection Environment) on my Linux server. This is a web server installed about a year ago. Since no integrity checks have been done before on ...
1
vote
1answer
125 views

Integrity Check on power on VS. Secure boot

Can we consider the Integrity Check on power-on and the secure boot equal from security point of view? Secure boot is about allowing only a trusted SW to boot on the processor. A chain of trust can ...
0
votes
0answers
74 views

Bell-LaPadula permissions

I have to find Read/Write permissions in this exercise. Security Levels = Low < Medium < High Categories = A, B Subject: Alice label(Alice) = (M, {A}) Objects: label(o1) = (L, {A,B}) label(...
1
vote
2answers
101 views

Detecting/preventing rollback of encrypted data on a server

I need to store a frequently-changing set of encrypted data in a database. This can be encrypted and decrypted with an internal key. The data is based upon other metrics within the system, mostly the ...
2
votes
1answer
95 views

How to ensure authenticity and integrity of a directory

I want to do something similar to Ubuntu's signed checksums in distribution and I'm currently stuck on the integrity part. The tutorial here covers most of what I'd like the process to look like (I've ...
2
votes
1answer
286 views

HMAC and integrity

I'm studying network security and I found this question in my slide, but don't have an answer. Discuss the use of keyed HMACs for guaranteeing the integrity of a file being transmitted over the ...
1
vote
0answers
78 views

How can I maintain and automate a list of download URLs with known hashes? [closed]

I'm familiar with the concept of downloading a file and manually checking it against a published checksum. See How to verify the checksum of a downloaded file (pgp, sha, etc.)? and Is there a command ...
1
vote
0answers
43 views

What does jarsigner verify in the first place (integrity or authenticity)?

I was reading sth about android code signing and have run into this statement: The second jarsigner command at v in Listing 3-7 first verifies the signature block and signing certificate, ...
3
votes
3answers
321 views

Do integrity and authentication always come together?

I cannot come up with a case where there is only one of them. When there is integrity, a random person cannot modify the message without being noticed. That is, an unauthenticated user cannot modify ...
1
vote
1answer
102 views

Does Integrity assures protection from unauthorized read, without any modification?

I'm not quite sure if I understood integrity deep enough. Let's suppose that Alice and Bob are using a public-key algorithm and using signatures to assure their data integrity. A hacker was able to ...
0
votes
2answers
786 views

Can importing an .ics file be dangerous?

Can there theoretically be any possible malicious code hidden in .ics files, which would steal your calendar data or something similar? For an example case, we'd be importing the .ics file into Google ...
1
vote
2answers
160 views

Protecting against planted evidence

This question was motivated by this 2018 article by the Electronic Frontier Foundation that discusses the findings from the Mark Rettenmaier case. For a bit of background on that case, this article ...
1
vote
0answers
118 views

x.509 certificate chain verification in Linux kernel prior to 4.12

I am trying to use certificate chain verification in Linux kernel. The purpose is to use IMA/EVM with public keys that are included in x.509 certificates signed by an own root CA. For this purpose I ...
0
votes
0answers
84 views

How to Use the Carter-Wegman MAC

I have a block of ciphertext, only two hundred characters long, and I want to give it authentication and proof of data integrity. I have decided upon the Carter-Wegman MAC because I like its ...
1
vote
1answer
117 views

How secure is a Mac if it passes Apple Diagnostics?

Recently I brought my MacBook Air to a Genius Bar to perform a clean MacOS installation. For security purposes, I asked for a hardware check as well. The Genius Bar technician ran Apple Diagnostics, ...
1
vote
1answer
212 views

If a site includes the header 'HTTP Content-Security-Policy require-sri-for' then does this include all nested scripts?

If I'm using subresource integrity on a web page and a script that I import then itself imports a further script, will the CSP 'require-sri-for' also include those subsequent, nested, imported scripts?...
0
votes
2answers
74 views

How to keep track of file authenticity while offline

I have an application running the client/server model and offering an online and an offline mode. Each user can read, create or modify text files (even in offline mode) that will be present on his ...
0
votes
1answer
304 views

Ways to verify Data Integrity

I've had looks to existing subjects but it usually gets heavily complicated while I'm new to this kind of stuff and I'd prefer to understand concepts first in order to understand better concrete ...
0
votes
1answer
101 views

How secure is virtualization against breaking out of the box [closed]

How secure are all currently used virtualization technologies (containers - BSD Jail, OpenVZ, Hypervisors - Hyper-V, KVM etc)? I heard about one vulnerability in VMware software, which lets you ...
1
vote
1answer
78 views

How to protect file integrity and history containing counters

I would like to create a solution that would sign the data and will have a increasing counter so I can track the number of signatures. One of the requirement is to have an increasing order of ...
2
votes
2answers
101 views

File integrity assurance

I have the following scenario : Two parties want to exchange files. First party publishes a file on a secure server First party sends to the second, a hash of the file in order to be able to verify ...
7
votes
6answers
4k views

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives. I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider ...
1
vote
2answers
530 views

How reliable is rpm --verify when auditing package integrity and what alternatives are there?

Currently to verify package integrity, the command rpm --verify is run. In reading the rpm manual (http://ftp.rpm.org/max-rpm/s1-rpm-verify-output.html), there is no indication as to the veracity of ...
1
vote
1answer
153 views

Persistent Bootable USB with Write Protection?

I am developing a series of extraction scripts (currently python 2.7) for a university project - these tools will be provided on a bootable USB for use by first responders when encountering a suspect ...
1
vote
1answer
124 views

Why do some websites have their hashes on the same area as the download link? [duplicate]

Some sites allow us to use hashes to make sure that the file we download is what it should be and that it is not tampered with. Some sites may have their hashes on a different domain probably on a ...
1
vote
1answer
270 views

Why “ Simple Integrity Property” axiom of Biba model protects data integrity?

I am reading CISSP and more specifically the Biba model. Biba has some basic properties: The Simple Integrity Property states that a subject cannot read an object at a lower integrity level (no read-...
1
vote
1answer
84 views

Does the file encryption of Microsoft Office guarantee integrity?

I stumbled upon Microsoft Office's feature of file encryption. For storing sensitive data in the cloud, e.g. DropBox, this sounds like a nice feature. Reading that the encryption is AES-128 in CBC ...
1
vote
1answer
506 views

Error detection capability of SHA-256

If we use SHA-256 checksum to detect corruptions to a file, what is its capability in terms of missed errors? For example, reading the page about error correction and detection here, under the ...
1
vote
3answers
278 views

Why is it required to HMAC riv in HDCP 2.3?

In HDCP 2.3 (pdf) during the Session Key Exchange, the HDCP transmitter sends also the 256-bit HMAC of riv (HMAC-SHA256(riv, kd)). Why is it required? Does it prevent any attack?
0
votes
3answers
687 views

Are hashes a reliable method of ensuring a file has not been tampered with?

Suppose I have a file and that I want to confirm that this file is the same as the original (IE: it has not been altered in any way) using hashing. If I were to use a hash function that has no known ...
1
vote
0answers
67 views

Provide email author origin integrity [closed]

If i receive an email, how does my computer verify the author origin integrity using the digital certificates? Does it use any specific protocol for this?
1
vote
1answer
69 views

Ensuring key integrity

I have encrypted AES key stored in the database with the encrypted data. AES key is encrypted with a key derived from the passphrase. I want to ensure the integrity of the stored AES key. Is the ...
1
vote
2answers
155 views

Is it secure to interact with a web page before it has fully loaded?

Web pages are often displayed in the browser before they have finished fully loading (i.e. the loading indicator is still spinning, etc). Usually this is caused by a slow advert or a video, etc. But ...
2
votes
1answer
167 views

How is compiling a program from source more secure?

When downloading compiled binaries for programs it is very important to check GPG signatures, Authenticode, hashes, etc. However, I often see people who say that compiling the code from source is the ...

1
2 3 4 5 6