Questions tagged [integrity]

Integrity is the property of preventing unauthorized modifications of an asset. In other words, integrity protects against the threat of tampering. It is one of the three key security properties of an asset, along with confidentiality and availability.

Filter by
Sorted by
Tagged with
1 vote
1 answer
557 views

What is a trans-cipher?

While discussing archive authenticity/integrity for long term and the problem of potentially re-keying in case of compromise, someone came up with the term "trans-cipher" (or "trans-ciphering"). I ...
1 vote
1 answer
96 views

What if in IPsec I have confidentiality BUT NOT integrity? What are the dangers?

ESP in IPsec v2 only provides integrity of the payload, not of the header. So my question is about that. The possible dangers in not having integrity of header, while having ESP active for payload. ...
1 vote
1 answer
592 views

If a site includes the header 'HTTP Content-Security-Policy require-sri-for' then does this include all nested scripts?

If I'm using subresource integrity on a web page and a script that I import then itself imports a further script, will the CSP 'require-sri-for' also include those subsequent, nested, imported scripts?...
0 votes
1 answer
52 views

How is the authenticity and integrity of the various chips inside laptops and mobile phones ensured by their vendors?

Modern laptops and mobile phone platforms are built around a main, beefy SoC, which generally supports Secure Boot for its firmware and also has a unique hardware identity that is used to attest to a ...
0 votes
0 answers
24 views

Does Node.js's npm provide cryptographic authentication and integrity validation?

Does Node.js's npm package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
1 vote
2 answers
457 views

What config files and logs files of a Linux system (CentOS 7) deserve to be monitored by a SIEM?

I am not a security expert (I am more a software developer) and I am working on a project related to a SIEM installation (Wazuh). This installation is only a demo for a customer, in a second time a ...
2 votes
1 answer
82 views

is it possible to checksum a set of R scripts to ensure code integrity?

This question was inspired to a degree by How secure is R and RStudio? It had a very reasonable answer and looking at the possibilities I thought a small system of R scripts (about 10 scripts) would ...
1 vote
2 answers
546 views

Checking system integrity after clicking scam email link on Linux

Earlier today, my mother opened an email thinking it was from my sister-inlaw, then clicked on the shortened link. The link loaded a page of fairly nonsensical text. The source of the page had no ...
0 votes
0 answers
56 views

Security implication of loading untrusted private keys

The FIPS draft for Dilithium signature scheme (official name ML-DSA) had just been released not long ago. In the specification for skDecode (which is the subroutine that loads the private signing key) ...
14 votes
3 answers
2k views

Does python's pip provide cryptographic authentication and integrity validation?

Does python's pip package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
0 votes
1 answer
123 views

WebAuthn does not guarantee public-key integrity other than trough attestation?

I've been reading about WebAuthn and try to write some code to exercise. One thing I noticed is that the spec doesn't seem to provide any way to verify the correctness of the public-key being create()'...
0 votes
1 answer
93 views

Can Hacker break the integrity of the data in UDP protocol?

Comparing the checksum received in the UDP segment with the checksum calculated in the data helps UDP determine the integrity of the data. Is there a case where the Hacker changes both the ...
5 votes
1 answer
5k views

LUKS2 dm-integrity

I am using Debian 9.5, Linux Kernel 4.16, I would like to use the dm-integrity feature with cryptsetup. cryptsetup luksFormat --type luks2 <device> --cipher aes-gcm-random --integrity aead ...
1 vote
1 answer
222 views

Does flatpak enforce cryptographic authentication and integrity validation by default for all packages? (fedora)

Does the flatpak package manager in Fedora-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get ...
0 votes
0 answers
43 views

Data integrity protection in Drupal 10.x - how lock conditions might fail

I was doing some pentesting on a Drupal 10.x application that some colleagues built; I have not reviewed the source code. The dynamic vulnerability scanner I use provoked some exceptions related to a ...
14 votes
2 answers
9k views

How robust is a VeraCrypt Container against disk errors (bit rot)?

I am planning to encrypt backup data using VeraCrypt. How safe are the generated containers? My worries is not so much the encryption, but potential data loss due to degrading harddisk media (bit rot) ...
7 votes
3 answers
4k views

Open-Source Hardware Security Modules (HSM)

Are there any Open-Source Hardware Security Modules (meeting OSHWA requirements)? I've worked with Utimaco HSMs, but I'm not a big fan of closed-source hardware -- especially when it comes to security ...
24 votes
4 answers
24k views

Verifying android application integrity from server side

I have android applications (Mobile banking) that connect to my server and do online transactions (via Internet/USSD/SMS), I want to make sure those clients are not tampered with and are the original ...
0 votes
0 answers
66 views

Ways to implement data integrity measures on static and non static data

I would like to know is there a need to implement data integrity measure given the scenario? Clients send data/files (may or may not contain public keys) to the server via server side CA cert. The ...
1 vote
0 answers
310 views

Sign vs hash HTTP body request

I use OAuth2 private_key_jwt authentication scheme to authenticate clients. Also, I need to be sure that request body isn't modified. I see two ways: In token which I use to authenticate client I can ...
3 votes
0 answers
436 views

Secure boot + full disk encryption, should I sign the kernel?

I'm redoing my laptop installation from scratch, and this time I want a full secure boot chain. Here's what I did so far : Enroll my own keys in the UEFI firmware Sign my grub bootloader Full disk ...
1 vote
0 answers
69 views

Does Firefox's addon/extension installer provide cryptographic authentication and integrity validation?

Does Firefox's built-in installer for addons/extensions validate its payload's authentication and integrity for all files it downloads before actually installing them? I avoid in-app updates because, ...
1 vote
1 answer
1k views

Is there any danger in refreshing JWT tokens directly without a refresh token?

So I wrote the following logic for my web app: When a user interacts with the website it initiates a Backend call. In the backend every endpoint has multiple middlewares, of which there is a JWT ...
0 votes
1 answer
51 views

validating the authenticity of messages from public client without authentication

Say I have a game, when you finish playing you put your name in and your score is synched with a public scoreboard. Assume also that I own the server and its code. How can I verify that the scores ...
-1 votes
1 answer
65 views

Can I use the CIA triad as a sliding scale wrt complexity?

I am looking for a device to explain the compromises that we make for extra layers of security. For example wrt extra layers: communication like JWT encryption/signing and other sorts of encapsulation ...
0 votes
1 answer
268 views

Is there any security technology/technique beside tpm/secure boot which can verify the integrity of the bios or bootloader?

For any file on your OS you can get a md5 or sha256 value and if you suspect anything you get it again and compare. I was wondering if there is any way to do the same with the bios and bootloader and ...
1 vote
0 answers
249 views

How do in-memory unrandomizers (like in Cheat Engine) work?

Cheat Engine is a rather known memory editing and manipulation tool for Windows. It has this feature to screw up your randomness generation, how does it achieve it? My guess would be that it makes the ...
12 votes
5 answers
3k views

Protect application from being modified

I have a question about how to detect a program/binary modification assuming the program is able to communicate with a remote validation server. More specifically I'm asking for android APK file, but ...
1 vote
1 answer
178 views

How message authentication code (MAC) works?

Let's suppose I'm uploading some website to website example.com, and I'm signing every single file with MAC which is shared by users of my website to verify that me (the admin) uploaded that file. It'...
0 votes
0 answers
428 views

Risk to perform a Penetration Testing in production environment

Let's say I have a web server exposed on Internet that deals with confidential data and it has high requirements in terms of integrity and availability. What are the risks to perform a penetration ...
20 votes
4 answers
5k views

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

Alternatively, the question could be asked: Does issuing a checksum for a file we sign anyways just duplicate work? Use case: Firmware sent to an IoT device. We sign it, and form a separate checksum ...
2 votes
1 answer
213 views

Which is the correct algorithm while checksumming a portion of code?

As part of my research, I came across a technique in a paper which applies checksumming on a portion of code. I want to implement it. Here is the research paper which talks about the checksumming ...
13 votes
7 answers
17k views

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives. I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider ...
1 vote
0 answers
23 views

Can I trust a hash commit for integrity of the entire repository? [duplicate]

Sometimes there's no tar release for some repo in github, and the download as zip button only generates a random zip with random hash. So, in my Dockerfile, I want to clone a repo but be able to check ...
0 votes
1 answer
267 views

How to securely hash sensitive data and make the hash public, while preventing an attack by someone who know the structure or some part of the data?

In a nutshell, I need: to hash a file and to make this hash public, to be able to prove data integrity when sharing the data privately with a trusted third party. to choose the right hashing method ...
0 votes
1 answer
152 views

Is it possible to enumerate thru all the hardware IDs?

I am thinking of developing of a rather primitive CLI program for the sole purpose of detecting rootkits/bootkits/firmware modifying advanced malware. Can you iterate thru all all hardware IDs (CPUID,...
0 votes
1 answer
211 views

Is there a way for a file/binary/exexutable to verify it's own integrity?

So I'm making a distributed recovery system which consists of a bunch of hidden usb sticks. I plan to have the file be an executable, probably in the form of a appimage, which will contain my ...
1 vote
3 answers
189 views

Verifiable alternative to screenshots for web browsers

Screenshots are generally held to be dubious evidence when presented in court because they are susceptible to alteration, especially when it comes to pages rendered in web browsers. You can use the ...
28 votes
2 answers
28k views

Something is changing my hosts file without asking

First: I can't find any information on this phenomenon, not anywhere on the net. I don't know which application does it, but something in my Windows 7 Home Premium system (fully updated & legal) ...
0 votes
2 answers
358 views

I invoked undefined behaviour. Do I need a new computer?

Suppose I'm working on a computer and write a C program which invokes undefined behaviour. Since anything may have occurred, a (perhaps paranoid view) would be that anything the computer does ...
1 vote
2 answers
262 views

Detecting/preventing rollback of encrypted data on a server

I need to store a frequently-changing set of encrypted data in a database. This can be encrypted and decrypted with an internal key. The data is based upon other metrics within the system, mostly the ...
0 votes
1 answer
5k views

Is enabling software flow-offloading in OpenWRT's firewall settings dangerous?

First of all, I did ask this on OpenWrt Forums already, I thought maybe someone here knows this. I noticed that my internet speed gets limited when this feature is not enabled, this feature is also ...
0 votes
0 answers
117 views

double hashing for code signing and verification

I have environmental constraints where the cyber and safety functions are segregated such that safety operations are handled by one unit and cyber operations such as firewall, HIDS, secure storage etc....
1 vote
1 answer
197 views

Does rust's Cargo provide cryptographic authentication and integrity validation?

Does rust's cargo package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
0 votes
1 answer
872 views

KeepassXC gpg verification with sig file

I downloaded the KeepassXC .AppImage file and was verifying it using first the .DIGEST file and then .sig file. While I was verifying the download using the .sig file I noticed something strange as I ...
-1 votes
1 answer
180 views

Consider a Fraudulent bank website, would it violate all the aspects of the CIA triad or any one? [closed]

I believe it would violate all the three aspects due to following reasons: Confidentiality: Since the website is obviously a scam, in case any person/user registers it, the data of the user would not ...
65 votes
4 answers
19k views

Why aren't application downloads routinely done over HTTPS?

We all know we should be using SSL whenever we collect passwords or other sensitive information. SSL provides two main benefits: Encryption: The data can't be read by a middle-man while in transit. ...
0 votes
1 answer
622 views

How hard is to reverse engineer a signature for a given message?

Given the following situation: User makes a request for temporary access to a video Backend responds with a json file containing timeAllowedInSeconds: 5 Backend also responds with the signature of ...
0 votes
2 answers
259 views

Why aren't installer isos gpg signed?

When downloading a Linux installer iso, the user is supposed to check the iso with sha or m5sum and compare the result against a checksum file, and then check the gpg signature of the checksum file. ...
2 votes
1 answer
522 views

Does gpg (or openpgp in general) authenticate symmetrically-encrypted data?

When using gpg --symmetric to encrypt a file/message with a passphrase, is there any cryptographic integrity check to prevent an attacker from modifying the ciphertext? E.g. does gpg (or any other ...

1
2 3 4 5
7