Questions tagged [integrity]

Integrity is the property of preventing unauthorized modifications of an asset. In other words, integrity protects against the threat of tampering. It is one of the three key security properties of an asset, along with confidentiality and availability.

Filter by
Sorted by
Tagged with
0 votes
1 answer
431 views

If a site includes the header 'HTTP Content-Security-Policy require-sri-for' then does this include all nested scripts?

If I'm using subresource integrity on a web page and a script that I import then itself imports a further script, will the CSP 'require-sri-for' also include those subsequent, nested, imported scripts?...
3 votes
3 answers
894 views

Open-Source Hardware Security Modules (HSM)

Are there any Open-Source Hardware Security Modules (meeting OSHWA requirements)? I've worked with Utimaco HSMs, but I'm not a big fan of closed-source hardware -- especially when it comes to security ...
1 vote
1 answer
388 views

What is a trans-cipher?

While discussing archive authenticity/integrity for long term and the problem of potentially re-keying in case of compromise, someone came up with the term "trans-cipher" (or "trans-ciphering"). I ...
11 votes
5 answers
3k views

Protect application from being modified

I have a question about how to detect a program/binary modification assuming the program is able to communicate with a remote validation server. More specifically I'm asking for android APK file, but ...
1 vote
1 answer
71 views

How message authentication code (MAC) works?

Let's suppose I'm uploading some website to website example.com, and I'm signing every single file with MAC which is shared by users of my website to verify that me (the admin) uploaded that file. It'...
0 votes
0 answers
40 views

Risk to perform a Penetration Testing in production environment

Let's say I have a web server exposed on Internet that deals with confidential data and it has high requirements in terms of integrity and availability. What are the risks to perform a penetration ...
17 votes
4 answers
3k views

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

Alternatively, the question could be asked: Does issuing a checksum for a file we sign anyways just duplicate work? Use case: Firmware sent to an IoT device. We sign it, and form a separate checksum ...
2 votes
1 answer
192 views

Which is the correct algorithm while checksumming a portion of code?

As part of my research, I came across a technique in a paper which applies checksumming on a portion of code. I want to implement it. Here is the research paper which talks about the checksumming ...
0 votes
0 answers
27 views

Can I use the CIA triad as a sliding scale wrt complexity?

I am looking for a device to explain the compromises that we make for extra layers of security. For example wrt extra layers: communication like JWT encryption/signing and other sorts of encapsulation ...
9 votes
7 answers
10k views

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives. I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider ...
1 vote
0 answers
20 views

Can I trust a hash commit for integrity of the entire repository? [duplicate]

Sometimes there's no tar release for some repo in github, and the download as zip button only generates a random zip with random hash. So, in my Dockerfile, I want to clone a repo but be able to check ...
0 votes
1 answer
82 views

How to securely hash sensitive data and make the hash public, while preventing an attack by someone who know the structure or some part of the data?

In a nutshell, I need: to hash a file and to make this hash public, to be able to prove data integrity when sharing the data privately with a trusted third party. to choose the right hashing method ...
0 votes
1 answer
267 views

Checking system integrity after clicking scam email link on Linux

Earlier today, my mother opened an email thinking it was from my sister-inlaw, then clicked on the shortened link. The link loaded a page of fairly nonsensical text. The source of the page had no ...
0 votes
1 answer
86 views

Is it possible to enumerate thru all the hardware IDs?

I am thinking of developing of a rather primitive CLI program for the sole purpose of detecting rootkits/bootkits/firmware modifying advanced malware. Can you iterate thru all all hardware IDs (CPUID,...
0 votes
1 answer
45 views

Is there a way for a file/binary/exexutable to verify it's own integrity?

So I'm making a distributed recovery system which consists of a bunch of hidden usb sticks. I plan to have the file be an executable, probably in the form of a appimage, which will contain my ...
0 votes
0 answers
66 views

When using gpg2 to verify Qubes, the pub is different

I'm trying to verify the fingerprint of the Qubes Master signing Key (QMSK) however, I've run into some inconsistent output. For example: Qubes Os website & web of trust shows after executing the ...
1 vote
3 answers
153 views

Verifiable alternative to screenshots for web browsers

Screenshots are generally held to be dubious evidence when presented in court because they are susceptible to alteration, especially when it comes to pages rendered in web browsers. You can use the ...
29 votes
2 answers
25k views

Something is changing my hosts file without asking

First: I can't find any information on this phenomenon, not anywhere on the net. I don't know which application does it, but something in my Windows 7 Home Premium system (fully updated & legal) ...
0 votes
2 answers
170 views

I invoked undefined behaviour. Do I need a new computer?

Suppose I'm working on a computer and write a C program which invokes undefined behaviour. Since anything may have occurred, a (perhaps paranoid view) would be that anything the computer does ...
1 vote
2 answers
203 views

Detecting/preventing rollback of encrypted data on a server

I need to store a frequently-changing set of encrypted data in a database. This can be encrypted and decrypted with an internal key. The data is based upon other metrics within the system, mostly the ...
1 vote
0 answers
44 views

Does flatpak enforce cryptographic authentication and integrity validation by default for all packages? (fedora)

Does the flatpak package manager in Fedora-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get ...
0 votes
1 answer
1k views

Is enabling software flow-offloading in OpenWRT's firewall settings dangerous?

First of all, I did ask this on OpenWrt Forums already, I thought maybe someone here knows this. I noticed that my internet speed gets limited when this feature is not enabled, this feature is also ...
0 votes
0 answers
64 views

double hashing for code signing and verification

I have environmental constraints where the cyber and safety functions are segregated such that safety operations are handled by one unit and cyber operations such as firewall, HIDS, secure storage etc....
1 vote
1 answer
110 views

Does rust's Cargo provide cryptographic authentication and integrity validation?

Does rust's cargo package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
1 vote
1 answer
222 views

What config files and logs files of a Linux system (CentOS 7) deserve to be monitored by a SIEM?

I am not a security expert (I am more a software developer) and I am working on a project related to a SIEM installation (Wazuh). This installation is only a demo for a customer, in a second time a ...
0 votes
1 answer
674 views

KeepassXC gpg verification with sig file

I downloaded the KeepassXC .AppImage file and was verifying it using first the .DIGEST file and then .sig file. While I was verifying the download using the .sig file I noticed something strange as I ...
-1 votes
1 answer
100 views

Consider a Fraudulent bank website, would it violate all the aspects of the CIA triad or any one? [closed]

I believe it would violate all the three aspects due to following reasons: Confidentiality: Since the website is obviously a scam, in case any person/user registers it, the data of the user would not ...
63 votes
4 answers
18k views

Why aren't application downloads routinely done over HTTPS?

We all know we should be using SSL whenever we collect passwords or other sensitive information. SSL provides two main benefits: Encryption: The data can't be read by a middle-man while in transit. ...
0 votes
1 answer
248 views

How hard is to reverse engineer a signature for a given message?

Given the following situation: User makes a request for temporary access to a video Backend responds with a json file containing timeAllowedInSeconds: 5 Backend also responds with the signature of ...
0 votes
2 answers
177 views

Why aren't installer isos gpg signed?

When downloading a Linux installer iso, the user is supposed to check the iso with sha or m5sum and compare the result against a checksum file, and then check the gpg signature of the checksum file. ...
2 votes
1 answer
198 views

Does gpg (or openpgp in general) authenticate symmetrically-encrypted data?

When using gpg --symmetric to encrypt a file/message with a passphrase, is there any cryptographic integrity check to prevent an attacker from modifying the ciphertext? E.g. does gpg (or any other ...
0 votes
1 answer
102 views

Does pacman enforce cryptographic authentication and integrity validation by default for all packages? (arch linux)

Does the built-in pacman package manager in Arch-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get ...
0 votes
0 answers
75 views

Does dnf enforce cryptographic authentication and integrity validation by default for all packages? (fedora linux)

Does the built-in dnf package manager in Fedora-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get ...
2 votes
1 answer
202 views

How does validating the PGP signature of a downloaded executable against the publisher's public key show that the binary has not been tampered with?

Websites that host downloadable executables often provide measures to confirm the integrity of the data that is available to download. Such measures include: Hosting the website under HTTPS; ...
1 vote
1 answer
103 views

E2E-Encrypted Storage: How to detect that data has been rolled back?

I am aware that it is possible to use a block cipher with the GCM-mode to provide authenticity, but this does not completely do what I need. I have a cloud storage provider I do not completely trust, ...
1 vote
2 answers
129 views

Can a meltdown attack also violate data integrity of other processes or is it just violating data secrecy?

Can a meltdown attack also violate data integrity of other processes by obtaining different passwords or is it just violating data secrecy by reading data it is unauthorized to do?
0 votes
0 answers
109 views

Cloud storage data integrity without trusting the server

Assuming I am using a cloud storage provider like Google Drive, how do I know that data hasn't been lost, deleted, modified or created by the service provider? I think the answer is that it is not ...
1 vote
3 answers
863 views

Sample attack scenarios on file downloads over HTTP

The websites that serve files over https, can it be considered overkill? or is it a best practice everyone has to follow? The downside to serving files over HTTPS is that you will lose the caching as ...
0 votes
3 answers
3k views

Can importing an .ics file be dangerous?

Can there theoretically be any possible malicious code hidden in .ics files, which would steal your calendar data or something similar? For an example case, we'd be importing the .ics file into Google ...
0 votes
1 answer
131 views

Is using full TLS suite in all communication scenarios a defacto standard?

Its usually recommended that 'don't use your own system of Crypto' rather use standard SSL/TLS! I understand that SSL/TLS is a complete protocol suite that addresses all three elements of CIA triad. ...
0 votes
1 answer
102 views

How to ensure integrity of program execution on foreign(someone else's) computer?

I want to run my computer program(or code) on someone else's computer(with permission from the owner of the computer) and get the results back. How can I make sure the owner is running my program only,...
1 vote
0 answers
80 views

Does snapd enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)

Does the snapd package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get packages ...
16 votes
2 answers
4k views

Does LUKS protect the filesystem integrity?

I have read in: http://css.csail.mit.edu/6.858/2013/readings/bitlocker.pdf that Bitlocker does not provide data integrity since it takes more space in the disk. The PDF says also that drive ...
2 votes
1 answer
303 views

Authenticate-then-Encrypt: does the authenticity provide a benefit?

First off: I know that encrypt-then-authenticate is better, however I want to understand the following for authenticate-then-encrypt. The underlying cipher is AES-CTR or AES-CBC for this consideration....
0 votes
3 answers
197 views

How to verify integrity of software when the download provider doesn't publish hashes?

I noticed that certain software does not provide hash anymore nowadays. E.g. Zoom https://zoom.us/download wolf@linux:~$ ls -lh zoom_amd64.deb -rw-rw-r-- 1 wolf wolf 44M Jan 1 00:00 zoom_amd64....
0 votes
0 answers
25 views

Does TLS provide data integrity? [duplicate]

I've looked around on this site and I've not seen a clear answer on this question. From what I've read TLS does not provide data integrity unless specific ciphers are used which use HMAC'ing as part ...
0 votes
0 answers
86 views

Does yarn (Node.js package manager) provide cryptographic authentication and integrity validation?

Does the yarn package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides providing ...
11 votes
3 answers
1k views

Does python's pip provide cryptographic authentication and integrity validation?

Does python's pip package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
1 vote
2 answers
413 views

How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change?

To help ensure authenticity of packages some projects on GitHub and on GitLab add hashsums to the descriptions of the release on the Releases page. Sometimes, at least here, the hashsum are made part ...
2 votes
1 answer
167 views

Why there is nothing that automatically checks signatures of files downloaded in browsers? [duplicate]

When downloading files (mainly software/installers) from pages in browsers, sometimes it comes also with a cryptographic hash or a signature to verify the authenticity of a file against data ...

1
2 3 4 5 6