70 votes
Accepted

How to verify the checksum of a downloaded file (pgp, sha, etc.)?

Usually this would start on the owners side displaying the checksum for the file that you wish to download. Which would look something like the following: md5: ba411cafee2f0f702572369da0b765e2 ...
Connor J's user avatar
  • 1,544
46 votes
Accepted

Download an OS image via torrent

file piece ("chunk") hashing is actually an essential, core feature of BitTorrent (the downloaded pieces are immediately and automatically verified), and a part of the BT protocol - the .torrent file ...
Piskvor left the building's user avatar
40 votes
Accepted

How does subresource integrity actually help?

Subresource integrity is not about protecting your own code of the web application against modification. What SRI is intended to do can be seen from the description of the goals: Compromise of a ...
Steffen Ullrich's user avatar
35 votes
Accepted

Why is it impossible to verify whether a file has been modified since creation?

I think you will want more of a philosophical answer than a technical one, given what you are rejecting. A file is just a discrete collection of bits. Relevance and meaning are overlaid onto those ...
schroeder's user avatar
  • 129k
34 votes
Accepted

Verifying android application integrity from server side

Update: For 2024, Google has replaced the SafetyNet API with the Play Integrity API. They are conceptually very similar, so the following still largely applies, although the details may differ with ...
josh3736's user avatar
  • 2,555
32 votes
Accepted

Is unauthorised deletion an integrity or availability issue?

As pointed out in this (unanswered) question, Availability in CVSSv3 is about how well the web service performs, not whether its data is available: While the Confidentiality and Integrity impact ...
Rhymoid's user avatar
  • 435
24 votes

Verifying android application integrity from server side

The only thing the server can reliably determine about a device is it's behaviour towards the server (the data received, and in what time patterns). Assuming an attacker has knowledge and control of ...
marstato's user avatar
  • 2,315
24 votes
Accepted

Why would a website serve different versions of a file over HTTP and HTTPS?

The simple answer is: because it wants to! The web server can serve whatever it likes, either by configuration or coincidence. Right now, I get the same 75916c7b file over both HTTP and HTTPS and ...
Sander's user avatar
  • 352
23 votes

How does subresource integrity actually help?

Let's say you have a site built around jQuery. You don't download jQuery and use your copy, but you use a version from a CDN, making use of the caching on client's browsers. That works because if one ...
ThoriumBR's user avatar
  • 53.9k
21 votes

Why is it impossible to verify whether a file has been modified since creation?

Imagine you're on a desert island and I hand you a print out of the US constitution, claiming that it is an exact copy (no words changed). With nothing to compare it against, you have no way to verify ...
Mike Ounsworth's user avatar
21 votes
Accepted

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

I would say that you are completely correct, but also not correct at the same time. From the IoT device's point of view, I agree that checking the signature does everything the checksum does, and more....
Mike Ounsworth's user avatar
18 votes

Where does authenticity fit into the CIA Triad?

I support David's view that if you had to fit your scenario into one of the CIA categories, integrity would be the appropriate one because you're creating an unintended state thus violating integrity. ...
Arminius's user avatar
  • 44.7k
17 votes
Accepted

Where does authenticity fit into the CIA Triad?

That would still be covered in integrity: creating or deleting data is still a violation of integrity. (This can be seen as a mutation on the overall data set.)
David's user avatar
  • 16.1k
17 votes

How to verify the checksum of a downloaded file (pgp, sha, etc.)?

Checksums vs Hashes vs Signatures You mention checksums, PGP, and SHA in your question title, but these are all different things. What is a checksum? A checksum simply verifies with a high degree ...
AndrolGenhald's user avatar
16 votes
Accepted

How robust is a VeraCrypt Container against disk errors (bit rot)?

Will the created containers still be bitwise comparable? No. Veracrypt stores different containers with different encryption keys, even if you use the same password. So the containers won't be ...
Lie Ryan's user avatar
  • 31.4k
15 votes

Does LUKS protect the filesystem integrity?

LUKS formatted with --integrity <algorithm> option will provide integrity protection for the encrypted volume. For that to work, --type luks2 must be used when formatting the device (opening of ...
Hubert Kario's user avatar
  • 3,798
15 votes
Accepted

Detection for corruption in HTTP and FTP

How is data downloaded from HTTP or FTP get checked for corruption? By itself, not at all. HTTP and FTP as protocols don't offer integrity¹. However, HTTP and FTP are usually used atop of TCP/IP, ...
Marcus Müller's user avatar
14 votes

Why would a website serve different versions of a file over HTTP and HTTPS?

Author of above referenced files here. The checksum of said files at the current state of things is normal to change when the build scripts are modified and a new build automatically triggered and ...
vsz's user avatar
  • 186
14 votes

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

There seems to be some confusion about the capabilities of a collision attack. Two of the properties a cryptographic hash must have are collision resistance and preimage resistance. If a hash is ...
AndrolGenhald's user avatar
13 votes

Something is changing my hosts file without asking

I faced similar problems. I solved it by following these steps Right click on hosts file go to properties. Go to the Security tab. Under Groups and users go to the System and edit permissions. Deny ...
Seo Gregory's user avatar
13 votes
Accepted

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider the file content as random input (no attacks) Based on your note of "no attacks" it seems to me ...
hft's user avatar
  • 5,021
12 votes

Is unauthorised deletion an integrity or availability issue?

I would say it presents a clear Availability issue as the attacker is able to completely remove that specific resource and prevent other users' ability to access. I would also say there is an ...
iainpb's user avatar
  • 4,172
12 votes
Accepted

Authentication as CIA triad

CIA are the aspects of a system that information security strives to protect. Authentication and authorization (important and distinct concepts) are security controls that are used to protect the ...
David's user avatar
  • 16.1k
11 votes

What security operations provide confidentiality, integrity and authentication?

Your question is difficult to answer because security is a property of a system, not a property of a single technology or algorithm. Confidentiality It can be assured using encryption, but that's ...
Out of Band's user avatar
  • 9,293
11 votes
Accepted

Is using desktop 2FA clients like Authy Desktop a good practice?

You made an assumption that affects your outcome, and you cannot forget that you are making this assumption: that one "likely" gets your password via the desktop computer (i.e. keylogger). If that is ...
schroeder's user avatar
  • 129k
9 votes
Accepted

How should I verify a backup has not been tampered with?

Cryptographic hash lists From a theoretical standpoint, verifying the integrity of data that will be put on an untrusted medium (such as a remote backup server or an unattended storage device) ...
forest's user avatar
  • 66.6k
9 votes

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

It's not uncommon to have both. For example, developers of the Tails operating system sign their ISO's using GPG. See https://tails.boum.org/install/expert/index.en.html#verify for more info. But, ...
mti2935's user avatar
  • 23.1k
8 votes

authenticity, confidentiality & integrity - general questions

The difference between authenticity and integrity is this: Suppose party A and B are talking to each other. Authenticity would mean that messages received by A are actually sent by B. Integrity ...
Limit's user avatar
  • 3,266
8 votes
Accepted

Can I trust a ubuntu repo mirror in a less 'free' country?

Take a look at man apt-secure, apt has done signature checks on release files for well over a decade. The release file contains a hash of all files in the package, and the release file gets signed by ...
AndrolGenhald's user avatar
8 votes

LUKS2 dm-integrity

The dm-integrity authenticated encryption support for block devices is part of the Linux kernel since version 4.12. If it's enabled in your kernel then it should be automatically loaded, when needed. ...
maxschlepzig's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible