61 votes
Accepted

How to verify the checksum of a downloaded file (pgp, sha, etc.)?

Usually this would start on the owners side displaying the checksum for the file that you wish to download. Which would look something like the following: md5: ba411cafee2f0f702572369da0b765e2 ...
user avatar
  • 1,444
46 votes
Accepted

Download an OS image via torrent

file piece ("chunk") hashing is actually an essential, core feature of BitTorrent (the downloaded pieces are immediately and automatically verified), and a part of the BT protocol - the .torrent file ...
user avatar
41 votes
Accepted

How can I ensure my dll has not been modified?

For Windows binaries, I would suggest to digitally sign the file. Where you use certificates, almost the same technology of HTTPS. Introduction to Code Signing SignTool Then you should use Windows ...
user avatar
40 votes
Accepted

How does subresource integrity actually help?

Subresource integrity is not about protecting your own code of the web application against modification. What SRI is intended to do can be seen from the description of the goals: Compromise of a ...
user avatar
36 votes
Accepted

JSON Web Tokens - How to securely store the key?

The reality is if other processes can access your process memory or features of your virtual machine, the game is probably over as you're already compromised. If a process has access at this level, it ...
user avatar
  • 3,242
35 votes
Accepted

Why is it impossible to verify whether a file has been modified since creation?

I think you will want more of a philosophical answer than a technical one, given what you are rejecting. A file is just a discrete collection of bits. Relevance and meaning are overlaid onto those ...
user avatar
  • 123k
34 votes
Accepted

Verifying android application integrity from server side

Use Android SafetyNet. This is how Android Pay validates itself. The basic flow is: Your server generates a nonce that it sends to the client app. The app sends a verification request with the ...
user avatar
  • 2,185
32 votes
Accepted

Is unauthorised deletion an integrity or availability issue?

As pointed out in this (unanswered) question, Availability in CVSSv3 is about how well the web service performs, not whether its data is available: While the Confidentiality and Integrity impact ...
user avatar
  • 435
30 votes

How can I ensure my dll has not been modified?

With the low level of protection the MAC address offers, I wouldn't bother. It is less effort to change the MAC address than it is to exchange your DLL.
user avatar
29 votes
Accepted

Difference between authentication, integrity and data origin authentication

Integrity is about making sure that some piece of data has not been altered from some "reference version". Authenticity is a special case of integrity, where the "reference version" is defined as "...
user avatar
24 votes
Accepted

Why would a website serve different versions of a file over HTTP and HTTPS?

The simple answer is: because it wants to! The web server can serve whatever it likes, either by configuration or coincidence. Right now, I get the same 75916c7b file over both HTTP and HTTPS and ...
user avatar
  • 352
23 votes

Verifying android application integrity from server side

The only thing the server can reliably determine about a device is it's behaviour towards the server (the data received, and in what time patterns). Assuming an attacker has knowledge and control of ...
user avatar
  • 2,237
23 votes

How does subresource integrity actually help?

Let's say you have a site built around jQuery. You don't download jQuery and use your copy, but you use a version from a CDN, making use of the caching on client's browsers. That works because if one ...
user avatar
  • 50.5k
21 votes

Why is it impossible to verify whether a file has been modified since creation?

Imagine you're on a desert island and I hand you a print out of the US constitution, claiming that it is an exact copy (no words changed). With nothing to compare it against, you have no way to verify ...
user avatar
20 votes
Accepted

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

I would say that you are completely correct, but also not correct at the same time. From the IoT device's point of view, I agree that checking the signature does everything the checksum does, and more....
user avatar
18 votes

Where does authenticity fit into the CIA Triad?

I support David's view that if you had to fit your scenario into one of the CIA categories, integrity would be the appropriate one because you're creating an unintended state thus violating integrity. ...
user avatar
  • 43.8k
17 votes
Accepted

Where does authenticity fit into the CIA Triad?

That would still be covered in integrity: creating or deleting data is still a violation of integrity. (This can be seen as a mutation on the overall data set.)
user avatar
  • 15.8k
16 votes

How can I ensure my dll has not been modified?

Hashes do not change between file systems. Check the SHA1 hash of the file against the known "good" value in your code and you should be away!
user avatar
  • 1,168
16 votes
Accepted

How robust is a VeraCrypt Container against disk errors (bit rot)?

Will the created containers still be bitwise comparable? No. Veracrypt stores different containers with different encryption keys, even if you use the same password. So the containers won't be ...
user avatar
  • 31.1k
15 votes

Does LUKS protect the filesystem integrity?

LUKS formatted with --integrity <algorithm> option will provide integrity protection for the encrypted volume. For that to work, --type luks2 must be used when formatting the device (opening of ...
user avatar
  • 3,718
15 votes
Accepted

Detection for corruption in HTTP and FTP

How is data downloaded from HTTP or FTP get checked for corruption? By itself, not at all. HTTP and FTP as protocols don't offer integrity¹. However, HTTP and FTP are usually used atop of TCP/IP, ...
user avatar
15 votes

How to verify the checksum of a downloaded file (pgp, sha, etc.)?

Checksums vs Hashes vs Signatures You mention checksums, PGP, and SHA in your question title, but these are all different things. What is a checksum? A checksum simply verifies with a high degree ...
user avatar
14 votes

Why would a website serve different versions of a file over HTTP and HTTPS?

Author of above referenced files here. The checksum of said files at the current state of things is normal to change when the build scripts are modified and a new build automatically triggered and ...
user avatar
  • 186
14 votes

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

There seems to be some confusion about the capabilities of a collision attack. Two of the properties a cryptographic hash must have are collision resistance and preimage resistance. If a hash is ...
user avatar
12 votes

Something is changing my hosts file without asking

I faced similar problems. I solved it by following these steps Right click on hosts file go to properties. Go to the Security tab. Under Groups and users go to the System and edit permissions. Deny ...
user avatar
12 votes
Accepted

Why would a replay attack be considered a threat to integrity and not confidentiality?

A replay attack is an attack where you record a legitimate transaction and then replay it at a later date. It is not an attack on confidentiality because the attacker isn't learning any new ...
user avatar
  • 18.5k
12 votes

Is unauthorised deletion an integrity or availability issue?

I would say it presents a clear Availability issue as the attacker is able to completely remove that specific resource and prevent other users' ability to access. I would also say there is an ...
user avatar
  • 4,132
11 votes

What security operations provide confidentiality, integrity and authentication?

Your question is difficult to answer because security is a property of a system, not a property of a single technology or algorithm. Confidentiality It can be assured using encryption, but that's ...
user avatar
  • 9,135
11 votes
Accepted

Authentication as CIA triad

CIA are the aspects of a system that information security strives to protect. Authentication and authorization (important and distinct concepts) are security controls that are used to protect the ...
user avatar
  • 15.8k
11 votes
Accepted

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider the file content as random input (no attacks) Based on your note of "no attacks" it seems to me ...
user avatar
  • 4,895

Only top scored, non community-wiki answers of a minimum length are eligible