Skip to main content
The 2024 Developer Survey results are live! See the results
73 votes
Accepted

How to verify the checksum of a downloaded file (pgp, sha, etc.)?

Usually this would start on the owners side displaying the checksum for the file that you wish to download. Which would look something like the following: md5: ba411cafee2f0f702572369da0b765e2 ...
Connor J's user avatar
  • 1,574
40 votes
Accepted

How does subresource integrity actually help?

Subresource integrity is not about protecting your own code of the web application against modification. What SRI is intended to do can be seen from the description of the goals: Compromise of a ...
Steffen Ullrich's user avatar
35 votes
Accepted

Why is it impossible to verify whether a file has been modified since creation?

I think you will want more of a philosophical answer than a technical one, given what you are rejecting. A file is just a discrete collection of bits. Relevance and meaning are overlaid onto those ...
schroeder's user avatar
  • 131k
32 votes
Accepted

Is unauthorised deletion an integrity or availability issue?

As pointed out in this (unanswered) question, Availability in CVSSv3 is about how well the web service performs, not whether its data is available: While the Confidentiality and Integrity impact ...
Rhymoid's user avatar
  • 435
32 votes

How to receive large files guaranteeing authenticity, integrity and sending time

If it's actually important that you can provide legal evidence, then you should discuss this with a (specialized) lawyer. While we can come up with all kinds of technical approaches, that doesn't mean ...
Ja1024's user avatar
  • 12.7k
25 votes

How to receive large files guaranteeing authenticity, integrity and sending time

The more complicated you make it technically, even if perfectly correct and tamper-proof, the more you have the problem that a judge will need to listen to one sides "technical expert" and ...
nvoigt's user avatar
  • 1,913
23 votes

How does subresource integrity actually help?

Let's say you have a site built around jQuery. You don't download jQuery and use your copy, but you use a version from a CDN, making use of the caching on client's browsers. That works because if one ...
ThoriumBR's user avatar
  • 54.6k
21 votes

Why is it impossible to verify whether a file has been modified since creation?

Imagine you're on a desert island and I hand you a print out of the US constitution, claiming that it is an exact copy (no words changed). With nothing to compare it against, you have no way to verify ...
Mike Ounsworth's user avatar
21 votes
Accepted

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

I would say that you are completely correct, but also not correct at the same time. From the IoT device's point of view, I agree that checking the signature does everything the checksum does, and more....
Mike Ounsworth's user avatar
18 votes

Where does authenticity fit into the CIA Triad?

I support David's view that if you had to fit your scenario into one of the CIA categories, integrity would be the appropriate one because you're creating an unintended state thus violating integrity. ...
Arminius's user avatar
  • 45k
17 votes
Accepted

Where does authenticity fit into the CIA Triad?

That would still be covered in integrity: creating or deleting data is still a violation of integrity. (This can be seen as a mutation on the overall data set.)
David's user avatar
  • 16.1k
17 votes

How to verify the checksum of a downloaded file (pgp, sha, etc.)?

Checksums vs Hashes vs Signatures You mention checksums, PGP, and SHA in your question title, but these are all different things. What is a checksum? A checksum simply verifies with a high degree ...
AndrolGenhald's user avatar
16 votes
Accepted

How robust is a VeraCrypt Container against disk errors (bit rot)?

Will the created containers still be bitwise comparable? No. Veracrypt stores different containers with different encryption keys, even if you use the same password. So the containers won't be ...
Lie Ryan's user avatar
  • 31.5k
15 votes

Does LUKS protect the filesystem integrity?

LUKS formatted with --integrity <algorithm> option will provide integrity protection for the encrypted volume. For that to work, --type luks2 must be used when formatting the device (opening of ...
Hubert Kario's user avatar
  • 3,808
15 votes
Accepted

Detection for corruption in HTTP and FTP

How is data downloaded from HTTP or FTP get checked for corruption? By itself, not at all. HTTP and FTP as protocols don't offer integrity¹. However, HTTP and FTP are usually used atop of TCP/IP, ...
Marcus Müller's user avatar
14 votes

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

There seems to be some confusion about the capabilities of a collision attack. Two of the properties a cryptographic hash must have are collision resistance and preimage resistance. If a hash is ...
AndrolGenhald's user avatar
13 votes
Accepted

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider the file content as random input (no attacks) Based on your note of "no attacks" it seems to me ...
hft's user avatar
  • 5,036
12 votes

Is unauthorised deletion an integrity or availability issue?

I would say it presents a clear Availability issue as the attacker is able to completely remove that specific resource and prevent other users' ability to access. I would also say there is an ...
iainpb's user avatar
  • 4,172
12 votes
Accepted

Authentication as CIA triad

CIA are the aspects of a system that information security strives to protect. Authentication and authorization (important and distinct concepts) are security controls that are used to protect the ...
David's user avatar
  • 16.1k
11 votes
Accepted

Is using desktop 2FA clients like Authy Desktop a good practice?

You made an assumption that affects your outcome, and you cannot forget that you are making this assumption: that one "likely" gets your password via the desktop computer (i.e. keylogger). If that is ...
schroeder's user avatar
  • 131k
10 votes

What security operations provide confidentiality, integrity and authentication?

Your question is difficult to answer because security is a property of a system, not a property of a single technology or algorithm. Confidentiality It can be assured using encryption, but that's ...
Out of Band's user avatar
  • 9,283
9 votes
Accepted

How should I verify a backup has not been tampered with?

Cryptographic hash lists From a theoretical standpoint, verifying the integrity of data that will be put on an untrusted medium (such as a remote backup server or an unattended storage device) ...
forest's user avatar
  • 67k
9 votes

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

It's not uncommon to have both. For example, developers of the Tails operating system sign their ISO's using GPG. See https://tails.boum.org/install/expert/index.en.html#verify for more info. But, ...
mti2935's user avatar
  • 23.7k
8 votes

authenticity, confidentiality & integrity - general questions

The difference between authenticity and integrity is this: Suppose party A and B are talking to each other. Authenticity would mean that messages received by A are actually sent by B. Integrity ...
Limit's user avatar
  • 3,276
8 votes
Accepted

Can I trust a ubuntu repo mirror in a less 'free' country?

Take a look at man apt-secure, apt has done signature checks on release files for well over a decade. The release file contains a hash of all files in the package, and the release file gets signed by ...
AndrolGenhald's user avatar
8 votes

LUKS2 dm-integrity

The dm-integrity authenticated encryption support for block devices is part of the Linux kernel since version 4.12. If it's enabled in your kernel then it should be automatically loaded, when needed. ...
maxschlepzig's user avatar
8 votes
Accepted

How is compiling a program from source more secure?

It's harder to hide a backdoor in source code than in a binary. Someone could easily add a bunch of code before compiling a binary, but leave the extra code unpublished. If you build it yourself, then ...
Ben's user avatar
  • 4,032
7 votes

Does python's pip provide cryptographic authentication and integrity validation?

The short answer is: pip always uses TLS, which is actually fairly useful here. It means that as long as no-one's managed to compromise PyPI itself or steal the site certificate, then you can be ...
Nathaniel J. Smith's user avatar
7 votes

How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change?

GitHub dynamically generates a tar.gz file when a user downloads a source release for a git tag. The hashes for those files are not stable, as they are dependent on the versions of git, tar, and gzip ...
maccam94's user avatar
  • 171
6 votes

Detection for corruption in HTTP and FTP

HTTP and FTP almost always use TCP as the underlying transport layer, so TCP's protections apply there as well. These, however, are only concerned with network-level accidental corruption issues. As ...
Xiong Chiamiov's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible