Reviewing how applications use cryptography
You find common crypto mistakes in application code such as ECB mode, IV reuse, hard-coded keys and weak randomness, and fix and verify them with authenticated encryption, high-level libraries, correct password storage and a key management service.
Level 401 · 16 lessons · 15 practice labs
Lessons
Common mistakes
- A cryptography review: what to look at
- ECB mode: encryption that gives the pattern away
- Detecting IV and nonce reuse
- Keys hard-coded in source
- Weak randomness: time-based seeds
- Short task: find the crypto mistakes in five code snippets
Sound constructions
- Authenticated encryption: AES-GCM and ChaCha20-Poly1305
- High-level libraries: libsodium and similar
- Auditing password storage in code: Argon2 and bcrypt settings
- Auditing JWT signature and algorithm settings
- Constant-time comparison
- Short task: fix faulty encryption code with authenticated encryption
Key management and reporting
- Key management services and envelope encryption
- Scanning crypto usage with static analysis
- Explaining crypto findings to developers
- Capstone: review a sample application’s cryptography and verify the fixes
Practice labs
- Detect ECB encryption that leaks patterns: Find repeating blocks in the lab app's encrypted records, confirm ECB mode in the code and write it up as a finding.
- Detect IV and nonce reuse: Count repeated IV values in the lab database's encrypted fields, find the line of code producing a fixed IV and add it to the report.
- Fix the repeated nonce issue and re-encrypt the data: Fix the code to generate a new nonce per record, re-encrypt the existing records and verify by counting that no repeats remain.
- Find an encryption key hard-coded in source: Find keys written as constants in the lab app's source code and list their locations and the data they affect.
- Detect tokens generated from a time-based seed: Prove the lab app's reset tokens are seeded from the clock, switch to a secure random source and test again.
- Remove the embedded key from code and renew the key: Move the embedded key in Narçiçeği Eczaneleri's lab app into environment configuration, renew the key and convert data encrypted with the old one.
- Find the cryptography mistakes in five code snippets: Review five short code snippets in the lab, name the mistake in each and suggest the correct construct in one sentence.
- Fix faulty encryption code with authenticated encryption: Rewrite CBC code without integrity checks using AES-GCM and test that tampered ciphertext is now rejected.
- Find and fix a timing-sensitive comparison: Find the early-exit comparison in the lab API's signature check, switch to a constant-time comparison and verify with unit tests.
- Audit password storage settings in code: Find the lab app's password hashing call, assess its algorithm and cost against policy and write a report line.
- Audit JWT signature and algorithm settings: Audit the algorithm list and secret length the lab API accepts, fix the weak setting and verify an unsigned token is rejected.
- Rotate the JWT signing key and invalidate old tokens: Run a two-key changeover using key IDs on Göktaşı Yazılım's lab API, retire the old key and report the process.
- Scan cryptography use with static analysis: Scan the lab repository with static analysis rules, pull out cryptography-related findings and mark false positives.
- Move to envelope encryption and connect the key service: Move data the lab app encrypts with a single key to a data-key and master-key setup, keeping the master key in the lab key service.
- Review an application's cryptography and verify the fixes: Review Erguvan Sigorta's lab app end to end, write findings in language developers understand, apply the fixes and retest.
About this course
You find common crypto mistakes in application code such as ECB mode, IV reuse, hard-coded keys and weak randomness, and fix and verify them with authenticated encryption, high-level libraries, correct password storage and a key management service.
What you will learn
- Common mistakes
- Sound constructions
- Key management and reporting
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.