Cybersecurity lab.

Aim

To break a Caesar cipher without knowing the key, using letter-frequency analysis and the chi-squared statistic to score every candidate shift automatically.

Theory

English text has a fixed letter-frequency fingerprint (E ~12.7%, T ~9.1%, A ~8.2%, ... Z ~0.07%). A Caesar shift only rotates this fingerprint, so the correct decryption is the one whose frequencies best match English. The chi-squared statistic measures that mismatch: for each candidate shift we compute the observed letter counts, compare them with the counts English predicts, and sum the squared relative error. The shift giving the lowest chi-squared is almost always the key — all 26 trials run instantly.

Procedure

1. Paste or type an intercepted ciphertext (or reuse the Caesar output from Experiment 1).
2. Run the analyser: it decrypts under all 26 shifts and scores each with chi-squared.
3. Read the ranked table — the lowest chi-squared is the recovered key.
4. Confirm the recovered plaintext is readable English.
5. Try a short ciphertext to see why analysis needs enough letters to be reliable.

Self-assessment

References

• Friedman, The Index of Coincidence and Its Applications in Cryptography (1922).
• NIST / Practical Cryptography — chi-squared scoring for monoalphabetic ciphers.
• Stinson & Paterson, Cryptography: Theory and Practice, ch. 2 (cryptanalysis).

Aim

To build the RSA public-key cryptosystem from first principles — generate a key pair from two primes, encrypt an integer message, and decrypt it back — using exact BigInt arithmetic.

Theory

RSA rests on the difficulty of factoring a large modulus n into its two prime factors p and q. The public exponent e and private exponent d are inverses modulo Euler's totient phi(n). Encryption raises the message to e, decryption raises the ciphertext to d, and Euler's theorem guarantees you get the original message back. Security comes from the fact that recovering d requires phi(n), which requires the factorisation of n.

Procedure

1. Enter two distinct primes p and q (the tool checks primality).
2. Choose a public exponent e that is coprime to phi(n).
3. Read the derived modulus n, totient phi, and private exponent d.
4. Enter a message integer m with 0 ≤ m < n.
5. Verify c = m^e mod n encrypts and c^d mod n recovers m exactly.
6. Follow the worked steps to see each modular operation.

Self-assessment

References

• Rivest, Shamir & Adleman, A Method for Obtaining Digital Signatures and Public-Key Cryptosystems, CACM 1978.
• Menezes, van Oorschot & Vanstone, Handbook of Applied Cryptography, ch. 8.
• RFC 8017 — PKCS #1 v2.2 RSA Cryptography Specifications.

Aim

To let two parties derive a shared secret key over a public channel without ever transmitting the secret, and to confirm both sides compute the identical value.

Theory

Diffie-Hellman uses a public prime p and generator g. Alice picks a secret a and sends A = g^a mod p; Bob picks a secret b and sends B = g^b mod p. Each then raises the other's public value to their own secret: Alice computes B^a, Bob computes A^b. Both equal g^(ab) mod p — the shared secret. An eavesdropper sees p, g, A and B but must solve the discrete logarithm problem to recover a or b, which is infeasible for large p.

Procedure

1. Set a public prime p and generator g (shared openly).
2. Give Alice and Bob private exponents a and b.
3. Watch the diagram exchange A and B over the public channel.
4. Confirm B^a mod p equals A^b mod p — the agreed secret.
5. Change a private value and see the secret change while p, g, A, B stay public.

Self-assessment

References

• Diffie & Hellman, New Directions in Cryptography, IEEE Trans. Inf. Theory, 1976.
• RFC 7919 — Negotiated Finite Field Diffie-Hellman Ephemeral Parameters.
• Menezes et al., Handbook of Applied Cryptography, ch. 12 (key establishment).

Aim

To compute SHA-256 digests and measure the avalanche effect — the property that flipping a single input bit changes about half the output bits.

Theory

A cryptographic hash maps any input to a fixed-length digest (256 bits for SHA-256). Good hashes are deterministic, preimage-resistant (you cannot reverse them), and collision-resistant. The avalanche effect is a key diffusion property: a one-bit change in the input should flip roughly 50% of the output bits, so similar inputs produce completely unrelated digests. We measure this with the Hamming distance — the number of differing bits between the two 256-bit outputs.

Procedure

1. Enter input A; the SHA-256 digest is computed via the Web Crypto API.
2. Flip one bit of A (button) or edit input B directly.
3. Compare the two digests — differing hex digits are highlighted red.
4. Read the Hamming distance and the resulting avalanche percentage.
5. Confirm even a one-character change flips close to 50% of the 256 output bits.

Self-assessment

References

• NIST FIPS 180-4 — Secure Hash Standard (SHA-256).
• Feistel, Cryptography and Computer Privacy, Scientific American 1973 (diffusion / avalanche).
• W3C / WHATWG — Web Cryptography API, SubtleCrypto.digest.

Aim

To estimate the entropy of a password from its length and character classes, and to convert that into an expected brute-force crack time at various attacker speeds.

Theory

If a password is drawn at random from a character pool of size R and has length L, the keyspace is R^L and its entropy is L*log2(R) bits. A brute-force attacker testing G guesses per second finds it, on average, after searching half the keyspace. This gives an upper bound on strength: real human passwords are far weaker because they are not random — dictionary, reuse and pattern attacks beat brute force.

Procedure

1. Type a candidate password (computed locally, never transmitted).
2. Select an attacker speed: throttled online, single GPU, or cluster.
3. Read the detected character classes and resulting pool size.
4. Observe the entropy in bits and the strength verdict.
5. Add length and classes; note that length dominates entropy growth.

Self-assessment

References

• NIST SP 800-63B — Digital Identity Guidelines (memorized secrets).
• Shannon, A Mathematical Theory of Communication (1948) — entropy.
• Bonneau, The Science of Guessing, IEEE S&P 2012 (password distributions).

Aim

To encrypt and decrypt a message with real AES-256-GCM, using a key derived from a passphrase with PBKDF2, and to observe the ciphertext, the random IV, and the authentication property.

Theory

AES is the standard symmetric block cipher: the same key encrypts and decrypts. GCM (Galois/Counter Mode) turns it into an authenticated stream cipher, producing ciphertext plus a tag that detects any tampering. Because a passphrase is not a uniform key, we stretch it with PBKDF2 — thousands of hash iterations over the passphrase and a random salt — to derive a 256-bit key. A fresh random IV (initialization vector) is required for every message so identical plaintexts never produce identical ciphertext.

Procedure

1. Enter a passphrase and the plaintext message.
2. Press Encrypt: PBKDF2 derives the key, a random salt and IV are generated, and AES-GCM produces the ciphertext.
3. Inspect the ciphertext hex, IV hex, and salt hex.
4. Press Decrypt to recover the plaintext using the same passphrase.
5. Change one passphrase character and decrypt — authentication fails, proving integrity.

Self-assessment

References

• NIST FIPS 197 — Advanced Encryption Standard (AES).
• NIST SP 800-38D — Galois/Counter Mode (GCM) and GMAC.
• RFC 8018 — PKCS #5 Password-Based Cryptography (PBKDF2).

Aim

To hide a secret text message inside the least-significant bits of an image's pixels (LSB steganography) and then extract the message back, demonstrating data hiding without visible distortion.

Theory

Where cryptography hides the meaning of a message, steganography hides its existence. Each pixel channel (R, G, B) is one byte; its least-significant bit contributes only 1 of 256 levels, so changing it is imperceptible to the eye. We encode each character as 8 bits and write those bits into successive LSBs across the pixel channels. A length header tells the extractor how many characters to read. The carrier image looks unchanged but secretly carries the payload.

Procedure

1. Generate a carrier image (a colour gradient is drawn on the canvas).
2. Type a secret message.
3. Press Hide: the message bits are written into pixel LSBs and the stego image is drawn.
4. Compare the original and stego images — they look identical.
5. Press Extract: the LSBs are read back and the hidden message is recovered.

Self-assessment

References

• Fridrich, Steganography in Digital Media: Principles, Algorithms, and Applications (2009).
• Johnson & Jajodia, Exploring Steganography: Seeing the Unseen, IEEE Computer 1998.
• Provos & Honeyman, Hide and Seek: An Introduction to Steganography, IEEE S&P 2003.

Aim

To step through one full AES round on a 16-byte block, watching the 4x4 state matrix transform under SubBytes, ShiftRows, MixColumns and AddRoundKey — with the real S-box and genuine GF(2^8) arithmetic, not a mock-up.

Theory

AES is a byte-oriented block cipher operating on a 4x4 matrix of bytes called the state (the 16 input bytes loaded column by column). Each round applies four invertible transforms. SubBytes is a fixed non-linear substitution: each byte is replaced via the AES S-box, which is the multiplicative inverse in GF(2^8) followed by an affine map. ShiftRows rotates row r left by r bytes, mixing across columns. MixColumns treats each column as a polynomial over GF(2^8) and multiplies it by the fixed matrix below, where all additions are XOR and multiplications use the reducing polynomial x^8 + x^4 + x^3 + x + 1 (0x11B). AddRoundKey XORs the round key into the state. Together SubBytes provides confusion while ShiftRows + MixColumns provide diffusion.

Procedure

1. Enter a 16-byte plaintext block and a 16-byte round key as hex (32 hex digits each).
2. Read the initial state matrix, filled column by column from the input bytes.
3. Press Run round to apply SubBytes, then ShiftRows, then MixColumns, then AddRoundKey in order.
4. Inspect the state matrix printed after each of the four steps; changed bytes are highlighted.
5. Use Step through to advance one transform at a time and watch how confusion and diffusion spread.

Self-assessment

References

• NIST FIPS 197 — Advanced Encryption Standard (AES), defines the S-box, ShiftRows and MixColumns.
• Daemen & Rijmen, The Design of Rijndael (2002).
• Paar & Pelzl, Understanding Cryptography, ch. 4 (AES and GF(2^8) arithmetic).

Aim

To build an elliptic curve over a small prime field, plot its points, implement point addition, doubling and scalar multiplication by double-and-add, and run an ECDH exchange in which Alice and Bob derive the same shared point.

Theory

An elliptic curve over the prime field Fp is the set of points (x, y) satisfying y^2 = x^3 + a*x + b (mod p), together with a point at infinity O that acts as the identity. Points form an abelian group under the chord-and-tangent rule. To add two distinct points P and Q you compute the slope of the line through them; to double a point you use the tangent slope (which needs the modular inverse of 2y). Scalar multiplication kP means adding P to itself k times, done efficiently by double-and-add over the bits of k. ECC security rests on the elliptic-curve discrete logarithm problem: given P and kP it is hard to recover k. In ECDH Alice and Bob agree on a base point G, pick secrets dA and dB, exchange dA*G and dB*G, and both compute dA*dB*G — the shared secret point.

Procedure

1. Choose the curve parameters a, b and a small prime p (the tool checks the curve is non-singular).
2. Read the list and plot of all affine points on the curve over Fp.
3. Pick a base point G; the order of G (how many times G generates before reaching O) is shown.
4. Set a scalar k and watch kP computed by double-and-add, with the running point highlighted on the plot.
5. Give Alice and Bob private scalars; confirm dA*(dB*G) equals dB*(dA*G) — the shared ECDH point.

Self-assessment

References

• Koblitz, Elliptic Curve Cryptosystems, Mathematics of Computation, 1987.
• Hankerson, Menezes & Vanstone, Guide to Elliptic Curve Cryptography (2004).
• SEC 1 — Elliptic Curve Cryptography (Standards for Efficient Cryptography).

Aim

To visualise a function’s stack frame — local buffer, saved frame pointer and return address — and observe how input longer than the buffer overwrites the return address, how that redirects execution, and how a stack canary detects the corruption. Educational and defensive only.

Theory

On most architectures the call stack grows toward lower addresses, but a buffer is filled toward higher addresses. So a fixed-size local buffer that is written past its end keeps overwriting the bytes above it: first the optional stack canary, then the saved frame pointer, then the saved return address the CPU will jump to when the function returns. If an attacker controls the input, the bytes that land on the return address slot become the next instruction pointer — classic control-flow hijacking. A stack canary is a random guard value placed just below the saved return address before the buffer; the function epilogue checks it is unchanged before returning. Because any contiguous overflow that reaches the return address must first pass through the canary, a modified canary aborts the program (stack smashing detected) and the hijack fails. This experiment is a conceptual byte-level model for defensive understanding; it does not run real shellcode.

Procedure

1. Set the local buffer size N (bytes) and whether a stack canary is present.
2. Type the attacker-supplied input; its length is shown against the buffer capacity.
3. Press Fill stack to animate the input bytes writing into the frame, byte by byte.
4. Watch which slots get overwritten — buffer, then canary, saved FP, and return address.
5. Read the verdict: safe, canary-detected abort, or return-address hijack, depending on length and canary.

Self-assessment

References

• Aleph One, Smashing the Stack for Fun and Profit, Phrack 49, 1996.
• Cowan et al., StackGuard: Automatic Detection and Prevention of Buffer-Overflow Attacks, USENIX Security 1998.
• Erickson, Hacking: The Art of Exploitation, 2nd ed., ch. 3 (stack-based overflows).