SEC-101 Lab 3: Crypto Warm-Up

Week: 4 Graded: Yes Time estimate: 60-90 minutes Tools: CyberChef (browser-based, gchq.github.io/CyberChef); picoCTF platform (picoctf.org)

Learning objective

Distinguish encoding (Base64, hex) from hashing (SHA-256) from symmetric encryption (AES) through hands-on exercises. Observe how cipher mode affects security: AES-ECB leaks structural information; AES-GCM does not. (Bloom's L2: Understand -- explain why these operations are fundamentally different; L3: Apply -- use CyberChef to encode, hash, and encrypt data.)

Setup

Open CyberChef in your browser: https://gchq.github.io/CyberChef

CyberChef is a free, browser-based tool maintained by GCHQ (UK NCSC). It runs entirely in your browser -- no data leaves your machine. It supports hundreds of encoding, encryption, hashing, and compression operations.

No account or login required.

Step-by-step instructions

Part A: Encoding is not encryption (20 min)

Encoding transforms data into a different representation. It is reversible with no key. Anyone can decode it.

Exercise A1: Base64

In CyberChef, set the Input to: Hello, SEC-101 student.

Under Operations (search bar), add "To Base64." Run. Record the output.

Then add a second operation: "From Base64." The output should match the original input.

Answer in your lab notebook:

• What does the Base64 output look like? Does it contain any obvious relationship to the original text?
• Is Base64 a security control? Why or why not?

Exercise A2: Hex encoding

Clear the operations. Input: SECRET PASSWORD. Add "To Hex." Record the output. Add "From Hex." Confirm round-trip.

Answer: Is there any security in hex encoding? Could an attacker who intercepts hex-encoded data read the original?

Part B: Hashing is one-way (20 min)

A hash function takes arbitrary input and produces fixed-length output. It is not reversible (pre-image resistance).

Exercise B1: SHA-256

Clear operations. Input: password123. Add "SHA2" (set to SHA-256). Record the output hash.

Now change the input to password124. Record the new hash. Are the two hashes similar or completely different?

Exercise B2: MD5

Clear SHA-256. Add "MD5". Input: password123. Record the hash.

Answer in your lab notebook:

• MD5 produces a shorter hash than SHA-256. What does this mean for collision resistance?
• Search the MD5 hash of password123 on any MD5 lookup site (search "md5 lookup"). What did you find? Why does this work for common passwords?

Exercise B3: Same input, same hash

With SHA-256, hash the phrase SEC-101 three times (run it three times). Confirm the output is identical each time. Why is this property (determinism) important for verifying file integrity?

Part C: Symmetric encryption (20 min)

Encryption requires a key. Without the key, the ciphertext reveals nothing about the plaintext.

Exercise C1: AES-ECB (insecure mode)

Search for "AES Encrypt" in CyberChef. Add it. Set:

• Mode: ECB
• Key: 0123456789ABCDEF0123456789ABCDEF (32 hex chars = 128-bit key)
• Input format: Raw, Output format: Hex

Input: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA (64 'A' characters)

Run and record the output hex. Do you see a repeated pattern in the ciphertext? Why?

Now try input: ABCDEFGHIJKLMNOPABCDEFGHIJKLMNOP (two identical 16-character blocks). Run. Are the two ciphertext blocks identical?

Exercise C2: AES-GCM (secure mode)

Change Mode to GCM. Add an IV (Initialization Vector / nonce): 000102030405060708090A0B (12 bytes = 96 bits, in hex). Run with the same input.

Does the output have repeated patterns? Change one character of the IV and run again. Does the output change completely?

Answer:

• Why does AES-ECB produce repeated ciphertext blocks for repeated plaintext blocks?
• Why does AES-GCM not have this problem?
• What happens to AES-GCM security if the same IV (nonce) is used twice with the same key?

Part D: picoCTF cryptography challenge (15 min)

Go to picoCTF.org and find a beginner Cryptography challenge (search for one involving Caesar cipher, ROT13, or character substitution). Solve it or document your approach if you cannot solve it.

In your lab notebook:

• Which challenge did you attempt?
• Is the cipher used in the challenge a symmetric cipher, an encoding, or a hash? How do you know?
• Could this cipher be broken by someone without the key? How?

Deliverable

Your lab notebook entries for all four parts: the CyberChef outputs, the answers to each question, and the picoCTF challenge documentation. Keep it under 600 words outside of raw hash/ciphertext values.

Grading rubric

picoCTF connection

If you get stuck on the picoCTF challenge, look for challenges in the Cryptography category labeled "beginner" or with a low point value (usually 100-200 points). Common starting challenges involve encoding (Base64, hex) rather than modern cryptography. The skill in Part A (recognizing encoding from the character set and padding) is directly useful for these challenges. Forward pointer: picoCTF's intermediate crypto challenges involve XOR cipher analysis, which is the same weakness that makes simple stream ciphers insecure without fresh keys.

Lab 3 of 9. Next: Lab 4 (Hash cracking with hashcat, Week 5).