Lab 09 — Cryptographic Failure Detector (OWASP A02)

Chapter: 15 (Cryptographic Failures).

Threat model

Correct primitives, used wrong. The "attacker" exploits the seams: a reused GCM nonce (recover plaintext and forge), ECB (structure leaks), an unauthenticated CBC endpoint (padding-oracle decrypt without the key), a token compared with == (timing forgery), a homemade H(secret‖msg) MAC (length-extension forgery), a non-CSPRNG token (predictable), or a fast/unsalted password hash (GPU cracking). None of these is an AES weakness — they're discipline failures a reviewer must catch.

What you build (lab.py)

  • analyze(usage) — flag ecb-mode, nonce-reuse (critical), unauthenticated-cbc, aead-tag-unchecked, weak-rng, timing-unsafe-compare, length-extension, weak-password-hash, severity-sorted.
  • is_safe(usage) — nothing medium-or-above.
  • find_nonce_reuse(operations) — given a log of (key_id, nonce) encrypt operations, return the keys that ever reused a nonce — the catastrophic AEAD failure, caught from telemetry.

Attack cases the tests cover

  • A clean AEAD usage (GCM, random nonce, CSPRNG, constant-time, tag checked) is safe.
  • Each seam is individually flagged at the right severity (nonce reuse = critical, first).
  • CBC nuance: unauthenticated CBC is a padding-oracle risk; CBC with encrypt-then-MAC is not flagged.
  • Weak password hashes (md5, sha256) flagged; argon2id clean.
  • Nonce-reuse detection across an operation log identifies exactly the offending keys.

Run

pip install -r requirements.txt
LAB_MODULE=solution pytest -q
pytest -q

Hardening / extensions

  • Add key management checks (hardcoded keys, key reuse across purposes, missing rotation).
  • Detect downgrade-prone TLS config (legacy versions/ciphers) and missing HSTS.
  • Parse real code/config (e.g. a Python AST) to locate Random(), == on hmac, MODE_ECB.
  • Estimate password-hash cracking cost from the KDF and parameters.

Interview / resume

"Built a cryptographic-failure detector for the OWASP A02 seams — ECB, nonce/IV reuse, padding-oracle CBC, unchecked AEAD tags, weak RNG, non-constant-time comparison, length-extension MACs, and weak password hashing — plus a nonce-reuse detector over an encrypt-operation log."

Limitations: reasons over usage metadata, not real ciphertext or source; the rule set is the common high-value seams, not an exhaustive cryptanalysis.