Advanced › Module 4 › Lesson 3
Freq Analysis Lab
Frequency analysis lab applies letter-count methods to YOUR $CRYPTO_LAB Caesar/Vigenère toys — not private messages you do not own.
Visual · t28_freq_analysis_lab
Freq analysis lab. $CRYPTO_LAB only. Original Cyberlium.
Opening
Count letters, find peaks, guess shifts — the lab runs on ciphertext YOU encrypted from YOUR paragraph.
Frequency analysis lab workflow: collect ciphertext, plot or count A–Z frequencies, compare to English ETAOIN profile, hypothesize Caesar shift or Vigenère column keys, iterate on YOUR sample until flag phrase appears. Tools: paper tally, Python Counter, Cyberium course scripts on lab toys only. Cyberlium applies freq analysis only to $CRYPTO_LAB classic toys — self-authored or course-labeled — never classmate notes or scraped messages. Next: Classic Lab.
1. Freq analysis workflow (lab toys)
Step 1: confirm sample is YOUR CTF toy. Step 2: letter frequency histogram. Step 3: match peaks to E/T/A. Step 4: for Vigenère, estimate key length then per-column shift. Step 5: verify English plaintext and flag.
On $CRYPTO_LAB, document five steps against one toy filename — no stranger ciphertext paths.
Command guide
Try these commands — Freq analysis workflow (lab toys)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
XOR literacy — https://cryptopals.com/ (Set 1 challenge context) CWE-326 — https://cwe.mitre.org/data/definitions/326.html NIST SP 800-57 — https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
Built-in (vim-common / xxd)
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/ Use WSL or Git Bash xxd
═══ LINUX / macOS ═══
Command — copy this
export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
python3 - <<'PY'
plain = b'Lab XOR demo'
key = b'\x42'
cipher = bytes(b ^ key[0] for b in plain)
recovered = bytes(b ^ key[0] for b in cipher)
print(f'plain: {plain}')
print(f'cipher: {cipher.hex()}')
print(f'recovered:{recovered.decode()} (YOUR bytes only)')
PYCommand — copy this
xxd -p <<< 'Lab XOR demo' | head -1
Primary tools to practice this lesson: python3, xxd. Reference sites: XOR literacy (https://cryptopals.com/); CWE-326 (https://cwe.mitre.org/data/definitions/326.html); NIST SP 800-57 (https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Common lab mistakes
Sample too short — frequencies lie. Wrong language profile — use appropriate corpus. Applying classic breaks to Base64 or AES ciphertext — wrong tool; literacy means knowing cipher class first.
Defenders do not freq-analyze AES — students learn boundary between classic and modern.
3. Scope lock
Forbidden: freq analysis on unauthorized messages. Allowed: freq lab log — toy name, histogram summary, recovered plaintext snippet (YOUR flag), UTC timestamp.
Ship: freq analysis lab log for $CRYPTO_LAB. Next: Classic Lab.
4. What you ship: freq analysis lab log for $CRYPTO_LAB
Toy name, histogram note, recovered flag snippet. $CRYPTO_LAB named. NO stranger ciphertext. chmod 600.
5. What you record before the next lesson
Date. Freq lab log. $CRYPTO_LAB named. File t28-m04-l03-freq-analysis-lab.txt chmod 600.
6. Wrong vs right: prod crypto oracles vs CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Freq-analyze private chat export without consent. Apply Caesar break to AES blob.
Right
Write freq analysis lab log for YOUR $CRYPTO_LAB classic toy. Next: Classic Lab.
Mission: freq-break YOUR toy
1) Run histogram on YOUR Caesar or Vigenère toy. 2) Document shift/key guess. 3) Record flag phrase recovered. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Index of coincidence helps Vigenère key length — on YOUR samples only.
Knowledge Check
APPLY: Freq analysis lab on Cyberlium applies to:
Multiple choice
Knowledge Check
APPLY: True or False: English ciphertext often peaks at E, T, A letter frequencies.
True or False
Knowledge Check
APPLY: Freq analysis on AES-GCM ciphertext is:
Multiple choice