Advanced › Module 8 › Lesson 4
Lab — Keys
Keys lab on $CRYPTO_LAB — CSPRNG card, storage table, rotation checklist; libraries-not-DIY stub.
Visual · t28_keys_lab
Lab: randomness and keys pack on YOUR $CRYPTO_LAB. Original Cyberlium.
Opening
Ship randomness and key hygiene artifacts from YOUR lab reviews — CSPRNG, storage, rotation — zero prod key exfiltration.
On YOUR $CRYPTO_LAB per brief: (1) scope proof — CTF toy or vulnerable sample name; (2) CSPRNG literacy card four APIs + weak RNG row from lab toy if brief assigns; (3) key storage table five options with one finding from sample code review; (4) rotation hygiene checklist; (5) libraries-not-DIY stub — which library API replaces DIY RNG (secrets, SecureRandom, etc.); (6) integrity — $CRYPTO_LAB only, no prod key scrape, no Math.random keys; (7) chmod 600 pack. Optional: openssl rand -hex 16 demo labeled lab-only.
1. Lab deliverables
CSPRNG + storage + rotation cross-indexed to one $CRYPTO_LAB sample.
Library API row names exact function — not custom LCG implementation.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-57 — https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final Let's Encrypt — https://letsencrypt.org/docs/
Optional command
OpenSSL — https://www.openssl.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl
macOS: Built-in
Windows:
Command — copy this
choco install openssl
═══ LINUX / macOS ═══
Command — copy this
export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
python3 - <<'PY'
import os
lab = os.environ.get('CRYPTO_LAB', os.path.expanduser('~/cyberlium-lab/t28-crypto'))
path = os.path.join(lab, 'notes', 'key-lifecycle-checklist.txt')
open(path, 'w').write('
'.join([
'Key lifecycle checklist (YOUR lab):',
' [ ] openssl rand -hex 32 generated',
' [ ] lab-toy-2048.pem created + chmod 600',
' [ ] never-publish-keys.txt reviewed',
' [ ] key-storage-literacy.txt reviewed',
' [ ] Never: publish private keys or reuse lab passphrases in production',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep '\[ \]' "$CRYPTO_LAB/notes/key-lifecycle-checklist.txt" ls -la "$CRYPTO_LAB/keys/"
═══ WINDOWS ═══
Command — copy this
openssl rand -hex 32 Get-Content $HOME/cyberlium-lab/t28-crypto/notes/never-publish-keys.txt | Select-String NEVER
Primary tools to practice this lesson: grep, openssl. Reference sites: NIST SP 800-57 (https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final); Let's Encrypt (https://letsencrypt.org/docs/); OpenSSL (https://www.openssl.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence hygiene
Redact any sample keys in share-safe copy; mentor pack chmod 600.
Label toy vs policy template sources separately.
3. Integrity
Prod key exfiltration = zero credit; DIY RNG in fix = refused.
openssl rand demo is lab generation only — not prod deployment.
4. What you ship: keys lab pack
CSPRNG + storage + rotation + library stub + integrity — chmod 600.
5. What you record before the next lesson
Keys lab pack path.
6. Wrong vs right: prod crypto oracles vs CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Keys lab includes scraped production API keys from public leak.
Right
Keys lab pack on $CRYPTO_LAB. Next: quiz.
Mission: keys lab
1) Scope proof. 2) CSPRNG and storage rows. 3) Rotation checklist. 4) Library API stub; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Policy-only lab — minimum rows?”
Knowledge Check
APPLY: Keys lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Scraped prod keys belong in keys lab.
True or False
Knowledge Check
APPLY: Fix for weak RNG should use:
Multiple choice