Crypto Findings

Crypto finding draft literacy — algorithm, mode, key handling, evidence — on $CRYPTO_LAB review notes.

Crypto Findings• Audio Walkthrough

00:00/02:52

Visual · t28_crypto_findings

Crypto finding = structured report row. $CRYPTO_LAB. Original Cyberlium.

A crypto finding without algorithm context is noise — draft rows the way defenders and devs can actually retest.

Crypto finding literacy: Finding ID, title, component, algorithm/mode (AES-GCM, RSA-OAEP, etc.), key source finding (hardcoded, weak RNG, ECB mode), observed evidence (code path, config snippet hash), inference separate, impact category (confidentiality/integrity), affected data class, reproduction on $CRYPTO_LAB only, recommended library fix stub. No prod oracle attack steps, no sensationalized 'broke AES' titles without evidence. Cyberlium templates chmod 600 — professional tone. Refused: padding-oracle repro steps against production, findings on stranger apps without scope, fabricated crypto evidence. Lab row: one complete finding from Module 5 or 8 lab artifact.

1. Finding row fields

ID, algorithm, mode, key handling, observed, inferred, impact, fix stub — crypto-specific columns.

Repro references $CRYPTO_LAB CTF or sample only.

Command guide

Try these commands — Finding row fields

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

CWE reporting — https://cwe.mitre.org/ (map findings to weakness IDs) NIST crypto — https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines

Optional command

OpenSSL — https://www.openssl.org/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows: Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
python3 - <<'PY'
import os
lab = os.environ.get('CRYPTO_LAB', os.path.expanduser('~/cyberlium-lab/t28-crypto'))
path = os.path.join(lab, 'report', 'finding-draft.txt')
os.makedirs(os.path.dirname(path), exist_ok=True)
open(path, 'w').write('
'.join([
  'FINDING ID: CRYPTO-LAB-001',
  'Title: Lab passphrase stored in shell history (literacy sample)',
  'Severity: Informational (lab only)',
  'Affected: YOUR demo.enc under t28-crypto/data/',
  'Description: symmetric key passed via -pass pass: on command line — bad practice literacy',
  'Evidence: demo.enc + openssl enc command in lab notes (no live exploit)',
  'Recommendation: use -pass file: or env var; prefer KMS for production keys',
  'CWE: CWE-522 (insufficiently protected credentials)',
  'Scope: authorized lab files only — not stranger API crypto abuse',
]))
print(f'Wrote {path}')
PY

Command — copy this

grep -E 'FINDING|CWE|Scope' "$CRYPTO_LAB/report/finding-draft.txt"

Primary tools to practice this lesson: python3, grep. Reference sites: CWE reporting (https://cwe.mitre.org/); NIST crypto (https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines); OpenSSL (https://www.openssl.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Evidence discipline

Config hash or code line citation — same integrity as DFIR exhibits.

Inference: 'oracle might' not 'broke prod' without authorized proof.

3. Scope refuse

No prod padding-oracle cookbooks in finding repro.

No fabricated crypto breakthrough claims.

4. What you ship: crypto finding template

Crypto finding fields + one completed $CRYPTO_LAB row + NEVER prod oracle line.

5. What you record before the next lesson

Crypto finding template path.

6. Wrong vs right: prod crypto oracles vs CTF toys

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Draft padding-oracle finding on live bank site without authorization.
Right: Crypto finding template with one $CRYPTO_LAB row. Next: Libraries Not DIY.

Hands-on Exercise