Lab — Encrypt & Verify a File

openssl dgst -sha256 lab.txt prints a 64-character hex of the file bytes. Record it before encryption. openssl enc -aes-256-cbc -salt -pbkdf2 reads lab.txt and writes lab.txt.enc, prompting for a passphrase (or reading one you pass in a way that does not land in shell history if you can avoid it — prefer the prompt). Decrypt with matching flags to lab.out.txt. Hash lab.out.txt. The two hexes must match. If they do not, you decrypted with the wrong passphrase, hashed the ciphertext by mistake, or edited a file between steps. SHA-256 here is integrity of YOUR toy file, not password hashing (no salt+Argon2 on this file) and not cracking. AES here is symmetric encryption with a passphrase that OpenSSL turns into a key via PBKDF2 in this command line. CBC is what this copy-paste uses for a widely available teaching path; remember Module 2/4: real applications prefer authenticated encryption (GCM). If you flip one byte of lab.txt.enc, decrypt may error or yield garbage — a reminder that integrity of ciphertext is why AEAD exists. Do not turn that observation into a bit-flipping attack on someone else’s data.

The lab passphrase is a secret the moment you choose it. Do not type your real login. Do not reuse it tomorrow on a website. Do not put it in encrypt-lab-notes.txt, git, chat, or a screenshot. The notes record that you used a unique lab passphrase, the before/after SHA-256 hexes, MATCH, and the ethics line. chmod 600 on lab.txt, the ciphertext, the decrypt output, and the notes. Delete or keep the ciphertext in the lab folder — do not email it. Empty notes fail. Notes that contain the passphrase fail hygiene even if the hashes matched.

lab.txt is a sentence you wrote. It is not /etc/shadow, not a customer export, not a classmate’s disk. openssl enc is not a warrant to decrypt files you found on a USB you do not own. Hashing is not rainbow tables. If a tutorial says “now crack the passphrase with a GPU,” that tutorial is not this lab. Topic 8’s earlier hash-crack lesson was toy-only on digests you created. This lab does not resume cracking. It proves a round trip.

Use Git Bash or WSL on Windows if openssl is missing from PowerShell. When openssl enc prompts, enter the lab passphrase twice for encrypt and once for decrypt. Do not pass -pass pass:yoursecret on a shared machine if the process list is visible — the interactive prompt is safer for teaching. Then lock files. Do not add a homebrew cipher “for comparison.”

mkdir -p "$HOME/cyberlium-lab"
cd "$HOME/cyberlium-lab"

printf '%s
' 'cyberlium crypto lab — fictional sample file' > lab.txt

echo "=== SHA-256 before encrypt ==="
openssl dgst -sha256 lab.txt

openssl enc -aes-256-cbc -salt -pbkdf2 -in lab.txt -out lab.txt.enc
openssl enc -d -aes-256-cbc -pbkdf2 -in lab.txt.enc -out lab.out.txt

echo "=== SHA-256 after decrypt ==="
openssl dgst -sha256 lab.out.txt

NOTES="$HOME/cyberlium-lab/encrypt-lab-notes.txt"
{
  echo "=== ENCRYPT AND VERIFY LAB ==="
  echo "file: $HOME/cyberlium-lab/lab.txt (toy text I created)"
  echo "hash: SHA-256 (integrity — NOT encryption, NOT cracking)"
  echo "enc: openssl enc AES-256-CBC + PBKDF2 (lab teaching path; apps should prefer AEAD APIs)"
  echo "digest_before:"
  echo "digest_after:"
  echo "compare: MATCH (expected) / DIFFER"
  echo "passphrase: unique lab secret — NOT written here, NOT reused on real accounts"
  echo "ethics: my file only; no live keys; no homebrew XOR; no attacking others' ciphertext"
} > "$NOTES"

chmod 600 "$HOME/cyberlium-lab/lab.txt" \
          "$HOME/cyberlium-lab/lab.txt.enc" \
          "$HOME/cyberlium-lab/lab.out.txt" \
          "$NOTES"

You used a hash for integrity and AES for confidentiality on a file you own, then locked the folder. Matching digests are byte equality after a round trip, not a CA, not a padlock, not permission to decrypt a stranger’s disk. Next — Quiz — Cryptography Basics Final — twelve APPLY items across hashing, encryption, TLS, and hygiene (the subtitle still says 10-question). Then Ethical Hacking (CEH v13): authorized methodology next, not a license to attack.