Cybersecurity › Module 4 › Lesson 5
Lab — Encrypt & Decrypt
See ciphertext — then practice safely with openssl
Opening
Reading about crypto ≠ watching bits flip
You know plaintext, keys, symmetric vs asymmetric ideas, hashes, and HTTPS. This lab makes the transformation visible — first in-app, then with ethical local openssl on files you create. Rules are non-negotiable: practice only on files you create under a lab folder in your home directory. Never encrypt, decrypt, crack, or attack anyone else's data, passwords, or websites. Strong crypto on someone else's files without permission is not a lab — it is abuse. Goal: feel how ciphertext depends on the key, complete a safe AES round-trip you control, and contrast encryption with hashing — then clean up.
1. Interactive lab: feel the key
Use the in-app encrypt/decrypt lab below. Enter a short practice message and a practice key. Watch ciphertext appear. Change one character of the key and decryption fails or yields garbage. That absolute dependence on the correct key is why key management is half of cryptography — and why losing the only key can mean permanent loss by design.
Try three deliberate experiments: (1) encrypt then decrypt with the same key — success; (2) decrypt with a one-character typo — failure; (3) encrypt two similar plaintexts and notice ciphertext looks unrelated if the tool uses a proper mode. You are building intuition, not inventing algorithms.
Encrypt & Decrypt Lab
2. What this lab proves (and what it does not)
Encryption proves Confidentiality when the key stays secret: observers without the key should not recover plaintext. It does not prove the message came from a particular person unless you also use authentication/signatures. It does not replace backups. It does not authorize you to touch files you do not own.
Hashing (you will run openssl dgst) is different: a one-way fingerprint for Integrity checks. Hashes are not encryption — you cannot "decrypt" SHA-256 back into the file. Mixing those words is a common beginner mistake; this lab keeps them side by side so the difference sticks.
3. Wrong vs right: losing the only key
Worked failure mode — encryption without recovery planning:
Wrong
You encrypt critical notes with a random passphrase, paste that passphrase into a sticky-note app synced everywhere, then delete the only plaintext copy. Sticky note leaks — or you forget the passphrase — and the notes are gone forever. Or worse: you "practice" openssl on a roommate's documents "just to see." That is unauthorized access, not learning.
Right
Use reputable tools, store real keys in a password manager / OS keychain, keep tested recovery codes offline, and practice only on files you create under $HOME/cyberlium-lab. Remember: strong encryption without the key means permanent loss — by design. Ethical scope is part of the skill.
4. Terminal practice: openssl in your lab folder only
The commands below create a practice directory under your home folder, write a harmless plaintext file you own, encrypt it with AES, decrypt it back, and hash both files. Use a throwaway practice passphrase — never a real password you reuse elsewhere. If openssl is missing, install a legitimate build for your OS or ask Mentor for a PATH hint — do not download random "crack" tools.
Stay inside $HOME/cyberlium-lab for every create, encrypt, decrypt, and delete. That folder boundary is the ethical fence: your practice ciphertext, your practice passphrase, your cleanup. If a command fails, fix PATH or flags — never "pivot" to someone else's Documents folder to make the demo work.
Command guide
openssl — AES round-trip + hash (OWN lab files only)
=== ETHICAL SCOPE (read before typing) === ONLY files YOU create under ~/cyberlium-lab (your home lab folder) NEVER other people's documents, password hashes, or websites NEVER try to crack / brute-force real passphrases
0) Create YOUR lab folder (pick your shell) Target: cyberlium-lab inside YOUR home directory only macOS / Linux / Git Bash / WSL:
Command — copy this
mkdir -p ~/cyberlium-lab cd ~/cyberlium-lab
Windows PowerShell (same openssl.exe on PATH — stay in YOUR folder only):
Optional command
New-Item -ItemType Directory -Force -Path "$env:USERPROFILE\cyberlium-lab" | Out-Null Set-Location "$env:USERPROFILE\cyberlium-lab"
"Hello Cyberlium lab" | Out-File -Encoding ascii practice-secret.txt
Optional command
openssl enc -aes-256-cbc -salt -in practice-secret.txt -out practice-secret.txt.enc openssl enc -d -aes-256-cbc -in practice-secret.txt.enc -out practice-secret.out.txt openssl dgst -sha256 practice-secret.txt openssl dgst -sha256 practice-secret.txt.enc Get-FileHash .\practice-secret.txt -Algorithm SHA256
(Ask Mentor for a PATH hint if openssl is missing — never use others' files)
Windows cmd (example — adjust drive/user; stay in YOUR folder only):
Optional command
mkdir %USERPROFILE%\cyberlium-lab cd /d %USERPROFILE%\cyberlium-lab
1) Create a practice plaintext file YOU own
Command — copy this
echo Hello Cyberlium lab > practice-secret.txt
2) Symmetric encrypt with AES-256-CBC (demo passphrase prompt) Use a THROWWAY practice passphrase — not a real reused password
Command — copy this
openssl enc -aes-256-cbc -salt -in practice-secret.txt -out practice-secret.txt.enc
enter practice passphrase when asked
3) Decrypt back (same practice passphrase)
Command — copy this
openssl enc -d -aes-256-cbc -in practice-secret.txt.enc -out practice-secret.out.txt
Compare practice-secret.txt and practice-secret.out.txt — should match
4) Integrity fingerprint (hashing, NOT encryption)
Command — copy this
openssl dgst -sha256 practice-secret.txt openssl dgst -sha256 practice-secret.txt.enc
Digests differ — ciphertext is different bytes; hash does not "unlock" data
5) Optional: wrong passphrase once (expect failure) — still YOUR file only
Optional command
openssl enc -d -aes-256-cbc -in practice-secret.txt.enc -out should-fail.txt
6) Cleanup practice files when finished
Optional command
rm practice-secret.txt practice-secret.txt.enc practice-secret.out.txt # macOS/Linux Remove-Item practice-secret.txt, practice-secret.txt.enc, practice-secret.out.txt # PowerShell del practice-secret.txt practice-secret.txt.enc practice-secret.out.txt # Windows cmd
DO NOT: reuse real passwords as the demo passphrase DO NOT: run these against other people's files or systems DO NOT: attack websites, crack dumps, or "test" roommate laptops
Mission: lab + local round-trip
1) Complete the in-app encrypt/decrypt lab above (encrypt, then decrypt; try a wrong key once). 2) On your PC, create $HOME/cyberlium-lab and run the openssl enc round-trip on a practice file YOU create there. 3) Run openssl dgst -sha256 on the plaintext and note the digest. 4) Delete practice files afterward. Never use other people's files, never crack passwords, never attack sites.
Stuck? Ask Cyberlium AI Mentor
If openssl errors on PATH or flags, ask Cyberlium AI Mentor for a hint for your OS — not for cracking real ciphertext or attacking systems. Try: "Hint only: openssl enc decrypt flag on Windows when command not found?" Or: "Hint only: why does dgst not decrypt my .enc file?"
You watched keys decide success or failure, practiced a safe AES encrypt/decrypt round-trip on files you created under your cyberlium-lab folder, and contrasted hashing with encryption. Next — Quiz — Data Protection Principles — prove the Module 4 toolkit sticks under pressure.
Knowledge Check
APPLY: In the lab, ciphertext decrypts only with the correct key. What security property does that demonstrate?
Multiple choice
Knowledge Check
APPLY: You run openssl dgst -sha256 on practice-secret.txt inside your lab folder. What did you produce?
Multiple choice
Knowledge Check
APPLY: True or False: It is acceptable to practice openssl enc on co-workers' private documents without asking, as long as you decrypt them afterward.
True or False