🧪 Labs › Cryptography

A secret that's short, guessable, or generated predictably isn't a secret.

What it is

Cryptography assumes keys and random values are unpredictable. When a secret is too short, drawn from a small space, generated from a weak source (time, a counter, a non-cryptographic RNG), or reused, an attacker can reproduce or brute-force it.

That breaks tokens, password resets, session ids, and signatures without touching the algorithm.

The weakness is in generation and management, not the primitive.

How to approach it

• Identify the secret or random value the security depends on — a reset token, a session id, a signing key.
• Study how it's generated: is it short, structured, or tied to something observable like time?
• Collect samples and look for patterns, low entropy, or reuse.
• Reason about whether you could predict or reproduce the next value.

How to prevent it

• Use a cryptographically secure RNG for all security-relevant values.
• Use sufficient key lengths and never reuse nonces or keys outside their design.
• Rotate and manage keys properly; don't derive secrets from predictable inputs.

More Cryptography labs

• Padding Oracle — An app that tells you whether a decryption 'looked right' leaks the plaintext, one byte at a time.
• RSA & Signature Verification Flaws — A signature check that's lenient in the wrong place lets forged data through.
• Hash Misuse — Hashes used the wrong way — for integrity, for passwords, for tokens — break in predictable ways.

← All labs