A04:2025 Cryptographic Failures

// If you came from Session 1.4: three different questions get called "crypto". Pick the job first,// then the tool. Each row below runs once in code right after the table.////   Job                        Tool                       Input              Output//   hide data                  AES-256-GCM (encryption)   plaintext + key    ciphertext; the same key reverses it//   check it was not altered   HMAC-SHA256                message + key      a short tag you compare; change one//                                                                            byte of the message and the tag changes//   store a password           slow salted hash           password           a hash you can only check, never//                              (scrypt here, argon2id                        reverse; the password is not in it//                              in production)//// The SSH key pair from 1.4 does the middle job with two keys instead of one: your private key makes the// tag, the public key checks it, so the public key proves who you are. That is the signature job.//// Stop here on your first visit from Session 1.4. The code below is JavaScript, which you meet in Unit 3; it runs// each row of the table once so the page can check itself. Sections 1 to 6 are for Unit 10, when the capstone// stores a password.const jobKey = crypto.randomBytes(32);                                   // one 256-bit secret for the demos below // hide data: encrypt, then decrypt with the same key and get the exact text backconst jobIv = crypto.randomBytes(12);const hider = crypto.createCipheriv('aes-256-gcm', jobKey, jobIv);const hidden = Buffer.concat([hider.update('meet at the north gate', 'utf8'), hider.final()]);const hiddenTag = hider.getAuthTag();const opener = crypto.createDecipheriv('aes-256-gcm', jobKey, jobIv);opener.setAuthTag(hiddenTag); // check it was not altered: same message + same key = same tag; one byte changed = different tagconst tagFor = (message) => crypto.createHmac('sha256', jobKey).update(message).digest('hex'); // store a password: the hash verifies the password, contains no trace of it, and cannot be turned back into itconst jobSalt = crypto.randomBytes(16);const pwHash = crypto.scryptSync('open sesame', jobSalt, 32);

// VULNERABLE://   db.users.insert({ email, password });                                  // plaintext//   db.users.insert({ email, password: md5(password) });                   // rainbow tables, GPU 10^10/s//   db.users.insert({ email, password: sha256(password) });                // still fast, unsalted// FIXED:const SCRYPT = { N: 2 ** 14, r: 8, p: 1, keylen: 64 };function hashPassword(password) {  const salt = crypto.randomBytes(16);  const hash = crypto.scryptSync(password, salt, SCRYPT.keylen, SCRYPT);  return `scrypt$${SCRYPT.N}$${salt.toString('base64')}$${hash.toString('base64')}`;}function verifyPassword(password, stored) {  const [algo, n, saltB64, hashB64] = stored.split('$');  if (algo !== 'scrypt') return false;  const expected = Buffer.from(hashB64, 'base64');  const actual = crypto.scryptSync(password, Buffer.from(saltB64, 'base64'), expected.length, { ...SCRYPT, N: Number(n) });  return crypto.timingSafeEqual(actual, expected);   // constant-time, not ===}const stored = hashPassword('correct horse battery staple');

// VULNERABLE://   const resetToken = Math.random().toString(36).slice(2);   // predictable PRNG, ~50 bits, seedable//   const sessionId = Date.now() + userId;                    // guessable// FIXED:function newToken(bytes = 32) { return crypto.randomBytes(bytes).toString('base64url'); }const t1 = newToken();

// VULNERABLE://   if (providedToken === storedToken) ...   // early-exit on first mismatched byte => timing oracle// FIXED:function safeEqual(a, b) {  const ab = Buffer.from(String(a));  const bb = Buffer.from(String(b));  if (ab.length !== bb.length) return false;                   // length leak acceptable; use HMAC of both to hide  return crypto.timingSafeEqual(ab, bb);}

// VULNERABLE://   crypto.createCipheriv('aes-256-ecb', key, null)              // ECB: identical blocks => identical ciphertext//   crypto.createCipheriv('aes-256-cbc', key, Buffer.alloc(16))  // fixed IV; no integrity => padding oracle//   const KEY = 'supersecretkey1234567890abcdef12';              // hardcoded in repo// FIXED:const key = crypto.randomBytes(32);   // from KMS / env in real life, never a literalfunction encrypt(plaintext, k, aad = '') {  const iv = crypto.randomBytes(12);                             // 96-bit nonce, unique per message  const cipher = crypto.createCipheriv('aes-256-gcm', k, iv);  cipher.setAAD(Buffer.from(aad));  const ct = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);  return { iv: iv.toString('base64'), ct: ct.toString('base64'), tag: cipher.getAuthTag().toString('base64') };}function decrypt({ iv, ct, tag }, k, aad = '') {  const decipher = crypto.createDecipheriv('aes-256-gcm', k, Buffer.from(iv, 'base64'));  decipher.setAAD(Buffer.from(aad));  decipher.setAuthTag(Buffer.from(tag, 'base64'));  return Buffer.concat([decipher.update(Buffer.from(ct, 'base64')), decipher.final()]).toString('utf8');}const msg = 'card=4111111111111111';const box = encrypt(msg, key, 'user:42');const tampered = { ...box, ct: Buffer.from(Buffer.from(box.ct, 'base64').map((b, i) => (i === 0 ? b ^ 1 : b))).toString('base64') };

// VULNERABLE: cookie = base64(JSON({ uid: 1, role: 'admin' }))   // client edits role// FIXED:const hmacKey = crypto.randomBytes(32);function sign(payload, k) {  const body = Buffer.from(JSON.stringify(payload)).toString('base64url');  const mac = crypto.createHmac('sha256', k).update(body).digest('base64url');  return `${body}.${mac}`;}function verify(token, k) {  const [body, mac] = token.split('.');  if (!body || !mac) return null;  const expected = crypto.createHmac('sha256', k).update(body).digest('base64url');  if (!safeEqual(mac, expected)) return null;  return JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));}const tok = sign({ uid: 1, role: 'user' }, hmacKey);const forgedBody = Buffer.from(JSON.stringify({ uid: 1, role: 'admin' })).toString('base64url');

// VULNERABLE: jwt.verify(token, publicKey)  with no { algorithms: [...] }  -> attacker sets alg=HS256, signs with public key// FIXED: const payload = jwt.verify(token, key, { algorithms: ['RS256'] });   // allowlist; never trust header.algfunction headerAlgAllowed(token, allowed) {  const header = JSON.parse(Buffer.from(token.split('.')[0], 'base64url').toString('utf8'));  return allowed.includes(header.alg);}const noneTok = Buffer.from(JSON.stringify({ alg: 'none', typ: 'JWT' })).toString('base64url') + '.e30.';