Intermediate
Cryptography Labs

Create a 2048-bit private key, then extract the public key from it. Run these commands directly in your terminal from ~/crypto_labs.

# Generate a 2048-bit private key — output saved to my_private.pem
openssl genrsa -out my_private.pem 2048

# Extract the public key from it
openssl rsa -in my_private.pem -pubout -out my_public.pem

# Verify both files exist
ls -lh my_private.pem my_public.pem

# Inspect the key structure (optional — press q to exit)
openssl rsa -in my_private.pem -text -noout | head -20

Share your my_public.pem with a classmate. Save their key as partner_public.pem in the same directory. If working alone, simulate a second participant:

# Simulate a second user's key pair in the same directory
openssl genrsa -out partner_private.pem 2048
openssl rsa -in partner_private.pem -pubout -out partner_public.pem

# Confirm you now have four .pem files
ls *.pem

Write a plaintext message and encrypt it so only the holder of partner_private.pem can read it.

# Create a short plaintext file
echo "Meet me at the clock tower at noon." > message.txt

# Encrypt using the partner's public key (OAEP padding)
openssl pkeyutl -encrypt \
  -pubin -inkey partner_public.pem \
  -in message.txt \
  -out message.enc

# Confirm the output is unreadable binary
xxd message.enc | head -4
# You should see hex bytes — no readable text

Use the partner's private key to recover the original message. In a real exchange your partner would do this with their private key on their machine.

# Decrypt using partner's private key
openssl pkeyutl -decrypt \
  -inkey partner_private.pem \
  -in message.enc \
  -out message_decrypted.txt

# Read the recovered plaintext
cat message_decrypted.txt
# Expected: Meet me at the clock tower at noon.

Digital signatures prove authenticity and integrity. OpenSSL hashes the document and encrypts that hash with your private key. Then tamper with the document to watch verification fail.

# Create the document to sign
echo "I, Alice, agree to the terms dated 2024-01-15." > contract.txt

# Sign it with your private key
openssl dgst -sha256 -sign my_private.pem \
  -out contract.sig contract.txt

# Verify the signature using your public key
openssl dgst -sha256 -verify my_public.pem \
  -signature contract.sig contract.txt
# Expected output: Verified OK

# Now tamper: append a dot to the document
echo "." >> contract.txt

# Verify again — it should now FAIL
openssl dgst -sha256 -verify my_public.pem \
  -signature contract.sig contract.txt
# Expected output: Verification Failure

Save the script as rsa_demo.py in ~/crypto_labs and run it with python3 rsa_demo.py.

# rsa_demo.py — save this file then run: python3 rsa_demo.py
from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.primitives import hashes

private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
public_key  = private_key.public_key()

message = b"Meet me at the clock tower."
ciphertext = public_key.encrypt(
    message,
    padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA256()),
                 algorithm=hashes.SHA256(), label=None)
)
print(f"Encrypted (first 20 bytes): {ciphertext[:20].hex()}")

plaintext = private_key.decrypt(
    ciphertext,
    padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA256()),
                 algorithm=hashes.SHA256(), label=None)
)
print(f"Decrypted: {plaintext.decode()}")

# Run it
python3 rsa_demo.py

Both commands must run in the same terminal session. Setting the environment variable and then launching Firefox from that same session ensures Firefox inherits the variable and writes session keys to the log file.

# Set the key log file path (stays active for this terminal session)
export SSLKEYLOGFILE=~/crypto_labs/tls_keys.log

# Confirm the variable is set
echo $SSLKEYLOGFILE
# Expected: /home/kali/crypto_labs/tls_keys.log

# Launch Firefox from this same terminal (& runs it in background)
firefox &

# Visit a simple JSON API in Firefox — easy to spot after decryption
# Browse to: https://httpbin.org/get

# After visiting the site, confirm the key log was written
ls -lh ~/crypto_labs/tls_keys.log
cat ~/crypto_labs/tls_keys.log | head -5

You can launch Wireshark from the terminal or from the Kali application menu. Starting from the terminal lets you see any errors.

# Launch Wireshark (GUI will open)
wireshark &

# Alternatively, capture directly to file from terminal (no GUI needed)
sudo tcpdump -i any -w ~/crypto_labs/capture.pcap port 443 &
# Browse to https://httpbin.org/get in Firefox, then stop tcpdump:
sudo pkill tcpdump

# Open the saved capture in Wireshark
wireshark ~/crypto_labs/capture.pcap

In Wireshark, type tcp port 443 in the display filter bar. You will see TLS records with Application Data payloads — unreadable binary at this point.

In Wireshark's filter bar, type tls.handshake to isolate handshake packets. Click a ClientHello packet, expand the TLS layer in the detail pane, and locate:

• The TLS version (look for 0x0304 = TLS 1.3)
• The cipher suites offered (look for TLS_AES_256_GCM_SHA384)
• The 32-byte client random nonce

Then click the Certificate packet and find the server's domain in the Subject Alternative Name (SAN) field.

In Wireshark, go to Edit → Preferences → Protocols → TLS. Set the (Pre)-Master-Secret log filename field to the full path of your keylog file, then click OK.

# Get the full path to paste into Wireshark
realpath ~/crypto_labs/tls_keys.log
# e.g. /home/kali/crypto_labs/tls_keys.log

Fill in the table below in your own notes using what you find in Wireshark:

# Remove the session key log and capture file
rm ~/crypto_labs/tls_keys.log
rm ~/crypto_labs/capture.pcap

# Unset the environment variable for this session
unset SSLKEYLOGFILE

Save the script as hash_compare.py and run it. Observe the timing difference — it tells you directly how hard each algorithm is to crack.

# Save as ~/crypto_labs/hash_compare.py
import hashlib, bcrypt, time
from argon2 import PasswordHasher

password = b"hunter2"

t0 = time.perf_counter()
md5_hash = hashlib.md5(password).hexdigest()
print(f"MD5 : {md5_hash}")
print(f"  time: {(time.perf_counter()-t0)*1000:.3f} ms\n")

t0 = time.perf_counter()
bc_hash = bcrypt.hashpw(password, bcrypt.gensalt(rounds=12))
print(f"bcrypt: {bc_hash.decode()}")
print(f"  time: {(time.perf_counter()-t0)*1000:.0f} ms\n")

ph = PasswordHasher(time_cost=3, memory_cost=65536, parallelism=1)
t0 = time.perf_counter()
arg_hash = ph.hash(password.decode())
print(f"Argon2: {arg_hash}")
print(f"  time: {(time.perf_counter()-t0)*1000:.0f} ms")

# Run it
python3 hash_compare.py

Create a file of MD5 hashes, then use Hashcat with rockyou.txt to crack them.

# Generate MD5 hashes of common passwords
python3 -c "
import hashlib
passwords = ['password', 'iloveyou', 'monkey', 'qwerty123', 'hunter2']
for p in passwords:
    print(hashlib.md5(p.encode()).hexdigest())
" > md5_hashes.txt

cat md5_hashes.txt

# Run Hashcat: mode 0 = raw MD5, attack mode 0 = dictionary
hashcat -m 0 -a 0 md5_hashes.txt /usr/share/wordlists/rockyou.txt

# If running in a VM without GPU, add --force to suppress the warning
# hashcat -m 0 -a 0 --force md5_hashes.txt /usr/share/wordlists/rockyou.txt

# Show cracked results from the potfile
hashcat -m 0 md5_hashes.txt --show

Generate a bcrypt hash and watch the H/s (hashes per second) metric in Hashcat. The difference in cracking speed compared to MD5 is the core takeaway.

# Generate a bcrypt hash of "monkey"
python3 -c "
import bcrypt
h = bcrypt.hashpw(b'monkey', bcrypt.gensalt(rounds=12))
print(h.decode())
" > bcrypt_hash.txt

cat bcrypt_hash.txt

# Attack it — mode 3200 = bcrypt
hashcat -m 3200 -a 0 bcrypt_hash.txt /usr/share/wordlists/rockyou.txt

# Watch the H/s figure: ~10 billion/s for MD5 vs ~20,000/s for bcrypt
# "monkey" is in rockyou so it should still crack — but compare the ETA
# for a full rockyou scan vs the MD5 run.

Save and run this script to see how salting ensures two users with the same password store different hashes.

# Save as ~/crypto_labs/salt_demo.py
import hashlib, os

password = "password123"

# Without salt — same input always gives same output
h1 = hashlib.sha256(password.encode()).hexdigest()
h2 = hashlib.sha256(password.encode()).hexdigest()
print(f"Same hash (no salt): {h1 == h2}")

# With a unique salt per user
salt1 = os.urandom(16).hex()
salt2 = os.urandom(16).hex()
h1 = hashlib.sha256((salt1 + password).encode()).hexdigest()
h2 = hashlib.sha256((salt2 + password).encode()).hexdigest()
print(f"Same hash (with salt): {h1 == h2}")
print(f"User 1 stored: {salt1}:{h1}")
print(f"User 2 stored: {salt2}:{h2}")

# Run it
python3 salt_demo.py

Save this as encrypt_file.py in ~/crypto_labs. The key is derived from your passphrase using PBKDF2 — never hard-code keys in source files.

# Save as ~/crypto_labs/encrypt_file.py
import os, sys
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives import hashes
import getpass

def derive_key(passphrase, salt):
    kdf = PBKDF2HMAC(algorithm=hashes.SHA256(), length=32,
                     salt=salt, iterations=390000)
    return kdf.derive(passphrase.encode())

def encrypt_file(input_path, output_path, passphrase):
    salt  = os.urandom(16)
    nonce = os.urandom(12)
    key   = derive_key(passphrase, salt)
    aesgcm = AESGCM(key)
    with open(input_path, "rb") as f:
        plaintext = f.read()
    ciphertext = aesgcm.encrypt(nonce, plaintext, None)
    with open(output_path, "wb") as f:
        f.write(salt + nonce + ciphertext)
    print(f"Encrypted: {input_path} -> {output_path}")
    print(f"  Salt : {salt.hex()}")
    print(f"  Nonce: {nonce.hex()}")

if __name__ == "__main__":
    pw = getpass.getpass("Passphrase: ")
    encrypt_file(sys.argv[1], sys.argv[1] + ".enc", pw)

# Create a test file and encrypt it
echo "TOP SECRET: Project Nightingale details go here." > secret.txt
python3 encrypt_file.py secret.txt
# You will be prompted for a passphrase — remember it for decryption

# Confirm the output is unreadable binary
xxd secret.txt.enc | head -4

Save this as decrypt_file.py. It reads the salt and nonce from the file header — neither is secret; only the passphrase must be protected.

# Save as ~/crypto_labs/decrypt_file.py
import sys, getpass
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.exceptions import InvalidTag
from encrypt_file import derive_key

def decrypt_file(enc_path, out_path, passphrase):
    with open(enc_path, "rb") as f:
        data = f.read()
    salt       = data[:16]
    nonce      = data[16:28]
    ciphertext = data[28:]
    key    = derive_key(passphrase, salt)
    aesgcm = AESGCM(key)
    try:
        plaintext = aesgcm.decrypt(nonce, ciphertext, None)
    except InvalidTag:
        print("Decryption failed: auth tag mismatch.")
        print("The ciphertext was tampered with, or the passphrase is wrong.")
        sys.exit(1)
    with open(out_path, "wb") as f:
        f.write(plaintext)
    print(f"Decrypted: {enc_path} -> {out_path}")

if __name__ == "__main__":
    pw = getpass.getpass("Passphrase: ")
    decrypt_file(sys.argv[1], sys.argv[1].replace(".enc", ".dec"), pw)

# Decrypt the file (enter the same passphrase you used to encrypt)
python3 decrypt_file.py secret.txt.enc

# Compare original and decrypted — should be identical
diff secret.txt secret.txt.dec && echo "Files match!"

Flip a single byte in the encrypted file and attempt to decrypt it. AES-GCM's authentication tag will reject it immediately.

# Flip one byte inside the ciphertext (past the 28-byte header)
python3 -c "
with open('secret.txt.enc', 'rb') as f:
    data = bytearray(f.read())
data[30] ^= 0xFF  # flip byte at position 30
with open('secret_tampered.enc', 'wb') as f:
    f.write(data)
print('Tampered file written.')
"

# Attempt decryption — should fail with auth tag mismatch
python3 decrypt_file.py secret_tampered.enc
# Expected: Decryption failed: auth tag mismatch.

AAD lets you authenticate metadata alongside the ciphertext without encrypting it. Save and run this standalone demo.

# Save as ~/crypto_labs/aad_demo.py
import os
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.exceptions import InvalidTag

key    = AESGCM.generate_key(bit_length=256)
nonce  = os.urandom(12)
aesgcm = AESGCM(key)

plaintext = b"Confidential payload"
aad       = b"recipient:alice,version:1"

ciphertext = aesgcm.encrypt(nonce, plaintext, aad)
print("Encrypted OK")

# Correct AAD — decrypts fine
msg = aesgcm.decrypt(nonce, ciphertext, aad)
print(f"Decrypted: {msg}")

# Wrong AAD — auth failure
try:
    aesgcm.decrypt(nonce, ciphertext, b"recipient:bob,version:1")
except InvalidTag:
    print("Auth tag mismatch: AAD was changed!")

# Run it
python3 aad_demo.py

Fernet is a high-level recipe combining AES-128-CBC + HMAC-SHA256. Simpler to use correctly but less flexible than raw AES-GCM.

# Run inline — no file needed
python3 -c "
from cryptography.fernet import Fernet
key   = Fernet.generate_key()
f     = Fernet(key)
token = f.encrypt(b'Secret message')
print(f'Token: {token[:40]}...')
msg   = f.decrypt(token)
print(f'Decrypted: {msg}')
"

Each participant needs their own key pair. You are simulating two users on one machine using separate --homedir paths so their keyrings never mix.

# Generate Alice's key pair in her isolated keyring
# GPG will open an interactive prompt — fill in the fields below
gpg --homedir ~/crypto_labs/alice_gpg --full-generate-key

# At the prompts, select:
#   Key type    : (1) RSA and RSA
#   Key size    : 4096
#   Expiry      : 0  (does not expire — fine for a lab)
#   Real name   : Alice Lab
#   Email       : alice@lab.local
#   Comment     : (leave blank)
#   Passphrase  : choose something simple, e.g. alicepass

# Generate Bob's key pair in his isolated keyring
gpg --homedir ~/crypto_labs/bob_gpg --full-generate-key

# At the prompts:
#   Real name   : Bob Lab
#   Email       : bob@lab.local
#   Passphrase  : e.g. bobpass

# Confirm both keyrings have their keys
gpg --homedir ~/crypto_labs/alice_gpg --list-keys
gpg --homedir ~/crypto_labs/bob_gpg   --list-keys

In a real email workflow, you publish your public key to a keyserver or attach it to an email. Here you will export both keys to files and import them into each other's keyring — simulating the key exchange step.

# Export Alice's public key to a file
gpg --homedir ~/crypto_labs/alice_gpg \
    --armor --export alice@lab.local \
    > alice_public.asc

# Export Bob's public key to a file
gpg --homedir ~/crypto_labs/bob_gpg \
    --armor --export bob@lab.local \
    > bob_public.asc

# Inspect what the exported key looks like
cat alice_public.asc
# You will see a -----BEGIN PGP PUBLIC KEY BLOCK----- header

# Import Bob's public key into Alice's keyring
# (Alice needs Bob's key to encrypt messages TO him)
gpg --homedir ~/crypto_labs/alice_gpg \
    --import bob_public.asc

# Import Alice's public key into Bob's keyring
# (Bob needs Alice's key to verify her signatures)
gpg --homedir ~/crypto_labs/bob_gpg \
    --import alice_public.asc

# Verify both keyrings now contain two keys
gpg --homedir ~/crypto_labs/alice_gpg --list-keys
gpg --homedir ~/crypto_labs/bob_gpg   --list-keys

Alice writes an email and signs it with her private key. The output is a cleartext message with a PGP signature block appended — anyone can read the message, but only Alice's private key could have produced that signature.

# Create the email body file
cat > email_body.txt << 'EOF'
To: bob@lab.local
From: alice@lab.local
Subject: Project update

Hi Bob,

The deployment is scheduled for Friday at 14:00 UTC.
Please confirm receipt.

-- Alice
EOF

# Sign it with Alice's private key (clearsign = readable + signature)
gpg --homedir ~/crypto_labs/alice_gpg \
    --clearsign \
    --local-user alice@lab.local \
    email_body.txt
# Enter Alice's passphrase when prompted
# Output written to: email_body.txt.asc

# Inspect the signed message
cat email_body.txt.asc
# You will see the original text plus a -----BEGIN PGP SIGNATURE----- block

# Bob verifies the signature using Alice's public key (already in his keyring)
gpg --homedir ~/crypto_labs/bob_gpg \
    --verify email_body.txt.asc
# Expected output:
# gpg: Good signature from "Alice Lab <alice@lab.local>"
# gpg: WARNING: This key is not certified ... (trust warning — ignore for lab)

# Now tamper with the message — edit one word — then verify again
sed -i 's/Friday/Saturday/' email_body.txt.asc

gpg --homedir ~/crypto_labs/bob_gpg \
    --verify email_body.txt.asc
# Expected: gpg: BAD signature from "Alice Lab <alice@lab.local>"

Alice encrypts a message to Bob. GPG generates a random session key, encrypts the message body with it, and then wraps the session key with Bob's public key — a digital envelope that only Bob can open.

# Re-create the email body (undo the tamper from Step 3)
cat > secret_email.txt << 'EOF'
To: bob@lab.local
From: alice@lab.local
Subject: Confidential

Bob, the server credentials are: admin / Tr0ub4dor&3
Do not share. Delete after reading.
-- Alice
EOF

# Encrypt to Bob (uses Bob's public key from Alice's keyring)
# --armor = ASCII output instead of binary (email-safe)
# --recipient = who can decrypt this
gpg --homedir ~/crypto_labs/alice_gpg \
    --armor \
    --encrypt \
    --recipient bob@lab.local \
    secret_email.txt
# Output: secret_email.txt.asc

# Inspect the encrypted output — should be unreadable
cat secret_email.txt.asc
# You will see -----BEGIN PGP MESSAGE----- followed by base64 data

# Bob decrypts using his private key
gpg --homedir ~/crypto_labs/bob_gpg \
    --decrypt secret_email.txt.asc
# Enter Bob's passphrase when prompted
# The plaintext message appears on stdout

# Redirect decrypted output to a file
gpg --homedir ~/crypto_labs/bob_gpg \
    --output secret_email_decrypted.txt \
    --decrypt secret_email.txt.asc

cat secret_email_decrypted.txt

# Try decrypting with Alice's key — it should FAIL
# (only Bob's private key can open this envelope)
gpg --homedir ~/crypto_labs/alice_gpg \
    --decrypt secret_email.txt.asc
# Expected: gpg: decryption failed: No secret key

In real secure email both operations happen together: Alice signs with her private key (so Bob knows it came from her) and encrypts with Bob's public key (so only Bob can read it). GPG does both in a single command.

# Alice signs AND encrypts in one step
gpg --homedir ~/crypto_labs/alice_gpg \
    --armor \
    --sign \
    --encrypt \
    --local-user alice@lab.local \
    --recipient bob@lab.local \
    secret_email.txt
# Output: secret_email.txt.asc (signed + encrypted)

# Bob decrypts — GPG will automatically verify the signature too
gpg --homedir ~/crypto_labs/bob_gpg \
    --decrypt secret_email.txt.asc
# Expected output includes:
# gpg: Good signature from "Alice Lab <alice@lab.local>"
# followed by the decrypted plaintext

GPG's --list-packets flag lets you see the internal structure of a PGP message — the individual packets for the encrypted session key, the encrypted body, the signature, and so on. This is the email equivalent of inspecting a TLS handshake in Wireshark.

# Inspect the signed-and-encrypted message structure
gpg --homedir ~/crypto_labs/bob_gpg \
    --list-packets secret_email.txt.asc

# Expected packet types (from outer to inner):
#   :pubkey enc packet:    — RSA-encrypted session key (for Bob)
#   :encrypted data packet: — the AES-encrypted payload
#     :compressed data packet: — GPG compresses before encrypting
#       :onepass sig packet:   — marker that a signature follows
#       :literal data packet:  — the actual message text
#       :signature packet:     — Alice's RSA signature over the message

# Inspect just the public-key encrypted session key packet
# Note the key ID — it corresponds to Bob's encryption subkey
gpg --homedir ~/crypto_labs/bob_gpg \
    --list-packets secret_email.txt.asc 2>&1 | grep -A5 "pubkey enc"

A GPG public key is identified by its fingerprint — a SHA-1 or SHA-256 hash of the key material. Verifying fingerprints out-of-band (phone, in-person) is how you confirm a public key genuinely belongs to who you think it does before trusting it. This is the human-layer solution to the key authentication problem.

# View Alice's key fingerprint
gpg --homedir ~/crypto_labs/alice_gpg \
    --fingerprint alice@lab.local

# View Bob's key fingerprint
gpg --homedir ~/crypto_labs/bob_gpg \
    --fingerprint bob@lab.local

# The fingerprint looks like:
# pub   rsa4096 2024-01-15 [SC]
#       A1B2 C3D4 E5F6 7890 ABCD  EF12 3456 7890 ABCD EF12
# Read it in groups of 4 characters when verifying over the phone

# Mark Bob's key as fully trusted in Alice's keyring
# (required to suppress the trust warning when encrypting)
gpg --homedir ~/crypto_labs/alice_gpg \
    --edit-key bob@lab.local

# At the gpg> prompt, type:
#   trust
#   5   (I trust ultimately)
#   y
#   quit

This script implements the full digital envelope manually — no GPG — using the same cryptography library from Lab 4. It makes the hybrid encryption structure explicit in code.

# Save as ~/crypto_labs/digital_envelope.py
import os
from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.primitives import hashes, serialization

# ── Key generation (Bob's key pair) ──────────────────────────────
bob_private = rsa.generate_private_key(public_exponent=65537, key_size=4096)
bob_public  = bob_private.public_key()

# ── ALICE SENDS: seal the digital envelope ───────────────────────
message = b"Bob, the secret credentials are: admin / Tr0ub4dor&3"

# Step 1: generate a random 256-bit AES session key
session_key = os.urandom(32)
nonce       = os.urandom(12)

# Step 2: encrypt the message body with the session key (AES-256-GCM)
aesgcm           = AESGCM(session_key)
encrypted_body   = aesgcm.encrypt(nonce, message, None)

# Step 3: encrypt the session key with Bob's RSA public key (the "envelope seal")
encrypted_session_key = bob_public.encrypt(
    session_key,
    padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA256()),
                 algorithm=hashes.SHA256(), label=None)
)

print(f"[Alice] Envelope sealed.")
print(f"  Session key (encrypted, first 16 bytes): {encrypted_session_key[:16].hex()}")
print(f"  Encrypted body (first 16 bytes)        : {encrypted_body[:16].hex()}\n")

# ── BOB RECEIVES: open the digital envelope ──────────────────────

# Step 4: decrypt the session key with Bob's private key
recovered_session_key = bob_private.decrypt(
    encrypted_session_key,
    padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA256()),
                 algorithm=hashes.SHA256(), label=None)
)

# Step 5: use the recovered session key to decrypt the message body
aesgcm2   = AESGCM(recovered_session_key)
plaintext = aesgcm2.decrypt(nonce, encrypted_body, None)

print(f"[Bob]   Envelope opened.")
print(f"  Decrypted message: {plaintext.decode()}")

# Run it
python3 digital_envelope.py