Lesson 6.1: Cryptographic mistakes in code
Most cryptographic failures in real systems aren't broken algorithms but misuse: switched-off certificate checks, keys written into source code, ECB mode, non-constant-time comparisons, predictable random numbers, fast hashes for passwords. OWASP calls this A02, Cryptographic Failures. In the lab you review a small PHP code base like an auditor, find five mistakes with one grep, fix the two that are one-line changes, check the syntax, and write down the fixes the others need.
18 min
You will learn to
- Recognise the common cryptographic mistakes in code
- Explain why certificate verification must never be disabled
- Use constant-time comparison for secrets
- Explain why keys don't belong in source code
- Write remediation notes
Key terms
- Cryptographic failures
- OWASP A02: data exposed because cryptography is missing, weak or misused.
- Certificate verification
- The client's check that the server's certificate is valid for that name and signed by a trusted CA.
- Hard-coded secret
- A password or key written into source code or a config file in the repository.
- Timing attack
- Learning a secret by measuring how long operations take, for example a comparison that stops at the first wrong character.
- Crypto agility
- Designing systems so algorithms and keys can be replaced without rewriting everything.
← Server-side request forgery (SSRF) · All lessons · Incident response: prepare, detect, contain, eradicate, recover, learn →