Goal
Work the first three Cryptopals sets as a staged project: build the primitives from bytes up, then attack them. By the end you have broken single- and repeating-key XOR, distinguished and decrypted AES modes, and executed a CBC padding-oracle attack — proving in your own hands why nonce reuse, missing authentication, and home-rolled modes are catastrophic, and why the boring library answers exist.
Subject: full brief & instructions
Practices
- Cryptography for engineers — the primitive families, AEAD, nonce discipline, and the misuse traps this project makes visceral.
- TLS/HTTPS & certificate management — where these same primitives get composed into a protocol you deploy.
- Unicode & text encoding — base64/hex are encodings, not encryption; the byte/character distinction bites early here.
Milestones
- Set 1 — basics. Hex↔base64, fixed XOR, single-byte XOR cipher (score plaintext by letter frequency), detect single-char XOR in a file, break repeating-key XOR (Hamming-distance keysize search), and decrypt AES-128-ECB with a library. Each is independently shippable and testable against the provided fixtures.
- Set 2 — block crypto. Implement PKCS#7 padding, CBC mode by hand on top of a raw ECB block function, write an ECB/CBC detection oracle, then mount the byte-at-a-time ECB decryption attack (simple, then with a random prefix).
- Set 3 — the payoff attack. Build the CBC padding-oracle attack end to end and recover plaintext with no key — the milestone that permanently changes how you read "encryption without integrity". Add CTR mode and break fixed-nonce CTR.
- Write up the lessons. For each attack, note the one design rule that would have prevented it (authenticate with AEAD, never reuse a nonce, pad-check in constant time).
Stretch goals
- Continue into set 4 (stream-cipher/CTR and MAC attacks) and set 5 (Diffie-Hellman, RSA).
- Re-implement one broken construction correctly with libsodium/Tink and show the attack now fails.
Related
- Cryptopals — subject — the full brief, instructions, and acceptance checks for this exercise.
- Cryptography for engineers — cites this
exercise in its
# Practicesection. - Personal CA + mTLS between two services — the constructive counterpart: compose primitives into a working protocol.