Attacking Weak Crypto

The break is (almost) never the algorithm

graph TD
ALGO["strong algorithm<br/>AES, SHA-256"] --> M1["fast hash for passwords"]
ALGO --> M2["reused nonce"]
ALGO --> M3["ECB mode"]
ALGO --> M4["hardcoded key"]
ALGO --> M5["math/rand"]
ALGO --> M6["== on secrets"]
M1 --> BROKEN["broken in practice"]
M2 --> BROKEN
M3 --> BROKEN
M4 --> BROKEN
M5 --> BROKEN
M6 --> BROKEN

Dictionary attacks: why fast hashes lose

“Cracking” a hash isn’t reversing it — it’s guessing and re-hashing until a guess matches. Because SHA-256 is fast, an attacker tries an enormous wordlist cheaply. This runs here: it cracks unsalted SHA-256 hashes against a small wordlist, exactly as a real cracker does:

package main

import (
"crypto/sha256"
"encoding/hex"
"fmt"
)

func sha(s string) string {
h := sha256.Sum256([]byte(s))
return hex.EncodeToString(h[:])
}

func main() {
// A "stolen database" of unsalted SHA-256 password hashes.
stolen := map[string]string{
	"alice": sha("password123"),
	"bob":   sha("letmein"),
	"carol": sha("S3cur3!Passphrase-No-One-Guesses"),
}

// The attacker's wordlist (real ones have millions of entries).
wordlist := []string{"123456", "password", "letmein", "password123", "qwerty"}

// Precompute hash -> word, then match the whole DB at once.
rainbow := make(map[string]string, len(wordlist))
for _, w := range wordlist {
	rainbow[sha(w)] = w
}

for user, h := range stolen {
	if pw, ok := rainbow[h]; ok {
		fmt.Printf("%-6s CRACKED -> %s\n", user, pw)
	} else {
		fmt.Printf("%-6s safe (not in wordlist)\n", user)
	}
}
}

alice and bob fall instantly; carol’s long, unusual passphrase survives this list but not a bigger one run at GPU speed. The fix isn’t a better hash function — it’s a slow, salted KDF (argon2id/bcrypt) so each guess costs ~100ms instead of nanoseconds, turning a seconds-long crack into millennia.

The other classic mistakes

• ECB mode leaks patterns. AES in ECB encrypts identical blocks identically, so structure shows through the ciphertext (the “ECB penguin”). Use AEAD (AES-GCM).
• Nonce reuse is fatal. Reuse a key+nonce with GCM/CTR and the keystream repeats: C1 XOR C2 = P1 XOR P2 leaks the plaintexts, and GCM additionally exposes its authentication key. One nonce, one message, forever.
• Hardcoded keys. A secret in source is in git history and the binary (strings ./app finds it). Rotating it needs a rebuild. Secrets go in the environment or a secrets manager.
• Weak randomness. math/rand is a predictable PRNG — fine for jitter, fatal for keys, tokens, and nonces. Use crypto/rand.
• Timing side-channels. Comparing a secret with == returns early on the first mismatch, leaking the matching length through response time. Use crypto/subtle.ConstantTimeCompare.

crypto/rand vs math/rand — the one-byte difference that matters

import "crypto/rand" // NOT math/rand — for any security value

token := make([]byte, 32)
rand.Read(token) // cryptographically secure, unpredictable
// math/rand would give predictable bytes an attacker can reproduce.

This single import choice is the difference between an unguessable session token and one an attacker can reproduce from the PRNG state. When in doubt for anything security-sensitive, it’s crypto/rand.

See also

• Hashing & passwords — the slow KDFs that defeat dictionary attacks.
• Symmetric encryption — AEAD, nonces, and why ECB is banned.
• Secrets management — keeping keys out of source and binaries.
• Supply-chain security — govulncheck for vulnerable crypto libraries.

Next: defensive engineering, starting with the bug class behind most breaches — input validation & injection defense.

Related topics