Lion Cipher Lab

Define an agent-to-agent message protocol from scratch — an envelope, a hand-written schema registry, HMAC-SHA256 over a canonical serialization with per-sender keys, and a replay window — then forge a containment order against your own SOC mesh and measure what each layer actually stops

• AI Security
• Advanced
• ~110 min
• Free · no account required

Why it matters

Split a SOC's automation across four agents — one triages the alert, one enriches it, one supervises, one contains — and you have built a MESH: peers that talk to each other over a bus, with no parent in the middle checking their homework. The last message in that mesh pulls a host off the network. That is the whole reason this lab exists. In a document pipeline a malformed handoff produces a bad summary. Here it produces a finance server that cannot reach the domain controller at 02:00, or an exfiltrating laptop that nobody isolated, and both of those are somebody's morning. Start where…

What you'll learn

• designing a MESSAGE ENVELOPE for peer agents that do not trust each other — msg_id, conversation_id, sender, recipient, type, schema_version, issued_at, expires_at, body — and being able to say what each field defends against, because a field nobody can justify is a field nobody will maintain
• writing a SCHEMA REGISTRY and validator by hand in about a hundred lines of standard library — required and optional fields, types, ranges, enums, string patterns, a stated unknown-field policy, and a route table that pins which agent may send which message type to whom — with no pydantic, no jsonschema and nothing you have not read
• measuring what shape validation actually buys: malformed-handoff detection from 10.6% to 96.9% and wrong containment decisions from 19 to 0 on the same 400 alerts, and measuring just as carefully what it does NOT buy — 200 of 200 forged containment orders sail straight through a schema that is perfectly satisfied by them
• authenticating a peer with HMAC-SHA256 over a CANONICAL serialization, verified with hmac.compare_digest, and proving by measurement why ONE SHARED MESH KEY is not authentication at all: the compromised agent holds it, so 200 of 200 forged orders are accepted, against 0 of 200 under per-sender keys
• diagnosing the non-canonical signing bug before it reaches production: naive json.dumps signing passes every test on your laptop and then drops 100% of your own mesh's legitimate traffic the moment one normalizing hop enters the path — measured at 400 of 400 conversations dead
• defeating REPLAY, which a signature cannot touch because a replayed message is genuine: an expires_at window plus a seen-msg_id cache take 400 accepted replays to 0, and knowing that a signature covering only the body sends that straight back to 400
• being honest about the cache you just built — its memory bound is peak message rate times window length, eviction is the line that makes it bounded, and a restart opens a hole exactly one window wide (measured, and not zero)
• evolving a live protocol without an outage: measuring the 184 of 400 LEGITIMATE messages (46.0%) that strict version matching drops during a half-rolled-out v2, and the worse thing that happens when you 'fix' it by accepting both versions of a REPURPOSED field — 0 drops and 24 silently wrong containment decisions
• the judgment to know when NOT to build your own protocol, and to name the three specific situations where an existing standard already fits better than anything you will write

Steps in this lab

1. What this lab is, what it is not, and every word you will need
2. Open a terminal, check Python, make a scratch folder
3. Build the mesh — and read the paragraph about stubs before you paste anything
4. The baseline: bare JSON dicts on a queue, and the 19 wrong containment decisions nobody heard about
5. The envelope and the schema registry — a hundred lines you can read
6. Measure the schema: 10.6% detection to 96.9%, 19 wrong decisions to 0 — and the three it cannot see
7. Authenticity: canonical bytes first, then HMAC-SHA256 with per-sender keys
8. The forgery: a compromised enrichment agent orders containment as 'supervisor'
9. Why signing a non-canonical json.dumps is a bug — 400 of 400 legitimate conversations, dead
10. Replay: 400 genuine orders, said again — and the trap that undoes both defences at once
11. Version skew — the honest negative, where your own protocol takes your own mesh down
12. The whole protocol, both attacks, one table
13. When NOT to build your own protocol — and what to do on Monday

Open the full interactive lab →