Lion Cipher Lab
Stop ciphertext swapping in field-level encryption by binding each value to its row with AEAD associated data
- AppSec / DevSecOps
- Advanced
- ~75 min
- Free · no account required
Why it matters
Teams encrypt the scary columns (social security numbers, bank accounts, roles, API tokens) and tick the 'encrypted at rest' box. Then someone with write access to the database, through SQL injection, a stolen backup, or an over-privileged admin, copies one encrypted value into another row. The app decrypts it perfectly, because the ciphertext is genuine. In this lab that one move makes an ordinary user an admin, redirects a payout to an attacker's account, and reads another user's SSN through the attacker's own profile page, all without the key. The fix is one argument most code leaves…
What you'll learn
- Field-level (application-layer) encryption of database columns with AES-GCM
- Threat-modelling an attacker who can write to the database but holds no key
- Binding ciphertext to table, column, primary key and key id with AEAD associated data
- Measuring cross-row, cross-column, rollback, bit-flip and truncation attacks before and after a fix
- Stopping rollback with a version in the AAD checked against an authoritative counter
- Key ids for rotation, and the NIST usage limit for random 96-bit GCM nonces
- Knowing what associated data does NOT protect against
Steps in this lab
- Field-level encryption and AEAD, in plain words
- The attacker who can write to your database but has no key
- Set up a workspace and install one library
- Read the toy app: one function decides everything
- Before: run it with no associated data
- The fix: bind each value to its key id, table, column and row
- Honest negative 1: binding does not stop rollback
- Honest negative 2: an attacker who can make the app encrypt
- Design the AAD well: what goes in, what stays out
- Nonces, usage limits and key rotation with a key id
- Where the key lives: envelope encryption and a KMS
- Searchable columns: why deterministic encryption leaks
- When to use this, when not to, and how a pro does it