Chapter 25 — Laboratory I

Chapter 25 — Laboratory I

Lesson map

Lesson 25 published. Map, example, EX073.

flowchart TD
  N0["Learning outcomes"]
  N1["25.1 The lab task"]
  N2["25.2 Testing"]
  N3["25.3 The lab report"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX073"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["25.1 The lab task"]
  N2["25.2 Testing"]
  N3["25.3 The lab report"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX073"]

[Learning outcomes]
    |
    v
[25.1 The lab task]
    |
    v
[25.2 Testing]
    |
    v
[25.3 The lab report]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX073]

Learning outcomes

You will (1) build a small protected-export tool in a lab; (2) test it with positive and negative cases; (3) write a lab report.

25.1 The lab task

In Laboratory I, Priya's team builds a tool that exports synthetic patron records for a partner library, protected with authenticated encryption from a vetted library, using the parameters from Chapter 23. The tool loads a key from a test secret store, encrypts each record with associated data, and writes a file the partner can decrypt with the shared key. The lab uses only synthetic records; no real patron data enters the lab environment. Each team member reviews another member's code before tests run, so mistakes are caught early.

25.2 Testing

The team writes tests: decryption returns the original records; a tampered byte causes failure; swapping two records' associated data causes failure; a wrong key causes failure; and encrypting the same record twice produces different outputs. One test fails initially because the team accidentally reused a fixed nonce from an example snippet, so repeated encryptions matched. They remove the fixed nonce and let the library generate it. The failing test prevented a dangerous mistake from reaching production. They also add a regression test for the nonce bug.

25.3 The lab report

Priya writes the report: aim, design, parameters with citations, tests and results, the nonce bug and its fix, and limitations. Limitations include key sharing by manual transfer, which a later lab will replace, and lack of side-channel review. She includes the test output and states plainly that the tool relies on the library's cryptography and that the team implemented no primitives. Dr. Echeverría grades the report for clarity and honesty as well as correctness. She also attaches the test logs as an appendix.

Worked example

The team's export tool passes five tests after a fixed-nonce bug from an example snippet is caught and removed, and Priya's report states limitations.

Synthetic case. The lab and records are invented.

Errors and limits

Example code often contains fixed keys or nonces for demonstration; never copy them. Manual key transfer is a weak point.

Exercises

• EX073 — Five tests. List three of the five tests. Rubric: 3 = three of correct decryption, tamper fails, swapped AD fails, wrong key fails, different outputs;; 2 = two;; 1 = one;; 0 = none.
• EX074 — Nonce bug. What bug did testing reveal? Rubric: 3 = a fixed nonce copied from an example snippet, making repeated encryptions identical;; 2 = fixed nonce;; 1 = vague;; 0 = none.
• EX075 — Report limitations. Name one limitation in the report. Rubric: 3 = manual key transfer or no side-channel review;; 2 = one;; 1 = vague;; 0 = none.

Synthesis

Laboratory work proves design choices with tests, and honest reports record both bugs and limits.

Continue studying — chapter 25 of 40

← Chapter 24 (draft) · Course chapter index · Chapter 26 (draft) →