OpenCyber Academy
Rapid course · Lesson 4 · English
Course code: OCA-008Lesson 04: OCA-008-A004

Cryptography and trust services: guided lab and applied synthesis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 04 published. Map, example, EX039.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 The guided task"]
  N2["Lab — Checking a download fingerprint"]
  N3["4.2 Reading the result"]
  N4["4.3 Summarising for the team"]
  N5["4.4 What comes next"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX039"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 The guided task"]
  N2["Lab — Checking a download fingerprint"]
  N3["4.2 Reading the result"]
  N4["4.3 Summarising for the team"]
  N5["4.4 What comes next"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX039"]

[Learning outcomes]
    |
    v
[4.1 The guided task]
    |
    v
[Lab — Checking a download fingerprint]
    |
    v
[4.2 Reading the result]
    |
    v
[4.3 Summarising for the team]
    |
    v
[4.4 What comes next]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX039]

Learning outcomes

You will (1) complete a guided task verifying a downloaded file with a published fingerprint; (2) interpret the result correctly; (3) write a short plain-language summary for the library team; (4) plan your next learning steps.

4.1 The guided task

The library wants to install a free catalogue tool on a staff laptop. The project's website publishes a SHA-256 fingerprint for each download. Inês asks Leo to check that the file he downloaded matches. The idea is simple: if even one byte of the file was damaged or swapped, the fingerprint will differ. Leo does the task in a safe way, using a synthetic file in the lab below, then repeats the steps with the real download under Inês's supervision. The lab compares a correct file and a tampered file against the published value and prints match or mismatch for each.

Lab — Checking a download fingerprint

# Compare synthetic downloads with a published SHA-256 fingerprint.
import hashlib
original = b"catalogue-tool v2.1 synthetic installer bytes " * 50
published = hashlib.sha256(original).hexdigest()
tampered = original[:-1] + b"!"
print("published:", published[:24] + "...")
for name, data in [("download_ok.bin", original), ("download_bad.bin", tampered)]:
    print(name, "MATCH" if hashlib.sha256(data).hexdigest() == published else "MISMATCH")

Run with python3 lab_checkfile.py. Verified output:

published: 215e60edb672063786f8bb92...
download_ok.bin MATCH
download_bad.bin MISMATCH

4.2 Reading the result

A match tells Leo the file is identical to the one whose fingerprint was published. It does not tell him the software is safe or free of bugs, and if an attacker had changed both the file and the fingerprint on the same website, the check would still match. That is why some projects also sign their releases with a digital signature, which needs the project's private key to forge. Leo writes down both points. A mismatch means stop: do not install, download again from the official site and tell Inês if it still fails.

4.3 Summarising for the team

Leo writes a five-sentence summary for library staff. The catalogue tool download was checked against the fingerprint published by the project and matched. This shows the file was not damaged or swapped on the way. It does not prove the software is safe, so it is installed only on one laptop first. If a check ever fails, the file must not be installed. Leo also lists the three findings from earlier chapters: the password sticky note, the expiry calendar and the warning about clicking through certificate errors, each with who will act.

4.4 What comes next

The course ends with a short reflection. Leo can now explain the three promises, tell encoding from encryption, ask for permission and scope, store nothing secret in notes and check a download fingerprint. He knows what he does not know: how TLS negotiates keys, how certificates are issued, and how organisations manage keys over years. Inês recommends next steps: the Professional course, and reading accessible chapters of the Handbook of Applied Cryptography by Menezes, van Oorschot and Vanstone, whose chapters are free online. Leo leaves with a clear picture of the core risks and one safe task completed.

Worked example

Leo runs the fingerprint lab, verifies the real download under supervision, writes a five-sentence staff summary and lists three earlier findings with owners.

Synthetic case. The catalogue tool, files and fingerprints are synthetic; the Handbook of Applied Cryptography is real.

Errors and limits

A fingerprint from the same website as the file proves only that the two match. Signatures need the signer's key to be trusted correctly.

Exercises

Synthesis

Checking a published fingerprint is a small, real cryptographic task, and understanding what it does and does not prove is the course's final lesson.

Continue studying — lesson 04 (chapter 04 of 20)

← Chapter 03 · Course chapter index · Chapter 05 →

Continue to the next authored lesson.

Worked answers

EX039. A SHA-256 fingerprint of each file.

EX040. The correct file printed MATCH and the tampered file printed MISMATCH.

EX041. That the downloaded file is exactly the file whose fingerprint was published.

EX042. It does not prove the software is safe or free of bugs.

EX043. If an attacker replaced both the file and the published fingerprint on the same website.

EX044. Because forging a digital signature requires the project's private key, which an attacker on the website lacks.

EX045. Stop, not install, download again from the official site and tell Inês if it still fails.

EX046. Because the match does not prove safety, so trying it on one laptop limits harm if something is wrong.

EX047. The password sticky note, the expiry calendar and the advice not to click through certificate warnings.

EX048. How TLS negotiates keys and how certificates are issued.

EX049. The Handbook of Applied Cryptography by Menezes, van Oorschot and Vanstone.

EX050. The Professional course in cryptography and trust services.