A02 — Cryptographic Failures

By the end of this lesson you can:

• Recognise the common cryptographic failures that cause real breaches.
• Identify sensitive data that must be protected in transit and at rest.
• Apply the modern defaults: bcrypt, TLS everywhere, Fernet/AES-GCM, secrets in env.
• Audit an app's crypto choices against a checklist.

AES, RSA, SHA-256 are not broken. Yet "cryptographic failures" is OWASP #2 — because the failures are in how crypto is applied: using a broken algorithm (MD5 for passwords), not encrypting at all (HTTP), hard-coding keys, or leaking secrets. You've already learned every fix across Lessons 9-17; this lesson assembles them into the A02 picture.

The catalogue of A02 failures

FAILURE                                  FIX (lesson)
plaintext transport (HTTP, Telnet, FTP)  TLS/HTTPS everywhere (L8-09)
passwords as plain/MD5/SHA-256           bcrypt or argon2 + salt (L8-12,13)
broken algorithm (MD5, SHA-1, DES, RC4)  SHA-256+/AES-GCM/Fernet (L8-11,15)
hard-coded / committed keys              secrets in env, .gitignore (L8-08,44)
weak randomness (random for tokens)      secrets module / os.urandom (below)
ECB mode / reused IV/nonce               authenticated modes, fresh IV (L8-15)
no encryption of sensitive data at rest  Fernet/AES-GCM (L8-14)
sensitive data in logs/URLs/errors       redact; never log secrets (L8-45)

Step 1: identify sensitive data

You can't protect what you haven't classified. Passwords, tokens, API keys, personal data (PII), payment info, health records — these need encryption in transit and at rest, and minimal retention. The first A02 question is always "what sensitive data does this app touch, and where does it live?"

Weak randomness — a subtle, common failure

import random, secrets

# WRONG: random is predictable — NOT for security tokens, IDs, salts
token = "".join(random.choices("abcdef0123456789", k=32))   # ✗ guessable

# RIGHT: the secrets module is cryptographically secure
token = secrets.token_hex(16)        # ✓ 32 hex chars, unpredictable
session_id = secrets.token_urlsafe(32)
reset_code = secrets.randbelow(1_000_000)   # secure random number

Putting the fixes together (a secure baseline)

import os, secrets, bcrypt
from cryptography.fernet import Fernet

# passwords: slow salted hash (never reversible)
hashed_pw = bcrypt.hashpw(password.encode(), bcrypt.gensalt())

# tokens / ids: cryptographically secure randomness
session_token = secrets.token_urlsafe(32)

# data at rest: authenticated encryption, key from the environment
key = os.environ["DATA_KEY"]                 # NOT hard-coded
ciphertext = Fernet(key).encrypt(sensitive_bytes)

# in transit: enforce HTTPS (config), reject plaintext
# (see L8-09: TLS with verification on)

The meta-rules

• Don't roll your own crypto — use cryptography, bcrypt, secrets with safe defaults.
• Encrypt in transit and at rest — both, for sensitive data.
• Protect the keys — env/secret manager, never code; rotate (L8-44).
• Don't leak via the side door — secrets in logs, URLs, or error pages are a crypto failure too.
• Minimise — don't store sensitive data you don't need; you can't leak what you don't have.

Goal: a before/after of a module riddled with A02 failures — the kind of code that ships and then leaks — fixed with the defaults you know.

# BEFORE — a catalogue of cryptographic failures
import hashlib, random

API_KEY = "sk-live-9f8a7b6c5d4e3f2a1b0c"        # ✗ hard-coded secret
def store_password(pw):
    return hashlib.md5(pw.encode()).hexdigest()  # ✗ MD5, no salt
def make_token():
    return str(random.randint(10**9, 10**10))    # ✗ predictable
def save_card(num):
    open("cards.txt", "a").write(num + "\n")      # ✗ plaintext at rest
def log_login(user, pw):
    print(f"login {user} pw={pw}")                # ✗ secret in logs

# AFTER — modern defaults, every failure fixed
import os, secrets, bcrypt, logging
from cryptography.fernet import Fernet

log = logging.getLogger("auth")
API_KEY = os.environ["API_KEY"]                   # ✓ from env, not code

def store_password(pw: str) -> bytes:
    return bcrypt.hashpw(pw.encode(), bcrypt.gensalt())   # ✓ slow, salted

def make_token() -> str:
    return secrets.token_urlsafe(32)              # ✓ cryptographically secure

def save_card(num: str) -> None:
    key = os.environ["CARD_KEY"]                  # ✓ key from env
    enc = Fernet(key).encrypt(num.encode())       # ✓ encrypted at rest
    open("cards.enc", "ab").write(enc + b"\n")
    # (better still: don't store card numbers at all — use a payment provider)

def log_login(user: str, pw: str) -> None:
    log.info("login attempt user=%s", user)       # ✓ never log the password

Audit result: 5 cryptographic failures → 0
  hard-coded key  → env var
  MD5 password    → bcrypt (salted, slow)
  random token    → secrets.token_urlsafe
  plaintext card  → Fernet-encrypted at rest (or: don't store it)
  pw in logs      → redacted

Read the code

Every fix is a one-liner you've already learned — the value of A02 is the checklist habit of spotting them. Notice the recurring theme: don't invent crypto, use the right library with safe defaults, keep keys in the environment, and don't leak secrets through logs or plaintext storage. The best fix of all is in the comment on save_card: the most secure way to store a card number is to not store it — outsource to a payment provider. Minimising sensitive data is the cheapest A02 defence.

Cryptographic Failures (A02) come from misusing crypto, not from broken maths: plaintext transport, weak algorithms (MD5/SHA-1 for passwords), hard-coded/leaked keys, predictable randomness (random instead of secrets), and leaking secrets via logs/URLs. The fixes are the modern defaults you've practised — bcrypt/argon2, TLS everywhere, Fernet/AES-GCM, secrets in env, the secrets module for tokens — plus the meta-rules: don't roll your own, protect the keys, and minimise the sensitive data you store. Start every review by mapping what's sensitive and how it's protected in transit and at rest.