Watch your en­cryp­tion break.

What happens

We draw a paper penguin in this tab and encrypt its pixels with AES-128 in ECB mode — a deliberately broken, quarantined implementation — one 16-byte block at a time, all under the same key. Identical plaintext blocks become identical ciphertext blocks, so flat color stays flat and the outline walks straight through the “encryption”. Beside it, the same pixels go through AES-128-GCM in your browser’s Web Crypto and come out as noise: same cipher, same key size, different mode. All of it is live.

Real-world

In 2020, Citizen Lab found every Zoom meeting’s audio and video encrypted with one shared AES-128 key in ECB mode; Zoom 5.0 moved to AES-256-GCM. Citizen Lab’s report

Adobe’s 2013 breach showed the same fingerprint: its leaked passwords were Triple DES, and the repeats in the dump showed ECB, so identical passwords had identical ciphertext. The deeper mistake was encrypting them at all. Passwords should be stored with a slow, salted password hash such as Argon2id, never encrypted. Sophos analysis (archived)

In your code

ECB rarely ships on purpose. Often it ships as a default: with Java’s standard provider (SunJCE), asking for plain "AES" gets you ECB.

// Java (SunJCE): plain "AES" means AES/ECB/PKCS5Padding
Cipher.getInstance("AES");
# Python, PyCryptodome
AES.new(key, AES.MODE_ECB)
// Node
createCipheriv('aes-128-ecb', key, null)

// the fix: an AEAD, with a fresh 96-bit nonce for every message
Cipher c = Cipher.getInstance("AES/GCM/NoPadding");
c.init(Cipher.ENCRYPT_MODE, key, new GCMParameterSpec(128, nonce));

GCM has its own sharp edge: never reuse a nonce under one key. A repeat leaks the XOR of the two messages and will likely let an attacker recover the authentication key and forge messages. A 2016 scan found 184 HTTPS servers doing it. With random nonces, NIST caps a key at 2³² messages.

How to find it

• Search code and config for MODE_ECB, modes.ECB, /ECB/, -ecb, CipherMode.ECB and a bare Cipher.getInstance("AES").
• Static analysis helps, unevenly: Semgrep flags ECB and a bare "AES" in Java, and CodeQL’s weak-cryptographic-algorithm queries catch ECB in Java and Python. Neither catches every Python or Node call, so search as well.
• Look at stored ciphertext: identical 16-byte blocks in records that should differ are ECB’s fingerprint.

What happens

Verified artifacts, checked live. We load two published colliding pairs — Wang, Feng, Lai and Yu’s 128-byte MD5 pair (2004) and the first 320 bytes of the SHAttered PDFs (CWI and Google, 2017) — confirm each file against a pinned SHA-256, then hash them in your browser: MD5 with a quarantined implementation, SHA-1 with Web Crypto. Different bytes, identical digests: a collision. SHA-256 then tells each pair apart.

We never fake finding a collision. An identical-prefix MD5 collision takes seconds on an ordinary PC today; SHAttered took about 6,500 CPU-years and 110 GPU-years (Google’s figures), and the 2020 chosen-prefix “Shambles” collision cost its authors about US$75,000.

Real-world

Flame (2012) spread in part as a fake Windows Update, signed with a certificate forged through an MD5 chosen-prefix collision to chain to a Microsoft root. Microsoft’s expla­nation

In your code

# Python
hashlib.md5(data).hexdigest()
// Java
MessageDigest.getInstance("SHA-1")
# a SHA-1-signed certificate request
openssl req -new -sha1 …

# the fix
hashlib.sha256(data).hexdigest()

MD5 still catches accidental corruption; it can’t stop an attacker. Anything someone might want to forge can’t rest on it: signatures, certificates, code signing, download checks, deduplication of user uploads.

How to find it

• Certificates: openssl x509 -in cert.pem -noout -text and look for sha1WithRSAEncryption or md5WithRSAEncryption.
• Code: search for md5, sha1, SHA-1, MD5.Create, SHA1.Create, then ask what each digest protects.
• Signing: check code-signing, package-signing and PGP keys still made or certified with SHA-1.

What happens

Three live breaks, all real math on deliberately weak keys, run in a worker: a toy modulus of up to 64 bits factored with Pollard’s rho, its private key rebuilt and a message decrypted; two 512-bit moduli that share a prime, both broken at once by one greatest common divisor; and a key whose primes sit too close together, split by Fermat’s method in milliseconds. The fix side runs RSA-OAEP with a 3072-bit key in Web Crypto.

We never fake factoring a properly generated 512-bit key: that took seven months, about 300 computers and a Cray supercomputer in 1999 — and under four hours and $75 of rented cloud time by 2015.

Real-world

In 2012, “Mining Your Ps and Qs” computed RSA private keys for about 64,000 TLS hosts (0.50%) whose keys shared primes — with one GCD pass. factorable.net

In your code

// Java KeyPairGenerator: too small
kpg.initialize(1024);
# OpenSSH: too small
ssh-keygen -t rsa -b 1024
# Python: fine
rsa.generate_private_key(public_exponent=65537, key_size=3072)

A small key is a setting you can grep for. Shared and too-close primes aren’t: they come from weak randomness or a broken key generator, often in firmware, and show up only in the keys themselves.

How to find it

• Key sizes: openssl x509 -in cert.pem -noout -text prints Public-Key: (1024 bit); ssh-keygen -l -f key.pub prints the bits first.
• Badly generated keys: badkeys checks public keys for ROCA, Fermat-close primes, Debian’s broken generator, known shared primes and known leaked keys.
• Shared primes among your own keys: run a batch GCD over all of them, such as fastgcd from the “Ps and Qs” team.
• Servers: testssl.sh -S host prints each server’s certificate key size and signature algorithm.

What happens

Live in your browser. A worker runs RC4 under many thousands of fresh keys and tallies the second keystream byte of each. A fair cipher spreads the tally evenly — about 0.39% per value; RC4 piles about 0.78% onto zero, roughly twice its share (the Mantin–Shamir bias). Run the same test on AES-GCM’s output and the tally stays level.

Real-world

RC4’s key-scheduling flaws broke WEP Wi-Fi (2001); its keystream biases later let researchers recover an HTTPS cookie from RC4-TLS in about 75 hours (2015). RC4 NOMORE

In your code

RC4 lingers in old cipher lists, legacy libraries and Windows Kerberos (RC4-HMAC).

# nginx: RC4 still allowed
ssl_ciphers HIGH:RC4-SHA;
# Apache
SSLCipherSuite AES128-SHA:RC4-SHA
// Java
Cipher.getInstance("ARCFOUR")

How to find it

• TLS: testssl.sh --rc4 host, or nmap -sV --script ssl-enum-ciphers -p 443 host, which reports “Broken cipher RC4 is deprecated by RFC 7465”.
• SSH: ssh-audit host flags the arcfour ciphers.
• Active Directory: since Microsoft’s April 2026 updates, domain controllers default to AES for Kerberos. Find the accounts whose msDS-SupportedEncryptionTypes still allow RC4.

What happens

Two lessons, both live. First, the keyspace: a worker brute-forces a deliberately reduced DES keyspace (up to 24 bits) so you can feel each extra bit double the work, then extrapolates from your browser’s own speed to the full 2⁵⁶ — which we never attempt. The EFF’s Deep Crack found a key in 56 hours in 1998 after searching about a quarter of it.

Second, the birthday bound: with 64-bit blocks, repeats become likely after about 2³² blocks (32 GiB) under one key, and in CBC mode a repeat leaks the XOR of two plaintext blocks. We simulate that at a scale your browser can hold, labeled as scaled; the real attack needs hundreds of gigabytes.

Real-world

Sweet32 (2016) recovered an HTTPS cookie from 3DES traffic after capturing 610 GB in 30.5 hours. sweet32.info

In your code

// Java: 3DES
Cipher.getInstance("DESede/CBC/PKCS5Padding")
# OpenVPN’s old default: Blowfish
cipher BF-CBC
# a 3DES suite in a TLS cipher list
TLS_RSA_WITH_3DES_EDE_CBC_SHA

How to find it

• TLS: testssl.sh --sweet32 host; nmap’s ssl-enum-ciphers warns “64-bit block cipher 3DES vulnerable to SWEET32 attack”.
• SSH: ssh-audit host flags 3des-cbc and blowfish-cbc.
• VPNs, configs and code: search for 3des, DES-CBC3, des-ede3, DESede, TripleDES, BF-CBC and blowfish.