Crypto lab
Three primitives, three failure modes, demonstrated on data you can safely break.
Each demo below runs entirely in your browser using the standard WebCrypto API — no network calls, no server, no stored state. They are built to show the failure behaviour, not just the happy path: tamper with the input and watch the control refuse.
Defensive demonstration only. All inputs are synthetic placeholders and all keys are generated locally per session. Do not paste real secrets, credentials, or personal data into these fields.
Interactive
Run the primitives
Every demo links back to the control it supports in the catalog, so the mechanism and its governance stay connected.
1 · Digest & the avalanche property
Change a single character below. The digest changes completely — that is what lets a hash safely name an artifact, a container image, or an audit record. It is also why hashes alone are not encryption and never protect confidentiality.
SHA-256 digest (hex)
—
Control link: CR-07 signs SHA-256 digests of build artifacts. MD5 and SHA-1 are prohibited in the approved catalog because collision resistance is a prerequisite wherever a hash authorises something.
2 · HMAC webhook integrity (CR-08)
A shared secret proves the message came from the partner and was not modified. Sign the payload, then edit the received body and verify — this is exactly the check that stops forged callbacks from moving money.
HMAC-SHA-256 signature header
—
Production requirements beyond this demo: constant-time comparison, a timestamp inside the signed material, a replay window (5 minutes), and per-partner secrets held in the secret store with rotation.
3 · AES-256-GCM envelope encryption (CR-01, CR-02)
A fresh data encryption key is generated per record and, in the real architecture, immediately wrapped by a non-exportable KMS key. The additional authenticated data binds the ciphertext to its tenant and record id — change it on decrypt and the whole operation fails closed.
The DEK is displayed here only because this is a teaching demo running in your own tab. In the reference architecture (ADR-023) key material is never exportable and never leaves the KMS boundary.
Interpretation
What a reviewer should take from this page
Fail closed, always
Authenticated encryption and MAC verification return nothing on mismatch. Any code path that logs, parses, or partially trusts unverified input has already lost.
Context is part of the ciphertext
Binding tenant and record identifiers into AAD converts a subtle authorisation bug into a hard cryptographic failure, which is far easier to detect and test.
Nonce discipline is the real risk
AES-GCM is unforgiving about nonce reuse, which is why the shared SDK owns nonce generation and rejects caller-supplied values outright.