Crypto Lab is a 10-part tutorial series on
cryptolab — GopherTrunk’s byte-oriented
cryptographic-research toolkit for security-testing RF encryption. Its
governing idea is blunt: attempting decryption is the test. Point it at
captured ciphertext and it attacks by every applicable method, then grades how
far each got — RESISTANT,
PARTIAL, or
BROKEN. We start from first
triage and climb to keystream-reuse recovery, the assess battery, and the
resumable subject framework.
Authorized testing only. These posts are for security researchers, licensed operators testing their own systems, and CTF/educational use. Intercepting or decrypting communications you are not authorized to access is illegal in most jurisdictions. Crypto Lab is deliberately build-tag-gated (
-tags cryptolab) and excluded from the default install.
Every post reads three ways: a TL;DR + cheat-sheet for skimmers, bold headers, tables, and diagrams for the medium read, and full prose for the deep read. Ada (new analyst) and Reese (the veteran) work each attack with you.
This is one leg of the Lab Bench trilogy: Signal Lab, RF Scope, and Crypto Lab (this one). The mystery signal Mercury, captured in Signal Lab and mapped in RF Scope, is finally cracked here.<ol class="post-list series-list"><li class="post-card"> <h2 class="post-card__title">Crypto Lab, Part 1: Breaking It Is the Test</h2> <p class="post-card__meta"> Tutorials </p><p class="post-card__desc">Crypto Lab is GopherTrunk’s byte-oriented cryptographic-research toolkit for security-testing RF encryption — shipped inside the binary but excluded from the default install behind a build tag, it attempts decryption by every applicable method and grades how far each one got.</p></li><li class="post-card"> <h2 class="post-card__title">Crypto Lab, Part 2: First Triage — classify auto and stats scan</h2> <p class="post-card__meta"> Tutorials </p><p class="post-card__desc">Crypto Lab’s classify auto emits a ranked verdict for an unknown RF payload — plaintext, substitution, repeating-XOR, periodic scrambler, LFSR, or strong-encrypted — each with the exact next command, backed by the stats scan and stats period statistical triage.</p></li><li class="post-card"> <h2 class="post-card__title">Crypto Lab, Part 3: Randomness — NIST SP 800-22 & the LFSR Signature</h2> <p class="post-card__meta"> Tutorials </p><p class="post-card__desc">Crypto Lab’s randomness battery runs a NIST SP 800-22 subset over a keystream bitstream — monobit, block frequency, runs, longest run, binary-matrix rank, spectral DFT, approximate entropy, serial, cumulative sums, and linear complexity — to tell strong keyed encryption from an exploitable LFSR scrambler.</p></li><li class="post-card"> <h2 class="post-card__title">Crypto Lab, Part 4: Classical Ciphers — Brute XOR, Caesar, Vigenère, Substitution</h2> <p class="post-card__meta"> Tutorials </p><p class="post-card__desc">Crypto Lab’s brute tool recovers classical ciphers — repeating XOR, Caesar shift, Vigenère, and monoalphabetic substitution — using an embedded English trigram language model and optional cribs, with lfsr recovering the keystream of a linear scrambler.</p></li><li class="post-card"> <h2 class="post-card__title">Crypto Lab, Part 5: Keystream Reuse — Many-Time-Pad & Crib-Dragging</h2> <p class="post-card__meta"> Tutorials </p><p class="post-card__desc">Crypto Lab’s ks tool exploits keystream reuse — the core real-world break against additive stream ciphers like P25 DES-OFB, ADP/RC4, and TETRA AIE — detecting IV/MI collisions with ks reuse and recovering plaintext with ks mtp via known-plaintext or crib-dragging, no key recovery required.</p></li><li class="post-card"> <h2 class="post-card__title">Crypto Lab, Part 6: The assess Battery — Attacking P25/DMR/TETRA</h2> <p class="post-card__meta"> Tutorials </p><p class="post-card__desc">Crypto Lab’s assess crypto harness runs every applicable attack against captured P25, DMR, and TETRA frames and grades each — cipher-strength, a published-weakness knowledge base, IV reuse, known-plaintext, weak/default keys against the real ciphers, and reduced-keyspace brute — landing on a RESISTANT, PARTIAL, or BROKEN verdict.</p></li><li class="post-card"> <h2 class="post-card__title">Crypto Lab, Part 7: CRC Recovery & the Recipe Pipeline</h2> <p class="post-card__meta"> Tutorials </p><p class="post-card__desc">Crypto Lab’s crc recover reconstructs a protocol’s CRC parameters — width, polynomial, init, reflection, and xorout — from sample frames, while recipe run chains transform and analysis operations into a CyberChef-style reusable pipeline for de-obfuscating RF payloads.</p></li><li class="post-card"> <h2 class="post-card__title">Crypto Lab, Part 8: Analog Voice Descrambling — Inversion, Split-Band, Rolling Code</h2> <p class="post-card__meta"> Tutorials </p><p class="post-card__desc">Crypto Lab’s descramble tool undoes analog voice privacy — frequency inversion, split-band inversion, and rolling-code hopping — operating on raw 16-bit PCM audio, and shows why analog scrambling is fundamentally weaker than digital encryption.</p></li></ol><p class="blog-feed-link"> See all tutorials or subscribe via RSS. </p>