Applied Cryptography Security Lab
Independent Project / Cybersecurity / Applied Cryptography / Security Architecture
A defensive applied-cryptography portfolio lab demonstrating cryptographic control selection, key lifecycle governance, encryption and integrity controls, TLS posture, evidence design, and responsible security architecture using synthetic data and browser-local cryptographic demonstrations.
Problem or objective
Enterprise cryptography is not only about choosing strong algorithms. Organizations also need clear ownership, key inventories, rotation and revocation processes, evidence, architecture decisions, and governance that make cryptographic controls reviewable and repeatable.
Rachel's role
Sole designer and full-stack builder responsible for the cryptographic control model, key-lifecycle concepts, synthetic governance data, browser-local Web Crypto demonstrations, architecture documentation, risk framing, UI/UX, testing, and public documentation.
Process
- 01Define cryptographic governance and security-architecture requirements
- 02Model synthetic control, key, owner, evidence, risk, and lifecycle data
- 03Build cryptographic control catalog
- 04Model key generation, use, rotation, revocation, and destruction lifecycle
- 05Demonstrate SHA-256/384/512 hashing
- 06Demonstrate HMAC-SHA-256 integrity verification and tamper rejection
- 07Demonstrate AES-256-GCM encryption with authenticated data binding
- 08Model TLS posture, governance reviews, architecture decisions, and post-quantum readiness
- 09Verify data integrity, typecheck, lint, and production build
Architecture components
Control model
- Cryptographic Control Catalog
- Evidence & Governance
- Risk Register / Post-Quantum Readiness
Key management
- Key Lifecycle Governance
- Generation, rotation, revocation, destruction
- Synthetic key aliases and custodians
Applied primitives
- Browser-local Web Crypto Lab
- Integrity Verification
- Encryption & Authenticated Data
Transport posture
- TLS Security Controls
- Illustrative framework mappings
- Architecture decision records
Case study
Business problem
Cryptographic strength alone does not make a program defensible. Teams need to know which control applies where, who owns each key, when it rotates, what evidence exists, and which architecture decisions were made and why. This lab models that governance layer alongside working cryptographic demonstrations.
Cryptographic control selection
- Catalog of cryptographic controls with purpose, scope, and rationale
- Control selection tied to data sensitivity and threat context rather than algorithm preference
- Illustrative framework mappings for reviewability, not compliance claims
- Synthetic coverage metrics that show gaps as clearly as strengths
Key lifecycle and governance
- Modeled lifecycle across generation, use, rotation, revocation, and destruction
- Synthetic key aliases with named custodians and ownership boundaries
- Rotation cadence and revocation triggers documented per key class
- Evidence records and governance reviews attached to lifecycle events
Applied cryptographic primitives
- SHA-256, SHA-384, and SHA-512 hashing demonstrated live in the browser
- HMAC-SHA-256 integrity verification with explicit tamper rejection
- AES-256-GCM encryption with authenticated additional data binding
- All operations run browser-local through the Web Crypto API; nothing is transmitted or stored
Architecture and production boundaries
- Implemented: control catalog, key lifecycle model, browser-local Web Crypto demonstrations, TLS posture views, evidence and risk register, documentation
- No backend, database, authentication, cloud KMS/HSM, external API, or real environment connection
- Production would require a managed KMS or HSM with hardware-backed key storage
- Production would require authentication, role-based authorization, and protected secrets
- Production would require persistent, monitored evidence storage and named control owners
Responsible limitations
- All records, metrics, custodians, risks, and decision records are synthetic and illustrative
- Framework references are illustrative mappings, not compliance, certification, attestation, or assessment
- Browser-local demonstrations are educational and are not a validated cryptographic implementation
- Post-quantum readiness content is planning framing, not a migration guarantee
Engineering quality
- TypeScript, React, and TanStack Start with typed domain modules
- Data-integrity checks across synthetic control, key, and evidence records
- Typecheck clean with 0 errors
- Lint clean with 0 errors
- Successful production build
Tools and technologies
- TypeScript
- React
- TanStack Start
- Tailwind CSS
- Web Crypto API
- AES-256-GCM
- HMAC-SHA-256
- SHA-2 Family
- Key Lifecycle Governance
- TLS Security Controls
- Security Architecture
Security and ethical considerations
- Browser-local cryptographic demonstrations only, executed with the Web Crypto API in the visitor's own browser
- No backend, no database, no authentication, no cloud KMS or HSM, no external API, and no real environment connection
- All program metrics, control records, key aliases, custodians, mappings, risks, and decision records are synthetic illustrative data
- Framework references are illustrative mappings only, not compliance, certification, attestation, or assessment
- Defensive scope only: control selection, governance, and verification, with no offensive or bypass techniques
- No secrets, credentials, or private keys in the public repository
Outcome
A public, documented applied-cryptography lab covering control selection, key lifecycle governance, browser-local hashing, HMAC integrity verification, AES-256-GCM authenticated encryption, TLS posture, evidence design, and post-quantum readiness framing, verified with clean typecheck, lint, and production build.
Portfolio lab using synthetic data only. All controls, keys, custodians, evidence, mappings, risks, and decision records are synthetic and illustrative. Cryptographic demonstrations run browser-local through the Web Crypto API. There is no backend, database, authentication, cloud KMS or HSM, external API, or real environment connection, and nothing here constitutes compliance, certification, attestation, or assessment.