Common crypto mistakes

A stream cipher combines the plaintext with a keystream built from the key and the nonce. Reuse the nonce and the same keystream appears twice, so wherever the two plaintexts agree the ciphertexts agree too, and the ciphertexts differ exactly where the plaintexts differ. An attacker who can guess one message recovers the other. The nonce is not secret; it just must never repeat under a given key.

ECB encrypts each block on its own with no link to the block before it, so identical plaintext blocks become identical ciphertext blocks. Encrypt a picture with ECB and you can still see its outline, because large areas of one colour become long runs of the same ciphertext. CBC and CTR chain each block to the previous one, so the pattern disappears. The fault is the mode, not the cipher.

SHA-256 is built for speed, which is exactly what an attacker wants: given a leaked file of hashes, they hash a list of common passwords and compare, and the search is quick. A password should be stored with a function made to be slow and to use memory, such as bcrypt, scrypt or Argon2, salted per user. The hash is not reversible, but being fast is enough to make it the wrong choice here.

If code acts on decrypted data before it has been authenticated, an attacker who can alter the ciphertext has a way to influence the result. The classic case is the padding oracle, where an error that appears only for bad padding lets the plaintext be recovered one byte at a time. Authenticated modes such as GCM attach a tag and release no plaintext unless the tag checks out, so checking first closes the channel.