Crypto

Crypto — Cryptography Implementation

Activate When

• User invokes /godmode:crypto
• User says "encryption", "hashing", "password storage", "bcrypt", "argon2"
• User says "key management", "digital signature", "JWT signing"
• User says "TLS setup", "HTTPS configuration", "certificate"
• When code handles sensitive data (PII, financial, health records)

Workflow

Step 1: Requirements Assessment

Classify data: at rest (passwords, PII, financial, API keys), in transit (TLS, mTLS, DB connections), integrity (signatures, HMAC, checksums), compliance (PCI-DSS, HIPAA, GDPR, FIPS).

Step 2: Algorithm Selection

Password hashing: Argon2id (m=65536, t=3, p=4) primary. bcrypt (cost 12+) fallback. NEVER MD5, SHA1, SHA256, PBKDF2 ( deploy -> grace -> retire old. Track version with data.

Step 8: Report

CRYPTO RESULT:
Use case: 
Algorithm: 
Key management: 
Key rotation: 
Weak crypto found: 
Verdict: 

Key Behaviors

1. Use established libraries. Never implement your own crypto.
2. Algorithm selection is not negotiable. AES-256-GCM, Argon2id, RS256/ES256.
3. Never reuse nonces/IVs. Single reuse with GCM breaks authentication.
4. Key management is the hard part. Use KMS or Vault.
5. Envelope encryption for data. Never encrypt directly with master key.
6. Forward secrecy is mandatory. ECDHE for TLS.
7. Hash passwords, never encrypt. Hashing is one-way.

Flags & Options

| Flag | Description | |--|--| | (none) | Full cryptographic assessment | | --passwords | Password hashing setup | | --encrypt | Encryption at rest | | --tls | TLS hardening | | --jwt | JWT signing/verification | | --keys | Key management and rotation | | --audit | Audit existing crypto |

HARD RULES

Never ask to continue. Loop autonomously until zero weak algorithms remain and all secrets are in env vars or secret managers.

1. NEVER implement your own cryptographic primitives.
2. NEVER reuse IVs/nonces with the same key.
3. NEVER store keys alongside encrypted data.
4. NEVER use MD5, SHA-1, DES, 3DES, RC4, or ECB for security.
5. NEVER encrypt passwords — hash with Argon2id or bcrypt.
6. NEVER use Math.random() for keys, tokens, or IVs.
7. ALWAYS use authenticated encryption (GCM, ChaCha20-Poly1305).
8. ALWAYS track key version with encrypted data.

# Audit crypto usage in codebase
grep -rn "md5\|sha1\|DES\|ECB\|Math.random" src/ --include="*.ts" --include="*.py"
openssl s_client -connect localhost:443 -tls1_2 &1 | grep Protocol
npx audit-ci --moderate

IF weak algorithm found (MD5, SHA1, DES): replace immediately. WHEN TLS version = 12.

Auto-Detection

1. grep for crypto, encrypt, decrypt, hash, bcrypt, argon2, jwt
2. Check nginx.conf for ssl_protocols, ssl_ciphers
3. grep for md5, sha1, des, ecb, Math.random — flag immediately

Platform Fallback (Gemini CLI, OpenCode, Codex)

Run crypto tasks inline. All conventions apply identically.

Output Format

Print: Crypto: {N} issues found, {M} fixed. Weak algorithms: {removed|none}. Key management: {env_vars|hardcoded}. Status: {DONE|PARTIAL}.

Error Recovery

| Failure | Action | |--|--| | Deprecated algorithm in production | Replace immediately (MD5/SHA1 -> SHA-256+, DES/3DES -> AES-256-GCM). Migrate existing hashes on next user login. | | Key rotation breaks decryption | Store key version with ciphertext. Support decryption with old key, encryption with new key during rotation window. | | CSPRNG not available | Use crypto.randomBytes (Node), secrets (Python), crypto/rand (Go). Never fall back to Math.random or random. | | TLS certificate expired | Automate renewal with Let's Encrypt/certbot. Set monitoring alert 30 days before expiry. |

Quality Targets

• Minimum key length: >=256-bit for symmetric, >=2048-bit for RSA
• Target: 0 deprecated algorithms (MD5, SHA1, DES, RC4)
• Key rotation interval: <90 days

Success Criteria

1. No weak algorithms (MD5, SHA1, DES, ECB mode, Math.random for security).
2. All secrets from environment variables or secret managers (not hardcoded).
3. Passwords hashed with bcrypt/argon2/scrypt (not SHA-256).
4. TLS 1.2+ enforced for all connections.

TSV Logging

Append to .godmode/crypto-results.tsv:

timestamp	finding_type	severity	location	algorithm_before	algorithm_after	status

One row per finding. Status: fixed, open, accepted_risk.

Keep/Discard Discipline

After EACH crypto change:
  KEEP if: no weak algorithms AND all tests pass AND existing encrypted data still decryptable
  DISCARD if: introduces weak algorithm OR breaks existing decryption OR hardcodes secrets
  On discard: revert immediately. Crypto regressions are security incidents.

Stop Conditions

STOP when ALL of:
  - No weak algorithms in codebase
  - All secrets in env vars or secret managers
  - Password hashing uses bcrypt/argon2/scrypt
  - TLS 1.2+ enforced

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: arbazkhan971
• Source: arbazkhan971/godmode
• License: MIT

Install and usage instructions live in the source repository linked above.