Cryptographic Analysis & Assessment

Cryptographic Analysis & Assessment

Purpose

Enable Claude to assist with cryptographic security assessments including SSL/TLS configuration auditing, cipher suite analysis and recommendation, hash algorithm identification, encryption implementation code review, key management evaluation, and detection of cryptographic vulnerabilities. Claude directly analyzes provided configurations and code.

---

Activation Triggers

This skill activates when the user asks about:

• Auditing SSL/TLS configuration of a server or service
• Evaluating cipher suites for security strength
• Identifying hash algorithms from hash values or code
• Reviewing code for cryptographic implementation flaws
• Assessing key lengths, key management, or rotation policies
• Detecting hardcoded keys, weak IVs, or ECB mode usage
• Generating TLS configuration recommendations (Mozilla profile)
• Certificate analysis (expiration, chain, transparency)
• Post-quantum cryptography guidance
• Password hashing implementation review (bcrypt, Argon2, PBKDF2)

---

Prerequisites

pip install cryptography requests pyOpenSSL

Recommended tools:

• sslyze — Python TLS scanner
• testssl.sh — Comprehensive TLS testing
• openssl — Command-line TLS operations
• Wireshark — TLS traffic analysis
• certbot — Certificate management

---

Core Capabilities

1. SSL/TLS Configuration Auditing

When the user asks to audit TLS for a server or paste a TLS configuration:

Command-line audit approach:

# Quick TLS check using openssl
openssl s_client -connect example.com:443 -tls1_2 2>/dev/null | grep -E "Protocol|Cipher"
openssl s_client -connect example.com:443 -tls1 2>/dev/null | grep -E "handshake|error"

# Check certificate details
openssl s_client -connect example.com:443 /dev/null | openssl x509 -noout -dates -subject -issuer

# Comprehensive scan with sslyze
sslyze --regular example.com --json_out result.json

# Or testssl.sh (most comprehensive)
./testssl.sh --severity HIGH --quiet example.com

# Use the skill's script
python scripts/tls_auditor.py --host example.com --port 443 --output report.json
python scripts/tls_auditor.py --host mail.example.com --port 993 --grade

TLS Version Support Ratings: | Protocol | Status | Action | |----------|--------|--------| | SSLv2 | Critically broken | Block immediately | | SSLv3 | Broken (POODLE) | Block immediately | | TLS 1.0 | Deprecated (PCI-DSS violation) | Disable — BEAST, POODLE | | TLS 1.1 | Deprecated | Disable | | TLS 1.2 | Acceptable (with strong ciphers) | Keep with restrictions | | TLS 1.3 | Current standard | Enable and prefer |

TLS Vulnerability Checklist:

[ ] Heartbleed (CVE-2014-0160): openssl s_client + heartbleed test
[ ] POODLE: SSLv3 enabled?
[ ] BEAST: TLS 1.0 + CBC cipher?
[ ] ROBOT: RSA key exchange supported?
[ ] DROWN: SSLv2 on any port of same server?
[ ] Logjam/FREAK: DHE  tuple[bytes, bytes]:
    if salt is None:
        salt = secrets.token_bytes(32)  # 256-bit random salt
    kdf = PBKDF2HMAC(
        algorithm=hashes.SHA256(),
        length=32,  # 256-bit key
        salt=salt,
        iterations=600_000  # NIST 2023 minimum for PBKDF2-SHA256
    )
    key = kdf.derive(password)
    return key, salt

# SECURE: AES-GCM (authenticated encryption)
def encrypt(data: bytes, key: bytes) -> bytes:
    aesgcm = AESGCM(key)
    nonce = secrets.token_bytes(12)  # 96-bit random nonce (NEVER reuse!)
    ciphertext = aesgcm.encrypt(nonce, data, associated_data=None)
    return nonce + ciphertext  # Prepend nonce for decryption

def decrypt(ciphertext: bytes, key: bytes) -> bytes:
    aesgcm = AESGCM(key)
    nonce = ciphertext[:12]
    return aesgcm.decrypt(nonce, ciphertext[12:], associated_data=None)

# SECURE: Argon2id for password hashing
from argon2 import PasswordHasher
ph = PasswordHasher(time_cost=3, memory_cost=65536, parallelism=4)
hashed = ph.hash(password)  # Automatic random salt
ph.verify(hashed, password)  # Verify with timing-safe comparison

Code Review Checklist:

Encryption:
[ ] No hardcoded keys (check for key = b"...", SECRET_KEY = "...", etc.)
[ ] No ECB mode (MODE_ECB, "AES/ECB/PKCS5Padding")
[ ] IV/Nonce is random and unique per encryption operation
[ ] Authenticated encryption used (AES-GCM, ChaCha20-Poly1305)
[ ] Key properly derived from password (PBKDF2, bcrypt, Argon2)
[ ] No custom/homebrew crypto algorithms

Certificate Handling:
[ ] Certificate validation is NOT disabled (verify=True)
[ ] Certificate pinning for mobile/critical apps
[ ] No ssl._create_unverified_context

Randomness:
[ ] Cryptographic operations use secrets module or os.urandom()
[ ] Not using random.random() or random.randint() for security
[ ] Tokens and OTPs have sufficient entropy (≥128 bits)

5. Key Management Assessment

When the user asks about key management:

Key Length Recommendations (2025): | Algorithm | Minimum | Recommended | Notes | |-----------|---------|-------------|-------| | RSA | 2048-bit | 3072-bit | NIST recommends 3072+ post-2030 | | ECC (ECDSA) | P-256 | P-384 | P-256 OK through 2030 | | AES | 128-bit | 256-bit | 128-bit adequate; use 256 for high-value | | ECDH (key exchange) | P-256 | P-384 | | | DH (classic) | 2048-bit | 3072-bit | Avoid, prefer ECDH | | SHA (hashing) | SHA-256 | SHA-256/384/512 | SHA-1 deprecated |

Post-Quantum Cryptography Transition:

NIST finalized PQC standards in 2024:

• ML-KEM (CRYSTALS-Kyber) — Key encapsulation mechanism (replaces RSA/ECDH for key exchange)
• ML-DSA (CRYSTALS-Dilithium) — Digital signature (replaces RSA/ECDSA)
• SLH-DSA (SPHINCS+) — Stateless hash-based signature (conservative fallback)

For systems expected to protect data beyond 2030, begin PQC migration planning.

Key Rotation Schedule: | Key Type | Recommended Rotation | |----------|---------------------| | TLS certificates | Annual (or use 90-day Let's Encrypt) | | Signing keys (JWT/API) | 90 days | | Encryption keys (data at rest) | Annual | | API keys / service tokens | 90 days or per-service | | Employee SSH keys | Annual + on role change | | Password hashes | On password change |

---

Script Reference

tls_auditor.py

python scripts/tls_auditor.py --host example.com --port 443 --output report.json
python scripts/tls_auditor.py --host mail.example.com --port 993 --grade

---

Skill Integration

| Condition | Adjacent Skill | |-----------|---------------| | TLS audit for web application | ← Skill 09 (Web Security) | | Cloud service encryption assessment | ← Skill 10 (Cloud Security) | | Weak crypto findings → hardening recommendations | → Skill 15 (Blue Team Defense) | | Crypto flaws → vulnerability report | → Skill 02 (Vulnerability Scanner) |

---

References

• Mozilla SSL Configuration Generator
• NIST SP 800-52 Rev. 2 — TLS Guidelines
• SSL Labs Grading Criteria
• NIST Post-Quantum Cryptography Standards
• OWASP Cryptographic Failures
• OWASP Cryptographic Storage Cheat Sheet
• NIST Password Storage Guidelines

---

v3.0 Enhancements (2026 Update)

Post-quantum migration is now operational:

• Finalized PQC standards — FIPS 203 (ML-KEM, key encapsulation), FIPS 204 (ML-DSA, signatures), and FIPS 205 (SLH-DSA, hash-based signatures) are published. Recommend these for new designs; FIPS 206 (FN-DSA/Falcon) is forthcoming.
• Hybrid key exchange — for TLS, recommend hybrid groups (e.g., X25519+ML-KEM-768 / X25519MLKEM768) so confidentiality survives both classical and quantum attacks during transition.
• Harvest-now-decrypt-later — prioritize PQC for long-lived secrets and data with multi-year confidentiality requirements; this is a present risk, not a future one.
• Crypto-agility — flag hardcoded algorithms/key sizes; recommend abstraction so primitives can be swapped. Inventory cryptography (a CBOM) as the first migration step.
• Hard deprecations — TLS 1.3 preferred / TLS 1.0-1.1 disallowed; SHA-1 and RSA/DH < 2048 flagged as failing; RSA-2048 acceptable now but on the PQC migration clock.

Precision rule: every finding states the primitive, key size/curve, protocol version, and the concrete upgrade (classical-now and PQC-target).

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Masriyan
• Source: Masriyan/Claude-Code-CyberSecurity-Skill
• License: MIT
• Homepage: https://www.security-life.org

Install and usage instructions live in the source repository linked above.