crypto-analyzer

Crypto Analyzer Skill

Purpose

Analyze and validate cryptographic implementations to ensure proper algorithm usage, key sizes, certificate validity, and compliance with cryptographic best practices and standards.

Capabilities

Encryption Implementation Analysis

• Analyze symmetric encryption usage (AES, ChaCha20)
• Review asymmetric encryption implementations (RSA, ECDSA)
• Check encryption mode selection (GCM, CBC, CTR)
• Validate initialization vector (IV) handling
• Verify padding schemes
• Identify insecure encryption patterns

Algorithm Strength Validation

• Check algorithm deprecation status
• Validate against NIST recommendations
• Compare with FIPS 140-3 requirements
• Assess quantum resistance readiness
• Flag weak or deprecated algorithms
• Recommend algorithm upgrades

Key Size Verification

• Validate RSA key lengths (minimum 2048-bit)
• Check ECC curve selections
• Verify symmetric key sizes
• Assess key derivation functions
• Check PBKDF2/scrypt/bcrypt parameters
• Validate key stretching implementations

Deprecated Algorithm Detection

• Identify MD5 and SHA-1 usage
• Flag DES and 3DES usage
• Detect RC4 stream cipher
• Find weak random number generation
• Identify export-grade cryptography
• Flag custom/homegrown crypto

Certificate Analysis

• Verify certificate validity periods
• Check certificate chain completeness
• Validate certificate key usage
• Detect wildcard certificate risks
• Check certificate transparency logs
• Monitor certificate expiration

Cryptographic Recommendations

• Suggest algorithm replacements
• Recommend key size upgrades
• Provide implementation guidance
• Map to compliance requirements
• Generate migration plans
• Prioritize remediation efforts

Algorithm Assessment

Symmetric Encryption

| Algorithm | Status | Recommendation |

|-----------|--------|----------------|

| AES-256-GCM | Approved | Preferred |

| AES-128-GCM | Approved | Acceptable |

| ChaCha20-Poly1305 | Approved | Preferred for mobile |

| AES-CBC | Caution | Use with HMAC |

| 3DES | Deprecated | Replace immediately |

| DES | Prohibited | Critical risk |

Asymmetric Encryption

| Algorithm | Min Key Size | Recommendation |

|-----------|-------------|----------------|

| RSA | 2048-bit | 3072+ preferred |

| ECDSA | P-256 | P-384 preferred |

| Ed25519 | N/A | Recommended |

Hash Functions

| Algorithm | Status | Use Case |

|-----------|--------|----------|

| SHA-256/384/512 | Approved | General use |

| SHA-3 | Approved | High security |

| BLAKE2 | Approved | Performance |

| SHA-1 | Deprecated | Legacy only |

| MD5 | Prohibited | Never use |

Integrations

• OpenSSL: Cryptographic library analysis
• testssl.sh: TLS configuration testing
• SSL Labs API: Certificate and TLS analysis
• Cryptographic libraries: Language-specific crypto review
• HSM interfaces: Hardware security module validation

Target Processes

• Cryptography and Key Management Process
• Security Code Review
• TLS Configuration Hardening
• Certificate Lifecycle Management

Input Schema

{
  "type": "object",
  "properties": {
    "analysisType": {
      "type": "string",
      "enum": ["code-review", "tls-config", "certificate", "implementation", "compliance"],
      "description": "Type of cryptographic analysis"
    },
    "targetPath": {
      "type": "string",
      "description": "Path to code or configuration to analyze"
    },
    "endpoints": {
      "type": "array",
      "items": { "type": "string" },
      "description": "TLS endpoints to analyze"
    },
    "certificates": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Certificate files or URLs to analyze"
    },
    "languages": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Programming languages to analyze"
    },
    "complianceFrameworks": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["NIST", "FIPS-140-3", "PCI-DSS", "HIPAA", "FedRAMP"]
      }
    },
    "includeQuantumAssessment": {
      "type": "boolean",
      "description": "Include post-quantum readiness assessment"
    }
  },
  "required": ["analysisType"]
}

Output Schema

{
  "type": "object",
  "properties": {
    "analysisId": {
      "type": "string"
    },
    "analysisType": {
      "type": "string"
    },
    "timestamp": {
      "type": "string",
      "format": "date-time"
    },
    "summary": {
      "type": "object",
      "properties": {
        "totalFindings": { "type": "integer" },
        "critical": { "type": "integer" },
        "high": { "type": "integer" },
        "medium": { "type": "integer" },
        "low": { "type": "integer" }
      }
    },
    "algorithmFindings": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "algorithm": { "type": "string" },
          "usage": { "type": "string" },
          "status": { "type": "string", "enum": ["approved", "caution", "deprecated", "prohibited"] },
          "location": { "type": "string" },
          "recommendation": { "type": "string" }
        }
      }
    },
    "keySizeFindings": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "algorithm": { "type": "string" },
          "currentSize": { "type": "string" },
          "minimumRequired": { "type": "string" },
          "recommendation": { "type": "string" }
        }
      }
    },
    "certificateFindings": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "subject": { "type": "string" },
          "issuer": { "type": "string" },
          "validFrom": { "type": "string" },
          "validTo": { "type": "string" },
          "keySize": { "type": "string" },
          "issues": { "type": "array" }
        }
      }
    },
    "tlsFindings": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "endpoint": { "type": "string" },
          "protocols": { "type": "array" },
          "cipherSuites": { "type": "array" },
          "grade": { "type": "string" },
          "issues": { "type": "array" }
        }
      }
    },
    "complianceStatus": {
      "type": "object"
    },
    "quantumReadiness": {
      "type": "object",
      "properties": {
        "atRiskAlgorithms": { "type": "array" },
        "migrationPriority": { "type": "string" },
        "recommendations": { "type": "array" }
      }
    },
    "remediationPlan": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "finding": { "type": "string" },
          "action": { "type": "string" },
          "priority": { "type": "string" },
          "effort": { "type": "string" }
        }
      }
    }
  }
}

Usage Example

skill: {
  name: 'crypto-analyzer',
  context: {
    analysisType: 'code-review',
    targetPath: './src',
    languages: ['Java', 'Python'],
    complianceFrameworks: ['NIST', 'PCI-DSS'],
    includeQuantumAssessment: true
  }
}