crypto

Cryptographic Failure Detection

Overview

Cryptography in an application is a small set of promises: that a stored password cannot be turned back into a password, that a ciphertext reveals nothing and cannot be altered undetected, that a token nobody issued cannot be guessed, that a signed value is the value that was signed. Every promise rests on a primitive plus the parameters it is handed, and it is almost always the parameters that fail — a digest chosen for speed where slowness was the point, a nonce that never changes, a random source built for simulations rather than secrets, a comparison that returns early. The attacker is either offline, holding a stolen table or a ciphertext and grinding at it with no rate limit, or online, predicting the next token, flipping bits in a cookie, or sitting between the application and a service whose certificate it declined to check. What they gain is every password in the table, the plaintext behind every stored field, or a forged value the application treats as its own. This skill finds such gaps by locating every site where a cryptographic decision is made, verifying each one in parallel, and merging the results into <output_dir>/crypto-results.md.

What it is NOT

• Credential material in the repository (/websec:secrets): a key, password, or token committed to source, configuration, or a client bundle. Test: would the finding survive if the value were replaced by a strong one from a managed source? If yes it is here, because the defect is in how the key is used; if the whole finding is that the value is in the repository, it is theirs. A good key used badly is here; a committed key is theirs.
• Signed-token mechanics (/websec:jwt): algorithm allowlists, header-driven key selection, unsecured mode, claim assertion, key-set fetching. Test: is the question which algorithm the token may name, or whether the primitive and its parameters are sound at all? The first is theirs; the second is here.
• The credential flow (/websec:authentication): login rate-limiting, lockout, how a reset link is issued and expired, how a session ends. Test: remove the flow and keep the storage — is the weakness still there? A password under a fast digest is here; a reset that never expires is theirs. A reset token's predictability is here; what the flow does with it is theirs.
• Data that was never protected (/websec:information-disclosure): a field returned in a response, logged, or shipped in a bundle in the clear. Test: was there a control that broke, or was there no control? Nothing applied is theirs; a control applied with parameters that make it breakable is here.
• Not a finding: a fast digest as a checksum, cache key, ETag, or content-addressed filename, where nothing security-relevant rests on collision resistance; a general-purpose generator behind jitter, sampling, or display order; an unauthenticated cipher whose ciphertext never leaves the process; a work factor lowered in a test configuration the deployed one overrides. Naming a deprecated primitive is not the finding — what depends on it is.