crypto-patterns

Cryptographic Patterns

Secure cryptographic patterns and deterministic weak-algorithm detection. The prose guidance covers intent and context; the script provides consistent, reference-backed PASS/WARN/FAIL verdicts.

Cryptographic guidance (when to use what) is prose judgment — the model reasons about context, threat model, and trade-offs. Weak-algorithm detection is deterministic — the script checks algorithm names, key sizes, modes, and work factors against published standards (NIST SP 800-131A, OWASP, Mozilla TLS, RFC 8725).

Never approve a cryptographic configuration without running the validator.

Invocation — Crypto Configuration Validator (L3 Script)

Assemble the cryptographic usages as a JSON array and run the validator. Consume its output only — the script source never enters context.

Format each usage:

[
  {
    "name": "user password storage",
    "type": "kdf",
    "algorithm": "bcrypt",
    "work_factor": 12
  },
  {
    "name": "API payload encryption",
    "type": "symmetric",
    "algorithm": "aes-256",
    "key_bits": 256,
    "mode": "GCM"
  },
  {
    "name": "auth token signing",
    "type": "jwt",
    "algorithm": "RS256",
    "jwt_alg": "RS256"
  }
]

Required fields per entry:

• name — human-readable label (e.g. "user session token")
• type — usage type: symmetric | hash | kdf | asymmetric | prng | tls | jwt
• algorithm — algorithm/cipher name (case-insensitive)

Optional fields (add any that apply):

• key_bits — key length in bits (symmetric and asymmetric)
• mode — cipher mode (symmetric; e.g. GCM, CBC, ECB)
• iv_reuse — true if the IV/nonce is reused (always triggers FAIL)
• work_factor — cost parameter (KDFs; bcrypt cost, argon2 iterations, etc.)
• tls_version — TLS/SSL version string (type=tls; e.g. "TLS1.2", "1.3")
• jwt_alg — JWT algorithm header value (type=jwt; e.g. "RS256", "none")

Run via Bash (file argument):

python .claude/skills/security/crypto-patterns/scripts/crypto_check.py config.json