finding-crypto-misuse

Finding crypto misuse: the finding is a recovery, not a weak primitive

Most crypto findings that matter are not "the algorithm is broken"; they are the algorithm used wrong in a way that hands you plaintext, a key, or a forgery. A cipher is only as safe as its nonce discipline, a signature only as safe as its randomness, a MAC only as safe as its construction. Finding crypto misuse means looking for the specific misuse patterns that collapse to a concrete attack, and proving the attack rather than flagging the primitive.

When to use

• You are reviewing code that encrypts, decrypts, signs, verifies, MACs, or hashes.
• A protocol or service rolls its own crypto or composes primitives by hand.
• You need to separate an exploitable misuse from a cosmetic "weak crypto" alert.

Scope check

Analyze crypto in code you own or are authorized to test. Demonstrate recovery or forgery only against your own keys and data. If you can't name the authorization, stop.

The loop

1. Inventory the crypto operations and their inputs. List every place the code encrypts, decrypts, signs, verifies, MACs, or hashes, and for each capture the primitive, the mode, and where the key, nonce or IV, and randomness come from. The misuse lives in the inputs, not the primitive name.

2. Hunt nonce and IV reuse. For any stream or counter/GCM mode, does a (key, nonce) pair ever repeat across messages (a fixed IV, a counter that resets, a random nonce in too small a space)? Reused keystream lets an attacker combine two ciphertexts to strip the key, and GCM nonce reuse additionally leaks the authentication key, enabling forgery. This is the highest-yield check.

3. Hunt signature-randomness reuse. For ECDSA or DSA, is the per-signature secret drawn fresh from a strong source every time, or can it repeat or be predictable? Two signatures under the same secret reveal the private key by simple algebra. Look for fixed, derived, or low-entropy per-signature values in signing code.