remediation-crypto

Remediation: Cryptographic Vulnerabilities

Actionable fix patterns for cryptography-related security vulnerabilities.

When to Use This Skill

• Fixing weak cryptography - After finding MD5/SHA1/DES usage
• Fixing insecure randomness - After finding Math.random()/random module usage
• Fixing TLS issues - After finding disabled certificate verification
• Code review feedback - Provide remediation guidance with examples

When NOT to Use This Skill

• Detecting vulnerabilities - Use vulnerability-patterns skill
• Fixing injection issues - Use remediation-injection skill
• Fixing auth issues - Use remediation-auth skill
• Fixing config issues - Use remediation-config skill

---

Weak Cryptography (CWE-327)

Problem

Using deprecated algorithms (MD5, SHA1, DES) or insecure modes (ECB) compromises data protection.

Python

Don't:

# VULNERABLE: MD5/SHA1 for security purposes
import hashlib
password_hash = hashlib.md5(password.encode()).hexdigest()

# VULNERABLE: DES encryption
from Crypto.Cipher import DES
cipher = DES.new(key, DES.MODE_ECB)

Do:

# SECURE: bcrypt for password hashing
import bcrypt
hashed = bcrypt.hashpw(password.encode(), bcrypt.gensalt())

# SECURE: argon2 (preferred)
from argon2 import PasswordHasher
ph = PasswordHasher()
hashed = ph.hash(password)

# SECURE: SHA-256+ for data integrity
import hashlib
file_hash = hashlib.sha256(data).hexdigest()

# SECURE: AES-GCM for encryption
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
key = AESGCM.generate_key(bit_length=256)
aesgcm = AESGCM(key)
nonce = os.urandom(12)
ciphertext = aesgcm.encrypt(nonce, plaintext, associated_data)

JavaScript/Node.js

Don't:

// VULNERABLE: MD5/SHA1
const crypto = require('crypto');
const hash = crypto.createHash('md5').update(data).digest('hex');

// VULNERABLE: Weak password hashing
const hash = crypto.createHash('sha256').update(password).digest('hex');