A cryptographic audit systematically reviews an application's use of cryptographic primitives, protocols, and key management to identify vulnerabilities such as weak algorithms, insecure modes, hardco
Start a fresh conversation. Replace the highlighted placeholders.
Use performing-cryptographic-audit-of-application to audit [application code and configuration files] in an authorized test or lab environment and deliver a severity-ranked report of cryptographic weaknesses, locations, and remediations, including dependency, certificate/TLS, key-storage, and rotation findings.
Required inputs
[application code and configuration files]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: performing-cryptographic-audit-of-applicationdescription: A cryptographic audit systematically reviews an application's use of cryptographic primitives, protocols, and key management to identify vulnerabilities such as weak algorithms, insecure modes, hardcodomain: cybersecuritysubdomain: cryptographytags: - cryptography- audit- security-review- compliance- vulnerability-assessmentversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - PR.DS-01- PR.DS-02- PR.DS-10mitre_attack: - T1600- T1573- T1553mitre_f3: version: '1.1' tactics: - reconnaissance - initial-access - positioning techniques: - id: T1557 name: Adversary-in-the-Middle tactic: positioning source: attack - id: T1555 name: Credentials from Password Stores tactic: reconnaissance source: attack - id: F1006.001 name: 'Account Takeover: Exposed API Key' tactic: initial-access source: f3 - id: F1004 name: Access with Stolen Session Cookie tactic: initial-access source: f3
Performing Cryptographic Audit of Application
Overview
A cryptographic audit systematically reviews an application's use of cryptographic primitives, protocols, and key management to identify vulnerabilities such as weak algorithms, insecure modes, hardcoded keys, insufficient entropy, and protocol misconfigurations. This skill covers building an automated crypto audit tool that scans Python and configuration files for common cryptographic weaknesses.
When to Use
When conducting security assessments that involve performing cryptographic audit of application
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
Familiarity with cryptography concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities
Objectives
Detect usage of deprecated algorithms (MD5, SHA-1, DES, RC4)
Identify insecure cipher modes (ECB) and padding schemes
Find hardcoded keys, passwords, and secrets in source code
Verify TLS/SSL configuration strength
Check key derivation function parameters
Validate random number generator usage
Produce a structured audit report with findings and remediation
Key Concepts
Cryptographic Weakness Categories
Category
Examples
Risk Level
Weak Hashing
MD5, SHA-1 for integrity/signatures
High
Insecure Encryption
DES, 3DES, RC4, Blowfish
High
Bad Cipher Mode
ECB mode for any block cipher
High
Insufficient Key Size
RSA < 2048, AES-128 for long-term
Medium
Hardcoded Secrets
Keys/passwords in source code
Critical
Weak KDF
Low iteration PBKDF2, plain MD5
High
Poor Entropy
time-based seeds, predictable IVs
High
Deprecated Protocols
SSLv3, TLS 1.0, TLS 1.1
High
Security Considerations
Review both application code and configuration files
Check third-party dependencies for known crypto vulnerabilities
Verify certificates and TLS configurations on deployed servers
Ensure secrets are loaded from environment variables or vaults
Review key storage and rotation practices
Validation Criteria
Scanner detects all injected test weaknesses
MD5/SHA-1 usage for security purposes is flagged
ECB mode usage is flagged
Hardcoded keys/passwords are detected
Weak KDF parameters are identified
Report includes severity, location, and remediation