Crypto Analyzer Skill
Purpose
Analyze and validate cryptographic implementations to ensure proper algorithm usage, key sizes, certificate validity, and compliance with cryptographic best practices and standards.
Capabilities
Encryption Implementation Analysis
- Analyze symmetric encryption usage (AES, ChaCha20)
- Review asymmetric encryption implementations (RSA, ECDSA)
- Check encryption mode selection (GCM, CBC, CTR)
- Validate initialization vector (IV) handling
- Verify padding schemes
- Identify insecure encryption patterns
Algorithm Strength Validation
- Check algorithm deprecation status
- Validate against NIST recommendations
- Compare with FIPS 140-3 requirements
- Assess quantum resistance readiness
- Flag weak or deprecated algorithms
- Recommend algorithm upgrades
Key Size Verification
- Validate RSA key lengths (minimum 2048-bit)
- Check ECC curve selections
- Verify symmetric key sizes
- Assess key derivation functions
- Check PBKDF2/scrypt/bcrypt parameters
- Validate key stretching implementations
Deprecated Algorithm Detection
- Identify MD5 and SHA-1 usage
- Flag DES and 3DES usage
- Detect RC4 stream cipher
- Find weak random number generation
- Identify export-grade cryptography
- Flag custom/homegrown crypto
Certificate Analysis
- Verify certificate validity periods
- Check certificate chain completeness
- Validate certificate key usage
- Detect wildcard certificate risks
- Check certificate transparency logs
- Monitor certificate expiration
Cryptographic Recommendations
- Suggest algorithm replacements
- Recommend key size upgrades
- Provide implementation guidance
- Map to compliance requirements
- Generate migration plans
- Prioritize remediation efforts
Algorithm Assessment
Symmetric Encryption
| Algorithm |
Status |
Recommendation |
| AES-256-GCM |
Approved |
Preferred |
| AES-128-GCM |
Approved |
Acceptable |
| ChaCha20-Poly1305 |
Approved |
Preferred for mobile |
| AES-CBC |
Caution |
Use with HMAC |
| 3DES |
Deprecated |
Replace immediately |
| DES |
Prohibited |
Critical risk |
Asymmetric Encryption
| Algorithm |
Min Key Size |
Recommendation |
| RSA |
2048-bit |
3072+ preferred |
| ECDSA |
P-256 |
P-384 preferred |
| Ed25519 |
N/A |
Recommended |
Hash Functions
| Algorithm |
Status |
Use Case |
| SHA-256/384/512 |
Approved |
General use |
| SHA-3 |
Approved |
High security |
| BLAKE2 |
Approved |
Performance |
| SHA-1 |
Deprecated |
Legacy only |
| MD5 |
Prohibited |
Never use |
Integrations
- OpenSSL: Cryptographic library analysis
- testssl.sh: TLS configuration testing
- SSL Labs API: Certificate and TLS analysis
- Cryptographic libraries: Language-specific crypto review
- HSM interfaces: Hardware security module validation
Target Processes
- Cryptography and Key Management Process
- Security Code Review
- TLS Configuration Hardening
- Certificate Lifecycle Management
Input Schema
{
"type": "object",
"properties": {
"analysisType": {
"type": "string",
"enum": ["code-review", "tls-config", "certificate", "implementation", "compliance"],
"description": "Type of cryptographic analysis"
},
"targetPath": {
"type": "string",
"description": "Path to code or configuration to analyze"
},
"endpoints": {
"type": "array",
"items": { "type": "string" },
"description": "TLS endpoints to analyze"
},
"certificates": {
"type": "array",
"items": { "type": "string" },
"description": "Certificate files or URLs to analyze"
},
"languages": {
"type": "array",
"items": { "type": "string" },
"description": "Programming languages to analyze"
},
"complianceFrameworks": {
"type": "array",
"items": {
"type": "string",
"enum": ["NIST", "FIPS-140-3", "PCI-DSS", "HIPAA", "FedRAMP"]
}
},
"includeQuantumAssessment": {
"type": "boolean",
"description": "Include post-quantum readiness assessment"
}
},
"required": ["analysisType"]
}
Output Schema
{
"type": "object",
"properties": {
"analysisId": {
"type": "string"
},
"analysisType": {
"type": "string"
},
"timestamp": {
"type": "string",
"format": "date-time"
},
"summary": {
"type": "object",
"properties": {
"totalFindings": { "type": "integer" },
"critical": { "type": "integer" },
"high": { "type": "integer" },
"medium": { "type": "integer" },
"low": { "type": "integer" }
}
},
"algorithmFindings": {
"type": "array",
"items": {
"type": "object",
"properties": {
"algorithm": { "type": "string" },
"usage": { "type": "string" },
"status": { "type": "string", "enum": ["approved", "caution", "deprecated", "prohibited"] },
"location": { "type": "string" },
"recommendation": { "type": "string" }
}
}
},
"keySizeFindings": {
"type": "array",
"items": {
"type": "object",
"properties": {
"algorithm": { "type": "string" },
"currentSize": { "type": "string" },
"minimumRequired": { "type": "string" },
"recommendation": { "type": "string" }
}
}
},
"certificateFindings": {
"type": "array",
"items": {
"type": "object",
"properties": {
"subject": { "type": "string" },
"issuer": { "type": "string" },
"validFrom": { "type": "string" },
"validTo": { "type": "string" },
"keySize": { "type": "string" },
"issues": { "type": "array" }
}
}
},
"tlsFindings": {
"type": "array",
"items": {
"type": "object",
"properties": {
"endpoint": { "type": "string" },
"protocols": { "type": "array" },
"cipherSuites": { "type": "array" },
"grade": { "type": "string" },
"issues": { "type": "array" }
}
}
},
"complianceStatus": {
"type": "object"
},
"quantumReadiness": {
"type": "object",
"properties": {
"atRiskAlgorithms": { "type": "array" },
"migrationPriority": { "type": "string" },
"recommendations": { "type": "array" }
}
},
"remediationPlan": {
"type": "array",
"items": {
"type": "object",
"properties": {
"finding": { "type": "string" },
"action": { "type": "string" },
"priority": { "type": "string" },
"effort": { "type": "string" }
}
}
}
}
}
Usage Example
skill: {
name: 'crypto-analyzer',
context: {
analysisType: 'code-review',
targetPath: './src',
languages: ['Java', 'Python'],
complianceFrameworks: ['NIST', 'PCI-DSS'],
includeQuantumAssessment: true
}
}
a5c-ai