# Crypto Technique

> Auth/lab: cryptanalysis methodology; RSA/ECC, PRNG, padding/oracle, symmetric issues, key/ciphertext/signature triage, proof workflow.

- Skill: `aeondave/crypto-technique` (Agent Skill, multi-file: 11 files)
- Install (CLI): `npx skillmds@latest add aeondave/crypto-technique`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/crypto-technique/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- License: MIT
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/crypto-technique

---


# Crypto Technique

Goal: help the agent diagnose cryptographic weaknesses, select the right attack, and execute exploitation to recover secrets—keys, plaintexts, random state, or authentication bypasses.

## When this technique applies

- Encrypted data with weak or custom cipher implementation.
- Public cryptographic key material (RSA, ECC, DSA) with non-standard properties.
- Oracle-based systems: padding oracles, timing leaks, signature verification errors.
- Pseudo-random number generators with biased output or insufficient entropy.
- Symmetric cipher misuse: ECB mode, IV reuse, weak key derivation.
- Ransomware or malware encryption routines requiring algorithm, key hierarchy, and recovery-feasibility analysis.
- Mathematical shortcuts: incomplete prime checking, careless modulus construction, protocol design flaws.

## Boundary with other skills

- **vs. recon-technique**: recon maps the attack surface and discovers services. Once you have cipher/key material in hand, crypto-technique takes over.
- **vs. network-technique**: network-technique handles protocol analysis and PCAP forensics. Crypto-technique assumes you have extracted the cryptographic artifact (ciphertext, key, signature).
- **vs. offensive-tools/cryptography/**: tool skills (rsactftool, sagemath, cyberchef) describe command syntax and flags. Crypto-technique is the decision flow: "should I use SageMath or RsaCtfTool here?"
- **vs. programming skills**: when you need to script an oracle interaction or build a custom solver, load the relevant programming skill (python-patterns, python-testing) *after* crypto-technique tells you what to build.

## Initial triage

Before attempting attacks, reduce the problem to a concrete primitive and rank the most plausible weaknesses.

- **Starting state**: do you have source code, ciphertexts, public keys, signatures, oracle access, PRNG outputs, or protocol transcripts?
- **First questions**: what primitive is involved (RSA, ECC, DH, symmetric, hash/PRNG, constraint system), what exact parameters are known, and is there a structural anomaly or observable oracle?
- **Immediate actions**: extract parameters, test the highest-signal hypotheses first, and define what successful validation looks like before scripting or brute force.
- **Tool-family direction**: use `cyberchef` for fast transform sanity checks, `rsactftool` for common weak-RSA triage, `sagemath` for algebraic or lattice work, and Python/pwntools only after the attack shape is clear.
- **Escalation rule**: do not parallelize many unrelated attacks; pick the top 1-3 based on evidence and iterate from results.

## Agent operating model

Cryptanalysis is a **structured diagnosis → decision → execution** loop:

```
Loop:
  1. Parse the problem: read source code, dump key/ciphertext, connect to oracle.
  2. Extract parameters: key size, exponents, curve equation, moduli, nonce/IV properties.
  3. Diagnose weakness category: check parameter tables, structural anomalies, oracle behavior.
  4. Select primary attack: consult decision trees in technique references.
  5. Prepare exploit: build oracle harness, write solver script, or invoke tool.
  6. Execute: measure timing/errors, recover secret, validate correctness.
  7. Pivot: escalate to next stage (decrypt file, forge signature, assume compromised identity).

Exit when: plaintext recovered, key material compromised, or service bypassed.
```

Do not attempt multiple attacks in parallel without first ranking them by signal strength and likelihood.

---

## Phase 1 — Problem diagnosis

Parse and extract cryptographic artifacts. Understand the attack surface before selecting tools.

### 1.1 Source code review

If source is available (Python, OpenSSL, Go), look for:

- **Key generation**: custom random? Weak seed? Reused entropy?
- **Modulus construction**: distinct primes? Known factors? Small primes?
- **Exponents**: small `e` in RSA? Weak `d` values? Nonce reuse in DSA/ECDSA?
- **Cipher mode**: ECB, CBC with predictable IV, CTR with reused counter?
- **Padding**: custom or standard (PKCS#1 v1.5)? Missing validation?
- **Key derivation**: hardcoded? Low entropy input? Weak hash function?
- **Randomness**: `random.randint()` instead of `secrets.randbelow()`? Biased LFSR?

Typical red flags:
- `random.seed()` with predictable value (timestamp, PID).
- `random.randint()` for cryptographic operations.
- Hardcoded keys or weak key stretching.
- Custom cipher implementation (almost always broken).

### 1.2 Key material extraction

Dump and inspect all available cryptographic parameters.

**RSA:**
- Public exponent `e`, modulus `n`, ciphertext `c`.
- If private key available: extract `p`, `q`, `d`, `dp`, `dq`, `qinv`.
- Check: is `n` factorable? Is `e` small? Is `d` abnormally small?

**ECC:**
- Curve parameters: `p`, `a`, `b`, base point `G`, order `n`.
- Public key (point coordinates), private key scalar.
- Check: does `p±1` factor smoothly? Is the curve singular or anomalous?

**DSA/ECDSA:**
- Signature pairs `(r, s)`, nonce `k`, message hash.
- Check: do multiple signatures share the same `k`? Is `k` drawn from a small space?

**Symmetric:**
- Key size, IV/nonce value, plaintext/ciphertext blocks.
- Check: IV reuse? Predictable IV? Weak key derivation?

**PRNG:**
- Output samples, internal state (if leaked), seed.
- Check: is output biased? Can state be recovered from samples?

### 1.3 Oracle and timing characterization

If attacking an oracle service (padding oracle, timing leak, signature verification error):

- Measure baseline response times (no oracle activity).
- Test oracle behavior: valid vs. invalid inputs, edge cases.
- Probe timing differences systematically (e.g., 100s of trials per decision point).
- Confirm signal-to-noise ratio before committing to an oracle attack (SNR > 5 preferred).

Load `references/oracle-detection-checklist.md` before building an oracle exploit; it separates real cryptographic signal from parser, cache, WAF, auth, and network-noise artifacts.

Use `offensive-tools/network/*` to interact with services; use `python-patterns` or pwntools for harness scripting.

---

## Phase 2 — Attack selection

Classify the problem and match it to a primary attack. Most crypto breaks reduce to:

1. **Factoring `n` or solving DLP** → choose based on key structure.
2. **Exploiting weak randomness** → PRNG or nonce reuse.
3. **Oracle interaction** → padding, timing, or signature validation.
4. **Cipher mode abuse** → ECB pattern leakage, IV reuse, block manipulation.
5. **Mathematical shortcut** → modulus construction, curve singularity, protocol flaw.

### 2.0 Known-problem hint research gate

If the primitive and anomaly are known but the attack construction is still missing after local tests, load `knowledge/known-problem-hint-research`.

Use it to find one decisive external hint — a paper, implementation note, technical article, public writeup, or discussion that matches the current fingerprint. Do not use it for broad crypto learning or before problem diagnosis; return with a local test and validation condition.

### 2.1 RSA weak-key decision tree

See `references/rsa-technique.md`.

**Quick triage:**
- Small `e` (3 or 5)? → Try cube/fifth root first.
- `e` close to `φ(n)`? → Wiener's attack likely.
- Multiple public keys with same `n`? → Common modulus attack.
- Multiple ciphertexts with same message and different `e`? → Hastad broadcast.
- Can you time oracle responses? → Bleichenbacher's attack (PKCS#1 v1.5) or Manger's attack (OAEP / PKCS#1 v2.x).
- Does `p-1` or `q-1` factor smoothly? → Pollard p-1 or ECM.
- Consecutive-like primes (close or near-squares)? → Fermat factorization.

Tool families:
- `offensive-tools/cryptography/rsactftool/` — automated attack selection and execution.
- `offensive-tools/cryptography/sagemath/` — lattice-based attacks (Wiener, Boneh-Durfee), custom factorization.
- `offensive-tools/cryptography/sagemath/` — elliptic curve factorization (ECM), finite-field arithmetic, custom number-theory scripts.

### 2.2 ECC and DSA weak-key decision tree

See `references/ecc-technique.md`.

**Quick triage:**
- Curve order `n` is smooth? → Pohlig-Hellman reduction.
- Multiple signatures with same nonce `k`? → Recover private key directly.
- Nonce `k` drawn from small space? → Brute force or meet-in-the-middle.
- Curve is anomalous (order = p)? → Smart's attack via isogeny.
- Curve is singular? → Reduce to additive/multiplicative group.

Tool families:
- `offensive-tools/cryptography/sagemath/` — ECDLP solving, singular curve reduction.
- `offensive-tools/cracking/hashcat/` — brute-force nonce spaces if small enough.

### 2.3 Lattice-based attack decision tree

See `references/lattice-lwe-technique.md`.

Use lattice techniques when:
- You have partial information (e.g., high bits of `d` in RSA).
- You're recovering from biased/truncated PRNG output.
- Problem involves LWE, subset sum, or Knapsack.
- Mathematical constraint system suggests linear algebra solution.

Tool families:
- `offensive-tools/cryptography/sagemath/` — LLL lattice reduction, Coppersmith's method.
- `offensive-tools/cryptography/sagemath/` combined with `python-patterns` for custom constraint modeling.

### 2.4 PRNG and oracle decision tree

See `references/prng-oracle-technique.md`.

- **PRNG output biased?** → Recover internal state via LLL or meet-in-the-middle.
- **Padding oracle?** → Bleichenbacher's attack (PKCS#1 v1.5) or Manger's attack (OAEP).
- **Timing oracle?** → Cache timing, branch prediction, or response latency.
- **Signature verification oracle?** → Fault injection, signature forgeability, or existential forgery.

Tool families:
- `offensive-tools/cryptography/sagemath/` — lattice recovery for LCG/LFSR state.
- `offensive-tools/network/*` — oracle interaction harness (pwntools, boofuzz).
- Custom Python scripts using `python-patterns` for oracle methodology.

### 2.5 Symmetric cipher decision tree

See `references/symmetric-cipher-technique.md`.

- **ECB mode?** → Block pattern leakage, chosen-plaintext recovery.
- **CBC with predictable IV?** → Bit-flipping attacks, IV forgery.
- **Stream cipher reuse?** → XOR keystream recovery from two ciphertexts.
- **AES-GCM nonce reuse?** → Recover authentication key, forge arbitrary ciphertexts.

Tool families:
- `offensive-tools/cryptography/cyberchef/` — mode-specific decryption workflows, plaintext recovery.
- Custom Python (cryptography library) for cipher mode exploitation.

### 2.6 Diffie-Hellman weak parameter attacks

See `references/dh-technique.md`.

**Quick triage:**
- Small group prime `p` (< 1024 bits)? → Discrete log via Pohlig-Hellman or index calculus is feasible.
- `p-1` factors smoothly? → Pohlig-Hellman reduction; complexity collapses with small factors.
- Same `g^a mod p` reused across sessions with same `p`? → Logjam / pre-computation attack.
- Group order `q` is small (e.g., `p = 2q+1` not satisfied, small subgroup)? → Small subgroup confinement attack.
- `g` is not a generator of the full group? → Attacker can confine secrets to a small subgroup.
- Static DH without ephemeral keys? → Passive decryption of captured sessions if `a` is recovered.

Tool families:
- `offensive-tools/cryptography/sagemath/` — discrete log solving, Pohlig-Hellman, index calculus for small primes.

### 2.7 Constraint solving decision tree

Use constraint solvers when the problem reduces to a set of equations or logical conditions over unknown variables:

- **Multiple equations relating unknowns?** → Z3 SMT solver (handles linear/nonlinear integer constraints).
- **Polynomial system over finite field?** → SageMath's `solve_mod()` or Gröbner basis.
- **PRNG recovering seed from outputs?** → Z3 or LLL depending on linearity.
- **Custom cipher with known input/output pairs?** → Z3 bit-vector theory.

```python
from z3 import *

# Example: recover seed from LCG outputs
seed = BitVec('seed', 32)
s = Solver()
# LCG: state = (a * seed + c) % m
a, c, m = 1664525, 1013904223, 2**32
out1, out2 = 0x12345678, 0x9abcdef0   # known outputs
s.add((a * seed + c) % m == out1)
if s.check() == sat:
    print(s.model()[seed])
```

Tool families:
- `offensive-tools/cryptography/sagemath/` — algebraic solving, Gröbner basis, polynomial systems.
- `z3` — SMT constraint solving; `pip install z3-solver`.

### 2.8 Finite field and secret sharing decision tree

See `references/finite-field-technique.md`.

- **Problem provides `(x_i, y_i)` tuples with a stated prime?** → Shamir secret sharing → Lagrange interpolation over `GF(p)` or `GF(p^k)`.
- **Polynomial degree stated or inferable?** → Collect `degree+1` shares; recover with Sage's `lagrange_polynomial()`.
- **Values are extension field elements?** → Use `GF(p^k)` field; constant term of recovered polynomial is the secret.

Tool families:
- `offensive-tools/cryptography/sagemath/` — Lagrange interpolation, `GF(p)`, `GF(p^k)` field arithmetic.

### 2.9 Ransomware encryption analysis

See `references/ransomware-encryption-analysis.md`.

- **Need to identify file encryption algorithm/mode?** → Static crypto API and constant analysis, then dynamic API breakpoints.
- **Need decryption feasibility?** → Determine key hierarchy, randomness source, nonce/IV reuse, and whether keys exist in memory or file metadata.
- **Hybrid crypto suspected?** → Separate per-file symmetric keys from public-key wrapping and test implementation flaws before claiming recovery.

---

## Phase 3 — Execution

Once the attack is selected:

1. **Assemble the harness**: oracle interaction, key parsing, result validation.
2. **Run the attack**: invoke tool or script; monitor for signal.
3. **Validate results**: re-encrypt, verify signature, test decryption.
4. **Pivot**: use recovered secret for next stage (file decryption, service authentication, privilege escalation).

### 3.1 Tool invocation workflow

- **Weak RSA key?** → Use `offensive-tools/cryptography/rsactftool/` for automated factorization and decryption.
- **Mathematical modeling needed?** → Use `offensive-tools/cryptography/sagemath/` with custom scripts for Coppersmith, LLL, or ECDLP.
- **Constraint system (equations over unknowns)?** → Use `z3` SMT solver (`pip install z3-solver`) for bit-vector and integer constraint solving; fall back to SageMath for polynomial systems.
- **Oracle harness needed?** → Use pwntools (python-patterns) + `offensive-tools/cryptography/sagemath/` or custom brute-force.
- **Plaintext recovery from ciphertext?** → Use `offensive-tools/cryptography/cyberchef/` for offline workflows; load `offensive-tools/cryptography/cyberchef/` Node API for programmatic chaining.

### 3.2 Tool selection quick map

| Problem shape | First tool skill | Why |
|---|---|---|
| RSA public key/ciphertext bundle | `offensive-tools/cryptography/rsactftool/` | Automates common weak-RSA attacks and factorization checks |
| Lattice, finite field, ECC, DH, custom math | `offensive-tools/cryptography/sagemath/` | Algebraic modeling and exact arithmetic |
| Encoding, mode experimentation, byte-level transforms | `offensive-tools/cryptography/cyberchef/` | Fast reversible transform chains and visual sanity checks |
| Hash/password recovery | `cracking-technique` + `offensive-tools/cracking/hashcat/` or `john/` | Candidate generation and offline cracking strategy |
| Oracle interaction | `coding/python-patterns/` + pwntools/socket harness | Repeatable measurements and controls |

### 3.3 Common pitfalls

- Running all attacks in parallel → wastes resources. Rank by likelihood, run top 3 first.
- Trusting a single oracle query → confirming the same result 10–100 times reduces noise.
- Forgetting to validate recovered plaintext → always re-encrypt and compare ciphertexts.
- Using Sage for pure brute force → use hashcat or custom C for speed. Use Sage for algebraic structure.
- Ignoring endianness, padding, or serialization → cryptographic bugs live in the details.

---

## References

- `references/problem-diagnosis.md` — detailed problem reading checklist and parameter extraction.
- `references/rsa-technique.md` — RSA weakness diagnosis, attack selection matrix, quick-reference attack conditions.
- `references/ecc-technique.md` — ECC and DSA weakness diagnosis, nonce reuse patterns, curve singularity checks.
- `references/lattice-lwe-technique.md` — LLL lattice reduction, Coppersmith's method, LWE embedding, constraint modeling.
- `references/prng-oracle-technique.md` — PRNG state recovery, oracle timing/error-based methodology, Bleichenbacher/Manger padding oracles.
- `references/oracle-detection-checklist.md` — Oracle confirmation workflow: observable channels, timing gates, controls, and exploit-readiness criteria.
- `references/symmetric-cipher-technique.md` — ECB, CBC, CTR, and GCM mode weaknesses; plaintext recovery techniques.
- `references/finite-field-technique.md` — Shamir secret sharing recovery, Lagrange interpolation over GF(p) and GF(p^k), field extension arithmetic.
- `references/dh-technique.md` — Diffie-Hellman weak parameter attacks: small prime, Pohlig-Hellman, small subgroup confinement, logjam, static DH session recovery.
- `references/ransomware-encryption-analysis.md` — Malware/ransomware encryption triage: API identification, key hierarchy, file format analysis, memory extraction, and recovery-feasibility assessment.

---

## Recommended workflow sequence

1. **Read the problem**: `references/problem-diagnosis.md`.
2. **Classify the cryptosystem**: RSA, ECC, DH, PRNG, symmetric, constraint-based, or oracle-based.
3. **Consult the relevant technique reference** to narrow attack choices.
4. **Select primary attack** based on parameter constraints.
5. **Load the appropriate tool skill** from `offensive-tools/cryptography/` to execute.
6. **Pivot to next stage** (decryption, signature forgery, service bypass).