1---2name: crypto-analysis3description: Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review4---56# Cryptographic Analysis78## When to Activate910- Auditing TLS/SSL/SSH configurations and X.509 PKI (cipher suites, downgrade, protocol flaws)11- Reviewing crypto implementations in source code or captured traffic12- Attacking weak RSA/ECC keys (CTF and real-world weak-key hygiene)13- Recovering ECDSA/DSA private keys from reused or biased nonces (lattice/HNP)14- Exploiting symmetric/AEAD misuse: padding oracles, GCM nonce reuse, key-commitment15- Forging JWT/JOSE tokens (algorithm confusion, none, jwk/jku/kid injection)16- Cracking password hashes and grading KDF strength17- Assessing post-quantum readiness ("harvest now, decrypt later" exposure)1819## Technique Map2021| Technique | ATT&CK | CWE | Reference | Script |22|-----------|--------|-----|-----------|--------|23| TLS cipher/protocol downgrade audit | T1600.001 | CWE-326 | references/tls-pki-audit.md | scripts/tls_audit.py |24| Terrapin SSH prefix truncation (CVE-2023-48795) | T1557 | CWE-222 | references/tls-pki-audit.md | scripts/tls_audit.py |25| Marvin/Bleichenbacher RSA timing oracle | T1600 | CWE-208 | references/tls-pki-audit.md | scripts/tls_audit.py |26| X.509 / CT-log shadow-asset discovery | T1589 | CWE-295 | references/tls-pki-audit.md | scripts/tls_audit.py |27| RSA weak-key factoring (Fermat/Wiener/common-modulus) | T1600 | CWE-326 | references/rsa-attacks.md | scripts/rsa_attack.py |28| Coppersmith partial-key & ROCA (CVE-2017-15361) | T1600 | CWE-310 | references/rsa-attacks.md | scripts/rsa_attack.py |29| Hastad broadcast / batch-GCD | T1600 | CWE-326 | references/rsa-attacks.md | scripts/rsa_attack.py |30| ECDSA nonce reuse key recovery | T1552.004 | CWE-323 | references/ecc-nonce-attacks.md | scripts/ecdsa_lattice.py |31| Biased-nonce lattice/HNP (Minerva, PuTTY CVE-2024-31497) | T1552.004 | CWE-1241 | references/ecc-nonce-attacks.md | scripts/ecdsa_lattice.py |32| Psychic signature (0,0) (CVE-2022-21449) | T1606.001 | CWE-347 | references/ecc-nonce-attacks.md | scripts/ecdsa_lattice.py |33| CBC padding oracle (byte-by-byte decrypt) | T1040 | CWE-209 | references/symmetric-aead.md | scripts/padding_oracle.py |34| AES-GCM nonce reuse "forbidden attack" | T1040 | CWE-323 | references/symmetric-aead.md | scripts/gcm_nonce_reuse.py |35| AEAD key-commitment / invisible salamanders / partitioning oracle | T1606 | CWE-347 | references/symmetric-aead.md | scripts/gcm_nonce_reuse.py |36| JWT algorithm confusion RS256→HS256 (CVE-2024-54150) | T1606.001 | CWE-347 | references/jwt-jose.md | scripts/jwt_forge.py |37| JWT alg=none / jwk / jku / kid injection | T1606.001 | CWE-347 | references/jwt-jose.md | scripts/jwt_forge.py |38| Hash identification & GPU cracking | T1110.002 | CWE-916 | references/hash-pq.md | scripts/hash_triage.py |39| Weak KDF / fast-hash password storage | T1110.002 | CWE-916 | references/hash-pq.md | scripts/hash_triage.py |40| Post-quantum / HNDL exposure review | T1600 | CWE-327 | references/hash-pq.md | scripts/tls_audit.py |4142## Quick Start4344```bash45# 0. TLS/PKI posture in one shot (downgrade, ROBOT, SWEET32, Terrapin, cert/CT)46python3 scripts/tls_audit.py target.com:443 --ssh target.com:22 --ct --json out.json47testssl.sh --full --robot --sweet32 https://target.com # cross-check with the canonical tool4849# 1. RSA weak-key triage on a captured public key50python3 scripts/rsa_attack.py --pubkey server.pem --ct ciphertext.b64 --auto51# tries Fermat (p~=q), Wiener (small d), batch-GCD/common-modulus, ROCA fingerprint5253# 2. ECDSA key recovery from a signature corpus (reuse or bias)54python3 scripts/ecdsa_lattice.py recover sigs.json --curve secp256r1 --known-msb 455# reuse: needs 2 sigs w/ same r; bias: ~256-1200 sigs depending on leak5657# 3. Symmetric/AEAD misuse58python3 scripts/padding_oracle.py --url https://t/dec --ct $CT --block 16 # CBC oracle59python3 scripts/gcm_nonce_reuse.py forbidden ct1.bin ct2.bin --nonce $N # recover H + forge6061# 4. JWT forgery chain62python3 scripts/jwt_forge.py confusion --pubkey jwt_pub.pem --claims '{"role":"admin"}'63python3 scripts/jwt_forge.py none --claims '{"sub":"admin"}'6465# 5. Hash triage + crack plan66python3 scripts/hash_triage.py hashes.txt # identify + emit hashcat -m / john format67hashcat -m 22000 capture.hc22000 wl.txt -r rules/best64.rule68```6970## OPSEC & Detection (summary)7172| Technique | Telemetry / IOC | Detection (Sigma/EDR) | OPSEC note |73|-----------|-----------------|-----------------------|------------|74| TLS scanning / testssl | Burst of handshakes, many cipher renegotiations, malformed ClientHellos | NIDS: high TLS alert rate from one src; Zeek `ssl.log` anomalous cipher offers | Rate-limit, spread across source IPs; passive cert/CT recon leaves no target-side trace |75| Marvin/ROBOT oracle probing | ~10^4–10^6 RSA decrypts, repeated malformed pre-master/CMS | WAF/IDS: spike of TLS decrypt errors, identical-size payloads | Extremely loud; only against authorized hosts; use minimal query budgets |76| Terrapin MitM | Injected SSH_MSG_IGNORE, sequence-number gap at NEWKEYS | SSH server logs `kex` mismatch; netflow showing on-path device | Requires active MitM; detectable by strict-kex peers; abort if `kex-strict` present |77| ECDSA nonce harvesting | Bulk signature collection (Git, TLS, SSH, blockchain) | Mostly offline — no target telemetry once sigs captured | Collection is passive; recovery is offline; rotate-key advice in report |78| CBC padding oracle | Thousands of decrypt requests, alternating valid/invalid padding | Web logs: ~256×blocks requests to one endpoint; Sigma on 4xx burst | Very noisy (256×blocks×msgs); throttle, randomize timing |79| GCM nonce reuse / partitioning | Repeated (nonce,key) pairs; multi-key ciphertext blobs | App crypto audit; flag reused IVs in logs | Forbidden-attack math is offline once two ciphertexts captured |80| JWT forgery | Anomalous `alg`, external `jku`/`x5u` fetch, all-zero ES signature | Sigma: JWT with `alg:none`/HS after RS expected; egress to attacker JWKS URL | Each forged token is a single request; minimal noise |81| Hash cracking | None on target (offline) | N/A unless online spray (then T1110) | Offline; protect loot at rest; never spray live without scope |8283## Deep Dives8485- **references/tls-pki-audit.md** — TLS/SSL/SSH posture: cipher/protocol downgrade, Terrapin (CVE-2023-48795), Marvin/Bleichenbacher (CVE-2022-4304, CVE-2024-2236), SWEET32/DROWN/Logjam/POODLE, X.509 and Certificate-Transparency analysis.86- **references/rsa-attacks.md** — Weak-key factoring: Fermat, Wiener, common modulus, Hastad broadcast, Coppersmith partial-key, batch-GCD, ROCA (CVE-2017-15361); RsaCtfTool / cado-nfs / SageMath workflow.87- **references/ecc-nonce-attacks.md** — ECDSA/DSA nonce reuse, biased-nonce lattice/HNP recovery (Minerva, PuTTY CVE-2024-31497), invalid-curve attacks, psychic signatures (CVE-2022-21449).88- **references/symmetric-aead.md** — Block-cipher mode misuse: ECB detection, CBC padding oracle, CTR/GCM nonce reuse (forbidden attack), AEAD key-commitment / invisible salamanders / partitioning oracles.89- **references/jwt-jose.md** — JWT/JOSE token forgery: algorithm confusion (CVE-2024-54150), alg=none, jwk/jku/x5u/kid injection, weak-secret cracking, library-level CVE landscape.90- **references/hash-pq.md** — Hash identification, modern GPU cracking economics (RTX 40/50-series), KDF strength grading, and post-quantum migration / "harvest now, decrypt later" assessment (ML-KEM/ML-DSA, hybrid TLS, crypto-agility).
hypnguyen1209