sawrus Skill: Cryptography Standards
When to load
When implementing password storage, data encryption, token signing, or key management.
Approved Algorithms
| Use Case | Approved | Forbidden |
|---|---|---|
| Password hashing | Argon2id, bcrypt (cost≥12) | MD5, SHA-1, unsalted SHA-256 |
| Data encryption | AES-256-GCM, ChaCha20-Poly1305 | DES, 3DES, AES-ECB |
| Token signing | RS256, ES256 | HS256 in distributed systems |
| TLS | TLS 1.2+, prefer TLS 1.3 | SSLv3, TLS 1.0, TLS 1.1 |
Password Storage (Argon2id)
from argon2 import PasswordHasher
ph = PasswordHasher(time_cost=2, memory_cost=65536, parallelism=2)
hashed = ph.hash(plain_password)
try:
ph.verify(stored_hash, provided_password)
if ph.check_needs_rehash(stored_hash):
new_hash = ph.hash(provided_password)
db.update_password_hash(user_id, new_hash)
except VerifyMismatchError:
raise InvalidCredentials()
Envelope Encryption
Never encrypt data directly with a master key.
1. Generate unique Data Encryption Key (DEK) per record
2. Encrypt data with DEK (AES-256-GCM)
3. Encrypt DEK with Key Encryption Key (KEK) in KMS
4. Store: encrypted_data + encrypted_DEK + IV