# Crypto Standards

> Skill: Cryptography Standards

- Skill: `sawrus/crypto-standards` (Agent Skill)
- Install (CLI): `npx skillmds@latest add sawrus/crypto-standards`
- Raw SKILL.md: https://api.skillmd.com/api/skills/sawrus/crypto-standards/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: sawrus (https://skillmd.com/u/sawrus)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/sawrus/crypto-standards

---

# Skill: Cryptography Standards

## When to load

When implementing password storage, data encryption, token signing, or key management.

## Approved Algorithms

| Use Case | Approved | Forbidden |
|:---|:---|:---|
| Password hashing | Argon2id, bcrypt (cost≥12) | MD5, SHA-1, unsalted SHA-256 |
| Data encryption | AES-256-GCM, ChaCha20-Poly1305 | DES, 3DES, AES-ECB |
| Token signing | RS256, ES256 | HS256 in distributed systems |
| TLS | TLS 1.2+, prefer TLS 1.3 | SSLv3, TLS 1.0, TLS 1.1 |

## Password Storage (Argon2id)

```python
from argon2 import PasswordHasher

ph = PasswordHasher(time_cost=2, memory_cost=65536, parallelism=2)
hashed = ph.hash(plain_password)

try:
    ph.verify(stored_hash, provided_password)
    if ph.check_needs_rehash(stored_hash):
        new_hash = ph.hash(provided_password)
        db.update_password_hash(user_id, new_hash)
except VerifyMismatchError:
    raise InvalidCredentials()
```

## Envelope Encryption

```
Never encrypt data directly with a master key.

1. Generate unique Data Encryption Key (DEK) per record
2. Encrypt data with DEK (AES-256-GCM)
3. Encrypt DEK with Key Encryption Key (KEK) in KMS
4. Store: encrypted_data + encrypted_DEK + IV
```