# Analyzing Crypto Weakness > Identifies weak cryptographic algorithms, hardcoded keys, and insecure key management practices in binary code. Use when analyzing encryption/decryption, authentication mechanisms, or reviewing cryptographic implementations. Use when this capability is needed. - Skill: `tomevault-io/analyzing-crypto-weakness` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/analyzing-crypto-weakness` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/analyzing-crypto-weakness/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: AI & ML - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/analyzing-crypto-weakness --- # Cryptographic Weakness Detection ## Detection Workflow 1. **Identify cryptographic functions**: Search for crypto-related function names, encryption/decryption operations, hash function usage 2. **Extract crypto parameters**: Identify algorithms used, check key sizes and modes, examine IV/nonce handling 3. **Check for hardcoded secrets**: Use `strings` to find potential keys, search for common password/key patterns, analyze data sections for secrets 4. **Assess implementation security**: Check for constant-time comparisons, verify proper padding, assess randomness of IVs/nonces ## Key Patterns - Weak algorithms: DES, 3DES, RC4, MD5, SHA1, ECB mode, small key sizes (<128 bits) - Hardcoded secrets: passwords/passphrases, keys, IVs/nonces, magic numbers - Insecure key management: keys embedded in code, plaintext storage, weak RNG, reused IVs/nonces - Implementation issues: timing attacks, side-channel vulnerabilities, incorrect padding, missing authentication ## Output Format Report with: id, type, subtype, severity, confidence, location, algorithm, mode, key_size, issues, recommendation, cve_references, mitigation. ## Severity Guidelines - **CRITICAL**: Hardcoded private keys or passwords - **HIGH**: Broken algorithms (DES, RC4) in security-critical code - **MEDIUM**: Weak algorithms in non-critical code - **LOW**: Minor crypto implementation issues ## See Also - `patterns.md` - Detailed detection patterns and exploitation scenarios - `examples.md` - Example analysis cases and code samples - `references.md` - CWE references and mitigation strategies --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/waiwai24) — claim your Tome and manage your conversions.