crypto-analysis
starsforks
How to install crypto-analysis?
hypnguyen1209/offensive-claude/crypto-analysis
$npx -y skills add hypnguyen1209/offensive-claude --skill crypto-analysisUse when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review
SKILL.md
| 1 | # Cryptographic Analysis |
| 2 | |
| 3 | ## When to Activate |
| 4 | |
| 5 | - Auditing TLS/SSL/SSH configurations and X.509 PKI (cipher suites, downgrade, protocol flaws) |
| 6 | - Reviewing crypto implementations in source code or captured traffic |
| 7 | - Attacking weak RSA/ECC keys (CTF and real-world weak-key hygiene) |
| 8 | - Recovering ECDSA/DSA private keys from reused or biased nonces (lattice/HNP) |
| 9 | - Exploiting symmetric/AEAD misuse: padding oracles, GCM nonce reuse, key-commitment |
| 10 | - Forging JWT/JOSE tokens (algorithm confusion, none, jwk/jku/kid injection) |
| 11 | - Cracking password hashes and grading KDF strength |
| 12 | - Assessing post-quantum readiness ("harvest now, decrypt later" exposure) |
| 13 | |
| 14 | ## Technique Map |
| 15 | |
| 16 | | Technique | ATT&CK | CWE | Reference | Script | |
| 17 | |-----------|--------|-----|-----------|--------| |
| 18 | | TLS cipher/protocol downgrade audit | T1600.001 | CWE-326 | references/tls-pki-audit.md | scripts/tls_audit.py | |
| 19 | | Terrapin SSH prefix truncation (CVE-2023-48795) | T1557 | CWE-222 | references/tls-pki-audit.md | scripts/tls_audit.py | |
| 20 | | Marvin/Bleichenbacher RSA timing oracle | T1600 | CWE-208 | references/tls-pki-audit.md | scripts/tls_audit.py | |
| 21 | | X.509 / CT-log shadow-asset discovery | T1589 | CWE-295 | references/tls-pki-audit.md | scripts/tls_audit.py | |
| 22 | | RSA weak-key factoring (Fermat/Wiener/common-modulus) | T1600 | CWE-326 | references/rsa-attacks.md | scripts/rsa_attack.py | |
| 23 | | Coppersmith partial-key & ROCA (CVE-2017-15361) | T1600 | CWE-310 | references/rsa-attacks.md | scripts/rsa_attack.py | |
| 24 | | Hastad broadcast / batch-GCD | T1600 | CWE-326 | references/rsa-attacks.md | scripts/rsa_attack.py | |
| 25 | | ECDSA nonce reuse key recovery | T1552.004 | CWE-323 | references/ecc-nonce-attacks.md | scripts/ecdsa_lattice.py | |
| 26 | | Biased-nonce lattice/HNP (Minerva, PuTTY CVE-2024-31497) | T1552.004 | CWE-1241 | references/ecc-nonce-attacks.md | scripts/ecdsa_lattice.py | |
| 27 | | Psychic signature (0,0) (CVE-2022-21449) | T1606.001 | CWE-347 | references/ecc-nonce-attacks.md | scripts/ecdsa_lattice.py | |
| 28 | | CBC padding oracle (byte-by-byte decrypt) | T1040 | CWE-209 | references/symmetric-aead.md | scripts/padding_oracle.py | |
| 29 | | AES-GCM nonce reuse "forbidden attack" | T1040 | CWE-323 | references/symmetric-aead.md | scripts/gcm_nonce_reuse.py | |
| 30 | | AEAD key-commitment / invisible salamanders / partitioning oracle | T1606 | CWE-347 | references/symmetric-aead.md | scripts/gcm_nonce_reuse.py | |
| 31 | | JWT algorithm confusion RS256→HS256 (CVE-2024-54150) | T1606.001 | CWE-347 | references/jwt-jose.md | scripts/jwt_forge.py | |
| 32 | | JWT alg=none / jwk / jku / kid injection | T1606.001 | CWE-347 | references/jwt-jose.md | scripts/jwt_forge.py | |
| 33 | | Hash identification & GPU cracking | T1110.002 | CWE-916 | references/hash-pq.md | scripts/hash_triage.py | |
| 34 | | Weak KDF / fast-hash password storage | T1110.002 | CWE-916 | references/hash-pq.md | scripts/hash_triage.py | |
| 35 | | Post-quantum / HNDL exposure review | T1600 | CWE-327 | references/hash-pq.md | scripts/tls_audit.py | |
| 36 | |
| 37 | ## Quick Start |
| 38 | |
| 39 | ```bash |
| 40 | # 0. TLS/PKI posture in one shot (downgrade, ROBOT, SWEET32, Terrapin, cert/CT) |
| 41 | python3 scripts/tls_audit.py target.com:443 --ssh target.com:22 --ct --json out.json |
| 42 | testssl.sh --full --robot --sweet32 https://target.com # cross-check with the canonical tool |
| 43 | |
| 44 | # 1. RSA weak-key triage on a captured public key |
| 45 | python3 scripts/rsa_attack.py --pubkey server.pem --ct ciphertext.b64 --auto |
| 46 | # tries Fermat (p~=q), Wiener (small d), batch-GCD/common-modulus, ROCA fingerprint |
| 47 | |
| 48 | # 2. ECDSA key recovery from a signature corpus (reuse or bias) |
| 49 | python3 scripts/ecdsa_lattice.py recover sigs.json --curve secp256r1 --known-msb 4 |
| 50 | # reuse: needs 2 sigs w/ same r; bias: ~256-1200 sigs depending on leak |
| 51 | |
| 52 | # 3. Symmetric/AEAD misuse |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
