13-crypto-analysis

Name: 13-crypto-analysis
Author: Masriyan

190stars37forks

How to install 13-crypto-analysis?

masriyan/claude-code-cybersecurity-skill/13-crypto-analysis

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 13-crypto-analysis

Installs into the current project.

Summary

SSL/TLS auditing, cipher suite analysis, hash algorithm identification, encryption implementation review, and cryptographic weakness detection in code

Files · 1

View on GitHub

SKILL.md

1	# Cryptographic Analysis & Assessment
2
3	## Purpose
4
5	Enable Claude to assist with cryptographic security assessments including SSL/TLS configuration auditing, cipher suite analysis and recommendation, hash algorithm identification, encryption implementation code review, key management evaluation, and detection of cryptographic vulnerabilities. Claude directly analyzes provided configurations and code.
6
7	---
8
9	## Activation Triggers
10
11	This skill activates when the user asks about:
12	- Auditing SSL/TLS configuration of a server or service
13	- Evaluating cipher suites for security strength
14	- Identifying hash algorithms from hash values or code
15	- Reviewing code for cryptographic implementation flaws
16	- Assessing key lengths, key management, or rotation policies
17	- Detecting hardcoded keys, weak IVs, or ECB mode usage
18	- Generating TLS configuration recommendations (Mozilla profile)
19	- Certificate analysis (expiration, chain, transparency)
20	- Post-quantum cryptography guidance
21	- Password hashing implementation review (bcrypt, Argon2, PBKDF2)
22
23	---
24
25	## Prerequisites
26
27	```bash
28	pip install cryptography requests pyOpenSSL
29	```
30
31	Recommended tools:
32	- `sslyze` — Python TLS scanner
33	- `testssl.sh` — Comprehensive TLS testing
34	- `openssl` — Command-line TLS operations
35	- `Wireshark` — TLS traffic analysis
36	- `certbot` — Certificate management
37
38	---
39
40	## Core Capabilities
41
42	### 1. SSL/TLS Configuration Auditing
43
44	When the user asks to audit TLS for a server or paste a TLS configuration:
45
46	Command-line audit approach:
47	```bash
48	# Quick TLS check using openssl
49	openssl s_client -connect example.com:443 -tls1_2 2>/dev/null \| grep -E "Protocol\|Cipher"
50	openssl s_client -connect example.com:443 -tls1 2>/dev/null \| grep -E "handshake\|error"
51
52	# Check certificate details
53	openssl s_client -connect example.com:443 </dev/null 2>/dev/null \| openssl x509 -noout -dates -subject -issuer
54
55	# Comprehensive scan with sslyze
56	sslyze --regular example.com --json_out result.json
57
58	# Or testssl.sh (most comprehensive)
59	./testssl.sh --severity HIGH --quiet example.com
60
61	# Use the skill's script
62	python scripts/tls_auditor.py --host example.com --port 443 --output report.json
63	python scripts/tls_auditor.py --host mail.example.com --port 993 --grade
64	```
65
66	TLS Version Support Ratings:
67	\| Protocol \| Status \| Action \|
68	\|----------\|--------\|--------\|
69	\| SSLv2 \| Critically broken \| Block immediately \|
70	\| SSLv3 \| Broken (POODLE) \| Block immediately \|
71	\| TLS 1.0 \| Deprecated (PCI-DSS violation) \| Disable — BEAST, POODLE \|
72	\| TLS 1.1 \| Deprecated \| Disable \|
73	\| TLS 1.2 \| Acceptable (with strong ciphers) \| Keep with restrictions \|
74	\| TLS 1.3 \| Current standard \| Enable and prefer \|
75
76	TLS Vulnerability Checklist:
77	```
78	[ ] Heartbleed (CVE-2014-0160): openssl s_client + heartbleed test
79	[ ] POODLE: SSLv3 enabled?
80	[ ] BEAST: TLS 1.0 + CBC cipher?
81	[ ] ROBOT: RSA key exchange supported?
82	[ ] DROWN: SSLv2 on any port of same server?
83	[ ] Logjam/FREAK: DHE < 2048-bit or EXPORT ciphers?
84	[ ] CRIME/BREACH: TLS compression enabled?
85	[ ] Sweet32: 3DES (64-bit block cipher) supported?
86	[ ] Weak certificate: RSA < 2048-bit, SHA-1 signed?
87	[ ] Certificate validity: Not expired, chain complete, not self-signed for prod?
88	[ ] HSTS: Strict-Transport-Security header present?
89	[ ] CT: Certificate in public transparency logs?
90	```
91
92	### 2. Cipher Suite Strength Evaluation
93
94	When the user asks about cipher suite security:
95
96	TLS 1.3 Cipher Suites (All Secure — Use These):
97	\| Cipher Suite \| Key Exchange \| Auth \| Encryption \| MAC \| Rating \|
98	\|-------------\|-------------\|------\|------------\|-----\|--------\|
99	\| TLS_AES_256_GCM_SHA384 \| ECDHE \| RSA/ECDSA \| AES-256-GCM \| SHA-384 \| A+ \|
100	\| TLS_CHACHA20_POLY1305_SHA256 \| ECDHE \| RSA/ECDSA \| ChaCha20 \| Poly1305 \| A+ \|
101	\| TLS_AES_128_GCM_SHA256 \| ECDHE \| RSA/ECDSA \| AES-128-GCM \| SHA-256 \| A \|
102
103	TLS 1.2 Cipher Suite Ratings:
104	\| Cipher Suite \| Rating \| Notes \|
105	\|-------------\|--------\|-------\|
106	\| ECDHE-ECDSA-AES256-GCM-SHA384 \| A+ \| Perfect — AEAD, PFS \|
107	\| ECDHE-RSA-AES256-GCM-SHA384 \| A+ \| Perfect — AEAD, PFS \|
108	\| ECDHE-RSA-AES128-GCM-SHA256 \| A \| Good — AEAD, PFS \|
109	\| DHE-RSA-AES256-GCM-SHA384 \| A \| Good — if DHE ≥ 2048-bit \|
110	\| AES256-GCM-SHA384 \| B \| No forward secrecy \|
111	\| ECDHE-RSA-AES256-SHA384 \| B \| CBC mode (timing attacks) \|
112	\| RC4-SHA \| F \| RC4 broken — never use \|
113	\| DES-CBC3-SHA \| F \| 3DES vulnerable (Sweet32) \|
114	\| NULL-SHA \| F \| No encryption \|
115	\| EXPORT-RC4-MD5 \| F \| FREAK vulnerable \|
116
117	Recommended nginx TLS Configuration (Mozilla Modern Profile):
118	```nginx
119	ssl_protocols TLSv1.2 TLSv1.3;
120	ssl_prefer_server_ciphers off; # TLS 1.3 ignores this; client order for TLS 1.2
121
122	# For TLS 1.2 compatibility
123	ssl_ciphers ECDHE-ECDSA-AES128-GCM-SH

People who liked this also viewed

6 picks

Type

13-crypto-analysis

190stars37forks

View on GitHub

How to install 13-crypto-analysis?

masriyan/claude-code-cybersecurity-skill/13-crypto-analysis

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 13-crypto-analysis

Installs into the current project.

Summary

SSL/TLS auditing, cipher suite analysis, hash algorithm identification, encryption implementation review, and cryptographic weakness detection in code

Files · 1

View on GitHub

SKILL.md

1	# Cryptographic Analysis & Assessment
2
3	## Purpose
4
5	Enable Claude to assist with cryptographic security assessments including SSL/TLS configuration auditing, cipher suite analysis and recommendation, hash algorithm identification, encryption implementation code review, key management evaluation, and detection of cryptographic vulnerabilities. Claude directly analyzes provided configurations and code.
6
7	---
8
9	## Activation Triggers
10
11	This skill activates when the user asks about:
12	- Auditing SSL/TLS configuration of a server or service
13	- Evaluating cipher suites for security strength
14	- Identifying hash algorithms from hash values or code
15	- Reviewing code for cryptographic implementation flaws
16	- Assessing key lengths, key management, or rotation policies
17	- Detecting hardcoded keys, weak IVs, or ECB mode usage
18	- Generating TLS configuration recommendations (Mozilla profile)
19	- Certificate analysis (expiration, chain, transparency)
20	- Post-quantum cryptography guidance
21	- Password hashing implementation review (bcrypt, Argon2, PBKDF2)
22
23	---
24
25	## Prerequisites
26
27	```bash
28	pip install cryptography requests pyOpenSSL
29	```
30
31	Recommended tools:
32	- `sslyze` — Python TLS scanner
33	- `testssl.sh` — Comprehensive TLS testing
34	- `openssl` — Command-line TLS operations
35	- `Wireshark` — TLS traffic analysis
36	- `certbot` — Certificate management
37
38	---
39
40	## Core Capabilities
41
42	### 1. SSL/TLS Configuration Auditing
43
44	When the user asks to audit TLS for a server or paste a TLS configuration:
45
46	Command-line audit approach:
47	```bash
48	# Quick TLS check using openssl
49	openssl s_client -connect example.com:443 -tls1_2 2>/dev/null \| grep -E "Protocol\|Cipher"
50	openssl s_client -connect example.com:443 -tls1 2>/dev/null \| grep -E "handshake\|error"
51
52	# Check certificate details
53	openssl s_client -connect example.com:443 </dev/null 2>/dev/null \| openssl x509 -noout -dates -subject -issuer
54
55	# Comprehensive scan with sslyze
56	sslyze --regular example.com --json_out result.json
57
58	# Or testssl.sh (most comprehensive)
59	./testssl.sh --severity HIGH --quiet example.com
60
61	# Use the skill's script
62	python scripts/tls_auditor.py --host example.com --port 443 --output report.json
63	python scripts/tls_auditor.py --host mail.example.com --port 993 --grade
64	```
65
66	TLS Version Support Ratings:
67	\| Protocol \| Status \| Action \|
68	\|----------\|--------\|--------\|
69	\| SSLv2 \| Critically broken \| Block immediately \|
70	\| SSLv3 \| Broken (POODLE) \| Block immediately \|
71	\| TLS 1.0 \| Deprecated (PCI-DSS violation) \| Disable — BEAST, POODLE \|
72	\| TLS 1.1 \| Deprecated \| Disable \|
73	\| TLS 1.2 \| Acceptable (with strong ciphers) \| Keep with restrictions \|
74	\| TLS 1.3 \| Current standard \| Enable and prefer \|
75
76	TLS Vulnerability Checklist:
77	```
78	[ ] Heartbleed (CVE-2014-0160): openssl s_client + heartbleed test
79	[ ] POODLE: SSLv3 enabled?
80	[ ] BEAST: TLS 1.0 + CBC cipher?
81	[ ] ROBOT: RSA key exchange supported?
82	[ ] DROWN: SSLv2 on any port of same server?
83	[ ] Logjam/FREAK: DHE < 2048-bit or EXPORT ciphers?
84	[ ] CRIME/BREACH: TLS compression enabled?
85	[ ] Sweet32: 3DES (64-bit block cipher) supported?
86	[ ] Weak certificate: RSA < 2048-bit, SHA-1 signed?
87	[ ] Certificate validity: Not expired, chain complete, not self-signed for prod?
88	[ ] HSTS: Strict-Transport-Security header present?
89	[ ] CT: Certificate in public transparency logs?
90	```
91
92	### 2. Cipher Suite Strength Evaluation
93
94	When the user asks about cipher suite security:
95
96	TLS 1.3 Cipher Suites (All Secure — Use These):
97	\| Cipher Suite \| Key Exchange \| Auth \| Encryption \| MAC \| Rating \|
98	\|-------------\|-------------\|------\|------------\|-----\|--------\|
99	\| TLS_AES_256_GCM_SHA384 \| ECDHE \| RSA/ECDSA \| AES-256-GCM \| SHA-384 \| A+ \|
100	\| TLS_CHACHA20_POLY1305_SHA256 \| ECDHE \| RSA/ECDSA \| ChaCha20 \| Poly1305 \| A+ \|
101	\| TLS_AES_128_GCM_SHA256 \| ECDHE \| RSA/ECDSA \| AES-128-GCM \| SHA-256 \| A \|
102
103	TLS 1.2 Cipher Suite Ratings:
104	\| Cipher Suite \| Rating \| Notes \|
105	\|-------------\|--------\|-------\|
106	\| ECDHE-ECDSA-AES256-GCM-SHA384 \| A+ \| Perfect — AEAD, PFS \|
107	\| ECDHE-RSA-AES256-GCM-SHA384 \| A+ \| Perfect — AEAD, PFS \|
108	\| ECDHE-RSA-AES128-GCM-SHA256 \| A \| Good — AEAD, PFS \|
109	\| DHE-RSA-AES256-GCM-SHA384 \| A \| Good — if DHE ≥ 2048-bit \|
110	\| AES256-GCM-SHA384 \| B \| No forward secrecy \|
111	\| ECDHE-RSA-AES256-SHA384 \| B \| CBC mode (timing attacks) \|
112	\| RC4-SHA \| F \| RC4 broken — never use \|
113	\| DES-CBC3-SHA \| F \| 3DES vulnerable (Sweet32) \|
114	\| NULL-SHA \| F \| No encryption \|
115	\| EXPORT-RC4-MD5 \| F \| FREAK vulnerable \|
116
117	Recommended nginx TLS Configuration (Mozilla Modern Profile):
118	```nginx
119	ssl_protocols TLSv1.2 TLSv1.3;
120	ssl_prefer_server_ciphers off; # TLS 1.3 ignores this; client order for TLS 1.2
121
122	# For TLS 1.2 compatibility
123	ssl_ciphers ECDHE-ECDSA-AES128-GCM-SH

People who liked this also viewed

6 picks

Type