crypto-analysis
Crypto-analysis evaluates cryptographic posture across TLS/SSL/SSH configurations, public-key implementations, and token schemes. It detects cipher downgrades, weak key generation, nonce reuse, AEAD misuse, and JWT algorithm confusion using integrated tools like testssl.sh, openssl, and hashcat. Use it to identify cryptographic flaws before attackers do.
Crypto-analysis audits TLS/PKI configurations, RSA/ECC implementations, and JWT tokens for cryptographic weaknesses and attack vectors.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-03
Crypto-analysis audits TLS/PKI configurations, RSA/ECC implementations, and JWT tokens for cryptographic weaknesses and attack vectors. Crypto-analysis evaluates cryptographic posture across TLS/SSL/SSH configurations, public-key implementations, and token schemes. It detects cipher downgrades, weak key generation, nonce reuse, AEAD misuse, and JWT algorithm confusion using integrated tools like testssl.sh, openssl, and hashcat. Use it to identify cryptographic flaws before attackers do.
Use it when
- Yes.
- Crypto-analysis recovers private keys from weak RSA and ECC implementations by detecting biased nonces and implementation flaws.
Verify before relying
Read SKILL.md below before installing (14 files). Open directory: indexed for reading, not audited.
Similar skills
Install
hypnguyen1209/offensive-claude/crypto-analysis · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is crypto-analysis and what does it do?
Crypto-analysis evaluates cryptographic posture across TLS/SSL/SSH configurations, public-key implementations, and token schemes. It detects cipher downgrades, weak key generation, nonce reuse, AEAD misuse, and JWT algorithm confusion using integrated tools like testssl.sh, openssl, and hashcat. Use it to identify cryptographic flaws before attackers do.
Can crypto-analysis perform TLS PKI audit and detect protocol flaws?
Yes. Crypto-analysis audits TLS/PKI configurations and cipher suites for downgrade attacks and protocol flaws. It identifies weak ciphers, SSL/TLS version misconfigurations, and certificate chain issues to harden your cryptographic infrastructure against known weaknesses.
How does crypto-analysis help with RSA key attack and ECDSA nonce recovery?
Crypto-analysis recovers private keys from weak RSA and ECC implementations by detecting biased nonces and implementation flaws. It applies lattice-based attacks and nonce analysis to expose key material from systems with poor randomness or side-channel leakage.
Does crypto-analysis detect JWT token forgery via algorithm confusion?
Yes. Crypto-analysis forges JWT/JOSE tokens by exploiting algorithm confusion and signature bypass vulnerabilities. It tests for 'none' algorithm acceptance, key confusion between symmetric and asymmetric schemes, and other token validation weaknesses.
What symmetric encryption misuse can crypto-analysis identify?
Crypto-analysis exploits symmetric cipher misuse including CBC padding oracles, AES-GCM nonce reuse, and AEAD key commitment failures. It detects improper IV handling, deterministic encryption, and other patterns that leak plaintext or enable forgery.
Does crypto-analysis assess post-quantum migration readiness?
Yes. Crypto-analysis assesses post-quantum cryptography migration readiness and identifies harvest-now-decrypt-later exposure. It evaluates your current reliance on quantum-vulnerable algorithms and guides transition planning to quantum-resistant schemes.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
name: crypto-analysis description: Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review metadata: type: offensive phase: analysis tools: testssl.sh, openssl, hashcat, john, RsaCtfTool, sagemath, jwt_tool, ecdsa-lattice mitre: [T1600, T1600.001, T1557, T1110.002, T1552.004, T1606.001, T1040] kill_chain: phase: [recon, exploit] step: [1, 4] attck_tactics: [TA0043, TA0006, TA0009] attck_techniques: [T1600, T1600.001, T1557, T1557.001, T1110.002, T1552.004, T1606.001, T1040] depends_on: [recon-osint] feeds_into: [exploit-development, web-pentest, network-attack] inputs: [tls_config, crypto_implementation, hash_samples, public_keys, jwt_tokens, signature_corpus] outputs: [crypto_weakness_report, finding_record, recovered_keys, cracked_credentials] references: - references/tls-pki-audit.md - references/rsa-attacks.md - references/ecc-nonce-attacks.md - references/symmetric-aead.md - references/jwt-jose.md - references/hash-pq.md scripts: - scripts/tls_audit.py - scripts/rsa_attack.py - scripts/ecdsa_lattice.py -
(truncated - see the full file via the links below)
File tree — 14 files
skills/crypto-analysis/SKILL.md
skills/crypto-analysis/references/ecc-nonce-attacks.md
skills/crypto-analysis/references/hash-pq.md
skills/crypto-analysis/references/jwt-jose.md
skills/crypto-analysis/references/rsa-attacks.md
skills/crypto-analysis/references/symmetric-aead.md
skills/crypto-analysis/references/tls-pki-audit.md
skills/crypto-analysis/scripts/ecdsa_lattice.py
skills/crypto-analysis/scripts/gcm_nonce_reuse.py
skills/crypto-analysis/scripts/hash_triage.py
skills/crypto-analysis/scripts/jwt_forge.py
skills/crypto-analysis/scripts/padding_oracle.py
skills/crypto-analysis/scripts/rsa_attack.py
skills/crypto-analysis/scripts/tls_audit.py
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Audit TLS/PKI configurations and cipher suites for downgrade and protocol flaws”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
ctf-crypto is a reference guide for cryptographic attack methods in CTF competitions, covering classical and modern cipher exploits, RSA and ECC vulnerabilities, lattice-based attacks, PRNG state recovery, and zero-knowledge proof breaks. It includes practical one-liners and supporting documentation for techniques like padding oracles, key derivation weaknesses, and Coppersmith attacks, with setup instructions for Python packages and external tools.
CTF Crypto helps you investigate cryptographic implementations embedded in compiled binaries through systematic detection, algorithm identification, and weakness analysis. Trace key sources, recognize standard algorithms and custom ciphers, and exploit implementation flaws to recover plaintext or extract keys.
This skill covers hands-on cryptanalysis of symmetric encryption vulnerabilities across block and stream ciphers. Learn to exploit CBC padding oracles and bit flipping attacks, detect and abuse ECB mode repetition, decrypt data byte-at-a-time, and break stream ciphers through key reuse and state recovery. Includes Python implementations and tool usage for authorized testing and CTF challenges.
Mobile-pentest guides dynamic analysis of Android and iOS applications through Frida-based instrumentation, certificate pinning circumvention, and detection bypass. It covers exported component abuse, deep-link exploitation, WebView attacks, and hybrid app reverse engineering for Flutter and React Native codebases.
Incident Response guides evidence collection and analysis during active security breaches across endpoints, memory, logs, and cloud environments. It covers triage acquisition with Velociraptor and KAPE, memory forensics via Volatility 3, Windows event-log timelining with Chainsaw and Hayabusa, anti-forensics detection including timestomping, cloud identity-plane attacks, and ransomware or ESXi hypervisor response.
Reverse Engineering provides techniques and tools for static and dynamic analysis of compiled binaries, firmware, and protected code. Recover decompiled source, unpack obfuscated samples, bypass anti-debugging defenses, and extract vulnerability details through patch diffing and protocol inference.
More skills cloud-security (MIT) · malware-analysis (MIT) · network-attack (MIT) · edr-evasion (MIT)