crypto-analysis
Crypto-analysis evaluates cryptographic posture across TLS/SSL/SSH configurations, public-key implementations, and token schemes. It detects cipher downgrades, weak key generation, nonce reuse, AEAD misuse, and JWT algorithm confusion using integrated tools like testssl.sh, openssl, and hashcat. Use it to identify cryptographic flaws before attackers do.
Crypto-analysis audits TLS/PKI configurations, RSA/ECC implementations, and JWT tokens for cryptographic weaknesses and attack vectors.
AI-generated summary based on this skill's SKILL.md
Install
hypnguyen1209/offensive-claude/crypto-analysis · repository language: Python
git clone https://github.com/hypnguyen1209/offensive-claude
cp -r offensive-claude/skills/crypto-analysis ~/.claude/skills/crypto-analysisnpx skillfed install hypnguyen1209/offensive-claude/crypto-analysisFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is crypto-analysis and what does it do?
Crypto-analysis evaluates cryptographic posture across TLS/SSL/SSH configurations, public-key implementations, and token schemes. It detects cipher downgrades, weak key generation, nonce reuse, AEAD misuse, and JWT algorithm confusion using integrated tools like testssl.sh, openssl, and hashcat. Use it to identify cryptographic flaws before attackers do.
Can crypto-analysis perform TLS PKI audit and detect protocol flaws?
Yes. Crypto-analysis audits TLS/PKI configurations and cipher suites for downgrade attacks and protocol flaws. It identifies weak ciphers, SSL/TLS version misconfigurations, and certificate chain issues to harden your cryptographic infrastructure against known weaknesses.
How does crypto-analysis help with RSA key attack and ECDSA nonce recovery?
Crypto-analysis recovers private keys from weak RSA and ECC implementations by detecting biased nonces and implementation flaws. It applies lattice-based attacks and nonce analysis to expose key material from systems with poor randomness or side-channel leakage.
Does crypto-analysis detect JWT token forgery via algorithm confusion?
Yes. Crypto-analysis forges JWT/JOSE tokens by exploiting algorithm confusion and signature bypass vulnerabilities. It tests for 'none' algorithm acceptance, key confusion between symmetric and asymmetric schemes, and other token validation weaknesses.
What symmetric encryption misuse can crypto-analysis identify?
Crypto-analysis exploits symmetric cipher misuse including CBC padding oracles, AES-GCM nonce reuse, and AEAD key commitment failures. It detects improper IV handling, deterministic encryption, and other patterns that leak plaintext or enable forgery.
Does crypto-analysis assess post-quantum migration readiness?
Yes. Crypto-analysis assesses post-quantum cryptography migration readiness and identifies harvest-now-decrypt-later exposure. It evaluates your current reliance on quantum-vulnerable algorithms and guides transition planning to quantum-resistant schemes.
SKILL.md
rendered from the published skill — quoted content, verbatim
name: crypto-analysis description: Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review metadata: type: offensive phase: analysis tools: testssl.sh, openssl, hashcat, john, RsaCtfTool, sagemath, jwt_tool, ecdsa-lattice mitre: [T1600, T1600.001, T1557, T1110.002, T1552.004, T1606.001, T1040] kill_chain: phase: [recon, exploit] step: [1, 4] attck_tactics: [TA0043, TA0006, TA0009] attck_techniques: [T1600, T1600.001, T1557, T1557.001, T1110.002, T1552.004, T1606.001, T1040] depends_on: [recon-osint] feeds_into: [exploit-development, web-pentest, network-attack] inputs: [tls_config, crypto_implementation, hash_samples, public_keys, jwt_tokens, signature_corpus] outputs: [crypto_weakness_report, finding_record, recovered_keys, cracked_credentials] references: - references/tls-pki-audit.md - references/rsa-attacks.md - references/ecc-nonce-attacks.md - references/symmetric-aead.md - references/jwt-jose.md - references/hash-pq.md scripts: - scripts/tls_audit.py - scripts/rsa_attack.py - scripts/ecdsa_lattice.py -
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 14 files
skills/crypto-analysis/SKILL.md
skills/crypto-analysis/references/ecc-nonce-attacks.md
skills/crypto-analysis/references/hash-pq.md
skills/crypto-analysis/references/jwt-jose.md
skills/crypto-analysis/references/rsa-attacks.md
skills/crypto-analysis/references/symmetric-aead.md
skills/crypto-analysis/references/tls-pki-audit.md
skills/crypto-analysis/scripts/ecdsa_lattice.py
skills/crypto-analysis/scripts/gcm_nonce_reuse.py
skills/crypto-analysis/scripts/hash_triage.py
skills/crypto-analysis/scripts/jwt_forge.py
skills/crypto-analysis/scripts/padding_oracle.py
skills/crypto-analysis/scripts/rsa_attack.py
skills/crypto-analysis/scripts/tls_audit.py