skillfed

crypto-analysis

Crypto-analysis evaluates cryptographic posture across TLS/SSL/SSH configurations, public-key implementations, and token schemes. It detects cipher downgrades, weak key generation, nonce reuse, AEAD misuse, and JWT algorithm confusion using integrated tools like testssl.sh, openssl, and hashcat. Use it to identify cryptographic flaws before attackers do.

Crypto-analysis audits TLS/PKI configurations, RSA/ECC implementations, and JWT tokens for cryptographic weaknesses and attack vectors.

AI-generated summary based on this skill's SKILL.md

326 58 MIT updated by hypnguyen1209

Install

hypnguyen1209/offensive-claude/crypto-analysis · repository language: Python

git clone https://github.com/hypnguyen1209/offensive-claude
cp -r offensive-claude/skills/crypto-analysis ~/.claude/skills/crypto-analysis
npx skillfed install hypnguyen1209/offensive-claude/crypto-analysis

Frequently asked questions

AI-generated answers based on this skill's SKILL.md and metadata

What is crypto-analysis and what does it do?

Crypto-analysis evaluates cryptographic posture across TLS/SSL/SSH configurations, public-key implementations, and token schemes. It detects cipher downgrades, weak key generation, nonce reuse, AEAD misuse, and JWT algorithm confusion using integrated tools like testssl.sh, openssl, and hashcat. Use it to identify cryptographic flaws before attackers do.

Can crypto-analysis perform TLS PKI audit and detect protocol flaws?

Yes. Crypto-analysis audits TLS/PKI configurations and cipher suites for downgrade attacks and protocol flaws. It identifies weak ciphers, SSL/TLS version misconfigurations, and certificate chain issues to harden your cryptographic infrastructure against known weaknesses.

How does crypto-analysis help with RSA key attack and ECDSA nonce recovery?

Crypto-analysis recovers private keys from weak RSA and ECC implementations by detecting biased nonces and implementation flaws. It applies lattice-based attacks and nonce analysis to expose key material from systems with poor randomness or side-channel leakage.

Does crypto-analysis detect JWT token forgery via algorithm confusion?

Yes. Crypto-analysis forges JWT/JOSE tokens by exploiting algorithm confusion and signature bypass vulnerabilities. It tests for 'none' algorithm acceptance, key confusion between symmetric and asymmetric schemes, and other token validation weaknesses.

What symmetric encryption misuse can crypto-analysis identify?

Crypto-analysis exploits symmetric cipher misuse including CBC padding oracles, AES-GCM nonce reuse, and AEAD key commitment failures. It detects improper IV handling, deterministic encryption, and other patterns that leak plaintext or enable forgery.

Does crypto-analysis assess post-quantum migration readiness?

Yes. Crypto-analysis assesses post-quantum cryptography migration readiness and identifies harvest-now-decrypt-later exposure. It evaluates your current reliance on quantum-vulnerable algorithms and guides transition planning to quantum-resistant schemes.

SKILL.md

rendered from the published skill — quoted content, verbatim


name: crypto-analysis description: Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review metadata: type: offensive phase: analysis tools: testssl.sh, openssl, hashcat, john, RsaCtfTool, sagemath, jwt_tool, ecdsa-lattice mitre: [T1600, T1600.001, T1557, T1110.002, T1552.004, T1606.001, T1040] kill_chain: phase: [recon, exploit] step: [1, 4] attck_tactics: [TA0043, TA0006, TA0009] attck_techniques: [T1600, T1600.001, T1557, T1557.001, T1110.002, T1552.004, T1606.001, T1040] depends_on: [recon-osint] feeds_into: [exploit-development, web-pentest, network-attack] inputs: [tls_config, crypto_implementation, hash_samples, public_keys, jwt_tokens, signature_corpus] outputs: [crypto_weakness_report, finding_record, recovered_keys, cracked_credentials] references: - references/tls-pki-audit.md - references/rsa-attacks.md - references/ecc-nonce-attacks.md - references/symmetric-aead.md - references/jwt-jose.md - references/hash-pq.md scripts: - scripts/tls_audit.py - scripts/rsa_attack.py - scripts/ecdsa_lattice.py -

(truncated - see the full file via the links below)

Read as markdown · JSON record · Browse the source repository

File tree — 14 files
skills/crypto-analysis/SKILL.md
skills/crypto-analysis/references/ecc-nonce-attacks.md
skills/crypto-analysis/references/hash-pq.md
skills/crypto-analysis/references/jwt-jose.md
skills/crypto-analysis/references/rsa-attacks.md
skills/crypto-analysis/references/symmetric-aead.md
skills/crypto-analysis/references/tls-pki-audit.md
skills/crypto-analysis/scripts/ecdsa_lattice.py
skills/crypto-analysis/scripts/gcm_nonce_reuse.py
skills/crypto-analysis/scripts/hash_triage.py
skills/crypto-analysis/scripts/jwt_forge.py
skills/crypto-analysis/scripts/padding_oracle.py
skills/crypto-analysis/scripts/rsa_attack.py
skills/crypto-analysis/scripts/tls_audit.py

Related skills

Tags

key-recovery tls-audit signature-forgery mode-oracle nonce-reuse weak-key-detection token-manipulation cipher-downgrade offline-cracking quantum-readiness