Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Enable Claude to assist with cryptographic security assessments including SSL/TLS configuration auditing, cipher suite analysis and recommendation, hash algorithm identification, encryption implementation code review, key management evaluation, and detection of cryptographic vulnerabilities. Claude directly analyzes provided configurations and code.
Activation Triggers
This skill activates when the user asks about:
Auditing SSL/TLS configuration of a server or service
Evaluating cipher suites for security strength
Identifying hash algorithms from hash values or code
Reviewing code for cryptographic implementation flaws
Assessing key lengths, key management, or rotation policies
Detecting hardcoded keys, weak IVs, or ECB mode usage
When the user asks to review code for cryptographic flaws:
Claude reads the code directly and flags these patterns:
Python Crypto Anti-Patterns:
# INSECURE: Hardcoded encryption key
key = b"mysecretkey12345"# ← NEVER hardcode keys
cipher = AES.new(key, AES.MODE_ECB) # ← ECB mode is insecure# INSECURE: ECB mode (produces identical ciphertext for identical blocks)from Crypto.Cipher import AES
cipher = AES.new(key, AES.MODE_ECB) # ← Pattern detection attacks possible# INSECURE: Static/reused IV
iv = b"\x00" * 16# ← Static IV allows pattern detection
cipher = AES.new(key, AES.MODE_CBC, iv) # ← Reusing IV with same key = CRITICAL# INSECURE: Weak hash for passwordsimport hashlib
password_hash = hashlib.md5(password.encode()).hexdigest() # ← GPU-crackable# INSECURE: Trusting certificate errorsimport ssl
ssl._create_default_https_context = ssl._create_unverified_context # ← MitM possible
requests.get(url, verify=False) # ← Never do this in production
Secure Python Crypto Patterns:
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives import hashes
import os, secrets
# SECURE: Derive key from password using PBKDF2defderive_key(password: bytes, salt: bytes = None) -> tuple[bytes, bytes]:
if salt isNone:
salt = secrets.token_bytes(32) # 256-bit random salt
kdf = PBKDF2HMAC(
algorithm=hashes.SHA256(),
length=32, # 256-bit key
salt=salt,
iterations=600_000# NIST 2023 minimum for PBKDF2-SHA256
)
key = kdf.derive(password)
return key, salt
# SECURE: AES-GCM (authenticated encryption)defencrypt(data: bytes, key: bytes) -> bytes:
aesgcm = AESGCM(key)
nonce = secrets.token_bytes(12) # 96-bit random nonce (NEVER reuse!)
ciphertext = aesgcm.encrypt(nonce, data, associated_data=None)
return nonce + ciphertext # Prepend nonce for decryptiondefdecrypt(ciphertext: bytes, key: bytes) -> bytes:
aesgcm = AESGCM(key)
nonce = ciphertext[:12]
return aesgcm.decrypt(nonce, ciphertext[12:], associated_data=None)
# SECURE: Argon2id for password hashingfrom argon2 import PasswordHasher
ph = PasswordHasher(time_cost=3, memory_cost=65536, parallelism=4)
hashed = ph.hash(password) # Automatic random salt
ph.verify(hashed, password) # Verify with timing-safe comparison
Code Review Checklist:
Encryption:
[ ] No hardcoded keys (check for key = b"...", SECRET_KEY = "...", etc.)
[ ] No ECB mode (MODE_ECB, "AES/ECB/PKCS5Padding")
[ ] IV/Nonce is random and unique per encryption operation
[ ] Authenticated encryption used (AES-GCM, ChaCha20-Poly1305)
[ ] Key properly derived from password (PBKDF2, bcrypt, Argon2)
[ ] No custom/homebrew crypto algorithms
Certificate Handling:
[ ] Certificate validation is NOT disabled (verify=True)
[ ] Certificate pinning for mobile/critical apps
[ ] No ssl._create_unverified_context
Randomness:
[ ] Cryptographic operations use secrets module or os.urandom()
[ ] Not using random.random() or random.randint() for security
[ ] Tokens and OTPs have sufficient entropy (≥128 bits)
Finalized PQC standards — FIPS 203 (ML-KEM, key encapsulation), FIPS 204 (ML-DSA, signatures), and FIPS 205 (SLH-DSA, hash-based signatures) are published. Recommend these for new designs; FIPS 206 (FN-DSA/Falcon) is forthcoming.
Hybrid key exchange — for TLS, recommend hybrid groups (e.g., X25519+ML-KEM-768 / X25519MLKEM768) so confidentiality survives both classical and quantum attacks during transition.
Harvest-now-decrypt-later — prioritize PQC for long-lived secrets and data with multi-year confidentiality requirements; this is a present risk, not a future one.
Crypto-agility — flag hardcoded algorithms/key sizes; recommend abstraction so primitives can be swapped. Inventory cryptography (a CBOM) as the first migration step.
Hard deprecations — TLS 1.3 preferred / TLS 1.0-1.1 disallowed; SHA-1 and RSA/DH < 2048 flagged as failing; RSA-2048 acceptable now but on the PQC migration clock.
Precision rule: every finding states the primitive, key size/curve, protocol version, and the concrete upgrade (classical-now and PQC-target).
