cryptography

name	cryptography
description	Use when selecting or implementing cryptographic controls for data protection. Covers TLS configuration, password hashing algorithms, key management, secrets management, and encryption standards across all platforms. USE FOR: TLS, encryption, hashing, Argon2, bcrypt, scrypt, key management, secrets management, AES, RSA, ECDSA, certificate management, HashiCorp Vault, AWS KMS, homomorphic encryption, FHE DO NOT USE FOR: authentication protocol design (use authentication), network security appliances, custom cryptographic algorithm design (use established libraries instead)
license	MIT
metadata	{"displayName":"Cryptography","author":"Tyler-R-Kendrick"}
compatibility	claude, copilot, cursor
references	[{"title":"NIST SP 800-57 Recommendation for Key Management","url":"https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final"},{"title":"OWASP Cryptographic Storage Cheat Sheet","url":"https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html"},{"title":"NIST SP 800-175B Guide to Secure Web Services","url":"https://csrc.nist.gov/publications/detail/sp/800-175b/rev-1/final"}]

Cryptography

Overview

Cryptography is the foundation of trust in modern software systems. It underpins confidentiality, integrity, authentication, and non-repudiation for data in transit and at rest. Every secure communication channel, every stored password, and every signed artifact relies on well-implemented cryptographic primitives.

The cardinal rule of applied cryptography is never roll your own crypto. Use established, peer-reviewed libraries and standards. Custom cryptographic algorithms or ad-hoc constructions are almost guaranteed to contain exploitable weaknesses. Rely on proven implementations such as OpenSSL, libsodium, Bouncy Castle, or the native cryptography modules provided by your platform.

TLS Configuration

Transport Layer Security protects data in transit. All services must enforce a minimum of TLS 1.2, and should prefer TLS 1.3 wherever supported.

Disabled Protocols

Protocol	Status	Reason
SSL 3.0	Disabled	Vulnerable to POODLE attack
TLS 1.0	Disabled	Deprecated by RFC 8996; known weaknesses
TLS 1.1	Disabled	Deprecated by RFC 8996; no modern benefits

Recommended Cipher Suites

Cipher Suite	Protocol	Notes
AES-128-GCM / AES-256-GCM	TLS 1.2+	Authenticated encryption, hardware-accelerated on modern CPUs
ChaCha20-Poly1305	TLS 1.2+	Excellent performance on devices without AES-NI

• In TLS 1.3, cipher suite negotiation is simplified and only secure options are available by default.
• Disable CBC-mode ciphers when possible to avoid padding oracle attacks.
• Always enable HSTS (HTTP Strict Transport Security) to prevent protocol downgrade attacks:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Password Hashing

Passwords must be hashed with a slow, memory-hard function designed specifically for password storage. General-purpose hash functions are not suitable.

Algorithm Comparison