cryptographic-vulnerabilities

name	Cryptographic Vulnerabilities
description	Crypto implementation analysis — weak algorithms, side-channels, key management flaws, padding oracles, random generation failures, implementation bugs
tags	["crypto","cryptography","security","side-channel","weak-algorithms","key-management","implementation","paddingoracle","rng","nonce","iv","encryption","hmac","signature"]
author	Spectra Security Research
version	1

Cryptographic Vulnerability Analysis

Overview

This skill analyzes cryptographic implementations for vulnerabilities in algorithm selection, key management, random generation, side-channel leaks, padding oracles, and other implementation flaws.

---

Analysis Phases

Phase 1: Algorithm Identification

# Identify crypto algorithms in use:

# Encryption algorithms:
# - AES (block cipher, modes: ECB, CBC, CTR, GCM, OCB, CFB, OFB)
# - ChaCha20, ChaCha20-Poly1305 (stream cipher)
# - 3DES, DES (legacy, weak)
# - RC4 (broken, avoid)

# Hash functions:
# - SHA-1 (broken, 160-bit)
# - SHA-2 (SHA-256, SHA-384, SHA-512)
# - SHA-3 (SHA3-256, etc.)
# - MD5, MD4 (broken)

# MAC algorithms:
# - HMAC (correct)
# - CBC-MAC (needs careful implementation)
# - CMAC (block cipher-based MAC)

# Asymmetric:
# - RSA (padding: PKCS#1 v1.5, OAEP, PSS)
# - ECDSA (curve selection matters)
# - Ed25519 (modern, recommended)
# - DSA (legacy)

# Detection in code:
grep -r "DES\|RC4\|MD5\|SHA1" codebase/
grep -r "AES_ECB\|AES_CBC_NO_AUTH" codebase/
grep -r "rsa.*pkcs1" codebase/

Weak Algorithm Indicators:

• DES, 3DES, RC4
• MD5, SHA1
• AES-ECB
• RSA without OAEP/PSS
• DSA

---

Phase 2: Weak Primitive Detection

2.1 Broken Hash Functions

# MD5 collisions
import hashlib
# MD5 is broken - collisions trivial
h = hashlib.md5()
# Avoid for: signatures, checksums, HMAC (HMAC-MD5 OK but discouraged)

# SHA1 collisions
# SHA-1 is broken (SHAttered, 2017)
h = hashlib.sha1()
# Avoid for: signatures, certificates

# Detection in code:
# - md5(), hashlib.md5, MD5(), MD5_Init()
# - sha1(), hashlib.sha1, SHA1(), SHA1_Init()

Novelty:

• Check for recent collision attacks
• Look for hash length extension attacks (SHA-2 without HMAC)
• Verify hash usage in signatures

2.2 Weak Encryption Modes

# AES-ECB (deterministic, no IV)
# ECB exposes patterns in identical blocks

from cryptography.hazmat.primitives.ciphers.modes import ECB
# DON'T USE ECB for anything

# Detection:
# - AES_ECB, MODE_ECB, EVP_CIPHER_AES_128_ECB
# - Cipher.getInstance("AES/ECB/")

# CBC without MAC (padding oracle risk)
# CBC requires integrity protection (HMAC, AEAD)
from cryptography.hazmat.primitives.ciphers.modes import CBC

# Detection:
# - CBC without HMAC/AEAD
# - Manual padding implementation
# - MAC-then-encrypt or encrypt-then-MAC errors

Padding Oracle Detection:

# Test for padding oracle vulnerability:
# 1. Send modified ciphertext
# 2. Observe error responses:
#    - "padding error" vs "decryption error"
#    - Different response times
#    - Different HTTP status codes

# Test:
# - Modify last byte of ciphertext
# - Send and observe response
# - If behavior differs → vulnerable

# Vulnerable patterns:
# - Manual padding check and error
# - Different exceptions for padding vs decryption
# - Timing differences in validation

2.3 Weak Random Generation

# PRNG vulnerabilities:

# Weak PRNGs:
# - rand(), random() (C, predictable)
# - Math.random() (JavaScript, predictable)
# - java.util.Random (predictable)
# - time()-based seeding

# Secure PRNGs:
import secrets  # Python
import random.SystemRandom()  # Python
// crypto.getRandomValues()  # JavaScript
// SecureRandom  # Java

# Detection:
# - time(), gettimeofday() used as seed
# - rand(), random() in crypto context
# - Math.random() for crypto
# - Predictable seed values

# Novelty:
# - Look for seed reuse
# - Check for insufficient entropy
# - Verify PRNG source

---

Phase 3: Side-Channel Discovery

3.1 Timing Attacks

# Timing attack vulnerable code:

# Constant-time comparison:
def constant_time_compare(a, b):
    # GOOD: Uses XOR to avoid branching
    result = 0
    for x, y in zip(a, b):
        result |= x ^ y
    return result == 0

# BAD: Uses early exit
def insecure_compare(a, b):
    # Leaks comparison time
    for x, y in zip(a, b):
        if x != y:
            return False
    return True

# Detection:
# - Loop with early return in comparison
# - Branching on secret data
# - Table lookups with secret index

# Testing:
# Measure response time vs input position
# Correlation indicates vulnerability

3.2 Cache/Timing Side Channels

# Cache attacks:

# Prime+Probe, Flush+Reload on:
# - AES lookup tables (software AES)
# - RSA modular exponentiation
# - Elliptic curve scalar multiplication

# Detection in code:
# - Table lookups with secret data
# - Branching on secret data
# - Memory access patterns

# Novelty:
# - New cache attack variants (MDS, Load+Reload)
# - Microarchitectural attacks
# - Speculative execution variants

3.3 Power/EM Side Channels

# For embedded/hardware:

# Power analysis (DPA, CPA):
# - Requires physical access
# - Measure power consumption during crypto ops
# - Correlate with key bits

# EM analysis:
# - Electromagnetic emanations
# - Can leak crypto operations

# Detection of protection:
# - Constant-time implementations
# - Masking/blinding techniques
# - Hardware security modules (HSM)

---

Phase 4: Padding Oracle Attacks

4.1 CBC Padding Oracle

# CBC padding oracle vulnerability:

# Vulnerable code (conceptual):
def decrypt_cbc(ciphertext, key, iv):
    # Decrypt with CBC
    plaintext = aes_cbc_decrypt(ciphertext, key, iv)
    # Check padding
    padding = plaintext[-1]
    if plaintext[-padding:] != bytes([padding] * padding):
        raise ValueError("Invalid padding")
    return plaintext

# Attack: Decrypt byte-by-byte by manipulating padding
# VCBM (Vaudenay's CBC Padding Oracle) attack

# Detection:
# - Padding validation errors differ from decryption errors
# - Timing differences in validation
# - HTTP response differences

4.2 RSA Padding Oracle

# RSA PKCS#1 v1.5 padding oracle:
# Error messages indicate padding validity

# Bleichenbacher's attack (1998) applies
# Millions of queries needed

# Detection:
# - "padding error" vs "decryption error"
# - Different error codes
# - Timing differences

# Novelty:
# - Look for newer variants (DROWN, ROBOT)
# - Check for partial side-channel protections

---

Phase 5: Key Management Issues

5.1 Hardcoded Keys

# Detection of hardcoded keys:

# In code:
grep -r "0x[0-9a-f]\{32,\}" codebase/  # Hex keys
grep -r "api_key\s*=\s*["\']" codebase/
grep -r "secret\s*=\s*["\']" codebase/
grep -r "password\s*=\s*["\']" codebase/

# Common locations:
# - Config files (.env, config.json, settings.py)
# - Source code (constant definitions)
# - Version control (git history)

# Novelty:
# - Check for embedded keys in binaries
# - Look for weak key derivation

5.2 Key Derivation Issues

# Key derivation vulnerabilities:

# Weak KDFs:
# - Simple XOR-based derivation
# - SHA-1 without salt
# - Single iteration PBKDF2

# Secure KDFs:
# - PBKDF2 with high iteration count
# - Argon2 (recommended)
# - scrypt

# Detection:
# - PBKDF2 with < 10000 iterations
# - Argon2 with low memory/time parameters
# - No salt in KDF
# - Reused salts

5.3 Key Reuse

# Key reuse vulnerabilities:

# Same key for different purposes:
# - Encryption key = HMAC key (bad practice)
# - Key reused across IVs (ECB, CBC without IV change)

# Detection:
# - Same key variable used for different crypto ops
# - IV not changed between encryptions
# - Nonce reuse in stream ciphers
# - RNG seed reuse

# Novelty:
# - Cross-protocol key reuse
# - Key rotation failures

---

Novelty Indicators (PURSUE)

✓ Recent crypto CVEs (2023-2024):

• CVE-2024-33024: Sponge attack on protocol primitives
• CVE-2024-23633: Minerva side-channel
• CVE-2024-26134: OpenSSH reuse attack

✓ Implementation bugs:

• Custom crypto implementations
• Incorrect AEAD usage
• Flawed constant-time code

✓ Protocol-level issues:

• Key exchange flaws (TLS downgrade, DH parameters)
• Certificate validation bypasses
• Protocol confusion attacks

✓ Hardware crypto bugs:

• Intel RDRAND/RDSEED issues
• CPU random number generator flaws
• TPM side-channels

---

Known Patterns (AVOID)

✗ Basic padding oracle (well-documented) ✗ AES-ECB mode (known weakness) ✗ MD5/SHA1 usage (published collisions) ✗ RSA PKCS#1 v1.5 (known attacks)

---

Analysis Checklist

Algorithm Selection

• Encryption algorithms identified
• Hash functions verified
• MAC algorithms checked
• Asymmetric algorithms reviewed
• Key lengths verified

Implementation Review

• Mode of operation checked
• IV/nonce generation verified
• Padding implementation reviewed
• Random generation audited
• Constant-time code examined

Key Management

• Key storage reviewed
• Key derivation checked
• Key rotation verified
• Key reuse tested
• Hardcoded keys scanned

Side-Channel Analysis

• Timing attack susceptibility
• Cache attack vectors
• Error handling leaks
• Resource exhaustion attacks
• Speculative execution issues

---

Quick Reference

Weakness	Detection	Severity
MD5/SHA1	grep -r "md5|sha1"	Medium
AES-ECB	grep "ECB"	High
No IV/IV reuse	Check iv generation	High
Weak RNG	rand(), time() seed	High
Padding oracle	Error response diffs	Critical
Hardcoded keys	Pattern matching	Critical
Weak KDF	Low iteration count	High
Key reuse	Cross-context	High
Timing leaks	Branching on secret	Medium
Cache attacks	Table lookups	High

---

Notes

• Focus on implementation bugs: Crypto algorithms are usually correct, implementations often flawed
• Side-channels: Timing, cache, power, EM leaks
• Protocol issues: TLS misconfig, certificate validation
• Verification: Document algorithm, implementation issue, exploit
• Responsible disclosure: Crypto bugs can have widespread impact