| name | cross-layer-crypto-analysis |
| description | Cross-layer cryptographic security analysis skill for evaluating message transformations across network protocol stack. Analyzes encryption, authentication, and encapsulation at each layer (application, transport, network, link, physical). Use when: (1) evaluating post-quantum security of network protocols, (2) auditing cryptographic operations across OSI/TCP layers, (3) analyzing message transformation security, (4) assessing quantum vulnerability of network stack, (5) security audit of protocol layer interactions. |
Cross-Layer Cryptographic Analysis
Analyze cryptographic transformations across network protocol stack layers for security evaluation, particularly post-quantum readiness.
Activation Keywords
- cross-layer crypto analysis
- protocol stack security
- post-quantum protocol analysis
- network layer encryption audit
- OSI layer security
- 跨层密码分析
- 协议栈安全
- 后量子协议
Tools Used
- exec: Run security analysis scripts, query cryptographic standards
- read: Load protocol specifications, security frameworks
- write: Generate security reports, audit findings
- web_search: Search for cryptographic vulnerabilities, post-quantum standards
Usage Patterns
Pattern 1: Full Stack Security Audit
Analyze all protocol layers for cryptographic operations and quantum vulnerability:
分析整个协议栈的密码学安全
Pattern 2: Layer-Specific Analysis
Focus on specific layer's cryptographic mechanisms:
分析传输层的量子安全威胁
Pattern 3: Post-Quantum Readiness Assessment
Evaluate quantum vulnerability of existing cryptographic implementations:
评估 TLS 1.3 的后量子安全状态
Instructions for Agents
Phase 1: Protocol Stack Mapping
Map the network stack layers and identify cryptographic operations at each layer:
OSI Model Layers:
┌─────────────────────────────────────┐
│ 7. Application Layer │ HTTPS, application encryption
├─────────────────────────────────────┤
│ 6. Presentation Layer │ SSL/TLS encryption
├─────────────────────────────────────┤
│ 5. Session Layer │ Session management
├─────────────────────────────────────┤
│ 4. Transport Layer │ TCP/UDP, transport security
├─────────────────────────────────────┤
│ 3. Network Layer │ IPsec, network encryption
├─────────────────────────────────────┤
│ 2. Data Link Layer │ MAC, link encryption
├─────────────────────────────────────┤
│ 1. Physical Layer │ Physical security
└─────────────────────────────────────┘
For each layer, document:
- Cryptographic algorithms: RSA, AES, ECC, SHA, etc.
- Security operations: Encryption, authentication, integrity
- Message transformations: Encapsulation, encoding
- Quantum vulnerability: Vulnerable to Shor/Grover algorithms?
Phase 2: Transformation Analysis
For each message transformation across layers:
def analyze_transformation(layer, operation, algorithm):
"""Analyze cryptographic transformation"""
analysis = {
"layer": layer,
"operation": operation,
"algorithm": algorithm,
"quantum_vulnerable": is_quantum_vulnerable(algorithm),
"pq_alternative": get_pq_alternative(algorithm),
"security_level": calculate_security_bits(algorithm),
"recommendation": generate_recommendation(algorithm)
}
return analysis
Quantum Vulnerability Assessment
| Algorithm | Quantum Attack | Vulnerability | PQ Alternative |
|---|
| RSA | Shor | ✗ HIGH | CRYSTALS-Kyber |
| ECC | Shor | ✗ HIGH | CRYSTALS-Dilithium |
| AES-128 | Grover | ◐ MEDIUM | AES-256 |
| SHA-256 | Grover | ◐ LOW | SHA-384/512 |
| DH | Shor | ✗ HIGH | SIKE (broken), Kyber |
Phase 3: Security Audit Checklist
Generate comprehensive audit findings:
## Cross-Layer Cryptographic Security Audit
### Application Layer (Layer 7)
- **Protocols**: HTTPS, application-specific encryption
- **Algorithms**: [list algorithms]
- **Quantum Status**: [vulnerable/safe]
- **Recommendations**: [pq migration plan]
### Transport Layer (Layer 4)
- **Protocols**: TLS 1.3, DTLS
- **Algorithms**: [list algorithms]
- **Quantum Status**: [vulnerable/safe]
- **Recommendations**: [pq migration plan]
### Network Layer (Layer 3)
- **Protocols**: IPsec, VPN
- **Algorithms**: [list algorithms]
- **Quantum Status**: [vulnerable/safe]
- **Recommendations**: [pq migration plan]
### Link Layer (Layer 2)
- **Protocols**: WPA3, MAC security
- **Algorithms**: [list algorithms]
- **Quantum Status**: [vulnerable/safe]
- **Recommendations**: [pq migration plan]
### Quantum Risk Summary
- **High Risk**: [count] algorithms vulnerable to Shor
- **Medium Risk**: [count] algorithms vulnerable to Grover
- **Safe**: [count] quantum-resistant algorithms
### Migration Priority
1. [Immediate] Replace RSA/ECC with PQ alternatives
[Near-term] Upgrade symmetric key sizes
[Long-term] Implement hybrid PQ/classic schemes
Phase 4: Post-Quantum Standards Reference
Current NIST PQC standards (2024):
- CRYSTALS-Kyber: Key encapsulation (replacement for RSA/ECDH)
- CRYSTALS-Dilithium: Digital signatures (replacement for RSA/ECDSA)
- Falcon: Digital signatures (lattice-based)
- SPHINCS+: Hash-based signatures
Implementation considerations:
- Hybrid mode: Classic + PQ algorithms during transition
- Performance impact: PQ algorithms larger keys/signatures
- Compatibility: Check protocol support for PQ algorithms
Error Handling
Algorithm Not Recognized
If algorithm not in database:
1. Search web for algorithm specifications
2. Determine if symmetric/asymmetric
3. Assess quantum vulnerability based on type
4. Document finding for future reference
Layer Mapping Unclear
If protocol layer unclear:
1. Refer to OSI model specification
2. Identify protocol's primary function
3. Map to closest matching layer
4. Document uncertainty in report
Examples
Example 1: TLS Security Audit
User: 分析 TLS 1.3 的跨层密码安全
Agent Process:
1. Maps TLS to Presentation/Transport layers
2. Analyzes cryptographic operations:
- Key exchange: ECDHE (vulnerable to Shor)
- Authentication: RSA-PSS/ECDSA (vulnerable to Shor)
- Encryption: AES-128-GCM (vulnerable to Grover)
- Integrity: SHA-256 (vulnerable to Grover)
3. Generates audit report with PQ recommendations
4. Suggests migration: TLS with Kyber + Dilithium
Example 2: Full Stack Analysis
User: 评估我的网络协议栈的后量子安全
Agent Process:
1. Maps all protocol layers (OSI model)
2. Identifies cryptographic operations at each layer
3. Assesses quantum vulnerability for each algorithm
4. Prioritizes migration based on risk level
5. Generates comprehensive audit report
Related Skills
- security-guardrails: Security best practices
- crypto-analysis: Cryptographic algorithm analysis
- network-security: Network security frameworks
Resources
Notes
- Focus on practical security assessment
- Prioritize high-risk algorithms (RSA, ECC)
- Recommend hybrid transition strategy
- Document migration timeline
