| name | cryptographic-failures |
| description | Detects weak or broken cryptography that lets attackers recover plaintext passwords, forge tokens, or decrypt sensitive data. Use when writing code that encrypts or decrypts data, hashes passwords or tokens, generates random values for security purposes, manages cryptographic keys, or configures TLS/SSL settings. Also invoke when storing sensitive data at rest. |
Cryptographic Failures Security Check (A04:2025)
What this checks
Protects against weak or broken cryptography that allows attackers to recover
plaintext passwords, forge tokens, or decrypt sensitive data. Failures here
directly enable credential stuffing, account takeover, and data breach.
Vulnerable patterns
- Password hashed with a fast or unsalted algorithm such as MD5, SHA1, or bare SHA-256
- Security-sensitive token, session ID, nonce, or key generated from a non-cryptographic PRNG
- Encryption or signing key declared as a hardcoded string in source
- Symmetric encryption using ECB mode, or CBC mode with no separate MAC
- A nonce or IV that is constant, zero, or reused across messages with the same key
Fix immediately
Flag the vulnerable code and explain the risk. Then suggest a fix that establishes
these properties:
- Passwords go through a slow, salted, memory-hard hash — bcrypt, scrypt, or
argon2. Never MD5, SHA1, or SHA256-alone: they're fast enough to brute-force
billions of candidates per second on consumer GPUs. The salt is per-password
and stored alongside the hash, not a global constant.
- Security-sensitive randomness comes from a CSPRNG — the language's
documented cryptographic random source. Never a general-purpose PRNG or
time-seeded generator for tokens, session IDs, nonces, or keys.
- Symmetric encryption uses an authenticated mode — AES-GCM, AES-CCM, or
ChaCha20-Poly1305. ECB never; CBC only with a separate MAC (encrypt-then-MAC).
A fresh nonce per message, never reused with the same key.
- Keys live outside the source tree — environment variable, secrets manager,
KMS, or OS keystore. Never hardcoded literals, never committed config files.
Rotation requires touching infrastructure, not source.
Translate these principles to the audited file's language and platform. Use the
documented cryptographic primitives for that stack — do not reimplement hashing,
random, or AEAD from lower-level building blocks.
Verification
Confirm the response:
References
