Crypto Audit

Automatically reviews cryptographic implementations in your codebase to identify weak algorithms, improper key management, and common cryptographic vulnerabilities.

What This Command Does

Automated Crypto Code Review:

• Detects weak or broken algorithms (MD5, SHA-1, DES, RC4)
• Identifies insufficient key sizes (RSA <2048-bit, AES <128-bit)
• Finds hardcoded keys and secrets
• Checks for proper IV generation and usage
• Verifies authenticated encryption usage
• Validates TLS/SSL configurations

Output: Crypto audit report with severity-rated findings and remediation steps

Time: 10-20 minutes per codebase

When to Use This Command

Perfect For:

• Pre-commit crypto review
• Security code review automation
• Compliance requirement (crypto standards)
• After adding crypto functionality
• Regular security audits

Use This When:

• Implementing encryption or hashing
• Reviewing third-party crypto code
• Preparing for security audit
• Responding to crypto vulnerabilities
• Onboarding new crypto libraries

Usage

# Audit current directory
/crypto-audit

# Audit specific file
/crypto-audit src/crypto/encryption.js

# Audit with detailed output
/crypto-audit --verbose

# Audit and generate report
/crypto-audit --output crypto-report.md

Shortcut:

/ca  # Quick crypto audit

What Gets Audited

1. Weak Algorithms (Critical)

Detects:

• MD5 hashing (completely broken)
• SHA-1 hashing (collision attacks)
• DES encryption (56-bit key, easily brute-forced)
• RC4 stream cipher (biases in keystream)
• ECB mode (pattern leakage)

Example Finding:

#  CRITICAL: MD5 password hashing detected
import hashlib
password_hash = hashlib.md5(password.encode()).hexdigest()

# Location: auth/password.py:45
# Severity: Critical
# CWE: CWE-327 (Use of Broken Crypto Algorithm)

# Impact: MD5 collisions can be generated in seconds
# Attacker can create password with same hash

# Remediation:
import argon2
password_hash = argon2.hash(password)

2. Insufficient Key Sizes (High)

Checks:

• RSA key size (minimum 2048-bit, recommend 3072-bit)
• AES key size (minimum 128-bit, recommend 256-bit)
• Elliptic curve key size (minimum 256-bit)

Example Finding:

// ️ HIGH: RSA key size insufficient
const key = crypto.generateKeyPairSync('rsa', {
  modulusLength: 1024  // TOO SMALL! Easily factored
})

// Location: services/encryption.js:23
// Severity: High
// CWE: CWE-326 (Inadequate Encryption Strength)

// Fix: Increase to 3072-bit
const key = crypto.generateKeyPairSync('rsa', {
  modulusLength: 3072  // Secure for next 10+ years
})

3. Hardcoded Secrets (Critical)

Finds:

• Hardcoded encryption keys
• Embedded API keys
• Fixed salts or IVs
• Hardcoded passwords

Example Finding:

//  CRITICAL: Hardcoded encryption key
const ENCRYPTION_KEY = "MySecretKey123456789012345678901"

// Location: config/crypto.js:12
// Severity: Critical
// CWE: CWE-798 (Hardcoded Credentials)

// Impact: If source code leaks, all encrypted data compromised

// Fix: Use environment variables
const ENCRYPTION_KEY = process.env.ENCRYPTION_KEY
if (!ENCRYPTION_KEY) throw new Error('Missing ENCRYPTION_KEY')

4. IV/Nonce Issues (High)

Detects:

• Reused initialization vectors
• Predictable IVs
• Missing IVs for CBC mode
• Zero IVs

Example Finding:

# ️ HIGH: Fixed IV reuse
IV = b'1234567890123456'  # Same IV every time!

# Location: crypto/aes.py:34
# Severity: High
# CWE: CWE-329 (Not Using Random IV with CBC)

# Impact: Reveals patterns in encrypted data
# First block of identical plaintexts produce identical ciphertexts

# Fix: Generate random IV per encryption
IV = os.urandom(16)

5. Unauthenticated Encryption (High)

Checks for:

• AES-CBC without HMAC
• CTR mode without authentication
• Missing auth tags

Example Finding:

// ️ HIGH: Encryption without authentication
const cipher = crypto.createCipheriv('aes-256-cbc', key, iv)

// Location: api/encrypt.js:56
// Severity: High
// CWE: CWE-353 (Missing Support for Integrity Check)

// Impact: Attacker can modify ciphertext without detection
// Padding oracle attacks possible

// Fix: Use GCM mode (authenticated encryption)
const cipher = crypto.createCipheriv('aes-256-gcm', key, iv)