Detecting Weak Cryptography

Overview

Weak cryptography (CWE-327 Use of a Broken or Risky Cryptographic Algorithm, CWE-330 Use of Insufficiently Random Values) shows up when engineers use the convenient API instead of the cryptographic one. hashlib.md5(password) is faster to type than the correct bcrypt/argon2 invocation; Math.random() returns a number quickly without needing to know about crypto.randomBytes().

The fix is universal: use the modern primitive. SHA-256 for general hashing, bcrypt/argon2/scrypt for passwords, AES-GCM for encryption, HMAC-SHA256 for signing, secrets / crypto.randomBytes / SecureRandom for randomness.

When the skill produces findings

| Finding | Severity | Threshold | Affected control | |---|---|---|---| | MD5 used in security context | HIGH | hashlib.md5, MessageDigest.MD5, CryptoJS.MD5 | CWE-327 | | SHA-1 used in security context | HIGH | hashlib.sha1, etc. | CWE-327 | | DES / 3DES cipher | CRITICAL | DESCrypto, "DES/CBC", "DESede" | CWE-327 | | RC4 cipher | CRITICAL | "ARC4", "RC4" | CWE-327 | | AES ECB mode | CRITICAL | "AES/ECB" or MODE_ECB | CWE-327 | | Hardcoded IV (initialization vector) | CRITICAL | IV literal in source | CWE-329 | | Custom XOR-based "encryption" | CRITICAL | XOR loop over bytes | CWE-327 | | Predictable random for crypto seed | CRITICAL | Math.random / java.util.Random / random.random for keys | CWE-330 | | TLS cert verification disabled | CRITICAL | verify=False, rejectUnauthorized:false, ServerCertificateValidationCallback returning true | CWE-295 | | Hardcoded HMAC secret | HIGH | Long literal in HMAC constructor | CWE-321 | | Insecure password hashing (no salt, no KDF) | CRITICAL | hashlib.sha256(password) without bcrypt/argon2 | CWE-916 |

Prerequisites

• Python 3.9+
• Source tree on local filesystem

Instructions

Run

bash
python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-weak-cryptography/scripts/scan_weak_crypto.py /path/to/repo

Options: --output, --format, --min-severity, --include-tests, --languages, --allow-md5-checksums (excludes MD5 used in non-security contexts like content-addressable storage).

Interpret

CRITICAL = direct cryptographic break available against the algorithm. CVEs, public attack tools, sometimes pre-computed tables (rainbow tables for MD5/SHA-1).

HIGH = algorithm collision-broken (MD5, SHA-1) but the specific use case may tolerate the weakness (file-deduplication checksums, non-security HMAC). Verify the usage context.

Remediation

See references/PLAYBOOK.md for per-primitive migration. Modern defaults: SHA-256/SHA-3 for hashing, AES-256-GCM for encryption, HMAC-SHA-256 for signing, secrets-grade random for keys, bcrypt / argon2id for password storage.

Examples

Pre-merge gate

bash
python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-weak-cryptography/scripts/scan_weak_crypto.py \
    --min-severity high $(git diff --name-only main...HEAD | tr '\n' ' ')

CI

yaml
- name: Weak-crypto scan
  run: |
    python3 plugins/security/penetration-tester/skills/detecting-weak-cryptography/scripts/scan_weak_crypto.py \
        . --min-severity high

Output

JSON / JSONL / Markdown. Exit codes: 0 / 1 / 2.

Error Handling

False positives common on:

• MD5 used for content-addressable storage (caches, content hashes)

where collision resistance against ATTACKERS isn't needed — use --allow-md5-checksums.

• HMAC-MD5 — broken against adversaries but acceptable as an

integrity check inside a TLS session where the channel is already authenticated.

Verify each finding by reading whether the algorithm's failure mode (collision, preimage, etc.) is actually exploitable in context.

Resources

• references/THEORY.md — Per-primitive attack model (why MD5 /

SHA-1 are collision-broken, why ECB leaks structure, why Math.random is non-crypto-grade)

• references/PLAYBOOK.md — Per-language modern-crypto recipes

(Python cryptography library, Node crypto, Java JCA with modern algorithms, Go crypto/rand + crypto/cipher AEAD)