cryptographic-practices-auditor

Purpose

Audit source code and infrastructure configurations for cryptographic weaknesses: obsolete ciphers (MD5, SHA1, DES, RC4), hardcoded encryption keys, weak key derivation functions (KDFs), insecure random number generators, and flawed token signing.

When to Use

• Reviewing password hashing, encryption at rest, and secret token generation.
• Implementing asymmetric JWT signing (RS256 / EdDSA) or HMAC validation.
• Validating TLS cipher suite configurations and webhook signature verification.

What to Analyze

1. Password Hashing: Use of Argon2id or bcrypt (cost factor >= 12) vs obsolete plain SHA256/MD5.
2. Symmetric Encryption: AES-256-GCM / ChaCha20-Poly1305 (authenticated encryption) vs insecure AES-ECB / AES-CBC without HMAC.
3. Random Number Generation: Cryptographically Secure PRNG (crypto.randomBytes, crypto.getRandomValues) vs Math.random().
4. Timing Attack Vulnerabilities: Constant-time string comparisons (crypto.timingSafeEqual) for tokens, HMACs, and signatures.
5. Key Management: Storage of private keys in KMS / HSM vs hardcoded string constants in source control.

Output Format

• Cryptographic Findings Table: [Component | Current Algorithm | Flaw | NIST/OWASP Standard].
• Remediation Code: Drop-in secure cryptographic implementations.
• Key Rotation Guidance: How to rotate keys without invalidating active sessions.

Avoid

• Inventing custom home-grown encryption algorithms.
• Using == or === for comparing HMAC hashes (susceptible to timing attacks).