Cryptography Review

1 — Quick sweep

rg -n -i "md5|sha1|des\b|rc4|ecb|cbc\(|blowfish|math\.random\(\)|random\.random\(\)|srand\(|new date\(\)\.gettime\(\)|nanoid\(|uuid\.v1\(" -g '!*.md' -g '!*.lock' -g '!*-lock.yaml' -g '!*.sum' -g '!*.snap'
rg -n -i "rejectunauthorized\s*:\s*false|insecureskipverify\s*:\s*true|verify\s*=\s*false|ssl_verify|checkhostname|node_tls_reject_unauthorized" -g '!*.md' -g '!*.lock' -g '!*.sum'
rg -n -i "aes\.|createcipheriv|crypto\.randombytes|secrets\.|urandom|crypto/rand|rand\.read"
rg -n -i "(key|iv|salt|secret|passphrase)\s*[:=]\s*[\"'][a-z0-9]{8,}[\"']"

2 — Judge each hit by purpose

Context decides severity. The same MD5 is noise in a cache key and CRITICAL in a password hash.

3 — Deep checks

• Static vs per-message IVs: createCipheriv('aes-256-cbc', key, FIXED_IV) or IV derived from deterministic data → HIGH (breaks semantic security; CBC+fixed IV leaks prefixes)
• Hardcoded keys: any literal key/PEM in source → CRITICAL (see ../secrets-detection/SKILL.md); keys should come from env/secret manager, and rotate-by-commit means history keeps them
• Key derivation: password used directly as AES key instead of KDF (PBKDF2/HKDF/scrypt) → HIGH
• Nonce reuse contexts: counters resetting per restart, random nonces >2^32 messages (GCM) — flag as note, usually theoretical
• Comparisons: token/password hash compared with == instead of constant-time (timingSafeEqual, hmac.compare_digest) → LOW/MEDIUM (timing oracle)
• Length: RSA < 2048, ECC < 256, HMAC-SHA1 legacy — MEDIUM hygiene
• Custom crypto: any hand-rolled cipher/XOR/"custom encoding" protecting real data → HIGH by default (rate as if broken)
• Multihashing / structured hashing with ambiguous encoding: hashing MULTIPLE fields by raw concatenation — hashlib.sha256(user + "|" + role + expiry), sha256(f"{a}:{b}"), chained createHash('sha256').update(a).update(b) — has two failure modes: (1) AMBIGUOUS ENCODING: field values containing the separator (or empty fields) make distinct logical tuples hash identically — attacker- influenced fields then forge inputs to capability tokens, cache keys, dedup/commitment digests; (2) LENGTH-EXTENSION: secret-PREFIX concatenation with a Merkle–Damgård hash (MD/SHA-1/SHA-2) lets attackers append suffixes to the authenticated blob. Class writeup: ToB SequenceHash/SequenceMAC (2026-10, C2SP) — the constructions exist precisely because naive multihashing keeps biting. High when any input is attacker-influenced AND the digest commits/authenticates; Medium for internal non-adversarial use. Safe shape: unambiguous length-prefixed (or fixed-width) encoding + a domain/customization string — NIST TupleHash, ToB SequenceHash, or manual length-prefix; HMAC/SequenceMAC for keyed use; NEVER separator concatenation:

rg -n "hashlib\.(sha256|sha512|sha384|blake2b)\(\s*[^)\n]*\+" src/ app/ -g '*.py'
rg -n "hashlib\.(sha256|sha512)\(\s*f[\"']" src/ app/ -g '*.py'
rg -n "\.update\([^)]*\)\s*\.update\(" src/ app/ -g '*.js' -g '*.ts' -g '*.py'

• MPC / threshold-crypto inside TEEs: single-use secrets (nonces, pre-signatures) must be consumed with rollback protection — delete-after-use alone fails because the untrusted TEE host can roll back the filesystem, forcing nonce-share reuse → private-key-share disclosure (ToB, 2026-09-25). Safe shape: monotonic counter / freshness bound in trusted storage before use. Attestation verification must cover quote signature + certificate chain to the vendor root + measurements vs known-good values (reproducible builds / binary transparency) — a "valid" quote over incomplete measurements (runtime-fetched code, unmeasured configs, LD_PRELOAD-injectable libs) is false assurance. Constant-time discipline still applies inside the enclave — the host controls timing

4 — Reporting

Per finding: purpose ("password hashing"), current construction, why it fails (one sentence), the drop-in replacement with correct usage example (e.g. crypto.createCipheriv('aes-256-gcm', key, crypto.randomBytes(12))), and severity per the table. Note positives: libsodium/argon2/CSPRNG usage done right.