Detecting Weak Cryptography
Overview
Weak cryptography (CWE-327 Use of a Broken or Risky Cryptographic
Algorithm, CWE-330 Use of Insufficiently Random Values) shows up
when engineers use the convenient API instead of the cryptographic
one. hashlib.md5(password) is faster to type than the correct
bcrypt/argon2 invocation; Math.random() returns a number quickly
without needing to know about crypto.randomBytes().
The fix is universal: use the modern primitive. SHA-256 for general
hashing, bcrypt/argon2/scrypt for passwords, AES-GCM for encryption,
HMAC-SHA256 for signing, secrets / crypto.randomBytes /
SecureRandom for randomness.
When the skill produces findings
| Finding | Severity | Threshold | Affected control |
|---|---|---|---|
| MD5 used in security context | HIGH | hashlib.md5, MessageDigest.MD5, CryptoJS.MD5 | CWE-327 |
| SHA-1 used in security context | HIGH | hashlib.sha1, etc. | CWE-327 |
| DES / 3DES cipher | CRITICAL | DESCrypto, "DES/CBC", "DESede" | CWE-327 |
| RC4 cipher | CRITICAL | "ARC4", "RC4" | CWE-327 |
| AES ECB mode | CRITICAL | "AES/ECB" or MODE_ECB | CWE-327 |
| Hardcoded IV (initialization vector) | CRITICAL | IV literal in source | CWE-329 |
| Custom XOR-based "encryption" | CRITICAL | XOR loop over bytes | CWE-327 |
| Predictable random for crypto seed | CRITICAL | Math.random / java.util.Random / random.random for keys | CWE-330 |
| TLS cert verification disabled | CRITICAL | verify=False, rejectUnauthorized:false, ServerCertificateValidationCallback returning true | CWE-295 |
| Hardcoded HMAC secret | HIGH | Long literal in HMAC constructor | CWE-321 |
| Insecure password hashing (no salt, no KDF) | CRITICAL | hashlib.sha256(password) without bcrypt/argon2 | CWE-916 |
Prerequisites
- Python 3.9+
- Source tree on local filesystem
Instructions
Run
python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-weak-cryptography/scripts/scan_weak_crypto.py /path/to/repo
Options: --output, --format, --min-severity, --include-tests,
--languages, --allow-md5-checksums (excludes MD5 used in
non-security contexts like content-addressable storage).
Interpret
CRITICAL = direct cryptographic break available against the algorithm. CVEs, public attack tools, sometimes pre-computed tables (rainbow tables for MD5/SHA-1).
HIGH = algorithm collision-broken (MD5, SHA-1) but the specific use case may tolerate the weakness (file-deduplication checksums, non-security HMAC). Verify the usage context.
Remediation
See references/PLAYBOOK.md for per-primitive migration. Modern
defaults: SHA-256/SHA-3 for hashing, AES-256-GCM for encryption,
HMAC-SHA-256 for signing, secrets-grade random for keys, bcrypt /
argon2id for password storage.
Examples
Pre-merge gate
python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-weak-cryptography/scripts/scan_weak_crypto.py \
--min-severity high $(git diff --name-only main...HEAD | tr '\n' ' ')
CI
- name: Weak-crypto scan
run: |
python3 plugins/security/penetration-tester/skills/detecting-weak-cryptography/scripts/scan_weak_crypto.py \
. --min-severity high
Output
JSON / JSONL / Markdown. Exit codes: 0 / 1 / 2.
Error Handling
False positives common on:
- MD5 used for content-addressable storage (caches, content hashes)
where collision resistance against ATTACKERS isn't needed — use
--allow-md5-checksums. - HMAC-MD5 — broken against adversaries but acceptable as an integrity check inside a TLS session where the channel is already authenticated.
Verify each finding by reading whether the algorithm's failure mode (collision, preimage, etc.) is actually exploitable in context.
Resources
references/THEORY.md— Per-primitive attack model (why MD5 / SHA-1 are collision-broken, why ECB leaks structure, why Math.random is non-crypto-grade)references/PLAYBOOK.md— Per-language modern-crypto recipes (Python cryptography library, Node crypto, Java JCA with modern algorithms, Go crypto/rand + crypto/cipher AEAD)