Mapped every skill to NIST CSF 2.0 subcategory IDs (GV/ID/PR/DE/RS/RC functions)
based on subdomain and content analysis. Restores 11 skills corrupted during
prior rebase, re-enriching with ATLAS, D3FEND, NIST AI RMF, and CSF 2.0 fields.
All 754 skills now carry structured mappings for all 5 security frameworks:
- MITRE ATT&CK (in tags)
- MITRE ATLAS v5.5 (atlas_techniques)
- MITRE D3FEND v1.3 (d3fend_techniques)
- NIST AI RMF 1.0 (nist_ai_rmf)
- NIST CSF 2.0 (nist_csf)
A cryptographic audit systematically reviews an application's use of cryptographic primitives, protocols, and key management to identify vulnerabilities such as weak algorithms, insecure modes, hardco
cybersecurity
cryptography
cryptography
audit
security-review
compliance
vulnerability-assessment
1.0
mahipal
Apache-2.0
PR.DS-01
PR.DS-02
PR.DS-10
Performing Cryptographic Audit of Application
Overview
A cryptographic audit systematically reviews an application's use of cryptographic primitives, protocols, and key management to identify vulnerabilities such as weak algorithms, insecure modes, hardcoded keys, insufficient entropy, and protocol misconfigurations. This skill covers building an automated crypto audit tool that scans Python and configuration files for common cryptographic weaknesses.
When to Use
When conducting security assessments that involve performing cryptographic audit of application
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
Familiarity with cryptography concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities
Objectives
Detect usage of deprecated algorithms (MD5, SHA-1, DES, RC4)
Identify insecure cipher modes (ECB) and padding schemes
Find hardcoded keys, passwords, and secrets in source code
Verify TLS/SSL configuration strength
Check key derivation function parameters
Validate random number generator usage
Produce a structured audit report with findings and remediation
Key Concepts
Cryptographic Weakness Categories
Category
Examples
Risk Level
Weak Hashing
MD5, SHA-1 for integrity/signatures
High
Insecure Encryption
DES, 3DES, RC4, Blowfish
High
Bad Cipher Mode
ECB mode for any block cipher
High
Insufficient Key Size
RSA < 2048, AES-128 for long-term
Medium
Hardcoded Secrets
Keys/passwords in source code
Critical
Weak KDF
Low iteration PBKDF2, plain MD5
High
Poor Entropy
time-based seeds, predictable IVs
High
Deprecated Protocols
SSLv3, TLS 1.0, TLS 1.1
High
Security Considerations
Review both application code and configuration files
Check third-party dependencies for known crypto vulnerabilities
Verify certificates and TLS configurations on deployed servers
Ensure secrets are loaded from environment variables or vaults
Review key storage and rotation practices
Validation Criteria
Scanner detects all injected test weaknesses
MD5/SHA-1 usage for security purposes is flagged
ECB mode usage is flagged
Hardcoded keys/passwords are detected
Weak KDF parameters are identified
Report includes severity, location, and remediation
mukul975
efca3ec611