Cryptographic Analysis

When to Activate

• Auditing TLS/SSL/SSH configurations and X.509 PKI (cipher suites, downgrade, protocol flaws)
• Reviewing crypto implementations in source code or captured traffic
• Attacking weak RSA/ECC keys (CTF and real-world weak-key hygiene)
• Recovering ECDSA/DSA private keys from reused or biased nonces (lattice/HNP)
• Exploiting symmetric/AEAD misuse: padding oracles, GCM nonce reuse, key-commitment
• Forging JWT/JOSE tokens (algorithm confusion, none, jwk/jku/kid injection)
• Cracking password hashes and grading KDF strength
• Assessing post-quantum readiness ("harvest now, decrypt later" exposure)

Technique Map