detecting-weak-cryptography
Installation
SKILL.md
Detecting Weak Cryptography
Overview
Weak cryptography (CWE-327 Use of a Broken or Risky Cryptographic
Algorithm, CWE-330 Use of Insufficiently Random Values) shows up
when engineers use the convenient API instead of the cryptographic
one. hashlib.md5(password) is faster to type than the correct
bcrypt/argon2 invocation; Math.random() returns a number quickly
without needing to know about crypto.randomBytes().
The fix is universal: use the modern primitive. SHA-256 for general
hashing, bcrypt/argon2/scrypt for passwords, AES-GCM for encryption,
HMAC-SHA256 for signing, secrets / crypto.randomBytes /
SecureRandom for randomness.