Cryptographic Failures Skill

Cryptographic failures happen when sensitive data is exposed because it was stored or transmitted without adequate protection. An agent generating data persistence or transmission code defaults to what works, not what is safe. MD5 works. SHA1 works. Storing passwords in plaintext works. None of them are acceptable.

What to Check Before Writing Crypto-Adjacent Code

1. Passwords Must be stored using an adaptive hashing algorithm: bcrypt, scrypt, Argon2, or PBKDF2. MD5, SHA1, SHA256, and SHA512 are not password hashing algorithms. If the code stores a password, the hash function must be one of the four above.

2. Sensitive data at rest PII, financial data, health records, and API keys must be encrypted at rest. "Stored in the database" is not the same as "encrypted." Check whether the column, file, or object is encrypted. If the ORM or storage layer does not handle it, application-level encryption is required.

3. Sensitive data in transit All transmission of sensitive data must use TLS 1.2 or higher. HTTP endpoints that accept credentials, tokens, or PII are a block condition.

4. Weak algorithms Flag and block use of: MD5, SHA1, DES, 3DES, RC4, ECB mode for block ciphers. These are broken or deprecated for security use.