wycheproof
Comprehensive test vectors for validating cryptographic implementations against known attacks and edge cases.
- Covers symmetric encryption (AES-GCM, ChaCha20-Poly1305), signatures (ECDSA, EdDSA, RSA), key exchange (ECDH, X25519), and hashing algorithms across multiple curves
- Test vectors organized by algorithm with shared attributes (tcId, comment, flags, result) plus algorithm-specific fields; results marked as valid, invalid, or acceptable
- Detects signature malleability, invalid DER encoding, invalid curve attacks, padding oracles, and tag forgery vulnerabilities
- Includes reference harnesses for Python (pytest) and JavaScript (Mocha) with examples for parsing JSON, filtering test groups, and parameterized testing; integrates via git submodule or direct file fetch
Wycheproof
Wycheproof is an extensive collection of test vectors designed to verify the correctness of cryptographic implementations and test against known attacks. Originally developed by Google, it is now a community-managed project where contributors can add test vectors for specific cryptographic constructions.
Background
Key Concepts
| Concept | Description |
|---|---|
| Test vector | Input/output pair for validating crypto implementation correctness |
| Test group | Collection of test vectors sharing attributes (key size, IV size, curve) |
| Result flag | Indicates if test should pass (valid), fail (invalid), or is acceptable |
| Edge case testing | Testing for known vulnerabilities and attack patterns |
Why This Matters
Cryptographic implementations are notoriously difficult to get right. Even small bugs can:
- Expose private keys
More from trailofbits/skills
ask-questions-if-underspecified
Clarify requirements before implementing. Use when serious doubts arise.
4.2Ksemgrep
>-
3.8Kmodern-python
Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.
3.8Kcodeql
>-
3.6Kinsecure-defaults
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.
3.5Ksecure-workflow-guide
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas.
3.4K