<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-cryptographic-compliance-audit
description: >-
  Audit cryptographic implementations against regulatory and industry
  standards. Covers FIPS 140-3, PCI DSS, NIST SP 800-131A, and SOC 2
  cryptographic requirements. Includes algorithm inventory, key management
  assessment, and compliance gap analysis.
domain: cybersecurity
subdomain: cryptography
tags:
  - fips-140
  - pci-dss
  - nist
  - compliance
  - algorithm-inventory
  - key-management
  - soc2
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Cryptographic Compliance Audit

## Overview

Cryptographic compliance audits verify that an organization's cryptographic
implementations meet regulatory and industry requirements. This skill covers
auditing against FIPS 140-3, PCI DSS 4.0, NIST SP 800-131A, and SOC 2
standards, including algorithm inventory, key lifecycle assessment, and
compliance gap analysis.

## Prerequisites

| Requirement | Install |
|---|---|
| OpenSSL 3.x | `apt install openssl` |
| nmap | `apt install nmap` |
| Python 3.10+ | For agent tooling |
| sslscan | `apt install sslscan` |

## Key Concepts

### Algorithm Inventory

```bash
# Scan TLS endpoints for cipher suites in use
nmap --script ssl-enum-ciphers -p 443 target.example.com

# Check OpenSSL FIPS mode status
openssl version -a | grep -i fips
openssl list -providers | grep -i fips

# List all enabled cipher suites
openssl ciphers -v 'ALL' | column -t

# Identify non-compliant algorithms in use
openssl ciphers -v 'ALL' | grep -iE 'RC4|DES|MD5|NULL|EXPORT'

# Scan code for deprecated algorithms
grep -rn -iE 'md5|sha1|des|rc4|blowfish' \
  --include='*.py' --include='*.js' --include='*.java' .
```

### FIPS 140-3 Compliance

```bash
# Check if OpenSSL FIPS provider is loaded
openssl list -providers 2>&1 | grep -A3 fips

# Test FIPS-approved algorithms only
OPENSSL_CONF=/etc/ssl/openssl-fips.cnf openssl speed aes-256-gcm

# Verify no non-FIPS algorithms in TLS
nmap --script ssl-enum-ciphers -p 443 target 2>/dev/null | \
  grep -vE 'AES|CHACHA20|SHA256|SHA384|ECDHE|DHE'
```

### PCI DSS 4.0 Cryptographic Requirements

```bash
# Req 4.2.1 — Strong cryptography for cardholder data in transit
# Check for TLS 1.2+ only
openssl s_client -connect payment-api:443 -tls1 < /dev/null 2>&1 | \
  grep "Protocol"  # Should fail

openssl s_client -connect payment-api:443 -tls1_2 < /dev/null 2>&1 | \
  grep "Protocol"  # Should succeed

# Req 3.5 — Strong key management
# Verify key storage and rotation policies
find /etc /opt -name '*.key' -o -name '*.pem' 2>/dev/null | \
  xargs -I{} stat --format='%n %a %U %G' {}
```

### Key Management Assessment

```bash
# Check certificate key sizes across infrastructure
for host in $(cat hosts.txt); do
  echo | openssl s_client -connect "$host":443 2>/dev/null | \
    openssl x509 -noout -text | \
    grep -E "Public-Key:|Signature Algorithm:" | head -2
done

# Verify no weak key sizes
echo | openssl s_client -connect target:443 2>/dev/null | \
  openssl x509 -noout -text | grep "Public-Key"
# RSA must be >= 2048, ECDSA >= P-256

# Check key permissions
find /etc/ssl -name '*.key' -exec stat --format='%n %a' {} \;
# Keys should be 600 or 400
```

### NIST SP 800-131A Transition Requirements

| Algorithm | Status | Replacement |
|---|---|---|
| SHA-1 (signatures) | Disallowed | SHA-256+ |
| RSA < 2048 | Disallowed | RSA 2048+ or ECDSA P-256+ |
| 3DES | Deprecated (2023) | AES-128+ |
| DES | Disallowed | AES-128+ |
| MD5 | Disallowed | SHA-256+ |

## Common Failures

| Failure | Cause | Fix |
|---|---|---|
| SHA-1 still in use | Legacy certificate chains | Reissue with SHA-256 |
| RSA 1024-bit keys | Old certificates not rotated | Generate 2048+ bit keys |
| Key files world-readable | Poor file permissions | chmod 600 on all key files |
| No key rotation policy | Policy gap | Document and enforce rotation schedule |

## Workflow

1. **Inventory** — Catalog all cryptographic algorithms and key types
2. **Map** — Map inventory to compliance requirements
3. **Assess** — Identify gaps between current state and requirements
4. **Prioritize** — Rank gaps by risk and remediation effort
5. **Remediate** — Implement compliant alternatives
6. **Verify** — Retest to confirm compliance

## Verification

| Check | Method |
|---|---|
| No disallowed algorithms | Scan confirms no MD5, SHA-1, DES, RC4 |
| Key sizes compliant | RSA ≥ 2048, ECDSA ≥ P-256 |
| TLS 1.2+ only | TLS 1.0/1.1 connections refused |
| Key permissions secure | All key files mode 600 or 400 |
| FIPS mode active | OpenSSL FIPS provider loaded (if required) |

## References

- [NIST SP 800-131A Rev. 2](https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/final)
- [FIPS 140-3](https://csrc.nist.gov/publications/detail/fips/140/3/final)
- [PCI DSS 4.0](https://www.pcisecuritystandards.org/document_library/)
- [NIST SP 800-57 — Key Management](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final)
