<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-weak-cryptographic-implementations
description: >-
  Identify deprecated algorithms, insufficient key lengths, broken RNG, insecure
  cipher modes, and hardcoded secrets in codebases, configurations, and network
  traffic. Covers static analysis, runtime detection, and compliance mapping.
domain: cybersecurity
subdomain: cryptography
tags:
  - crypto-audit
  - weak-algorithms
  - deprecated-crypto
  - static-analysis
  - owasp
  - cwe
  - md5
  - sha1
  - des
  - rc4
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1600"]
---

# Detecting Weak Cryptographic Implementations

## Overview

OWASP A02:2021 (Cryptographic Failures) remains a top risk. Weak crypto
implementations include deprecated algorithms (MD5, SHA-1, DES, RC4),
insufficient key lengths (RSA-1024), ECB mode, hardcoded keys, and poor
RNG usage. This skill covers detection across code, config, and network layers.

## Prerequisites

| Requirement | Install |
|---|---|
| OpenSSL 3.x | `apt install openssl` |
| semgrep | `pip install semgrep` |
| trufflehog | `brew install trufflehog` / binary release |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Deprecated Algorithm Reference

| Algorithm | Status | Vulnerability | CWE |
|---|---|---|---|
| MD5 | Broken | Collision attacks (2004) | CWE-328 |
| SHA-1 | Deprecated | SHAttered collision (2017) | CWE-328 |
| DES / 3DES | Deprecated | Sweet32, 56-bit key | CWE-327 |
| RC4 | Broken | Bias attacks, RFC 7465 | CWE-327 |
| RSA-1024 | Deprecated | Factorable with modern compute | CWE-326 |
| AES-ECB | Insecure mode | Pattern preservation | CWE-327 |
| PBKDF2-SHA1 <100k iter | Weak | GPU-crackable | CWE-916 |

### Code-Level Detection

```bash
# Grep for known weak algorithms in source code
grep -rn --include='*.py' --include='*.java' --include='*.go' --include='*.js' \
  -E '(MD5|SHA1|DES|RC4|ECB|Blowfish)' src/

# Semgrep rules for insecure crypto
semgrep --config "p/owasp-top-ten" --include="*.py" src/
semgrep --config "p/insecure-transport" src/

# Python-specific: detect hashlib.md5 usage
grep -rn "hashlib\.md5\|hashlib\.sha1\|DES\.\|ARC4\." --include='*.py' src/

# Java-specific: detect weak algorithms
grep -rn 'Cipher.getInstance("DES\|Cipher.getInstance("RC4\|MessageDigest.getInstance("MD5' \
  --include='*.java' src/
```

### Configuration Detection

```bash
# Check OpenSSL for deprecated algorithms
openssl ciphers -v 'ALL' | grep -E '(DES|RC4|MD5|NULL|EXPORT)'

# Check SSH config for weak algorithms
grep -E '(arcfour|blowfish|3des|diffie-hellman-group1)' /etc/ssh/sshd_config

# Check nginx/apache for weak TLS ciphers
grep -rn 'ssl_ciphers\|SSLCipherSuite' /etc/nginx/ /etc/apache2/ 2>/dev/null
```

### Secret Detection

```bash
# Scan for hardcoded secrets
trufflehog filesystem --directory . --only-verified

# Grep for potential hardcoded keys
grep -rn --include='*.py' --include='*.js' --include='*.yaml' \
  -E '(password|secret|api_key|private_key)\s*[:=]\s*["\x27][^"\x27]{8,}' .
```

## Workflow

1. **Inventory** — Catalog all cryptographic usage in the codebase
2. **Scan** — Run semgrep, grep, and trufflehog for weak patterns
3. **Classify** — Map findings to CWE and OWASP categories
4. **Assess** — Determine exploitability and business impact
5. **Remediate** — Replace with approved algorithms, rotate exposed keys
6. **Verify** — Re-scan to confirm fixes, add CI checks

## Verification

| Check | Method |
|---|---|
| No MD5/SHA-1 for security | `grep -rn 'MD5\|SHA1'` returns zero security uses |
| No DES/RC4 in configs | TLS config only lists AES/ChaCha ciphers |
| Key lengths adequate | RSA ≥ 2048, ECDSA ≥ P-256 |
| No hardcoded secrets | trufflehog returns zero verified findings |
| CI gate added | semgrep crypto rules in CI pipeline |

## References

- [OWASP A02:2021 — Cryptographic Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)
- [CWE-327 — Use of Broken Crypto Algorithm](https://cwe.mitre.org/data/definitions/327.html)
- [NIST SP 800-131A Rev. 2 — Transitioning Algorithms](https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/final)
- [Semgrep Registry — Crypto Rules](https://semgrep.dev/r?q=crypto)
