finding-crypto-misuse

# Finding crypto misuse: the finding is a recovery, not a weak primitive Most crypto findings that matter are not "the algorithm is broken"; they are the algorithm used wrong in a way that hands you plaintext, a key, or a forgery. A cipher is only as safe as its nonce discipline, a signature only as safe as its randomness, a MAC only as safe as its construction. Finding crypto misuse means looking for the specific misuse patterns that collapse to a concrete attack, and proving the attack rather than flagging the primitive. ## When to use - You are reviewing code that encrypts, decrypts, signs, verifies, MACs, or hashes. - A protocol or service rolls its own crypto or composes primitives by hand. - You need to separate an exploitable misuse from a cosmetic "weak crypto" alert. ## Scope check Analyze crypto in code you own or are authorized to test. Demonstrate recovery or forgery only against your own keys and data. If you can't name the authorization, stop. ## The loop 1. **Inventory the crypto operations and their inputs.** List every place the code encrypts, decrypts, signs, verifies, MACs, or hashes, and for each capture the primitive, the mode, and where the key, nonce or IV, and randomness come from. The misuse lives in the inputs, not the primitive name. 2. **Hunt nonce and IV reuse.** For any stream or counter/GCM mode, does a (key, nonce) pair ever repeat across messages (a fixed IV, a counter that resets, a random nonce in too small a space)? R...