LLMs won’t replace a formal security audit, but they can rapidly triage crypto code and surface obvious risks developers miss under deadline pressure.
Inspired by Simon Willison’s write-up on using Claude to uncover crypto weaknesses, here’s a practical, safety-first workflow you can use today (source).
What Claude does well in crypto reviews
- Flags insecure modes like AES-ECB and low iteration KDFs (e.g., weak PBKDF2).
- Spots nonce/IV reuse, hard-coded keys, and insecure randomness (e.g., Math.random()).
- Highlights homegrown crypto and DIY JWT signing or “none” algorithm pitfalls.
- Suggests safer libraries (libsodium, WebCrypto) and minimal, testable fixes.
A safe, verifiable workflow
- 1) Baseline: Ask Claude to list risks and explain impact with references. Request a severity rating and assumptions.
- 2) Evidence: For each claim, ask for a concise proof or minimal repro—e.g., why ECB leaks structure, how IV reuse breaks confidentiality.
- 3) Tests: Generate unit tests or property tests that fail on the insecure path and pass on the fix.
- 4) Secure rewrites: Have Claude propose drop-in replacements using vetted libraries (e.g., libsodium) with constant-time ops and unique nonces.
- 5) Standards check: Cross-verify against OWASP and vendor docs before changing production code.
- 6) Tooling confirm: Run static analyzers (e.g., Bandit, Semgrep rules for crypto) and lint before merge.
- 7) Review & gate: Require human security review for any crypto change; document threat model and residual risk.
Prompt starter
- “Act as a security reviewer. Analyze the following code for cryptographic weaknesses. For each finding: explain impact, provide a minimal failing test, propose a fix using a vetted library, and cite a standard. Note assumptions and uncertainty.”
- Follow-up: “Show how ECB, nonce reuse, weak RNG, DIY JWT, or low KDF iterations could be exploited here. Provide repro and safer defaults.”
Limits and risk management
- LLMs can hallucinate vulnerabilities or fixes. Demand tests, citations, and run independent tooling.
- Never deploy crypto changes without human review and staging validation.
- Prefer battle-tested primitives and high-level APIs over custom constructions.
Use OWASP’s Cryptographic Failures guidance to validate findings and fixes (OWASP Cheat Sheet).
Key takeaway
Claude is a powerful first-pass reviewer for crypto code—use it to surface issues fast, then verify with tests, standards, and human security judgment.
Enjoy concise AI insights like this? Subscribe to our newsletter for weekly, no-fluff playbooks and tools: theainuggets.com/newsletter
