About This Tool

Paranoid's library contains implementations of checks for well known weaknesses on cryptographic artifacts.

Primary Use Case

This tool is used to analyze cryptographic artifacts to identify vulnerabilities, especially those generated by third-party or black-box hardware and software where source code is unavailable. Security researchers, cryptographers, and organizations aiming to validate the strength of cryptographic material would use this library to increase confidence in cryptographic implementations.

Key Features

Checks for known weaknesses in public keys, digital signatures, and pseudorandom numbers
Implements and optimizes detection methods based on academic research
Detects vulnerabilities caused by weak random number generators and programming errors
Supports testing cryptographic artifacts without needing source code access
Targets both known and potential unknown vulnerabilities
Includes examples and unit tests for practical usage demonstration
Designed to complement other Google cryptographic tools like BoringSSL, Tink, and Wycheproof

Insights & Recommendations

Requires Python 3.11 or newer and several system dependencies including pybind11, fpylll, and gmpy2. Primarily designed for use on Debian stable (bookworm) but should work on similar Linux distributions. The project is actively evolving and encourages community feedback to improve detection of weak cryptographic implementations.

Installation

git clone https://github.com/google/paranoid_crypto.git && cd paranoid_crypto
sudo apt update && sudo apt install python3 python3-full python3-pip python3-pybind11 python3-fpylll python3-gmpy2 protobuf-compiler
python3 -m venv --system-site-packages ~/paranoid-venv
source ~/paranoid-venv/bin/activate
pip install -r requirements.txt (implied from typical Python projects, not explicitly stated but likely needed)

Usage

python3 examples/example_test.py

Run example scripts demonstrating how to test different cryptographic artifacts

pytest *test.py

Run unit tests to verify implemented checks and functionality

Smart Usage Notes

Integrate Paranoid_crypto into CI/CD pipelines to automate cryptographic artifact validation before deployment.Use Paranoid_crypto outputs to enhance threat hunting by identifying weak cryptographic artifacts that may indicate compromise.Combine Paranoid_crypto with fuzz testing tools to proactively discover unknown cryptographic vulnerabilities.Leverage Paranoid_crypto in purple team exercises to simulate attacks exploiting weak cryptographic materials and validate detection capabilities.Extend Paranoid_crypto with telemetry from hardware security modules (HSMs) to monitor cryptographic artifact integrity in real-time.

OpenSec Atlas

paranoid_crypto