## Cryptographic Failures (High)

### Trigger Signals

- Hardcoded keys/passwords (`password`/`secret`/`apikey`/`token` assigned as string constants)
- Use of weak cryptographic algorithms (`md5`, `sha1`, `DES`, `RC4`, `ECB` mode)
- Insecure random numbers (`Math.random()`, `random.random()` used in security contexts)
- Custom cryptographic implementations (non-standard algorithms, manually implemented encryption)

### Key Sinks

| Defect Type | Check Points |
|---------|--------|
| Hardcoded Keys | `SECRET = "..."`, `API_KEY = "..."`, `password: "..."` |
| Weak Hashing | `md5()`, `sha1()` (used for password storage or signing) |
| Weak Encryption | `DES`, `RC4`, `ECB` mode, `AES` + fixed IV |
| Insecure Random | `Math.random()`, `random.random()` (used for Token/key/salt) |
| Custom Crypto | Manual implementations not using `crypto`/`openssl`/`nacl` libraries |

### Judgment Process

1. **Check hardcoded keys**: `Grep` searches for `secret`, `password`, `apikey`, `private_key`, `token` assigned as string constants, `Read` confirms:
   - Whether it is a production environment key (not test/mock value)
   - Whether it should be obtained from environment variables/key management services
2. **Check algorithm strength**: `Read` confirms the encryption/hashing algorithms used:
   - Password storage: should use `bcrypt`/`argon2` (not MD5/SHA)
   - Data encryption: should use `AES-256-GCM` (not DES/RC4/ECB)
   - Digital signatures: should use `RSA-2048+`/`ECDSA P-256+` (not MD5/SHA1)
   - IV/Nonce: should be randomly generated and unique (not fixed values)
3. **Check random number security**: `Read` confirms the random number generator used in security-related contexts:
   - `crypto.randomBytes()` (Node.js), `secrets` (Python), `java.security.SecureRandom` → secure
   - `Math.random()`, `random.random()`, `rand()` → insecure
4. **Check custom crypto**: `Read` confirms whether standard libraries are used (`crypto`, `openssl`, `nacl`, `cryptography`), rather than custom implementations

### Evidence Construction

After confirming a defect, the output must include:
- Defect location (hardcoded value/weak algorithm usage location, with file:line number)
- Risk level (hardcoded key → Critical, weak hash → High, weak random → Medium)
- Alternative approach (secure algorithm/key acquisition method that should be used)
- Business impact (key leakage, data can be decrypted, Token can be predicted)

### Exclusions

- Hardcoded values in test/Mock environments (filename contains `test`/`mock`/`fixture`)
- Keys already obtained from environment variables (`process.env.SECRET`)
- `MD5`/`SHA1` used in non-security contexts (file verification, cache key, not password/signing)
- `Math.random()` used in non-security contexts (UI animation, random sorting)
