Skill UI

This guide details how to implement secure, keyless software signing using the Sigstore ecosystem components (Cosign, Fulcio, Rekor). It establishes cryptographic provenance for container images and binaries by binding identity via OIDC, ensuring verifiable integrity and tamper-proofing throughout the CI/CD supply chain.

A comprehensive guide for cryptanalysts detailing advanced attack vectors against RSA cryptography. This playbook covers factorization methods, small exponent exploits (e.g., Hastad Broadcast), lattice-based attacks (Wiener's, Boneh-Durfee), and methods exploiting protocol weaknesses like padding oracles. Essential for CTF challenges and authorized security assessments.

This skill proactively hunts for advanced firmware threats, including UEFI bootkits (e.g., BlackLotus, ESPecter), residing in the EFI System Partition (ESP). It establishes a cryptographic baseline, verifies bootloader signatures, scans for out-of-band changes, and uses YARA rules to detect persistence mechanisms related to pre-OS compromise (MITRE ATT&CK T1542.003). Ideal for forensic investigations and security hardening.

A comprehensive guide for engineering the migration from classical public-key cryptography to quantum-resistant standards. This skill covers building a Cryptographic Bill of Materials (CBOM) to inventory assets, prioritizing migration based on Harvest-Now-Decrypt-Later (HNDL) risk, and deploying hybrid PQC key exchange (e.g., X25519MLKEM768) on critical channels like TLS, VPN, and SSH. Essential for achieving long-term quantum readiness and crypto-agility.

This guide provides a specialized framework for authors targeting the IACR Conference on Cryptographic Hardware and Embedded Systems (CHES). It details the specific scope, evidence bar, and framing techniques required for cryptographic hardware papers, ensuring submissions meet the high standards of the community. It helps reposition work from journal or general CS styles.

A specialized downstream skill designed for solving encrypted ZIP/PKZIP challenges, particularly those using the legacy ZipCrypto method in CTF competitions. This workflow utilizes known-plaintext attacks (via tools like bkcrack) to recover internal encryption keys, enabling decryption and extraction without resorting to brute-force password guessing. Use this when a predictable plaintext fixture is available.

A comprehensive skill set for performing offensive security assessments on TLS/SSL implementations. This includes identifying cryptographic weaknesses (like POODLE, DROWN, Heartbleed), testing for protocol downgrades, analyzing weak cipher suites, and bypassing security controls such as certificate pinning and improper validation. Essential for penetration testers and security engineers to audit network service integrity.