Encryption

What This Skill Does

The Encryption skill provides comprehensive support for cryptographic operations, secure storage, and security auditing within your development workflow. It serves as an expert assistant for implementing best practices, helping you choose the right algorithms for password hashing, symmetric/asymmetric encryption, and key management. The skill includes built-in audit checklists to ensure your applications adhere to industry standards like NIST recommendations, preventing common vulnerabilities such as timing attacks, hardcoded secrets, and the use of deprecated cryptographic primitives.

Installation

To install this skill, run the following command in your terminal: clawhub install openclaw/skills/skills/ivangdavila/encryption

Use Cases

• Security Audits: Scan your codebase to identify weak algorithms (e.g., MD5, SHA1) or potential leaks of sensitive credentials in environment variables or hardcoded strings.
• Data Protection: Implement robust AES-256-GCM encryption for application data at rest and ensure secure key rotation patterns using KMS or HashiCorp Vault.
• Authentication Architecture: Guidance on migrating legacy password storage to modern standards like argon2id or bcrypt with appropriate cost factors.
• Secure Infrastructure: Design TLS termination and certificate management strategies, including mTLS configurations for service-to-service communication.
• Compliance: Verify your implementation against a security checklist that mandates secure random number generation (CSPRNG), unique initialization vectors (IVs), and authenticated encryption (AEAD).

Example Prompts

1. "Check my Node.js authentication module for vulnerabilities; I want to ensure my password hashing uses bcrypt with the correct cost factor and that I am not using weak crypto libraries."
2. "I need to store sensitive customer files on our server. Provide a secure implementation strategy using AES-256-GCM in Python and advise on how to handle key rotation securely."
3. "My team is moving from RSA-1024 to modern asymmetric encryption. Can you explain why Ed25519 is preferred and provide a configuration snippet for our signing process?"

Tips & Limitations

• Always prioritize AEAD: Avoid legacy modes like CBC that are susceptible to padding oracle attacks. Always verify that your implementation uses authentication tags.
• Secrets Management: This skill can generate key management patterns, but it does not replace a dedicated Secret Management Service (e.g., Vault). Never expose raw keys in logs or git repositories.
• CSPRNG Reliance: Never use pseudo-random generators (like Math.random()) for security-sensitive data. Always rely on OS-level entropy sources (CSPRNG).
• Audit Regularly: Security is a process, not a state. Re-run audits after every major dependency update or infrastructure change to ensure that deprecated algorithms have not been introduced.