wycheproof

Wycheproof is a specialized security skill designed to verify the correctness of cryptographic software implementations. By leveraging the extensive Wycheproof project—a collection of test vectors originally developed by Google—this skill helps developers and security auditors ensure that cryptographic libraries handle edge cases and known attack patterns securely. It is intended for software engineers, security researchers, and DevOps professionals working with sensitive cryptographic code who need to validate their implementations against established industry standards. Typical use cases include testing popular algorithms such as AES-GCM, ECDSA, ECDH, RSA, and ChaCha20-Poly1305 during library development or integration into larger security-critical systems. The skill simplifies the complex process of running cryptographic test suites by providing structured parsing and guidance on how to interpret test results, including distinguishing between valid, invalid, and acceptable cryptographic inputs.

• Performs automated validation of cryptographic implementations using standardized JSON-based test vectors.

• Supports a wide array of cryptographic constructions including symmetric encryption, digital signatures, key exchange, and hashing functions.

• Identifies potential implementation flaws that could lead to private key exposure, signature forgery, or consensus failures.

• Integrates with development workflows to support test-driven development (TDD) for cryptographic primitives.

• Provides clear mapping for test groups based on attributes like key size, IV size, and elliptic curves.

• Apply this skill when validating established algorithms; it is not suitable for testing timing side-channels or auditing custom, experimental algorithms.

• The output includes results for individual test IDs, allowing for precise identification of failing code paths.

• Always prioritize integration via git submodules to ensure that test vectors remain synchronized with the official Wycheproof repository.

• Expected inputs include the target cryptographic implementation and relevant test vector files; expected outputs include comprehensive pass/fail reports and explanations of failed edge cases.

• Note that this tool assumes the user has basic familiarity with cryptography and is primarily focused on correctness and edge-case resistance rather than general fuzzing or side-channel analysis.