Secure Code Review and Application Security
Cryptography Usage Review
We review how your application uses encryption, signing and key storage in the code and configuration. We identify where the correct algorithm is used incorrectly.
What it is
Cryptographic errors are usually due to how algorithms are used, not the algorithms themselves. Strong encryption with a fixed initialization vector or without integrity checks does not provide the expected protection. Storing passwords with a fast hash function is a similar mistake. The review evaluates each cryptographic operation against its purpose and current best practices.
Scope
- Encryption algorithm, mode of operation and initialization vector (IV) use
- Password storage method and hash function selection
- Random number source for tokens, keys and one-time codes
- Key generation, storage and rotation (KMS or HSM)
- Signature, certificate and JWT validation, and TLS client settings
- Inventory of algorithms and protocols in use
The need
When organizations need it
- When you need to demonstrate that sensitive personal data such as health data are stored with approved cryptographic methods.
- When a customer or auditor requests a list of the encryption algorithms and protocols you use.
- When planning a transition to post-quantum cryptography and you need to know which algorithm is used where.
Method
How we work
-
Inventory
We list all cryptographic operations and libraries used in the code and configuration.
-
Purpose
We assess what each operation is intended to protect and whether it uses the appropriate construction.
-
Key lifecycle
We track where keys are generated and stored, who has access, and how they are rotated.
-
Recommendations
For each finding, we provide recommended usage and migration order based on current best practices.
Outcome
What you have at the end
You receive an inventory of the cryptographic operations in your application and whether each is used correctly. This inventory is also the starting point for a post-quantum migration plan.
Frequently asked questions
What should we do about post-quantum cryptography now?
NIST approved the first post-quantum cryptography standards (FIPS 203, 204 and 205) in August 2024. The first step in migration is knowing which algorithm is used in each system. This review provides that inventory.
We wrote our own encryption code. Is that a problem?
Writing your own algorithm or protocol is a significant risk. We recommend migrating to correct use of widely accepted libraries, and we review existing code during this process.
Are server and load balancer TLS settings in scope?
How the application validates TLS connections and certificates is in scope. Server and load balancer configurations can be included on request.
Secure Code Review and Application Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting