Cryptographic Analysis

Source-Level Cryptographic Review|Compatibility and Integrity|Evidence You Can Reproduce

Sphere 10 analyses the cryptographic behaviour of applications, protocols and stored formats. We trace how bytes become keys, signatures, hashes and encrypted records, then test whether the implementation satisfies its intended contract. The output is a set of evidenced findings, reproducible fixtures and a practical remediation plan.

Review the Construction and Its Integration

We examine the complete path: input encoding, randomness, key derivation, algorithm selection, signing or encryption, parsing and verification. Correct use of a primitive matters as much as its name. The review identifies which data is authenticated, who can create a valid record and what an application does when verification fails.

Our .NET work uses Sphere10 Framework's Hashers and CHF algorithm identifiers, IDigitalSignatureScheme contracts and CryptoEx implementations where they fit the selected system. We distinguish signing a message from signing an already calculated digest, inspect deterministic key-generation requirements and check interoperability against the actual peer format.

Use a Concrete Compatibility Case

Our published PascalCoin ECIES compatibility analysis documents differences between native and managed padding and length handling. It explains how apparently successful decryption could lose genuine trailing-zero bytes, and why reader migration had to precede changes to writers.

That work also separates byte recovery from authentication: the legacy encrypted envelope leaves its length metadata outside the MAC. The distinction matters because a compatibility correction does not, by itself, establish integrity for every returned byte. We apply the same source-to-fixture discipline to the construction under review.

A scoped threat and trust model tied to the exact application or protocol version.
A source review of key handling, message framing, authentication and failure paths.
Interoperability vectors and regression fixtures for boundaries, malformed input and tampering.
Prioritised findings that distinguish demonstrated defects, source concerns and untested assumptions.

Deliver Findings That Can Be Closed

For each finding, we record the affected code, triggering conditions, observed result and recommended correction. Remediation work can include format validation, a versioned authenticated envelope, migration sequencing or an implementation change with regression coverage. Compatibility requirements are retained explicitly so a repair does not make historical data unreadable.

Acceptance is based on the agreed test vectors and previously failing cases, with a clear account of what remains outside the review. You receive the report, fixtures and relevant source changes if remediation is included. This is an engineering analysis with defined evidence and scope; any separate certification or independent assurance requirement is specified as its own engagement.

Platforms & Tooling

.NET C# Sphere10 Framework CryptoEx ECDSA Merkle Trees NUnit

Discuss Your Project Back to Services