wycheproof
Wycheproof provides test vectors for validating cryptographic implementations. Use when testing crypto code for known attacks and edge cases.
npx skills add trailofbits/skills --skill wycheproof --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
Wycheproof offers a collection of test vectors to validate cryptographic implementations and test against known attacks and edge cases. It is intended for testing crypto code across various algorithms and setups.
How it works
The skill describes how Wycheproof is used and integrated: add Wycheproof to a project (prefer Git submodule), or fetch specific test vector JSON files. It explains parsing the test vectors by algorithm-specific JSON files, then writing a testing harness that handles valid and invalid test cases, with examples in Python and JavaScript. It covers CI integration, including submodule updates or fetch scripts, and provides a workflow for Phase 2 parsing, Phase 3 harness, and Phase 4 CI steps. It also outlines test file structure, test group organization, and shared/test vector attributes like tcId, comment, flags, and result. It includes examples of handling AES-GCM, ECDSA, ECDH, RSA, and ChaCha20-Poly1305 test vectors, showing how to extract or transform fields for tests and how to assert expected results based on the tv["result"] value.
When to use it
Apply Wycheproof when testing cryptographic implementations (AES-GCM, ECDSA, ECDH, RSA, etc.), validating edge cases, verifying against known attack vectors, setting up CI/CD for crypto libraries, and auditing third-party crypto code for correctness.
What it can touch
The skill references commands and file names in the provided workflow, such as:
- Submodule command: git submodule add https://github.com/C2SP/wycheproof.git
- JSON test files like aes_gcm_test.json, ecdsa_test.json, ecdhtest.json, rsa*_test.json, chacha20_poly1305_test.json
- Paths like wycheproof/testvectors_v1/ and related Python/JavaScript code snippets that load and parse these JSON files
- Testing harness code snippets in Python (pytest) and JavaScript (Mocha) demonstrating how to instantiate crypto primitives and verify results against tv['result']
Caveats
The skill describes using Wycheproof test vectors and harnesses; it notes that vectors cover established algorithms and edges, and may require maintaining submodules or fetch scripts to stay up to date. It emphasizes filtering test groups by parameters and understanding flags in the notes for vulnerability patterns. It does not guarantee passing tests for all implementations and recommends using both valid and invalid/acceptable cases in testing.
# Wycheproof Wycheproof is an extensive collection of test vectors designed to verify the correctness of cryptographic implementations and test against known attacks. Originally developed by Google, it is now a community-managed project where contributors can add test vectors for specific cryptographic constructions. ## Background ### Key Concepts | Concept | Description | |---------|-------------| | Test vector | Input/output pair for validating crypto implementation correctness | | Test group | Collection of test vectors sharing attributes (key size, IV size, curve) | | Result flag | Indicates if test should pass (valid), fail (invalid), or is acceptable | | Edge case testing | Testing for known vulnerabilities and attack patterns | ### Why This Matters Cryptographic implementations are notoriously difficult to get right. Even small bugs can: - Expose private keys - Allow signature forgery - Enable message decryption - Create consensus problems when different implementations accept/reject the same inputs Wycheproof has found vulnerabilities in major libraries including OpenJDK's SHA1withDSA, Bouncy Castle's ECDHC, and the elliptic npm package. ## When to Use **Apply Wycheproof wh
- Background
- Key Concepts
- Why This Matters
- When to Use
- Quick Reference
- Testing Workflow
- Repository Structure
- Supported Algorithms
- Test File Structure
- Test Groups
- Test Vector Attributes
- Implementation Guide
- Phase 1: Add Wycheproof to Your Project
- Phase 2: Parse Test Vectors
git submodule add https://github.com/C2SP/wycheproof.git
Create wycheproof folder
mkdir -p $TMP_WYCHEPROOF_FOLDER
Request all test vector files if they don't exist
for i in "${TEST_VECTORS[@]}"; do
if [ ! -f "${TMP_WYCHEPROOF_FOLDER}${i}" ]; then
curl -o "${TMP_WYCHEPROOF_FOLDER}${i}" "${BASE_URL}${i}"
if [ $? -ne 0 ]; then
echo "Failed to download ${i}"
exit 1What does the wycheproof skill do?
Wycheproof provides test vectors for validating cryptographic implementations. Use when testing crypto code for known attacks and edge cases.
How do I install it?
Run `npx skills add trailofbits/skills --skill wycheproof --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From trailofbits/skills, a repository with 6,426 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.