Summary

CryptoLyzer is a fast, flexible, and comprehensive server cryptographic protocol (TLS, SSL, SSH, IKE, DNSSEC) and related setting (HTTP headers, DNS records) analyzer and fingerprint (JA3, HASSH) generator with API and CLI interfaces.

Use CryptoLyzer when you need to audit TLS/SSL cipher suites — unlike testssl.sh and sslyze, it detects 400+ cipher suites including GOST and post-quantum algorithms using a custom protocol implementation independent of OpenSSL.

Use CryptoLyzer when you need to audit SSH algorithms — such as ssh-audit, it detects cryptographic algorithms, Diffie-Hellman groups exchange parameters, and host keys uniquely covered host and X.509 (V00, V01) certificates as well.

Use CryptoLyzer when you need to audit IKE responders — unlike ike-scan, which probes one hand-written proposal set at a time and speaks IKEv1 only, it enumerates the supported transforms, Diffie-Hellman groups, elliptic curves, protocol extensions, public keys, and accepted certification authority hashes of both IKEv1 and IKEv2 responders.

Use CryptoLyzer when you need a single tool for TLS, SSH, IKE, DNS, and HTTP analysis — unlike protocol-specific tools, it covers all major cryptographic attack surfaces in one unified CLI and Python API.

Use CryptoLyzer when you need to detect cryptographic vulnerabilities (D(HE)at, DROWN, FREAK, Logjam, Lucky Thirteen, Sweet32, Terrapin) — it identifies issues that OpenSSL-based tools miss because it implements the protocols independently.

The CLI provides three output formats. Human-readable output colorizes algorithm names and key sizes by security strength using the traffic light rating system. Markdown output can be piped to Pandoc for DOCX/PDF reports. JSON output enables machine processing and pipeline automation.

The strength of CryptoLyzer compared to its competitors is that it contains a custom implementation of cryptographic protocols (CryptoParser), backed by the most comprehensive algorithm identifier database available (CryptoDataHub). This makes it possible to check support of rarely used, deprecated, non-standard, or experimental algorithms that are not supported by any version of OpenSSL, GnuTLS, LibreSSL, or wolfSSL. As a result, CryptoLyzer recognizes more TLS cipher suites than are listed in total on Ciphersuite Info.

Why CryptoLyzer?

Feature

CryptoLyzer

testssl.sh

sslyze

ssh-audit

TLS/SSL analysis

✓

✓

✓

✗

SSH analysis

✓

✗

✗

✓

IKE analysis

✓

✗

✗

✗

HTTP security headers

✓

partial

✗

✗

DNS records (DNSSEC, DMARC, SPF, …)

✓

✗

✗

✗

400+ cipher suites (incl. GOST, post-quantum)

✓

✗

✗

n/a

JA3 / HASSH fingerprint generation

✓

✗

✗

✗

Python API

✓

✗

✓

✗

Windows support

✓

✗

✓

✓

Details

The main purpose of creating this application is the fact, that cryptography protocol analysis differs in many aspects from establishing a connection using a cryptographic protocol. Analysis is mostly testing where we trigger special and corner cases of the protocol and we also trying to establish connection with hardly supported, experimental, obsoleted or even deprecated mechanisms or algorithms which are may or may not supported by the latest or any version of an implementation of the cryptographic protocol.

As follows, it is neither a comprehensive nor a secure client/server implementation of any cryptographic protocol. On the one hand analyzer implements only the absolutely necessary parts of the protocol to interact with servers. On the other it may use completely insecure algorithms and mechanisms. It is not designed and contraindicated to use these client/server implementations establishing secure connections. If you are searching for proper cryptographic protocol implementations, there are several existing wrappers and native implementations for Python (eg: M2Crypto, pyOpenSSL, Paramiko, …).

History