Installs into .claude/skills of the current project.
Are you the author of Crypto?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/majiayu000-crypto)
---
name: crypto
description: Client-side cryptography with libsodium. Use when working on files in src/lib/crypto/.
---
# Crypto Guidelines
**All crypto happens client-side. Server NEVER sees plaintext.**
## Architecture
- Seed phrase (128-bit) → Ed25519 keypair (signing) → X25519 keypair (encryption)
- Vault key (random 256-bit) wrapped with user's X25519 public key
- Data encrypted with XChaCha20-Poly1305
## Critical Rules
1. **Never log keys or sensitive data** - not even in development
2. **Use libsodium** - don't implement crypto primitives
3. **Async everywhere** - all functions async (libsodium-wrappers)
4. **Constant-time comparisons** - `sodium.compare` for secrets
5. **Zeroize secrets** - `sodium.memzero` when done
6. **Type-safe keys** - use branded types (VaultKey, SigningKey)
## Common Pitfalls
- Don't use `crypto.randomBytes` → use `sodium.randombytes_buf`
- Don't concatenate key material → use proper KDFs
- Don't store keys in localStorage without encryption
- Don't forget `await sodium.ready` before operations
## Testing
Use property-based tests for roundtrip verification with fast-check.
