CAIN-42 CLAWXCrypto Audit: figures & benchmarks
Evidence for Crypto Audit: 1. Evidence pack · 2. Answers to buyer questions · 3. Figures & benchmarks · 4. Selling tools · IHVRK kit · Learn it · why these pages exist
Every number on this page is read from the signed transcript inside the IHVRK kit; none is typed in by hand.
6/6
claims matched when recorded
5
attack cases refused or flagged as claimed
79 ms
median round trip (min 71, max 145), incl. network
| # | Kind | Claim | Recorded value | HTTP | ms |
|---|---|---|---|---|---|
| C01 | control | Modern code: bcrypt, SHA-256, secrets, default TLS -> No findings: no false alarm. | 0 | 200 | 107 |
| C02 | attack | Signature check off, TLS check off, key in the code -> Three classic mistakes, three findings. | 3 | 200 | 79 |
| C03 | attack | Passwords hashed with MD5 -> MD5 is broken for passwords. | "WeakHash_MD5" | 200 | 145 |
| C04 | attack | AES in ECB mode -> ECB leaks patterns in the data. | "InsecureMode_ECB" | 200 | 73 |
| C05 | attack | random() used for a security token -> random() is predictable; use secrets. | "InsecureRandom_Crypto" | 200 | 71 |
| C06 | attack | A 1024-bit RSA key -> Under 2048 bits is too short. | "ShortRSAKey" | 200 | 72 |
Copy the table (paste into a spreadsheet)
id kind claim recorded_value expected http ms recorded_at C01 control Modern code: bcrypt, SHA-256, secrets, default TLS -> No findings: no false alarm. 0 [0] 200 107 2026-11-03T22:48:36+00:00 C02 attack Signature check off, TLS check off, key in the code -> Three classic mistakes, three findings. 3 [3] 200 79 2026-11-03T22:48:36+00:00 C03 attack Passwords hashed with MD5 -> MD5 is broken for passwords. "WeakHash_MD5" ["WeakHash_MD5"] 200 145 2026-11-03T22:48:37+00:00 C04 attack AES in ECB mode -> ECB leaks patterns in the data. "InsecureMode_ECB" ["InsecureMode_ECB"] 200 73 2026-11-03T22:48:38+00:00 C05 attack random() used for a security token -> random() is predictable; use secrets. "InsecureRandom_Crypto" ["InsecureRandom_Crypto"] 200 71 2026-11-03T22:48:38+00:00 C06 attack A 1024-bit RSA key -> Under 2048 bits is too short. "ShortRSAKey" ["ShortRSAKey"] 200 72 2026-11-03T22:48:39+00:00
Download: figures.tsv · transcript.json (full answers) · whole kit
How to read these numbers
- Recorded 2026-11-03T22:48:39+00:00 against cainstudio.online from our build host; times include the internet round trip.
- They show these inputs, not every possible input. Known misses are on the limits page.
- This is not a load test, an SLA or a third-party benchmark. Re-run it yourself:
python3 verify.py --live.