Operation Groups¶
Use Operation Groups to review related cryptographic calls together. This view is useful when an operation is configured in one call and used in later calls, or when a proposed fix affects several parts of the code.
The report file is operation-groups.json.
What a group represents¶
A group can show key-generator setup and key generation; cipher setup and encryption or decryption; or the creation, update, and completion of a signature, digest, or message authentication code.
Groups reflect relationships found in the scanned source. When a relationship is unclear, inspect the source and available evidence before treating the calls as one operation.
What a group contains¶
| Detail | Use it to |
|---|---|
| Operation and source context | Identify the purpose and affected code |
| Related calls and locations | Follow the setup and use of the operation |
| Algorithm and parameters | Understand its security configuration |
| Reused configuration | See supported settings established by an earlier call |
| Conflicts and missing context | Identify questions that need manual investigation |
| Five assessment dimensions | Read each result alongside its reasoning, discovery follow-ups, and assessment-review needs |
| Remediation and migration guidance | Prepare a change or follow-up review |
Details vary with the library, source pattern, and evidence available.
Review an operation¶
- Expand the relevant file section and group, then confirm its purpose and source location.
- Read the related calls, including setup and completion steps.
- Check algorithm and parameter details, including units and unresolved values.
- Investigate any conflicts or missing context.
- Read Assessment, Reasoning, and Remediation before defining a change.
In the standalone viewer, collapse file sections independently to keep the selection manageable. When arriving from Assessment, check the active filters before interpreting the visible group count. You can edit or clear the selection using the ordinary filter controls.
For example, reviewing only a cipher's final call can miss key or IV settings established earlier. See Configuration Reuse.
Investigate a conflict¶
A group can contain incompatible parameter values or an unknown replacement for an earlier value. Inspect the contributing locations and confirm which configuration applies in the application.
Keep the item in manual review until you have enough evidence. Record decisions in your tracking system, then rescan after source changes.
Move between groups and calls¶
Use the group for operation-level review and Crypto Functions for exact call details. Function entries can refer back to the group that supplied additional assessment context.
A source group does not prove successful execution, correct error handling, or that every runtime path uses the same settings. Use application tests and deployment evidence where needed.