Detect weak crypto algorithm names

Challenge

Audit a config blob for deprecated crypto by counting how many lines name a known-weak algorithm.

Task

Implement int weak_crypto_count(const char *config) that returns the number of lines mentioning any of these weak algorithms, matched case-insensitively as a substring: MD5, SHA1, DES, RC4, 3DES.

A line counts once even if it names several weak algorithms.

Input

• config: a NUL-terminated, multi-line config string the grader provides. Lines are separated by \n.

Output

Returns the count of lines that contain at least one weak-algorithm name, as an int.

Example

"cipher = AES-256\nhash = MD5\nfallback = sha1\n"   ->   2
"old = des-ede3 (3des)\ntransport = rc4-md5\n"       ->   2   (each line counted once)
"safe = sha256\n"                                    ->   0
""                                                  ->   0

Edge cases

• Empty input: returns 0.
• A line with two weak names counts once.
• Matching is substring-based; the fixtures avoid traps like sha1 inside sha10.

Why this matters

Auditing config files for deprecated crypto is the kind of grep-able problem real security tools (semgrep, bandit, OpenSSL hardener) solve every day. Implementing one teaches the alert-vs-allow distinction.

Input format

A NUL-terminated multi-line config string (lines separated by \n).

Output format

Count of lines naming any of MD5/SHA1/DES/RC4/3DES, as an int.

Constraints

Case-insensitive substring match; each line counts at most once.

Starter code

int weak_crypto_count(const char *config) { /* TODO */ return 0; }

Common mistakes

Counting SHA256 as SHA1 (need word boundary or proper token check — for this exercise substring is fine, but watch the test cases); counting the same line twice when two algorithms appear.

Edge cases to handle

Empty input. Line with two weak ciphers — counts once.

Complexity

O(n * weak_count).

Background lessons

• Searching for a substring