panva/node-oidc-provider

ECDSA Quantum-vulnerable Renamed import 125 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. lib/consts/jwa.js:5 'ES256', 'ES384', 'ES512',
2. lib/helpers/defaults.js:3432 'ES256',
3. lib/helpers/defaults.js:3455 idTokenSigningAlgValues: ['RS256', 'PS256', 'ES256', 'Ed25519', 'EdDSA'],
4. lib/helpers/defaults.js:3479 'ES256',
5. lib/helpers/defaults.js:3502 userinfoSigningAlgValues: ['RS256', 'PS256', 'ES256', 'Ed25519', 'EdDSA'],
6. lib/helpers/defaults.js:3525 'ES256',
7. lib/helpers/defaults.js:3551 'ES256',
8. lib/helpers/defaults.js:3820 dPoPSigningAlgValues: ['ES256', 'Ed25519', 'EdDSA'],
9. lib/helpers/defaults.js:3839 attestSigningAlgValues: ['ES256', 'Ed25519', 'EdDSA'],
10. lib/helpers/initialize_keystore.js:61 available = ['ES256'];
11. lib/helpers/initialize_keystore.js:64 available = ['ES384'];
12. lib/helpers/initialize_keystore.js:67 available = ['ES512'];
13. lib/helpers/keystore.js:113 case 'ES256': return 'P-256';
14. lib/helpers/keystore.js:114 case 'ES384': return 'P-384';
15. lib/helpers/keystore.js:115 case 'ES512': return 'P-521';
16. lib/models/id_token.js:17 case 'ES256':
17. lib/models/id_token.js:22 case 'ES384':
18. lib/models/id_token.js:27 case 'ES512':
19. test/ciba/ciba.config.js:105 test path backchannel_authentication_request_signing_alg: 'ES256',
20. test/ciba/ciba.test.js:931 test path const { privateKey, publicKey } = await generateKeyPair('ES256');
21. test/ciba/ciba.test.js:946 test path }).setProtectedHeader({ alg: 'ES256' })
22. test/ciba/ciba.test.js:963 test path const { privateKey } = await generateKeyPair('ES256');
23. test/ciba/ciba.test.js:972 test path }).setProtectedHeader({ alg: 'ES256' })
24. test/ciba/ciba.test.js:997 test path const { privateKey } = await generateKeyPair('ES256');
25. test/ciba/ciba.test.js:1006 test path }).setProtectedHeader({ alg: 'ES256' })
26. test/ciba/ciba.test.js:1031 test path const { privateKey } = await generateKeyPair('ES256');
27. test/ciba/ciba.test.js:1040 test path }).setProtectedHeader({ alg: 'ES256' })
28. test/ciba/ciba.test.js:1065 test path const { privateKey } = await generateKeyPair('ES256');
29. test/ciba/ciba.test.js:1074 test path }).setProtectedHeader({ alg: 'ES256' })
30. test/client_auth/client_auth.test.js:190 test path 'ES256',
31. test/client_auth/client_auth.test.js:191 test path 'ES384',
32. test/client_auth/client_auth.test.js:192 test path 'ES512',
33. test/client_auth/client_auth.test.js:223 test path 'ES256',
34. test/client_auth/client_auth.test.js:224 test path 'ES384',
35. test/client_auth/client_auth.test.js:225 test path 'ES512',
36. test/configuration/client_metadata.test.js:687 test path 'ES256',
37. test/configuration/client_metadata.test.js:688 test path 'ES384',
38. test/configuration/client_metadata.test.js:689 test path 'ES512',
39. test/configuration/client_metadata.test.js:1650 test path 'ES256',
40. test/configuration/client_metadata.test.js:1651 test path 'ES384',
41. test/configuration/client_metadata.test.js:1652 test path 'ES512',
42. test/configuration/client_metadata.test.js:1873 test path for (const alg of ['RS256', 'PS384', 'ES512', 'Ed25519', 'EdDSA', ...pqc]) {
43. test/configuration/client_metadata.test.js:2152 test path const supported = ['PS256', 'ES256', 'RS256'];
44. test/configuration/client_metadata.test.js:2156 test path id_token_signing_alg_values_supported: ['PS256', 'RS256', 'ES256'],
45. test/configuration/client_metadata.test.js:2162 test path rejects(this.title, ['ES256'], `${this.title} must include the value of provided id_token_signed_response_alg`, {
46. test/configuration/client_metadata.test.js:2166 test path rejects(this.title, ['ES256'], `${this.title} includes no supported values`, undefined, {
47. test/configuration/keystore_configuration.test.js:66 test path generateKeyPair('ES256', { extractable: true }),
48. test/custom_grants/custom_grants.config.js:10 test path config.enabledJWA.dPoPSigningAlgValues = ['ES256'];
49. test/custom_grants/grant_implementations.test.js:94 test path .setProtectedHeader({ alg: 'ES256' })
50. test/custom_grants/grant_implementations.test.js:104 test path async function signClaims(privateKey, claims, alg = 'ES256') {
51. test/custom_grants/grant_implementations.test.js:170 test path alg: 'ES256',
52. test/custom_grants/grant_implementations.test.js:183 test path this.jwtKeyPair = await generateKeyPair('ES256');
53. test/custom_grants/grant_implementations.test.js:184 test path this.otherKeyPair = await generateKeyPair('ES256');
54. test/custom_grants/grant_implementations.test.js:225 test path { algorithms: ['ES256'], key: this.jwtKeyPair.publicKey },
55. test/custom_grants/grant_implementations.test.js:249 test path const keyPair = await generateKeyPair('ES256', { extractable: true });
56. test/custom_grants/grant_implementations.test.js:752 test path const es384 = await generateKeyPair('ES384');
57. test/custom_grants/grant_implementations.test.js:760 test path }, 'ES384'),
58. test/custom_grants/grants/jwt_bearer.js:57 test path algorithms = ['ES256'],
59. test/dpop/dpop.config.js:7 test path config.enabledJWA.dPoPSigningAlgValues = ['ES256', 'PS256'];
60. test/dpop/dpop.test.js:27 test path }).setProtectedHeader({ alg: 'ES256', typ: 'dpop+jwt', jwk: await exportJWK(keypair.publicKey) })
61. test/dpop/dpop.test.js:38 test path this.keypair = await generateKeyPair('ES256', { extractable: true });
62. test/dpop/dpop.test.js:47 test path expect(response.body).to.have.deep.property('dpop_signing_alg_values_supported', ['ES256', 'PS256']);
63. test/dpop/dpop.test.js:123 test path alg: 'ES256',
64. test/dpop/dpop.test.js:173 test path alg: 'ES256',
65. test/dpop/dpop.test.js:197 test path alg: 'ES256',
66. test/dpop/dpop.test.js:216 test path alg: 'ES256',
67. test/dpop/dpop.test.js:232 test path .setProtectedHeader({ alg: 'ES256', typ: 'dpop+jwt', jwk: this.jwk })
68. test/dpop/dpop.test.js:246 test path .setProtectedHeader({ alg: 'ES256', typ: 'dpop+jwt', jwk: this.jwk })
69. test/dpop/dpop.test.js:261 test path .setProtectedHeader({ alg: 'ES256', typ: 'dpop+jwt', jwk: this.jwk })
70. test/dpop/dpop.test.js:292 test path .setProtectedHeader({ alg: 'ES256', typ: 'dpop+jwt', jwk: this.jwk })
71. test/dpop/dpop.test.js:377 test path .set('DPoP', await DPoP(await generateKeyPair('ES256', { extractable: true }), `${this.provider.issuer}${this.suitePath('/me')}`, 'GET', undefined, token))
72. test/dpop/dpop.test.js:386 test path .set('DPoP', await DPoP(await generateKeyPair('ES256', { extractable: true }), `${this.provider.issuer}${this.suitePath('/me')}`, 'GET', undefined, dpop))
73. test/dpop/dpop.test.js:797 test path .set('DPoP', await DPoP(await generateKeyPair('ES256', { extractable: true }), `${this.provider.issuer}${this.suitePath('/token')}`, 'POST'))
74. test/dpop/dpop.test.js:971 test path .set('DPoP', await DPoP(await generateKeyPair('ES256', { extractable: true }), `${this.provider.issuer}${this.suitePath('/token')}`, 'POST'))
75. test/dpop/dpop.test.js:982 test path await generateKeyPair('ES256', { extractable: true }),
76. test/external_signing/external_signing.config.js:103 test path id_token_signed_response_alg: 'ES256',
77. test/external_signing/external_signing.config.js:119 test path id_token_signed_response_alg: 'ES384',
78. test/external_signing/external_signing.test.js:40 test path expect(body.id_token_signing_alg_values_supported).to.include('ES384');
79. test/fapi/fapi-final.config.js:10 test path export const keypair = await generateKeyPair('ES256');
80. test/fapi/fapi-final.config.js:27 test path requestObjectSigningAlgValues: ['ES256'],
81. test/fapi/fapi-final.test.js:115 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey);
82. test/fapi/fapi-final.test.js:151 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey);
83. test/fapi/fapi-final.test.js:184 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey);
84. test/fapi/fapi-final.test.js:218 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey);
85. test/fapi/fapi-final.test.js:252 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey);
86. test/fapi/fapi2.config.js:10 test path export const keypair = await generateKeyPair('ES256');
87. test/fapi/fapi2.config.js:26 test path requestObjectSigningAlgValues: ['ES256'],
88. test/fapi/fapi2.test.js:88 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey),
89. test/fapi/fapi2.test.js:164 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey);
90. test/fapi/fapi2.test.js:195 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey);
91. test/fapi/fapi2.test.js:228 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey);
92. test/fapi/fapi2.test.js:261 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey);
93. test/formats/jwt.test.js:535 test path alg: 'ES512',
94. test/jwks/jwks_uri.test.js:105 test path alg: 'ES256',
95. test/jwt/jsonwebtoken.test.js:102 test path const { privateKey, publicKey } = await generateKeyPair('ES256');
96. test/jwt/jsonwebtoken.test.js:104 test path return JWT.sign({ data: true }, privateKey, 'ES256')
97. test/jwt/jsonwebtoken.test.js:107 test path expect(decoded.header).to.have.property('alg', 'ES256');
98. test/keys.js:14 test path generate('ES256'),
99. test/openid4vci/openid4vci.config.js:11 test path export const attesterKeypair = await generateKeyPair('ES256', { extractable: true });
100. test/openid4vci/openid4vci.config.js:17 test path config.enabledJWA.dPoPSigningAlgValues = ['ES256'];
101. test/openid4vci/openid4vci.config.js:93 test path proof_signing_alg_values_supported: ['ES256'],
102. test/openid4vci/openid4vci.config.js:104 test path proof_signing_alg_values_supported: ['ES256'],
103. test/openid4vci/openid4vci.config.js:128 test path proof_signing_alg_values_supported: ['ES256'],
104. test/openid4vci/openid4vci.config.js:139 test path proof_signing_alg_values_supported: ['ES256'],
105. test/openid4vci/openid4vci.test.js:35 test path alg = 'ES256',
106. test/openid4vci/openid4vci.test.js:77 test path alg = 'ES256',
107. test/openid4vci/openid4vci.test.js:114 test path .setProtectedHeader({ alg: 'ES256', typ: 'dpop+jwt', jwk: await exportJWK(keypair.publicKey) })
108. test/openid4vci/openid4vci.test.js:133 test path proof_signing_alg_values_supported: ['ES256'],
109. test/openid4vci/openid4vci.test.js:181 test path proof_signing_alg_values_supported: ['ES256'],
110. test/openid4vci/openid4vci.test.js:276 test path proof_signing_alg_values_supported: ['ES256'],
111. test/openid4vci/openid4vci.test.js:302 test path proof_signing_alg_values_supported: ['ES256'],
112. test/openid4vci/openid4vci.test.js:330 test path proof_signing_alg_values_supported: ['ES256'],
113. test/openid4vci/openid4vci.test.js:358 test path proof_signing_alg_values_supported: ['ES256'],
114. test/openid4vci/openid4vci.test.js:496 test path this.keypair = await generateKeyPair('ES256', { extractable: true });
115. test/openid4vci/openid4vci.test.js:498 test path this.otherKeypair = await generateKeyPair('ES256', { extractable: true });
116. test/openid4vci/openid4vci.test.js:730 test path .expect('WWW-Authenticate', /algs="ES256"/);
117. test/openid4vci/openid4vci.test.js:1461 test path const thirdKeypair = await generateKeyPair('ES256', { extractable: true });
118. test/openid4vci/openid4vci.test.js:1660 test path const p384 = await generateKeyPair('ES384', { extractable: true });
119. test/openid4vci/openid4vci.test.js:1662 test path alg: 'ES384',
120. test/openid4vci/openid4vci.test.js:1766 test path const wrongKey = await generateKeyPair('ES256', { extractable: true });
121. test/openid4vci/openid4vci.test.js:2244 test path const wrongKey = await generateKeyPair('ES256', { extractable: true });
122. test/openid4vci/openid4vci.test.js:2268 test path const p384 = await generateKeyPair('ES384', { extractable: true });
123. test/openid4vci/openid4vci.test.js:2272 test path alg: 'ES384',
124. test/openid4vci/pre_authorized_code.test.js:191 test path const keypair = await generateKeyPair('ES256', { extractable: true });
125. test/openid4vci/pre_authorized_code.test.js:194 test path alg: 'ES256',

jose.algorithm · CWE-327

RSASSA-PKCS1v15 Quantum-vulnerable Renamed import 98 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. lib/consts/client_attributes.js:32 authorization_signed_response_alg: 'RS256',
2. lib/consts/client_attributes.js:36 id_token_signed_response_alg: 'RS256',
3. lib/consts/client_attributes.js:37 introspection_signed_response_alg: 'RS256',
4. lib/consts/dev_keystore.js:4 alg: 'RS256',
5. lib/consts/jwa.js:3 'RS256', 'RS384', 'RS512',
6. lib/helpers/defaults.js:826 id_token_signed_response_alg: 'RS256',
7. lib/helpers/defaults.js:3430 'RS256',
8. lib/helpers/defaults.js:3455 idTokenSigningAlgValues: ['RS256', 'PS256', 'ES256', 'Ed25519', 'EdDSA'],
9. lib/helpers/defaults.js:3477 'RS256',
10. lib/helpers/defaults.js:3502 userinfoSigningAlgValues: ['RS256', 'PS256', 'ES256', 'Ed25519', 'EdDSA'],
11. lib/helpers/defaults.js:3523 'RS256',
12. lib/helpers/defaults.js:3549 'RS256',
13. lib/helpers/initialize_keystore.js:56 available = ['PS256', 'PS384', 'PS512', 'RS256', 'RS384', 'RS512'];
14. lib/models/id_token.js:15 case 'RS256':
15. lib/models/id_token.js:20 case 'RS384':
16. lib/models/id_token.js:25 case 'RS512':
17. test/ciba/ciba.test.js:349 test path }, createPrivateKey({ format: 'jwk', key: keys[0] }), 'RS256');
18. test/claims/claims.test.js:540 test path }, createPrivateKey({ format: 'jwk', key: keys[0] }), 'RS256');
19. test/client_auth/client_auth.config.js:55 test path if (header.alg === 'RS256') {
20. test/client_auth/client_auth.test.js:64 test path alg: 'RS256',
21. test/client_auth/client_auth.test.js:184 test path 'RS256',
22. test/client_auth/client_auth.test.js:185 test path 'RS384',
23. test/client_auth/client_auth.test.js:186 test path 'RS512',
24. test/client_auth/client_auth.test.js:217 test path 'RS256',
25. test/client_auth/client_auth.test.js:218 test path 'RS384',
26. test/client_auth/client_auth.test.js:219 test path 'RS512',
27. test/client_auth/client_auth.test.js:1257 test path }, privateKey, 'RS256', {
28. test/client_auth/client_auth.test.js:1277 test path }, privateKey, 'RS256', {
29. test/client_auth/client_auth.test.js:1463 test path alg: 'RS256',
30. test/client_auth/client_auth.test.js:1511 test path alg: 'RS256',
31. test/client_auth/client_auth.test.js:1523 test path alg: 'RS256',
32. test/client_auth/client_auth.test.js:1535 test path alg: 'RS256',
33. test/client_auth/client_auth.test.js:1547 test path alg: 'RS256',
34. test/client_auth/client_auth.test.js:1559 test path alg: 'RS256',
35. test/client_auth/client_auth.test.js:1571 test path alg: 'RS256',
36. test/client_auth/client_auth.test.js:1583 test path alg: 'RS256',
37. test/client_auth/client_auth.test.js:1595 test path alg: 'RS256',
38. test/client_auth/client_auth.test.js:1622 test path alg: 'RS256',
39. test/configuration/client_metadata.test.js:430 test path defaultsTo(this.title, 'RS256');
40. test/configuration/client_metadata.test.js:681 test path 'RS256',
41. test/configuration/client_metadata.test.js:682 test path 'RS384',
42. test/configuration/client_metadata.test.js:683 test path 'RS512',
43. test/configuration/client_metadata.test.js:1009 test path defaultsTo(this.title, 'RS256', undefined, configuration);
44. test/configuration/client_metadata.test.js:1018 test path defaultsTo(this.title, 'RS256', undefined, configuration);
45. test/configuration/client_metadata.test.js:1148 test path userinfo_signed_response_alg: 'RS256',
46. test/configuration/client_metadata.test.js:1199 test path [this.title.replace('encrypted', 'signed').replace('_enc', '_alg')]: 'RS256',
47. test/configuration/client_metadata.test.js:1209 test path [this.title.replace('encrypted', 'signed').replace('_enc', '_alg')]: 'RS256',
48. test/configuration/client_metadata.test.js:1221 test path [this.title.replace('encrypted', 'signed').replace('_enc', '_alg')]: 'RS256',
49. test/configuration/client_metadata.test.js:1231 test path [this.title.replace('encrypted', 'signed').replace('_enc', '_alg')]: 'RS256',
50. test/configuration/client_metadata.test.js:1243 test path [this.title.replace('encrypted', 'signed').replace('_enc', '_alg')]: 'RS256',
51. test/configuration/client_metadata.test.js:1253 test path introspection_signed_response_alg: 'RS256',
52. test/configuration/client_metadata.test.js:1353 test path authorization_signed_response_alg: 'RS256',
53. test/configuration/client_metadata.test.js:1644 test path 'RS256',
54. test/configuration/client_metadata.test.js:1645 test path 'RS384',
55. test/configuration/client_metadata.test.js:1646 test path 'RS512',
56. test/configuration/client_metadata.test.js:1873 test path for (const alg of ['RS256', 'PS384', 'ES512', 'Ed25519', 'EdDSA', ...pqc]) {
57. test/configuration/client_metadata.test.js:1899 test path [prop.replace('encrypted', 'signed')]: 'RS256',
58. test/configuration/client_metadata.test.js:2152 test path const supported = ['PS256', 'ES256', 'RS256'];
59. test/configuration/client_metadata.test.js:2156 test path id_token_signing_alg_values_supported: ['PS256', 'RS256', 'ES256'],
60. test/configuration/client_metadata.test.js:2163 test path id_token_signed_response_alg: 'RS256',
61. test/configuration/client_metadata.test.js:2169 test path idTokenSigningAlgValues: ['RS256'],
62. test/configuration/configuration.test.js:75 test path clientAuthSigningAlgValues: ['HS256', 'RS256'],
63. test/configuration/configuration.test.js:103 test path expect(configuration.clientAuthSigningAlgValues).to.eql(['RS256']);
64. test/configuration/configuration.test.js:106 test path expect(input.enabledJWA.clientAuthSigningAlgValues).to.eql(['HS256', 'RS256']);
65. test/configuration/keystore_configuration.test.js:65 test path generateKeyPair('RS256', { extractable: true }),
66. test/configuration/omit_algs.test.js:11 test path invalidProperty: ['HS256', 'RS256'],
67. test/configuration/omit_algs.test.js:21 test path idTokenSigningAlgValues: new Set(['HS256', 'RS256']),
68. test/configuration/omit_algs.test.js:38 test path const { privateKey } = await generateKeyPair('RS256', { extractable: true });
69. test/configuration/omit_algs.test.js:41 test path idTokenSigningAlgValues: ['HS256', 'RS256'],
70. test/configuration/omit_algs.test.js:48 test path expect(i(provider).configuration.idTokenSigningAlgValues).to.eql(['HS256', 'RS256']);
71. test/core/implicit/implicit.config.js:24 test path id_token_signed_response_alg: 'RS256',
72. test/dynamic_registration/dynamic_registration.test.js:36 test path expect(response.body).to.have.property('id_token_signed_response_alg', 'RS256');
73. test/dynamic_registration/dynamic_registration.test.js:534 test path expect(response.body).to.have.property('id_token_signed_response_alg', 'RS256');
74. test/encryption/encryption.config.js:37 test path userinfo_signed_response_alg: 'RS256',
75. test/encryption/encryption.test.js:129 test path client.userinfoSignedResponseAlg = 'RS256';
76. test/external_signing/external_signing.config.js:111 test path id_token_signed_response_alg: 'RS256',
77. test/formats/jwt.test.js:99 test path expect(header).to.have.property('alg', 'RS256');
78. test/formats/jwt.test.js:100 test path expect(header).to.have.property('kid', i(this.provider).keystore.selectForSign({ alg: 'RS256' })[0].kid);
79. test/formats/jwt.test.js:115 test path expect(header).to.have.property('alg', 'RS256');
80. test/formats/jwt.test.js:116 test path expect(header).to.have.property('kid', i(this.provider).keystore.selectForSign({ alg: 'RS256' })[0].kid);
81. test/formats/jwt.test.js:122 test path const [source] = keystore.selectForSign({ alg: 'RS256' });
82. test/formats/jwt.test.js:133 test path sign: { alg: 'RS256', kid: jwk.kid },
83. test/jwks/jwks-enc.config.js:30 test path alg: 'RS256',
84. test/jwks/jwks-noenc.config.js:30 test path alg: 'RS256',
85. test/jwks/jwks_uri.test.js:30 test path alg: 'RS256',
86. test/jwks/jwks_uri.test.js:95 test path alg: 'RS256',
87. test/jwt/jsonwebtoken.test.js:91 test path const { privateKey, publicKey } = await generateKeyPair('RS256');
88. test/jwt/jsonwebtoken.test.js:93 test path return JWT.sign({ data: true }, privateKey, 'RS256')
89. test/jwt/jsonwebtoken.test.js:96 test path expect(decoded.header).to.have.property('alg', 'RS256');
90. test/jwt_introspection/jwt_introspection.config.js:18 test path introspection_signed_response_alg: 'RS256',
91. test/keys.js:13 test path generate('RS256'),
92. test/openid4vci/openid4vci.test.js:2421 test path for (const alg of ['RS256', 'Ed25519']) {
93. test/registration_management/registration_management.test.js:102 test path const client = await setup.call(this, { userinfo_signed_response_alg: 'RS256' });
94. test/registration_management/registration_management.test.js:130 test path const client = await setup.call(this, { userinfo_signed_response_alg: 'RS256' });
95. test/signatures/signatures.test.js:73 test path this.client.idTokenSignedResponseAlg = 'RS256';
96. test/signatures/signatures.test.js:122 test path this.client.idTokenSignedResponseAlg = 'RS512';
97. test/signatures/signatures.test.js:141 test path this.client.idTokenSignedResponseAlg = 'RS384';
98. test/signatures/signatures.test.js:160 test path this.client.idTokenSignedResponseAlg = 'RS256';

jose.algorithm · CWE-327

RSA-OAEP Quantum-vulnerable Recorded traffic 71 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. lib/consts/jwa.js:17 'RSA-OAEP',
2. lib/consts/jwa.js:18 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512',
3. lib/helpers/defaults.js:3580 'RSA-OAEP',
4. lib/helpers/defaults.js:3581 'RSA-OAEP-256',
5. lib/helpers/defaults.js:3609 'RSA-OAEP',
6. lib/helpers/defaults.js:3610 'RSA-OAEP-256',
7. lib/helpers/defaults.js:3638 'RSA-OAEP',
8. lib/helpers/defaults.js:3639 'RSA-OAEP-256',
9. lib/helpers/defaults.js:3668 'RSA-OAEP',
10. lib/helpers/defaults.js:3669 'RSA-OAEP-256',
11. lib/helpers/defaults.js:3698 'RSA-OAEP',
12. lib/helpers/defaults.js:3699 'RSA-OAEP-256',
13. lib/helpers/initialize_keystore.js:112 available = ['RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512'];
14. test/configuration/client_metadata.test.js:1064 test path 'RSA-OAEP',
15. test/configuration/client_metadata.test.js:1065 test path 'RSA-OAEP-256',
16. test/configuration/client_metadata.test.js:1066 test path 'RSA-OAEP-384',
17. test/configuration/client_metadata.test.js:1067 test path 'RSA-OAEP-512',
18. test/configuration/client_metadata.test.js:1098 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
19. test/configuration/client_metadata.test.js:1107 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
20. test/configuration/client_metadata.test.js:1118 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
21. test/configuration/client_metadata.test.js:1138 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
22. test/configuration/client_metadata.test.js:1170 test path 'RSA-OAEP',
23. test/configuration/client_metadata.test.js:1171 test path 'RSA-OAEP-256',
24. test/configuration/client_metadata.test.js:1172 test path 'RSA-OAEP-384',
25. test/configuration/client_metadata.test.js:1173 test path 'RSA-OAEP-512',
26. test/configuration/client_metadata.test.js:1198 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
27. test/configuration/client_metadata.test.js:1208 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
28. test/configuration/client_metadata.test.js:1220 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
29. test/configuration/client_metadata.test.js:1242 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
30. test/configuration/client_metadata.test.js:1275 test path 'RSA-OAEP',
31. test/configuration/client_metadata.test.js:1276 test path 'RSA-OAEP-256',
32. test/configuration/client_metadata.test.js:1277 test path 'RSA-OAEP-384',
33. test/configuration/client_metadata.test.js:1278 test path 'RSA-OAEP-512',
34. test/configuration/client_metadata.test.js:1303 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
35. test/configuration/client_metadata.test.js:1312 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
36. test/configuration/client_metadata.test.js:1323 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
37. test/configuration/client_metadata.test.js:1343 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
38. test/configuration/client_metadata.test.js:1375 test path 'RSA-OAEP',
39. test/configuration/client_metadata.test.js:1376 test path 'RSA-OAEP-256',
40. test/configuration/client_metadata.test.js:1377 test path 'RSA-OAEP-384',
41. test/configuration/client_metadata.test.js:1378 test path 'RSA-OAEP-512',
42. test/configuration/client_metadata.test.js:1403 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
43. test/configuration/client_metadata.test.js:1412 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
44. test/configuration/client_metadata.test.js:1423 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
45. test/configuration/client_metadata.test.js:1443 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
46. test/configuration/client_metadata.test.js:1479 test path 'RSA-OAEP',
47. test/configuration/client_metadata.test.js:1480 test path 'RSA-OAEP-256',
48. test/configuration/client_metadata.test.js:1481 test path 'RSA-OAEP-384',
49. test/configuration/client_metadata.test.js:1482 test path 'RSA-OAEP-512',
50. test/configuration/client_metadata.test.js:1507 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
51. test/configuration/client_metadata.test.js:1515 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
52. test/configuration/client_metadata.test.js:1525 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
53. test/configuration/client_metadata.test.js:1544 test path [this.title.replace(/(enc$)/, 'alg')]: 'RSA-OAEP',
54. test/configuration/client_metadata.test.js:1891 test path ['RSA-OAEP', 'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW'].forEach(
55. test/encryption/encryption.config.js:18 test path pull(config.enabledJWA.requestObjectEncryptionAlgValues, 'RSA-OAEP-512');
56. test/encryption/encryption.config.js:21 test path export const keypair = await generateKeyPair('RSA-OAEP');
57. test/encryption/encryption.config.js:33 test path id_token_encrypted_response_alg: 'RSA-OAEP',
58. test/encryption/encryption.config.js:35 test path request_object_encryption_alg: 'RSA-OAEP',
59. test/encryption/encryption.config.js:38 test path userinfo_encrypted_response_alg: 'RSA-OAEP',
60. test/encryption/encryption.test.js:154 test path client.userinfoEncryptedResponseAlg = 'RSA-OAEP';
61. test/encryption/encryption.test.js:177 test path let [key] = i(this.provider).keystore.selectForEncrypt({ kty: 'RSA', alg: 'RSA-OAEP-512' });
62. test/encryption/encryption.test.js:181 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'RSA-OAEP-512' })
63. test/encryption/encryption.test.js:208 test path let [key] = i(this.provider).keystore.selectForEncrypt({ kty: 'RSA', alg: 'RSA-OAEP-512' });
64. test/encryption/encryption.test.js:212 test path .setProtectedHeader({ enc: 'A192CBC-HS384', alg: 'RSA-OAEP-512' })
65. test/encryption/encryption.test.js:244 test path let [key] = i(this.provider).keystore.selectForEncrypt({ kty: 'RSA', alg: 'RSA-OAEP' });
66. test/encryption/encryption.test.js:248 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'RSA-OAEP' })
67. test/encryption/encryption.test.js:285 test path let [key] = i(this.provider).keystore.selectForEncrypt({ kty: 'RSA', alg: 'RSA-OAEP' });
68. test/encryption/encryption.test.js:289 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'RSA-OAEP' })
69. test/encryption/encryption.test.js:329 test path client.idTokenEncryptedResponseAlg = 'RSA-OAEP';
70. test/jwks/jwks-enc.config.js:42 test path alg: 'RSA-OAEP',
71. test/jwks/jwks_uri.test.js:38 test path alg: 'RSA-OAEP',

jose.algorithm · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable Renamed import 59 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. certification/oidc/configuration.js:90 crv: 'Ed25519',
2. lib/consts/jwa.js:6 'Ed25519', 'EdDSA',
3. lib/helpers/defaults.js:3433 'Ed25519',
4. lib/helpers/defaults.js:3434 'EdDSA',
5. lib/helpers/defaults.js:3455 idTokenSigningAlgValues: ['RS256', 'PS256', 'ES256', 'Ed25519', 'EdDSA'],
6. lib/helpers/defaults.js:3480 'Ed25519',
7. lib/helpers/defaults.js:3481 'EdDSA',
8. lib/helpers/defaults.js:3502 userinfoSigningAlgValues: ['RS256', 'PS256', 'ES256', 'Ed25519', 'EdDSA'],
9. lib/helpers/defaults.js:3526 'Ed25519',
10. lib/helpers/defaults.js:3527 'EdDSA',
11. lib/helpers/defaults.js:3552 'Ed25519',
12. lib/helpers/defaults.js:3553 'EdDSA',
13. lib/helpers/defaults.js:3820 dPoPSigningAlgValues: ['ES256', 'Ed25519', 'EdDSA'],
14. lib/helpers/defaults.js:3839 attestSigningAlgValues: ['ES256', 'Ed25519', 'EdDSA'],
15. lib/helpers/initialize_keystore.js:74 case 'Ed25519':
16. lib/helpers/initialize_keystore.js:75 available = ['EdDSA', 'Ed25519'];
17. lib/helpers/keystore.js:116 case 'EdDSA':
18. lib/helpers/keystore.js:117 case 'Ed25519': return 'Ed25519';
19. lib/models/client.js:28 const OKP_SUBTYPES = new Set(['Ed25519', 'X25519']);
20. lib/models/id_token.js:29 case 'Ed25519':
21. lib/models/id_token.js:30 case 'EdDSA': // alias for Ed25519, Ed448 is not supported
22. test/attest_bindings/attest_bindings.test.js:24 test path alg: 'Ed25519',
23. test/attest_bindings/attest_bindings.test.js:36 test path alg: 'Ed25519',
24. test/client_auth/client_auth.test.js:75 test path alg: 'Ed25519',
25. test/client_auth/client_auth.test.js:193 test path 'Ed25519',
26. test/client_auth/client_auth.test.js:194 test path 'EdDSA',
27. test/client_auth/client_auth.test.js:226 test path 'Ed25519',
28. test/client_auth/client_auth.test.js:227 test path 'EdDSA',
29. test/client_auth/client_auth.test.js:1471 test path alg: 'Ed25519',
30. test/client_auth/client_auth.test.js:1494 test path alg: 'Ed25519',
31. test/client_auth/client_auth.test.js:1633 test path alg: 'Ed25519',
32. test/client_auth/client_auth.test.js:1664 test path alg: 'Ed25519',
33. test/client_auth/client_auth.test.js:1687 test path alg: 'Ed25519',
34. test/client_auth/client_auth.test.js:1710 test path alg: 'Ed25519',
35. test/client_auth/client_auth.test.js:1735 test path alg: 'Ed25519',
36. test/client_auth/client_auth.test.js:1744 test path alg: 'Ed25519',
37. test/client_auth/client_auth.test.js:1753 test path alg: 'Ed25519',
38. test/client_auth/client_auth.test.js:1762 test path alg: 'Ed25519',
39. test/client_auth/client_auth.test.js:1771 test path alg: 'Ed25519',
40. test/client_auth/client_auth.test.js:1780 test path alg: 'Ed25519',
41. test/client_auth/client_auth.test.js:1789 test path alg: 'Ed25519',
42. test/configuration/client_metadata.test.js:690 test path 'Ed25519',
43. test/configuration/client_metadata.test.js:691 test path 'EdDSA',
44. test/configuration/client_metadata.test.js:1653 test path 'Ed25519',
45. test/configuration/client_metadata.test.js:1654 test path 'EdDSA',
46. test/configuration/client_metadata.test.js:1826 test path [[{ kty: 'OKP', crv: 'Ed25519' }], 'jwks.keys[0].x must be a non-empty string for OKP keys'],
47. test/configuration/client_metadata.test.js:1827 test path [[{ kty: 'OKP', crv: 'Ed25519', x: 'x', d: 'd' }], 'jwks.keys[0].d must not be provided for OKP keys'],
48. test/configuration/client_metadata.test.js:1873 test path for (const alg of ['RS256', 'PS384', 'ES512', 'Ed25519', 'EdDSA', ...pqc]) {
49. test/configuration/keystore_configuration.test.js:43 test path const { publicKey } = await generateKeyPair('EdDSA');
50. test/jwt/jsonwebtoken.test.js:113 test path const { privateKey, publicKey } = await generateKeyPair('EdDSA');
51. test/jwt/jsonwebtoken.test.js:115 test path return JWT.sign({ data: true }, privateKey, 'EdDSA')
52. test/jwt/jsonwebtoken.test.js:118 test path expect(decoded.header).to.have.property('alg', 'EdDSA');
53. test/jwt/jsonwebtoken.test.js:124 test path const { privateKey, publicKey } = await generateKeyPair('Ed25519');
54. test/jwt/jsonwebtoken.test.js:126 test path return JWT.sign({ data: true }, privateKey, 'Ed25519')
55. test/jwt/jsonwebtoken.test.js:129 test path expect(decoded.header).to.have.property('alg', 'Ed25519');
56. test/keys.js:15 test path generate('EdDSA'),
57. test/keys.js:16 test path generate('Ed25519'),
58. test/openid4vci/openid4vci.test.js:2421 test path for (const alg of ['RS256', 'Ed25519']) {
59. test/signatures/signatures.test.js:77 test path for (const alg of ['Ed25519', 'EdDSA']) {

jose.algorithm · CWE-327

RSA-PSS Quantum-vulnerable 46 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. certification/fapi/index.js:27 const ALGS = ['PS256'];
2. certification/fapi/index.js:285 alg: 'PS256',
3. certification/fapi/index.js:307 authorization_signed_response_alg: 'PS256',
4. certification/fapi/index.js:308 id_token_signed_response_alg: 'PS256',
5. certification/fapi/index.js:309 request_object_signing_alg: 'PS256',
6. certification/fapi/plan.json:24 "alg": "PS256",
7. certification/fapi/plan.json:55 "alg": "PS256",
8. lib/consts/jwa.js:4 'PS256', 'PS384', 'PS512',
9. lib/helpers/defaults.js:3431 'PS256',
10. lib/helpers/defaults.js:3455 idTokenSigningAlgValues: ['RS256', 'PS256', 'ES256', 'Ed25519', 'EdDSA'],
11. lib/helpers/defaults.js:3478 'PS256',
12. lib/helpers/defaults.js:3502 userinfoSigningAlgValues: ['RS256', 'PS256', 'ES256', 'Ed25519', 'EdDSA'],
13. lib/helpers/defaults.js:3524 'PS256',
14. lib/helpers/defaults.js:3550 'PS256',
15. lib/helpers/initialize_keystore.js:56 available = ['PS256', 'PS384', 'PS512', 'RS256', 'RS384', 'RS512'];
16. lib/models/id_token.js:16 case 'PS256':
17. lib/models/id_token.js:21 case 'PS384':
18. lib/models/id_token.js:26 case 'PS512':
19. test/client_auth/client_auth.test.js:128 test path clientAuthSigningAlgValues: ['PS256'],
20. test/client_auth/client_auth.test.js:187 test path 'PS256',
21. test/client_auth/client_auth.test.js:188 test path 'PS384',
22. test/client_auth/client_auth.test.js:189 test path 'PS512',
23. test/client_auth/client_auth.test.js:220 test path 'PS256',
24. test/client_auth/client_auth.test.js:221 test path 'PS384',
25. test/client_auth/client_auth.test.js:222 test path 'PS512',
26. test/configuration/client_metadata.test.js:684 test path 'PS256',
27. test/configuration/client_metadata.test.js:685 test path 'PS384',
28. test/configuration/client_metadata.test.js:686 test path 'PS512',
29. test/configuration/client_metadata.test.js:1647 test path 'PS256',
30. test/configuration/client_metadata.test.js:1648 test path 'PS384',
31. test/configuration/client_metadata.test.js:1649 test path 'PS512',
32. test/configuration/client_metadata.test.js:1873 test path for (const alg of ['RS256', 'PS384', 'ES512', 'Ed25519', 'EdDSA', ...pqc]) {
33. test/configuration/client_metadata.test.js:2119 test path defaultsTo('id_token_signed_response_alg', 'PS256', undefined, {
34. test/configuration/client_metadata.test.js:2121 test path id_token_signed_response_alg: 'PS256',
35. test/configuration/client_metadata.test.js:2152 test path const supported = ['PS256', 'ES256', 'RS256'];
36. test/configuration/client_metadata.test.js:2156 test path id_token_signing_alg_values_supported: ['PS256', 'RS256', 'ES256'],
37. test/dpop/dpop.config.js:7 test path config.enabledJWA.dPoPSigningAlgValues = ['ES256', 'PS256'];
38. test/dpop/dpop.test.js:47 test path expect(response.body).to.have.deep.property('dpop_signing_alg_values_supported', ['ES256', 'PS256']);
39. test/formats/jwt.test.js:76 test path sign: { alg: 'PS256' },
40. test/formats/jwt.test.js:85 test path expect(header).to.have.property('alg', 'PS256');
41. test/formats/jwt.test.js:373 test path alg: 'PS256',
42. test/formats/jwt.test.js:402 test path alg: 'PS256',
43. test/registration_policies/registration_policies.test.js:95 test path id_token_signed_response_alg: 'PS256',
44. test/registration_policies/registration_policies.test.js:99 test path expect(body).to.have.property('id_token_signed_response_alg', 'PS256');
45. test/registration_policies/registration_policies.test.js:120 test path id_token_signed_response_alg: 'PS256',
46. test/registration_policies/registration_policies.test.js:142 test path id_token_signed_response_alg: 'PS256',

jose.algorithm · CWE-327

ECDH Quantum-vulnerable Recorded traffic 41 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. lib/consts/jwa.js:19 'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW',
2. lib/helpers/defaults.js:3579 'ECDH-ES',
3. lib/helpers/defaults.js:3608 'ECDH-ES',
4. lib/helpers/defaults.js:3637 'ECDH-ES',
5. lib/helpers/defaults.js:3667 'ECDH-ES',
6. lib/helpers/defaults.js:3697 'ECDH-ES',
7. lib/helpers/initialize_keystore.js:119 available = ['ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW'];
8. lib/helpers/initialize_keystore.js:127 available = ['ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW'];
9. test/configuration/client_keystore.test.js:44 test path id_token_encrypted_response_alg: 'ECDH-ES+A128KW',
10. test/configuration/client_metadata.test.js:1068 test path 'ECDH-ES',
11. test/configuration/client_metadata.test.js:1069 test path 'ECDH-ES+A128KW',
12. test/configuration/client_metadata.test.js:1070 test path 'ECDH-ES+A192KW',
13. test/configuration/client_metadata.test.js:1071 test path 'ECDH-ES+A256KW',
14. test/configuration/client_metadata.test.js:1174 test path 'ECDH-ES',
15. test/configuration/client_metadata.test.js:1175 test path 'ECDH-ES+A128KW',
16. test/configuration/client_metadata.test.js:1176 test path 'ECDH-ES+A192KW',
17. test/configuration/client_metadata.test.js:1177 test path 'ECDH-ES+A256KW',
18. test/configuration/client_metadata.test.js:1279 test path 'ECDH-ES',
19. test/configuration/client_metadata.test.js:1280 test path 'ECDH-ES+A128KW',
20. test/configuration/client_metadata.test.js:1281 test path 'ECDH-ES+A192KW',
21. test/configuration/client_metadata.test.js:1282 test path 'ECDH-ES+A256KW',
22. test/configuration/client_metadata.test.js:1379 test path 'ECDH-ES',
23. test/configuration/client_metadata.test.js:1380 test path 'ECDH-ES+A128KW',
24. test/configuration/client_metadata.test.js:1381 test path 'ECDH-ES+A192KW',
25. test/configuration/client_metadata.test.js:1382 test path 'ECDH-ES+A256KW',
26. test/configuration/client_metadata.test.js:1483 test path 'ECDH-ES',
27. test/configuration/client_metadata.test.js:1484 test path 'ECDH-ES+A128KW',
28. test/configuration/client_metadata.test.js:1485 test path 'ECDH-ES+A192KW',
29. test/configuration/client_metadata.test.js:1486 test path 'ECDH-ES+A256KW',
30. test/configuration/client_metadata.test.js:1891 test path ['RSA-OAEP', 'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW'].forEach(
31. test/encryption/encryption.test.js:320 test path client.idTokenEncryptedResponseAlg = 'ECDH-ES';
32. test/formats/jwt.test.js:376 test path alg: 'ECDH-ES',
33. test/formats/jwt.test.js:388 test path expect(header).to.have.property('alg', 'ECDH-ES');
34. test/formats/jwt.test.js:405 test path alg: 'ECDH-ES',
35. test/formats/jwt.test.js:428 test path alg: 'ECDH-ES',
36. test/formats/jwt.test.js:440 test path expect(header).to.have.property('alg', 'ECDH-ES');
37. test/formats/jwt.test.js:577 test path alg: 'ECDH-ES',
38. test/jwks/jwks-enc.config.js:57 test path alg: 'ECDH-ES',
39. test/jwks/jwks_uri.test.js:54 test path alg: 'ECDH-ES',
40. test/openid4vci/openid4vci.test.js:224 test path alg_values_supported: ['ECDH-ES'],
41. test/openid4vci/openid4vci.test.js:246 test path alg_values_supported: ['ECDH-ES'],

jose.algorithm · CWE-327

ECDSA Quantum-vulnerable 33 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. test/ciba/ciba.test.js:946 test path }).setProtectedHeader({ alg: 'ES256' })
2. test/ciba/ciba.test.js:972 test path }).setProtectedHeader({ alg: 'ES256' })
3. test/ciba/ciba.test.js:1006 test path }).setProtectedHeader({ alg: 'ES256' })
4. test/ciba/ciba.test.js:1040 test path }).setProtectedHeader({ alg: 'ES256' })
5. test/ciba/ciba.test.js:1074 test path }).setProtectedHeader({ alg: 'ES256' })
6. test/custom_grants/grant_implementations.test.js:94 test path .setProtectedHeader({ alg: 'ES256' })
7. test/custom_grants/grant_implementations.test.js:170 test path alg: 'ES256',
8. test/custom_grants/grant_implementations.test.js:225 test path { algorithms: ['ES256'], key: this.jwtKeyPair.publicKey },
9. test/dpop/dpop.test.js:27 test path }).setProtectedHeader({ alg: 'ES256', typ: 'dpop+jwt', jwk: await exportJWK(keypair.publicKey) })
10. test/dpop/dpop.test.js:123 test path alg: 'ES256',
11. test/dpop/dpop.test.js:173 test path alg: 'ES256',
12. test/dpop/dpop.test.js:197 test path alg: 'ES256',
13. test/dpop/dpop.test.js:216 test path alg: 'ES256',
14. test/dpop/dpop.test.js:232 test path .setProtectedHeader({ alg: 'ES256', typ: 'dpop+jwt', jwk: this.jwk })
15. test/dpop/dpop.test.js:246 test path .setProtectedHeader({ alg: 'ES256', typ: 'dpop+jwt', jwk: this.jwk })
16. test/dpop/dpop.test.js:261 test path .setProtectedHeader({ alg: 'ES256', typ: 'dpop+jwt', jwk: this.jwk })
17. test/dpop/dpop.test.js:292 test path .setProtectedHeader({ alg: 'ES256', typ: 'dpop+jwt', jwk: this.jwk })
18. test/fapi/fapi-final.test.js:115 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey);
19. test/fapi/fapi-final.test.js:151 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey);
20. test/fapi/fapi-final.test.js:184 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey);
21. test/fapi/fapi-final.test.js:218 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey);
22. test/fapi/fapi-final.test.js:252 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey);
23. test/fapi/fapi2.test.js:88 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey),
24. test/fapi/fapi2.test.js:164 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey);
25. test/fapi/fapi2.test.js:195 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey);
26. test/fapi/fapi2.test.js:228 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey);
27. test/fapi/fapi2.test.js:261 test path }).setProtectedHeader({ alg: 'ES256' }).sign(keypair.privateKey);
28. test/formats/jwt.test.js:535 test path alg: 'ES512',
29. test/jwks/jwks_uri.test.js:105 test path alg: 'ES256',
30. test/openid4vci/openid4vci.test.js:114 test path .setProtectedHeader({ alg: 'ES256', typ: 'dpop+jwt', jwk: await exportJWK(keypair.publicKey) })
31. test/openid4vci/openid4vci.test.js:1662 test path alg: 'ES384',
32. test/openid4vci/openid4vci.test.js:2272 test path alg: 'ES384',
33. test/openid4vci/pre_authorized_code.test.js:194 test path alg: 'ES256',

js.jwt.algorithm · CWE-327

RSASSA-PKCS1v15 Quantum-vulnerable 20 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. lib/consts/dev_keystore.js:4 alg: 'RS256',
2. test/client_auth/client_auth.test.js:64 test path alg: 'RS256',
3. test/client_auth/client_auth.test.js:1463 test path alg: 'RS256',
4. test/client_auth/client_auth.test.js:1511 test path alg: 'RS256',
5. test/client_auth/client_auth.test.js:1523 test path alg: 'RS256',
6. test/client_auth/client_auth.test.js:1535 test path alg: 'RS256',
7. test/client_auth/client_auth.test.js:1547 test path alg: 'RS256',
8. test/client_auth/client_auth.test.js:1559 test path alg: 'RS256',
9. test/client_auth/client_auth.test.js:1571 test path alg: 'RS256',
10. test/client_auth/client_auth.test.js:1583 test path alg: 'RS256',
11. test/client_auth/client_auth.test.js:1595 test path alg: 'RS256',
12. test/client_auth/client_auth.test.js:1622 test path alg: 'RS256',
13. test/formats/jwt.test.js:100 test path expect(header).to.have.property('kid', i(this.provider).keystore.selectForSign({ alg: 'RS256' })[0].kid);
14. test/formats/jwt.test.js:116 test path expect(header).to.have.property('kid', i(this.provider).keystore.selectForSign({ alg: 'RS256' })[0].kid);
15. test/formats/jwt.test.js:122 test path const [source] = keystore.selectForSign({ alg: 'RS256' });
16. test/formats/jwt.test.js:133 test path sign: { alg: 'RS256', kid: jwk.kid },
17. test/jwks/jwks-enc.config.js:30 test path alg: 'RS256',
18. test/jwks/jwks-noenc.config.js:30 test path alg: 'RS256',
19. test/jwks/jwks_uri.test.js:30 test path alg: 'RS256',
20. test/jwks/jwks_uri.test.js:95 test path alg: 'RS256',

js.jwt.algorithm · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable 16 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. test/attest_bindings/attest_bindings.test.js:24 test path alg: 'Ed25519',
2. test/attest_bindings/attest_bindings.test.js:36 test path alg: 'Ed25519',
3. test/client_auth/client_auth.test.js:75 test path alg: 'Ed25519',
4. test/client_auth/client_auth.test.js:1471 test path alg: 'Ed25519',
5. test/client_auth/client_auth.test.js:1494 test path alg: 'Ed25519',
6. test/client_auth/client_auth.test.js:1633 test path alg: 'Ed25519',
7. test/client_auth/client_auth.test.js:1664 test path alg: 'Ed25519',
8. test/client_auth/client_auth.test.js:1687 test path alg: 'Ed25519',
9. test/client_auth/client_auth.test.js:1710 test path alg: 'Ed25519',
10. test/client_auth/client_auth.test.js:1735 test path alg: 'Ed25519',
11. test/client_auth/client_auth.test.js:1744 test path alg: 'Ed25519',
12. test/client_auth/client_auth.test.js:1753 test path alg: 'Ed25519',
13. test/client_auth/client_auth.test.js:1762 test path alg: 'Ed25519',
14. test/client_auth/client_auth.test.js:1771 test path alg: 'Ed25519',
15. test/client_auth/client_auth.test.js:1780 test path alg: 'Ed25519',
16. test/client_auth/client_auth.test.js:1789 test path alg: 'Ed25519',

js.jwt.algorithm · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable Renamed import 12 places See details

Classical key pair generated with Node crypto

`crypto.generateKeyPair()` or its synchronous form. The detector resolves the algorithm through a `promisify()` wrapper and through an import alias, both of which are common enough that missing them would leave real key generation unreported.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Node exposes neither yet, so this usually means an addon or a service boundary.

1. test/attest_bindings/attest_bindings.config.js:9 test path const attestationKeyPair = generateKeyPairSync('ed25519');
2. test/attest_bindings/attest_bindings.test.js:62 test path const instanceKeyPair = generateKeyPairSync('ed25519');
3. test/attest_bindings/attest_bindings.test.js:98 test path const instanceKeyPair2 = generateKeyPairSync('ed25519');
4. test/attest_bindings/attest_bindings.test.js:172 test path const instanceKeyPair = generateKeyPairSync('ed25519');
5. test/attest_bindings/attest_bindings.test.js:211 test path const instanceKeyPair = generateKeyPairSync('ed25519');
6. test/attest_bindings/attest_bindings.test.js:238 test path const instanceKeyPair2 = generateKeyPairSync('ed25519');
7. test/attest_bindings/attest_bindings.test.js:268 test path const instanceKeyPair = generateKeyPairSync('ed25519');
8. test/attest_bindings/attest_bindings.test.js:290 test path const instanceKeyPair2 = generateKeyPairSync('ed25519');
9. test/attest_bindings/attest_bindings.test.js:320 test path const instanceKeyPair = generateKeyPairSync('ed25519');
10. test/attest_bindings/attest_bindings.test.js:343 test path const instanceKeyPair2 = generateKeyPairSync('ed25519');
11. test/client_auth/client_auth.test.js:1293 test path const instanceKeyPair = generateKeyPairSync('ed25519');
12. test/client_auth/client_auth.test.js:1452 test path const instanceKeyPair = generateKeyPairSync('ed25519');

js.generatekeypair · CWE-327

RSA-OAEP Quantum-vulnerable Recorded traffic 10 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. test/encryption/encryption.test.js:177 test path let [key] = i(this.provider).keystore.selectForEncrypt({ kty: 'RSA', alg: 'RSA-OAEP-512' });
2. test/encryption/encryption.test.js:181 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'RSA-OAEP-512' })
3. test/encryption/encryption.test.js:208 test path let [key] = i(this.provider).keystore.selectForEncrypt({ kty: 'RSA', alg: 'RSA-OAEP-512' });
4. test/encryption/encryption.test.js:212 test path .setProtectedHeader({ enc: 'A192CBC-HS384', alg: 'RSA-OAEP-512' })
5. test/encryption/encryption.test.js:244 test path let [key] = i(this.provider).keystore.selectForEncrypt({ kty: 'RSA', alg: 'RSA-OAEP' });
6. test/encryption/encryption.test.js:248 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'RSA-OAEP' })
7. test/encryption/encryption.test.js:285 test path let [key] = i(this.provider).keystore.selectForEncrypt({ kty: 'RSA', alg: 'RSA-OAEP' });
8. test/encryption/encryption.test.js:289 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'RSA-OAEP' })
9. test/jwks/jwks-enc.config.js:42 test path alg: 'RSA-OAEP',
10. test/jwks/jwks_uri.test.js:38 test path alg: 'RSA-OAEP',

js.jwt.algorithm · CWE-327

ECDH256-bitsecg/secp256r1 Quantum-vulnerable Recorded traffic Renamed import 8 places See details

Classical key pair generated with Node crypto

`crypto.generateKeyPair()` or its synchronous form. The detector resolves the algorithm through a `promisify()` wrapper and through an import alias, both of which are common enough that missing them would leave real key generation unreported.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Node exposes neither yet, so this usually means an addon or a service boundary.

1. test/external_signing/external_signing.config.js:8 test path const es256 = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
2. test/formats/jwt.test.js:378 test path key: (await generateKeyPair('ec', { namedCurve: 'P-256' })).publicKey,
3. test/formats/jwt.test.js:407 test path key: (await generateKeyPair('ec', { namedCurve: 'P-256' })).publicKey,
4. test/formats/jwt.test.js:430 test path key: (await generateKeyPair('ec', { namedCurve: 'P-256' })).publicKey,
5. test/formats/jwt.test.js:494 test path key: (await generateKeyPair('ec', { namedCurve: 'P-256' })).publicKey,
6. test/formats/jwt.test.js:515 test path key: (await generateKeyPair('ec', { namedCurve: 'P-256' })).privateKey,
7. test/formats/jwt.test.js:557 test path key: (await generateKeyPair('ec', { namedCurve: 'P-256' })).privateKey,
8. test/formats/jwt.test.js:579 test path key: (await generateKeyPair('ec', { namedCurve: 'P-256' })).publicKey,

js.generatekeypair · CWE-327

ECDH Quantum-vulnerable Recorded traffic 6 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. test/formats/jwt.test.js:376 test path alg: 'ECDH-ES',
2. test/formats/jwt.test.js:405 test path alg: 'ECDH-ES',
3. test/formats/jwt.test.js:428 test path alg: 'ECDH-ES',
4. test/formats/jwt.test.js:577 test path alg: 'ECDH-ES',
5. test/jwks/jwks-enc.config.js:57 test path alg: 'ECDH-ES',
6. test/jwks/jwks_uri.test.js:54 test path alg: 'ECDH-ES',

js.jwt.algorithm · CWE-327

RSA-PSS Quantum-vulnerable 4 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. certification/fapi/index.js:285 alg: 'PS256',
2. test/formats/jwt.test.js:76 test path sign: { alg: 'PS256' },
3. test/formats/jwt.test.js:373 test path alg: 'PS256',
4. test/formats/jwt.test.js:402 test path alg: 'PS256',

js.jwt.algorithm · CWE-327

RSA Quantum-vulnerable Recorded traffic 3 places See details

Public key declared as a JSON Web Key

A `kty` field, with the curve read from the sibling `crv` where the family needs one. A JWKS document declares a key without naming an algorithm anywhere, so it is invisible to a scan that only looks for `alg`.

This file publishes the public keys other systems use to check this system's signatures. Everyone who trusts these keys has to accept the new kind of key before the old ones can be retired.

What to do. A published JWKS is what relying parties trust. It has to accept a post-quantum key type before the keys behind it can change, so put it early in the migration order.

1. certification/fapi/plan.json:22 "kty": "RSA",
2. certification/fapi/plan.json:53 "kty": "RSA",
3. test/jwks/jwks.json:14 test path "kty": "RSA",

jose.jwk · CWE-327

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 2 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. test/jwks/client.crt:1 test path -----BEGIN CERTIFICATE-----
2. test/jwks/ec.crt:1 test path -----BEGIN CERTIFICATE-----

pem.certificate

RSA Quantum-vulnerable Recorded traffic Renamed import 2 places See details

One-shot signing or public-key encryption

`crypto.sign()`, `crypto.verify()`, `privateEncrypt()`, `publicDecrypt()`, `privateDecrypt()` or `publicEncrypt()`. These take the key at runtime, so the algorithm follows the key; every key type Node accepts here is classical.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures.

1. test/external_signing/external_signing.config.js:25 test path return crypto.sign('sha256', data, {
2. test/external_signing/external_signing.config.js:74 test path return crypto.sign('sha384', data, {

js.node.oneshot · CWE-327

ECDH384-bitsecg/secp384r1 Quantum-vulnerable Recorded traffic Renamed import 1 place See details

Classical key pair generated with Node crypto

`crypto.generateKeyPair()` or its synchronous form. The detector resolves the algorithm through a `promisify()` wrapper and through an import alias, both of which are common enough that missing them would leave real key generation unreported.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Node exposes neither yet, so this usually means an addon or a service boundary.

1. test/external_signing/external_signing.config.js:9 test path const es384 = crypto.generateKeyPairSync('ec', { namedCurve: 'P-384' });

js.generatekeypair · CWE-327

ECDSA Quantum-vulnerable 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. test/jwks/ec.key:1 test path -----BEGIN EC PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 1 place See details

Public key declared as a JSON Web Key

A `kty` field, with the curve read from the sibling `crv` where the family needs one. A JWKS document declares a key without naming an algorithm anywhere, so it is invisible to a scan that only looks for `alg`.

This file publishes the public keys other systems use to check this system's signatures. Everyone who trusts these keys has to accept the new kind of key before the old ones can be retired.

What to do. A published JWKS is what relying parties trust. It has to accept a post-quantum key type before the keys behind it can change, so put it early in the migration order.

1. test/jwks/jwks.json:4 test path "kty": "EC",

jose.jwk · CWE-327

RSA2048-bit Quantum-vulnerable Recorded traffic Renamed import 1 place See details

Classical key pair generated with Node crypto

`crypto.generateKeyPair()` or its synchronous form. The detector resolves the algorithm through a `promisify()` wrapper and through an import alias, both of which are common enough that missing them would leave real key generation unreported.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Node exposes neither yet, so this usually means an addon or a service boundary.

1. test/external_signing/external_signing.config.js:10 test path const rs256 = crypto.generateKeyPairSync('rsa', { modulusLength: 2048 });

js.generatekeypair · CWE-327

RSA2048-bit Quantum-vulnerable 1 place See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. test/jwks/rsa.crt:1 test path -----BEGIN CERTIFICATE-----

pem.certificate

RSA Quantum-vulnerable Recorded traffic 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. test/jwks/rsa.key:1 test path -----BEGIN RSA PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

AES-128 Reduced margin 85 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Grover's algorithm halves the effective strength; the parameter, not the design, is the problem.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. certification/fapi/index.js:333 enc: 'A128CBC-HS256',
2. lib/consts/client_attributes.js:130 authorization_encrypted_response_enc: ['authorization_encrypted_response_alg', 'A128CBC-HS256'],
3. lib/consts/client_attributes.js:131 id_token_encrypted_response_enc: ['id_token_encrypted_response_alg', 'A128CBC-HS256'],
4. lib/consts/client_attributes.js:132 introspection_encrypted_response_enc: ['introspection_encrypted_response_alg', 'A128CBC-HS256'],
5. lib/consts/client_attributes.js:133 request_object_encryption_enc: ['request_object_encryption_alg', 'A128CBC-HS256'],
6. lib/consts/client_attributes.js:134 userinfo_encrypted_response_enc: ['userinfo_encrypted_response_alg', 'A128CBC-HS256'],
7. lib/consts/jwa.js:21 'A128GCMKW', 'A192GCMKW', 'A256GCMKW', 'A128KW', 'A192KW', 'A256KW',
8. lib/consts/jwa.js:27 'A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM',
9. lib/helpers/defaults.js:3577 'A128KW',
10. lib/helpers/defaults.js:3606 'A128KW',
11. lib/helpers/defaults.js:3635 'A128KW',
12. lib/helpers/defaults.js:3665 'A128KW',
13. lib/helpers/defaults.js:3695 'A128KW',
14. lib/helpers/defaults.js:3717 'A128CBC-HS256',
15. lib/helpers/defaults.js:3718 'A128GCM',
16. lib/helpers/defaults.js:3737 'A128CBC-HS256',
17. lib/helpers/defaults.js:3738 'A128GCM',
18. lib/helpers/defaults.js:3757 'A128CBC-HS256',
19. lib/helpers/defaults.js:3758 'A128GCM',
20. lib/helpers/defaults.js:3777 'A128CBC-HS256',
21. lib/helpers/defaults.js:3778 'A128GCM',
22. lib/helpers/defaults.js:3797 'A128CBC-HS256',
23. lib/helpers/defaults.js:3798 'A128GCM',
24. test/configuration/client_keystore.test.js:45 test path id_token_encrypted_response_enc: 'A128CBC-HS256',
25. test/configuration/client_metadata.test.js:1072 test path 'A128GCMKW',
26. test/configuration/client_metadata.test.js:1075 test path 'A128KW',
27. test/configuration/client_metadata.test.js:1096 test path 'A128CBC-HS256',
28. test/configuration/client_metadata.test.js:1112 test path ['A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM'].forEach(
29. test/configuration/client_metadata.test.js:1178 test path 'A128GCMKW',
30. test/configuration/client_metadata.test.js:1181 test path 'A128KW',
31. test/configuration/client_metadata.test.js:1196 test path 'A128CBC-HS256',
32. test/configuration/client_metadata.test.js:1214 test path ['A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM'].forEach(
33. test/configuration/client_metadata.test.js:1283 test path 'A128GCMKW',
34. test/configuration/client_metadata.test.js:1286 test path 'A128KW',
35. test/configuration/client_metadata.test.js:1301 test path 'A128CBC-HS256',
36. test/configuration/client_metadata.test.js:1317 test path ['A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM'].forEach(
37. test/configuration/client_metadata.test.js:1383 test path 'A128GCMKW',
38. test/configuration/client_metadata.test.js:1386 test path 'A128KW',
39. test/configuration/client_metadata.test.js:1401 test path 'A128CBC-HS256',
40. test/configuration/client_metadata.test.js:1417 test path ['A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM'].forEach(
41. test/configuration/client_metadata.test.js:1487 test path 'A128GCMKW',
42. test/configuration/client_metadata.test.js:1490 test path 'A128KW',
43. test/configuration/client_metadata.test.js:1505 test path 'A128CBC-HS256',
44. test/configuration/client_metadata.test.js:1519 test path ['A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM'].forEach(
45. test/encryption/encryption.config.js:47 test path id_token_encrypted_response_alg: 'A128KW',
46. test/encryption/encryption.config.js:56 test path id_token_encrypted_response_alg: 'A128KW',
47. test/encryption/encryption.test.js:25 test path 'A128GCMKW', 'A192GCMKW', 'A256GCMKW', 'A128KW', 'A192KW', 'A256KW',
48. test/encryption/encryption.test.js:181 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'RSA-OAEP-512' })
49. test/encryption/encryption.test.js:248 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'RSA-OAEP' })
50. test/encryption/encryption.test.js:289 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'RSA-OAEP' })
51. test/encryption/encryption.test.js:365 test path let [key] = client.symmetricKeyStore.selectForEncrypt({ alg: 'A128KW' });
52. test/encryption/encryption.test.js:369 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'A128KW' })
53. test/encryption/encryption.test.js:401 test path let [key] = client.symmetricKeyStore.selectForEncrypt({ alg: 'A128KW' });
54. test/encryption/encryption.test.js:405 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'A128KW' })
55. test/encryption/encryption.test.js:431 test path expect(header).to.have.property('alg', 'A128KW');
56. test/encryption/encryption.test.js:463 test path let [key] = client.symmetricKeyStore.selectForEncrypt({ alg: 'A128CBC-HS256' });
57. test/encryption/encryption.test.js:467 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'dir' })
58. test/encryption/encryption.test.js:499 test path let [key] = client.symmetricKeyStore.selectForEncrypt({ alg: 'A128CBC-HS256' });
59. test/encryption/encryption.test.js:503 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'dir' })
60. test/encryption/encryption.test.js:530 test path expect(header).to.have.property('enc', 'A128CBC-HS256');
61. test/formats/jwt.test.js:212 test path enc: 'A128GCM',
62. test/formats/jwt.test.js:271 test path enc: 'A128GCM',
63. test/formats/jwt.test.js:283 test path expect(header).to.have.property('enc', 'A128GCM');
64. test/formats/jwt.test.js:298 test path enc: 'A128GCM',
65. test/formats/jwt.test.js:310 test path expect(header).to.have.property('enc', 'A128GCM');
66. test/formats/jwt.test.js:325 test path enc: 'A128GCM',
67. test/formats/jwt.test.js:337 test path expect(header).to.have.property('enc', 'A128GCM');
68. test/formats/jwt.test.js:352 test path enc: 'A128GCM',
69. test/formats/jwt.test.js:377 test path enc: 'A128GCM',
70. test/formats/jwt.test.js:389 test path expect(header).to.have.property('enc', 'A128GCM');
71. test/formats/jwt.test.js:406 test path enc: 'A128GCM',
72. test/formats/jwt.test.js:429 test path enc: 'A128GCM',
73. test/formats/jwt.test.js:441 test path expect(header).to.have.property('enc', 'A128GCM');
74. test/formats/jwt.test.js:556 test path enc: 'A128GCM',
75. test/formats/jwt.test.js:578 test path enc: 'A128GCM',
76. test/formats/jwt.test.js:601 test path enc: 'A128GCM',
77. test/jwt/jsonwebtoken.test.js:148 test path () => generateSecret('A128GCM', { extractable: true }),
78. test/jwt/jsonwebtoken.test.js:166 test path alg: 'dir', enc: 'A128GCM',
79. test/jwt/jsonwebtoken.test.js:187 test path alg: 'dir', enc: 'A128GCM',
80. test/jwt_introspection/jwt_introspection.config.js:33 test path introspection_encrypted_response_alg: 'A128KW',
81. test/jwt_introspection/jwt_introspection.test.js:173 test path expect(header).to.have.property('alg', 'A128KW');
82. test/jwt_introspection/jwt_introspection.test.js:174 test path expect(header).to.have.property('enc', 'A128CBC-HS256');
83. test/jwt_response_modes/jwt_response_modes.config.js:29 test path authorization_encrypted_response_alg: 'A128KW',
84. test/openid4vci/openid4vci.test.js:225 test path enc_values_supported: ['A128GCM'],
85. test/openid4vci/openid4vci.test.js:247 test path enc_values_supported: ['A128GCM'],

jose.algorithm · CWE-327

AES-128 Reduced margin 25 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Grover's algorithm halves the effective strength; the parameter, not the design, is the problem.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. certification/fapi/index.js:333 enc: 'A128CBC-HS256',
2. test/encryption/encryption.test.js:181 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'RSA-OAEP-512' })
3. test/encryption/encryption.test.js:248 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'RSA-OAEP' })
4. test/encryption/encryption.test.js:289 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'RSA-OAEP' })
5. test/encryption/encryption.test.js:365 test path let [key] = client.symmetricKeyStore.selectForEncrypt({ alg: 'A128KW' });
6. test/encryption/encryption.test.js:369 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'A128KW' })
7. test/encryption/encryption.test.js:401 test path let [key] = client.symmetricKeyStore.selectForEncrypt({ alg: 'A128KW' });
8. test/encryption/encryption.test.js:405 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'A128KW' })
9. test/encryption/encryption.test.js:463 test path let [key] = client.symmetricKeyStore.selectForEncrypt({ alg: 'A128CBC-HS256' });
10. test/encryption/encryption.test.js:467 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'dir' })
11. test/encryption/encryption.test.js:499 test path let [key] = client.symmetricKeyStore.selectForEncrypt({ alg: 'A128CBC-HS256' });
12. test/encryption/encryption.test.js:503 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'dir' })
13. test/formats/jwt.test.js:212 test path enc: 'A128GCM',
14. test/formats/jwt.test.js:271 test path enc: 'A128GCM',
15. test/formats/jwt.test.js:298 test path enc: 'A128GCM',
16. test/formats/jwt.test.js:325 test path enc: 'A128GCM',
17. test/formats/jwt.test.js:352 test path enc: 'A128GCM',
18. test/formats/jwt.test.js:377 test path enc: 'A128GCM',
19. test/formats/jwt.test.js:406 test path enc: 'A128GCM',
20. test/formats/jwt.test.js:429 test path enc: 'A128GCM',
21. test/formats/jwt.test.js:556 test path enc: 'A128GCM',
22. test/formats/jwt.test.js:578 test path enc: 'A128GCM',
23. test/formats/jwt.test.js:601 test path enc: 'A128GCM',
24. test/jwt/jsonwebtoken.test.js:166 test path alg: 'dir', enc: 'A128GCM',
25. test/jwt/jsonwebtoken.test.js:187 test path alg: 'dir', enc: 'A128GCM',

js.jwt.algorithm · CWE-327

AES-192 Reduced margin 20 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Grover's algorithm halves the effective strength; the parameter, not the design, is the problem.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. lib/consts/jwa.js:21 'A128GCMKW', 'A192GCMKW', 'A256GCMKW', 'A128KW', 'A192KW', 'A256KW',
2. lib/consts/jwa.js:27 'A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM',
3. test/configuration/client_metadata.test.js:1073 test path 'A192GCMKW',
4. test/configuration/client_metadata.test.js:1076 test path 'A192KW',
5. test/configuration/client_metadata.test.js:1112 test path ['A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM'].forEach(
6. test/configuration/client_metadata.test.js:1179 test path 'A192GCMKW',
7. test/configuration/client_metadata.test.js:1182 test path 'A192KW',
8. test/configuration/client_metadata.test.js:1214 test path ['A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM'].forEach(
9. test/configuration/client_metadata.test.js:1284 test path 'A192GCMKW',
10. test/configuration/client_metadata.test.js:1287 test path 'A192KW',
11. test/configuration/client_metadata.test.js:1317 test path ['A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM'].forEach(
12. test/configuration/client_metadata.test.js:1384 test path 'A192GCMKW',
13. test/configuration/client_metadata.test.js:1387 test path 'A192KW',
14. test/configuration/client_metadata.test.js:1417 test path ['A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM'].forEach(
15. test/configuration/client_metadata.test.js:1488 test path 'A192GCMKW',
16. test/configuration/client_metadata.test.js:1491 test path 'A192KW',
17. test/configuration/client_metadata.test.js:1519 test path ['A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM'].forEach(
18. test/encryption/encryption.config.js:19 test path pull(config.enabledJWA.requestObjectEncryptionEncValues, 'A192CBC-HS384');
19. test/encryption/encryption.test.js:25 test path 'A128GCMKW', 'A192GCMKW', 'A256GCMKW', 'A128KW', 'A192KW', 'A256KW',
20. test/encryption/encryption.test.js:212 test path .setProtectedHeader({ enc: 'A192CBC-HS384', alg: 'RSA-OAEP-512' })

jose.algorithm · CWE-327

SHA-256 Reduced margin Renamed import 5 places See details

Hash function in use

`createHash()` or `subtle.digest()`. The digest is read from the argument, so one rule covers the family: MD5 and SHA-1 are reported as broken, SHA-256 as a reduced margin, SHA-384 and above as inventory.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something long-lived.

1. certification/oidc/configuration.js:191 return crypto.createHash('sha256')
2. docs/type-contracts.js:579 return createHash('sha256').update(JSON.stringify(payload)).digest('hex');
3. test/introspection/introspection.config.js:18 test path .createHash('sha256')
4. test/pairwise/pairwise.config.js:13 test path .createHash('sha256')
5. test/tools/type_contracts.test.js:189 test path createHash('sha256').update(JSON.stringify(payload)).digest('hex'),

js.hash · CWE-328

AES-192 Reduced margin 1 place See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Grover's algorithm halves the effective strength; the parameter, not the design, is the problem.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. test/encryption/encryption.test.js:212 test path .setProtectedHeader({ enc: 'A192CBC-HS384', alg: 'RSA-OAEP-512' })

js.jwt.algorithm · CWE-327

SHA-256 Reduced margin Renamed import 1 place See details

Keyed hash in use

`createHmac()`. HMAC is not broken by Shor. Reported so the inventory is complete, and raised only where the underlying digest is MD5 or SHA-1 - which still appears in TOTP and in older protocol implementations.

This is a fingerprint proving a message was not altered. Quantum computers do not break it.

What to do. No action, unless the digest is MD5 or SHA-1.

1. test/request/jwt_request.test.js:761 test path const signature = crypto.createHmac('sha256', 'secret')

js.hmac

unknown Could not be determined 2 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

The algorithm could not be established from the source. Usually it is selected while the program runs, but it may equally be that the call gives no clue, or that it is decided somewhere this scan does not reach. Somebody has to check.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. test/formats/jwt.test.js:453 test path alg: 'none',
2. test/pushed_authorization_requests/pushed_authorization_requests.test.js:282 test path expect(header).to.deep.eql({ alg: 'none' });

js.jwt.algorithm · CWE-327

unknown Could not be determined 2 places See details

Key pair algorithm chosen at runtime

`generateKeyPair(x, …)` where the first argument is an identifier rather than a literal. Reported as unresolved rather than assumed.

This code picks its encryption method while it runs. A scan cannot tell which one it ends up using.

What to do. Trace the value to its configuration source and record the concrete algorithm by hand.

1. test/keys.js:8 test path const result = await generateKeyPair(alg, { extractable: true });
2. test/openid4vci/openid4vci.test.js:2423 test path const { privateKey } = await generateKeyPair(alg, { extractable: true });

js.generatekeypair.variable · CWE-327

unknown Could not be determined 1 place See details

Cryptographic library in the dependency manifest

A dependency known to implement classical asymmetric cryptography. Its presence is inventory, not a finding about this codebase: the library may never be called with a quantum-vulnerable algorithm.

The project depends on a cryptography library. Listed so the inventory is complete; it is not by itself a problem.

What to do. Check the version. Several of these libraries have shipped ML-KEM and ML-DSA support since 2024, so the migration may need an upgrade rather than a replacement.

1. package.json:62 "jose": "^6.2.10",

dep.crypto-library

HMAC Quantum-safe Renamed import 195 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. A keyed MAC is not affected by Shor and only marginally by Grover.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. lib/consts/jwa.js:2 'HS256', 'HS384', 'HS512',
2. lib/helpers/defaults.js:3429 'HS256',
3. lib/helpers/defaults.js:3476 'HS256',
4. lib/models/id_token.js:18 case 'HS256':
5. lib/models/id_token.js:23 case 'HS384':
6. lib/models/id_token.js:28 case 'HS512':
7. test/ciba/ciba.test.js:880 test path expect(response.body).to.have.property('backchannel_authentication_request_signing_alg_values_supported').not.contains('HS256');
8. test/client_auth/client_auth.test.js:145 test path clientAuthSigningAlgValues: ['HS256'],
9. test/client_auth/client_auth.test.js:164 test path 'HS256',
10. test/client_auth/client_auth.test.js:165 test path 'HS384',
11. test/client_auth/client_auth.test.js:166 test path 'HS512',
12. test/client_auth/client_auth.test.js:214 test path 'HS256',
13. test/client_auth/client_auth.test.js:215 test path 'HS384',
14. test/client_auth/client_auth.test.js:216 test path 'HS512',
15. test/client_auth/client_auth.test.js:666 test path this.key = await importJWK((await this.provider.Client.find('client-jwt-secret')).symmetricKeyStore.selectForSign({ alg: 'HS256' })[0]);
16. test/client_auth/client_auth.test.js:675 test path }, this.key, 'HS256', { expiresIn: 60 }).then((assertion) => this.agent.post(route)
17. test/client_auth/client_auth.test.js:692 test path }, this.key, 'HS256', { expiresIn: 60 }).then((assertion) => this.agent.post(route)
18. test/client_auth/client_auth.test.js:708 test path }, this.key, 'HS256', { expiresIn: 60 }).then((assertion) => this.agent.post(route)
19. test/client_auth/client_auth.test.js:726 test path }, this.key, 'HS256', { expiresIn: 60 }).then((assertion) => this.agent.post(route)
20. test/client_auth/client_auth.test.js:744 test path }, this.key, 'HS256', { expiresIn: 60 }).then((assertion) => this.agent.post('/token/introspection')
21. test/client_auth/client_auth.test.js:762 test path }, this.key, 'HS256', { expiresIn: 60 }).then((assertion) => this.agent.post('/token/introspection')
22. test/client_auth/client_auth.test.js:782 test path }, this.key, 'HS256', { expiresIn: 60 }).then((assertion) => this.agent.post(route)
23. test/client_auth/client_auth.test.js:805 test path }, this.key, 'HS256', { expiresIn: 60 }).then((assertion) => this.agent.post(route)
24. test/client_auth/client_auth.test.js:827 test path }, this.key, 'HS256', { expiresIn: 60 }).then((assertion) => this.agent.post(route)
25. test/client_auth/client_auth.test.js:889 test path }, this.key, 'HS256', {
26. test/client_auth/client_auth.test.js:914 test path }, this.key, 'HS256', {
27. test/client_auth/client_auth.test.js:940 test path }, this.key, 'HS256', {
28. test/client_auth/client_auth.test.js:966 test path }, this.key, 'HS256', {
29. test/client_auth/client_auth.test.js:992 test path }, this.key, 'HS256', {
30. test/client_auth/client_auth.test.js:1018 test path }, this.key, 'HS256', {
31. test/client_auth/client_auth.test.js:1042 test path }, this.key, 'HS256', { expiresIn: 60 }).then((assertion) => this.agent.post(route)
32. test/client_auth/client_auth.test.js:1064 test path }, this.key, 'HS256', {
33. test/client_auth/client_auth.test.js:1087 test path }, this.key, 'HS256', {
34. test/client_auth/client_auth.test.js:1128 test path }, this.key, 'HS256', {
35. test/client_auth/client_auth.test.js:1147 test path const key = await importJWK((await this.provider.Client.find('secret-expired-jwt')).symmetricKeyStore.selectForSign({ alg: 'HS256' })[0]);
36. test/client_auth/client_auth.test.js:1153 test path }, key, 'HS256', {
37. test/client_auth/client_auth.test.js:1178 test path }, this.key, 'HS256', {
38. test/client_auth/client_auth.test.js:1211 test path (await this.provider.Client.find('client-jwt-secret')).tokenEndpointAuthSigningAlg = 'HS384';
39. test/client_auth/client_auth.test.js:1224 test path }, this.key, 'HS256', {
40. test/configuration/client_keystore.test.js:43 test path id_token_signed_response_alg: 'HS256',
41. test/configuration/client_metadata.test.js:678 test path 'HS256',
42. test/configuration/client_metadata.test.js:679 test path 'HS384',
43. test/configuration/client_metadata.test.js:680 test path 'HS512',
44. test/configuration/client_metadata.test.js:990 test path allows(this.title, 'HS256', undefined, configuration);
45. test/configuration/client_metadata.test.js:1011 test path allows(this.title, 'HS256', undefined, configuration);
46. test/configuration/client_metadata.test.js:1020 test path allows(this.title, 'HS256', undefined, configuration);
47. test/configuration/client_metadata.test.js:1662 test path rejects(this.title, 'HS256', undefined, metadata, withRequestObjects);
48. test/configuration/client_metadata.test.js:1663 test path rejects(this.title, 'HS384', undefined, metadata, withRequestObjects);
49. test/configuration/client_metadata.test.js:1664 test path rejects(this.title, 'HS512', undefined, metadata, withRequestObjects);
50. test/configuration/configuration.test.js:75 test path clientAuthSigningAlgValues: ['HS256', 'RS256'],
51. test/configuration/configuration.test.js:106 test path expect(input.enabledJWA.clientAuthSigningAlgValues).to.eql(['HS256', 'RS256']);
52. test/configuration/omit_algs.test.js:11 test path invalidProperty: ['HS256', 'RS256'],
53. test/configuration/omit_algs.test.js:21 test path idTokenSigningAlgValues: new Set(['HS256', 'RS256']),
54. test/configuration/omit_algs.test.js:41 test path idTokenSigningAlgValues: ['HS256', 'RS256'],
55. test/configuration/omit_algs.test.js:48 test path expect(i(provider).configuration.idTokenSigningAlgValues).to.eql(['HS256', 'RS256']);
56. test/core/implicit/implicit.config.js:16 test path id_token_signed_response_alg: 'HS256',
57. test/dpop/dpop.test.js:150 test path for (const value of [1, true, 'none', 'HS256', 'unsupported']) {
58. test/dpop/dpop.test.js:666 test path .setProtectedHeader({ alg: 'HS256' })
59. test/dynamic_registration/dynamic_registration.test.js:276 test path id_token_signed_response_alg: 'HS256',
60. test/encryption/encryption.config.js:72 test path request_object_signing_alg: 'HS256',
61. test/encryption/encryption.test.js:123 test path client.userinfoSignedResponseAlg = 'HS256';
62. test/encryption/encryption.test.js:175 test path }, Buffer.from('secret'), 'HS256', { issuer: 'client', audience: this.provider.issuer });
63. test/encryption/encryption.test.js:206 test path }, Buffer.from('secret'), 'HS256', { issuer: 'client', audience: this.provider.issuer });
64. test/encryption/encryption.test.js:236 test path const [hsSecret] = client.symmetricKeyStore.selectForSign({ alg: 'HS256' });
65. test/encryption/encryption.test.js:242 test path }, client.symmetricKeyStore.getKeyObject(hsSecret), 'HS256', { issuer: 'client', audience: this.provider.issuer });
66. test/encryption/encryption.test.js:277 test path const [hsSecret] = client.symmetricKeyStore.selectForSign({ alg: 'HS256' });
67. test/encryption/encryption.test.js:283 test path }, client.symmetricKeyStore.getKeyObject(hsSecret), 'HS256', { issuer: 'clientRequestObjectSigningAlg', audience: this.provider.issuer });
68. test/encryption/encryption.test.js:363 test path }, Buffer.from('secret'), 'HS256', { issuer: 'clientSymmetric', audience: this.provider.issuer });
69. test/encryption/encryption.test.js:399 test path }, Buffer.from('secret'), 'HS256', { issuer: 'clientSymmetric-expired', audience: this.provider.issuer });
70. test/encryption/encryption.test.js:461 test path }, Buffer.from('secret'), 'HS256', { issuer: 'clientSymmetric-dir', audience: this.provider.issuer });
71. test/encryption/encryption.test.js:497 test path }, Buffer.from('secret'), 'HS256', { issuer: 'clientSymmetric-expired', audience: this.provider.issuer });
72. test/end_session/end_session.config.js:22 test path id_token_signed_response_alg: 'HS256',
73. test/end_session/end_session.test.js:362 test path Buffer.from(JSON.stringify({ alg: 'HS256' })).toString('base64url'),
74. test/end_session/end_session.test.js:395 test path }, Buffer.from('secret'), 'HS256'),
75. test/end_session/end_session.test.js:420 test path }, Buffer.from('not THE secret'), 'HS256'),
76. test/formats/jwt.test.js:156 test path sign: { alg: 'HS256', key: crypto.randomBytes(32) },
77. test/formats/jwt.test.js:165 test path expect(header).to.have.property('alg', 'HS256');
78. test/formats/jwt.test.js:174 test path sign: { alg: 'HS256', key: await crypto.subtle.generateKey({ name: 'HMAC', hash: 'SHA-256' }, false, ['sign']) },
79. test/formats/jwt.test.js:183 test path expect(header).to.have.property('alg', 'HS256');
80. test/formats/jwt.test.js:192 test path sign: { alg: 'HS256', key: crypto.randomBytes(32), kid: 200 },
81. test/formats/jwt.test.js:233 test path sign: { alg: 'HS256', key: crypto.randomBytes(32), kid: 'feb-2020' },
82. test/formats/jwt.test.js:250 test path sign: { alg: 'HS256', key: crypto.createSecretKey(crypto.randomBytes(32)) },
83. test/formats/jwt.test.js:259 test path expect(header).to.have.property('alg', 'HS256');
84. test/formats/jwt.test.js:473 test path alg: 'HS256',
85. test/formats/jwt.test.js:493 test path alg: 'HS256',
86. test/formats/jwt.test.js:514 test path alg: 'HS256',
87. test/id_token_claims/conform.config.js:23 test path userinfo_signed_response_alg: 'HS256',
88. test/id_token_claims/conform.test.js:90 test path client.userinfoSignedResponseAlg = 'HS256';
89. test/id_token_claims/non_conform.test.js:80 test path client.userinfoSignedResponseAlg = 'HS256';
90. test/jwt/jsonwebtoken.test.js:57 test path const keyobject = await generateSecret('HS256', { extractable: true });
91. test/jwt/jsonwebtoken.test.js:70 test path const keyobject = await generateSecret('HS256', { extractable: true });
92. test/jwt/jsonwebtoken.test.js:72 test path return JWT.sign({ data: true }, keyobject, 'HS256')
93. test/jwt/jsonwebtoken.test.js:76 test path expect(decoded.header).to.have.property('alg', 'HS256');
94. test/jwt/jsonwebtoken.test.js:82 test path const keyobject = await generateSecret('HS256', { extractable: true });
95. test/jwt/jsonwebtoken.test.js:83 test path return JWT.sign({ 'ś∂źć√': 'ś∂źć√' }, keyobject, 'HS256')
96. test/jwt/jsonwebtoken.test.js:143 test path () => generateSecret('HS256', { extractable: true }),
97. test/jwt/jsonwebtoken.test.js:155 test path const jwt = await JWT.sign({ data: true }, signingKeys[position], 'HS256');
98. test/jwt/jsonwebtoken.test.js:177 test path const jwt = await JWT.sign({ data: true }, signingKeys[3], 'HS256');
99. test/jwt/jsonwebtoken.test.js:197 test path const jwt = await JWT.sign({ data: true }, signingKeys[3], 'HS256');
100. test/jwt/jsonwebtoken.test.js:215 test path it('iat by default', async () => JWT.sign({ data: true }, await generateSecret('HS256', { extractable: true }), 'HS256')
101. test/jwt/jsonwebtoken.test.js:221 test path it('expiresIn', async () => JWT.sign({ data: true }, await generateSecret('HS256', { extractable: true }), 'HS256', { expiresIn: 60 })
102. test/jwt/jsonwebtoken.test.js:227 test path it('audience', async () => JWT.sign({ data: true }, await generateSecret('HS256', { extractable: true }), 'HS256', { audience: 'clientId' })
103. test/jwt/jsonwebtoken.test.js:233 test path it('issuer', async () => JWT.sign({ data: true }, await generateSecret('HS256', { extractable: true }), 'HS256', { issuer: 'http://example.com/issuer' })
104. test/jwt/jsonwebtoken.test.js:239 test path it('subject', async () => JWT.sign({ data: true }, await generateSecret('HS256', { extractable: true }), 'HS256', { subject: 'http://example.com/subject' })
105. test/jwt/jsonwebtoken.test.js:248 test path const keyobject = await generateSecret('HS256', { extractable: true });
106. test/jwt/jsonwebtoken.test.js:250 test path return JWT.sign({ data: true, nbf: epochTime() + 3600 }, keyobject, 'HS256')
107. test/jwt/jsonwebtoken.test.js:262 test path const keyobject = await generateSecret('HS256', { extractable: true });
108. test/jwt/jsonwebtoken.test.js:264 test path return JWT.sign({ data: true, nbf: epochTime() + 3600 }, keyobject, 'HS256')
109. test/jwt/jsonwebtoken.test.js:271 test path const keyobject = await generateSecret('HS256', { extractable: true });
110. test/jwt/jsonwebtoken.test.js:273 test path return JWT.sign({ data: true, nbf: epochTime() + 5 }, keyobject, 'HS256')
111. test/jwt/jsonwebtoken.test.js:280 test path const keyobject = await generateSecret('HS256', { extractable: true });
112. test/jwt/jsonwebtoken.test.js:282 test path return JWT.sign({ data: true, nbf: 'not a nbf' }, keyobject, 'HS256')
113. test/jwt/jsonwebtoken.test.js:294 test path const keyobject = await generateSecret('HS256', { extractable: true });
114. test/jwt/jsonwebtoken.test.js:296 test path return JWT.sign({ data: true, iat: epochTime() + 3600 }, keyobject, 'HS256', {
115. test/jwt/jsonwebtoken.test.js:310 test path const keyobject = await generateSecret('HS256', { extractable: true });
116. test/jwt/jsonwebtoken.test.js:312 test path return JWT.sign({ data: true, iat: epochTime() + 3600 }, keyobject, 'HS256', {
117. test/jwt/jsonwebtoken.test.js:321 test path const keyobject = await generateSecret('HS256', { extractable: true });
118. test/jwt/jsonwebtoken.test.js:323 test path return JWT.sign({ data: true, iat: epochTime() + 5 }, keyobject, 'HS256', {
119. test/jwt/jsonwebtoken.test.js:332 test path const keyobject = await generateSecret('HS256', { extractable: true });
120. test/jwt/jsonwebtoken.test.js:334 test path return JWT.sign({ data: true, iat: 'not an iat' }, keyobject, 'HS256', {
121. test/jwt/jsonwebtoken.test.js:348 test path const keyobject = await generateSecret('HS256', { extractable: true });
122. test/jwt/jsonwebtoken.test.js:350 test path return JWT.sign({ data: true, exp: epochTime() - 3600 }, keyobject, 'HS256')
123. test/jwt/jsonwebtoken.test.js:362 test path const keyobject = await generateSecret('HS256', { extractable: true });
124. test/jwt/jsonwebtoken.test.js:364 test path return JWT.sign({ data: true, exp: epochTime() - 3600 }, keyobject, 'HS256')
125. test/jwt/jsonwebtoken.test.js:371 test path const keyobject = await generateSecret('HS256', { extractable: true });
126. test/jwt/jsonwebtoken.test.js:373 test path return JWT.sign({ data: true, exp: epochTime() - 5 }, keyobject, 'HS256')
127. test/jwt/jsonwebtoken.test.js:380 test path const keyobject = await generateSecret('HS256', { extractable: true });
128. test/jwt/jsonwebtoken.test.js:382 test path return JWT.sign({ data: true, exp: 'not an exp' }, keyobject, 'HS256')
129. test/jwt/jsonwebtoken.test.js:394 test path const keyobject = await generateSecret('HS256', { extractable: true });
130. test/jwt/jsonwebtoken.test.js:396 test path return JWT.sign({ data: true }, keyobject, 'HS256', {
131. test/jwt/jsonwebtoken.test.js:405 test path const keyobject = await generateSecret('HS256', { extractable: true });
132. test/jwt/jsonwebtoken.test.js:407 test path return JWT.sign({ data: true }, keyobject, 'HS256', {
133. test/jwt/jsonwebtoken.test.js:416 test path const keyobject = await generateSecret('HS256', { extractable: true });
134. test/jwt/jsonwebtoken.test.js:418 test path return JWT.sign({ data: true }, keyobject, 'HS256', {
135. test/jwt/jsonwebtoken.test.js:435 test path const keyobject = await generateSecret('HS256', { extractable: true });
136. test/jwt/jsonwebtoken.test.js:437 test path return JWT.sign({ data: true }, keyobject, 'HS256', {
137. test/jwt/jsonwebtoken.test.js:454 test path const keyobject = await generateSecret('HS256', { extractable: true });
138. test/jwt/jsonwebtoken.test.js:456 test path return JWT.sign({ data: true }, keyobject, 'HS256', {
139. test/jwt/jsonwebtoken.test.js:465 test path const keyobject = await generateSecret('HS256', { extractable: true });
140. test/jwt/jsonwebtoken.test.js:467 test path return JWT.sign({ data: true }, keyobject, 'HS256', {
141. test/jwt_introspection/jwt_introspection.config.js:26 test path introspection_signed_response_alg: 'HS256',
142. test/jwt_response_modes/jwt_response_modes.config.js:38 test path authorization_signed_response_alg: 'HS256',
143. test/pushed_authorization_requests/pushed_authorization_requests.config.js:51 test path request_object_signing_alg: 'HS256',
144. test/pushed_authorization_requests/pushed_authorization_requests.test.js:433 test path this.key = await importJWK(client.symmetricKeyStore.selectForSign({ alg: 'HS256' })[0]);
145. test/pushed_authorization_requests/pushed_authorization_requests.test.js:480 test path }, this.key, 'HS256', { expiresIn: 30 }).then((request) => {
146. test/pushed_authorization_requests/pushed_authorization_requests.test.js:504 test path }, this.key, 'HS256', {
147. test/pushed_authorization_requests/pushed_authorization_requests.test.js:536 test path }, this.key, 'HS256'),
148. test/pushed_authorization_requests/pushed_authorization_requests.test.js:560 test path }, this.key, 'HS256', {
149. test/pushed_authorization_requests/pushed_authorization_requests.test.js:588 test path }, this.key, 'HS256', {
150. test/pushed_authorization_requests/pushed_authorization_requests.test.js:618 test path }, this.key, 'HS256', { expiresIn: 30 }),
151. test/pushed_authorization_requests/pushed_authorization_requests.test.js:638 test path }, this.key, 'HS384'),
152. test/pushed_authorization_requests/pushed_authorization_requests.test.js:656 test path }, this.key, 'HS256', { expiresIn: 30 }),
153. test/pushed_authorization_requests/pushed_authorization_requests.test.js:677 test path }, this.key, 'HS256', { expiresIn: 30 }),
154. test/pushed_authorization_requests/pushed_authorization_requests.test.js:699 test path }, this.key, 'HS256', { expiresIn: 30 }),
155. test/pushed_authorization_requests/pushed_authorization_requests.test.js:731 test path }, this.key, 'HS256', { expiresIn: 30 }),
156. test/registration_policies/registration_policies.test.js:73 test path properties.id_token_signed_response_alg = 'HS256';
157. test/registration_policies/registration_policies.test.js:87 test path expect(body).to.have.property('id_token_signed_response_alg', 'HS256');
158. test/registration_policies/registration_policies.test.js:108 test path properties.id_token_signed_response_alg = 'HS256';
159. test/registration_policies/registration_policies.test.js:124 test path expect(body).to.have.property('id_token_signed_response_alg', 'HS256');
160. test/request/jwt_request.test.js:93 test path }, Buffer.from('secret'), 'HS256', { issuer: 'client', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
161. test/request/jwt_request.test.js:130 test path }, Buffer.from('secret'), 'HS256', {
162. test/request/jwt_request.test.js:182 test path }, Buffer.from('secret'), 'HS256', {
163. test/request/jwt_request.test.js:220 test path }, Buffer.from('secret'), 'HS256', {
164. test/request/jwt_request.test.js:256 test path }, Buffer.from('secret'), 'HS256', { issuer: 'client', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
165. test/request/jwt_request.test.js:287 test path }, Buffer.from('secret'), 'HS256', { issuer: 'client', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
166. test/request/jwt_request.test.js:323 test path }, Buffer.from('secret'), 'HS256', { issuer: 'client', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
167. test/request/jwt_request.test.js:356 test path }, Buffer.from('secret'), 'HS256', { issuer: 'client', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
168. test/request/jwt_request.test.js:377 test path let [key] = client.symmetricKeyStore.selectForSign({ alg: 'HS256' });
169. test/request/jwt_request.test.js:389 test path }, key, 'HS256', { issuer: 'client-with-HS-sig', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
170. test/request/jwt_request.test.js:406 test path let [key] = client.symmetricKeyStore.selectForSign({ alg: 'HS256' });
171. test/request/jwt_request.test.js:416 test path }, key, 'HS256', { issuer: 'client-with-HS-sig', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
172. test/request/jwt_request.test.js:433 test path let [key] = client.symmetricKeyStore.selectForSign({ alg: 'HS256' });
173. test/request/jwt_request.test.js:446 test path }, key, 'HS256', { issuer: 'client-with-HS-sig-expired', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
174. test/request/jwt_request.test.js:480 test path }, Buffer.from('secret'), 'HS256', { issuer: 'client', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
175. test/request/jwt_request.test.js:514 test path }, Buffer.from('secret'), 'HS256', { issuer: 'client', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
176. test/request/jwt_request.test.js:547 test path }, Buffer.from('secret'), 'HS256', { issuer: 'client', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
177. test/request/jwt_request.test.js:575 test path }, Buffer.from('secret'), 'HS256', { issuer: 'client', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
178. test/request/jwt_request.test.js:609 test path }, Buffer.from('secret'), 'HS256', { issuer: 'client', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
179. test/request/jwt_request.test.js:643 test path }, Buffer.from('secret'), 'HS256', { issuer: 'client2', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
180. test/request/jwt_request.test.js:678 test path }, Buffer.from('secret'), 'HS256', { issuer: 'client2', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
181. test/request/jwt_request.test.js:727 test path Buffer.from(JSON.stringify({ alg: 'HS256' })).toString('base64url'),
182. test/request/jwt_request.test.js:800 test path }, Buffer.from('secret'), 'HS512', { issuer: 'client-with-HS-sig', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
183. test/request/jwt_request.test.js:833 test path }, crypto.createSecretKey(crypto.randomBytes(48)), 'HS384', { issuer: 'client', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
184. test/request/jwt_request.test.js:862 test path }, Buffer.from('not THE secret'), 'HS256', { issuer: 'client', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
185. test/request/jwt_request.test.js:893 test path }, Buffer.from('secret'), 'HS256', { issuer: 'client', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
186. test/request/jwt_request.test.js:913 test path let [key] = client.symmetricKeyStore.selectForSign({ alg: 'HS256' });
187. test/request/jwt_request.test.js:924 test path }, key, 'HS256', { issuer: 'client-with-HS-sig', audience: this.provider.issuer, expiresIn: 30 }).then((request) => this.wrap({
188. test/request/request.config.js:17 test path pull(config.enabledJWA.requestObjectSigningAlgValues, 'HS384');
189. test/request/request.config.js:38 test path request_object_signing_alg: 'HS256',
190. test/request/request.config.js:46 test path request_object_signing_alg: 'HS256',
191. test/rich_authorization_requests/rich_authorization_requests.config.js:188 test path request_object_signing_alg: 'HS256',
192. test/rich_authorization_requests/rich_authorization_requests.test.js:327 test path client.symmetricKeyStore.selectForSign({ alg: 'HS256' })[0],
193. test/rich_authorization_requests/rich_authorization_requests.test.js:375 test path }, this.requestObjectKey, 'HS256', { expiresIn: 30 });
194. test/signatures/signatures.config.js:25 test path id_token_signed_response_alg: 'HS256',
195. test/signatures/signatures.test.js:44 test path expect(decode(this.idToken)).to.have.nested.property('header.alg', 'HS256');

jose.algorithm · CWE-327

AES-256 Quantum-safe 33 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. lib/consts/jwa.js:21 'A128GCMKW', 'A192GCMKW', 'A256GCMKW', 'A128KW', 'A192KW', 'A256KW',
2. lib/consts/jwa.js:27 'A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM',
3. lib/helpers/defaults.js:3578 'A256KW',
4. lib/helpers/defaults.js:3607 'A256KW',
5. lib/helpers/defaults.js:3636 'A256KW',
6. lib/helpers/defaults.js:3666 'A256KW',
7. lib/helpers/defaults.js:3696 'A256KW',
8. lib/helpers/defaults.js:3719 'A256CBC-HS512',
9. lib/helpers/defaults.js:3720 'A256GCM',
10. lib/helpers/defaults.js:3739 'A256CBC-HS512',
11. lib/helpers/defaults.js:3740 'A256GCM',
12. lib/helpers/defaults.js:3759 'A256CBC-HS512',
13. lib/helpers/defaults.js:3760 'A256GCM',
14. lib/helpers/defaults.js:3779 'A256CBC-HS512',
15. lib/helpers/defaults.js:3780 'A256GCM',
16. lib/helpers/defaults.js:3799 'A256CBC-HS512',
17. lib/helpers/defaults.js:3800 'A256GCM',
18. test/configuration/client_metadata.test.js:1074 test path 'A256GCMKW',
19. test/configuration/client_metadata.test.js:1077 test path 'A256KW',
20. test/configuration/client_metadata.test.js:1112 test path ['A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM'].forEach(
21. test/configuration/client_metadata.test.js:1180 test path 'A256GCMKW',
22. test/configuration/client_metadata.test.js:1183 test path 'A256KW',
23. test/configuration/client_metadata.test.js:1214 test path ['A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM'].forEach(
24. test/configuration/client_metadata.test.js:1285 test path 'A256GCMKW',
25. test/configuration/client_metadata.test.js:1288 test path 'A256KW',
26. test/configuration/client_metadata.test.js:1317 test path ['A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM'].forEach(
27. test/configuration/client_metadata.test.js:1385 test path 'A256GCMKW',
28. test/configuration/client_metadata.test.js:1388 test path 'A256KW',
29. test/configuration/client_metadata.test.js:1417 test path ['A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM'].forEach(
30. test/configuration/client_metadata.test.js:1489 test path 'A256GCMKW',
31. test/configuration/client_metadata.test.js:1492 test path 'A256KW',
32. test/configuration/client_metadata.test.js:1519 test path ['A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM'].forEach(
33. test/encryption/encryption.test.js:25 test path 'A128GCMKW', 'A192GCMKW', 'A256GCMKW', 'A128KW', 'A192KW', 'A256KW',

jose.algorithm · CWE-327

CSPRNG Quantum-safe Renamed import 23 places See details

Random number generation

`crypto.randomBytes()`, `randomUUID()` or `getRandomValues()`. A platform CSPRNG is not a quantum exposure; it is recorded because an inventory that omits the randomness source is incomplete. `Math.random()` is a separate, present-day defect.

This is where the software gets its random numbers. Quantum computers do not weaken it.

What to do. No action.

1. certification/fapi/index.js:105 const eKey = crypto.randomBytes(32);
2. certification/oidc/configuration.js:173 nonceSecret: crypto.randomBytes(32),
3. certification/oidc/index.js:53 ctx.res.locals.cspNonce = crypto.randomBytes(16).toString('base64');
4. lib/helpers/defaults.js:277 return crypto.randomBytes(64).toString('base64url');
5. lib/shared/xsrf.js:7 const secret = crypto.randomBytes(24).toString('hex');
6. test/attest_bindings/attest_bindings.config.js:23 test path challengeSecret: randomBytes(32),
7. test/attest_bindings/attest_bindings.test.js:39 test path .setJti(crypto.randomUUID())
8. test/backchannel_logout/backchannel_logout.test.js:115 test path nonce: randomBytes(16).toString('base64url'),
9. test/client_auth/client_auth.config.js:49 test path challengeSecret: randomBytes(32),
10. test/configuration/keystore_configuration.test.js:35 test path { kty: 'oct', k: randomBytes(32).toString('base64url') },
11. test/custom_grants/grant_implementations.test.js:83 test path jti = randomUUID(),
12. test/custom_grants/grants/jwt_bearer.js:207 test path const grantId = randomUUID();
13. test/custom_grants/grants/saml2_bearer.js:190 test path const grantId = randomUUID();
14. test/dpop/dpop.test.js:217 test path jwk: await exportJWK(randomBytes(32)),
15. test/end_session/end_session.test.js:50 test path nonce: randomBytes(16).toString('base64url'),
16. test/fapi/fapi2.test.js:82 test path jti: crypto.randomUUID(),
17. test/formats/jwt.test.js:156 test path sign: { alg: 'HS256', key: crypto.randomBytes(32) },
18. test/helpers/challenge.test.js:11 test path const secret = randomBytes(32);
19. test/openid4vci/openid4vci.test.js:115 test path .setJti(randomUUID())
20. test/pushed_authorization_requests/pushed_authorization_requests.test.js:475 test path jti: randomBytes(16).toString('base64url'),
21. test/request/jwt_request.test.js:70 test path this.code_verifier = crypto.randomBytes(32).toString('base64url');
22. test/rich_authorization_requests/rich_authorization_requests.test.js:370 test path jti: randomBytes(16).toString('base64url'),
23. test/test_helper.js:264 test path this.state = 'state' in parameters ? parameters.state : crypto.randomBytes(16).toString('base64url');

js.rng

HMAC Quantum-safe Renamed import 21 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

No known quantum attack changes how strong this is. A keyed MAC is not affected by Shor and only marginally by Grover.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. test/client_auth/client_auth.test.js:666 test path this.key = await importJWK((await this.provider.Client.find('client-jwt-secret')).symmetricKeyStore.selectForSign({ alg: 'HS256' })[0]);
2. test/client_auth/client_auth.test.js:1147 test path const key = await importJWK((await this.provider.Client.find('secret-expired-jwt')).symmetricKeyStore.selectForSign({ alg: 'HS256' })[0]);
3. test/dpop/dpop.test.js:666 test path .setProtectedHeader({ alg: 'HS256' })
4. test/encryption/encryption.test.js:236 test path const [hsSecret] = client.symmetricKeyStore.selectForSign({ alg: 'HS256' });
5. test/encryption/encryption.test.js:277 test path const [hsSecret] = client.symmetricKeyStore.selectForSign({ alg: 'HS256' });
6. test/end_session/end_session.test.js:362 test path Buffer.from(JSON.stringify({ alg: 'HS256' })).toString('base64url'),
7. test/formats/jwt.test.js:156 test path sign: { alg: 'HS256', key: crypto.randomBytes(32) },
8. test/formats/jwt.test.js:174 test path sign: { alg: 'HS256', key: await crypto.subtle.generateKey({ name: 'HMAC', hash: 'SHA-256' }, false, ['sign']) },
9. test/formats/jwt.test.js:192 test path sign: { alg: 'HS256', key: crypto.randomBytes(32), kid: 200 },
10. test/formats/jwt.test.js:233 test path sign: { alg: 'HS256', key: crypto.randomBytes(32), kid: 'feb-2020' },
11. test/formats/jwt.test.js:250 test path sign: { alg: 'HS256', key: crypto.createSecretKey(crypto.randomBytes(32)) },
12. test/formats/jwt.test.js:473 test path alg: 'HS256',
13. test/formats/jwt.test.js:493 test path alg: 'HS256',
14. test/formats/jwt.test.js:514 test path alg: 'HS256',
15. test/pushed_authorization_requests/pushed_authorization_requests.test.js:433 test path this.key = await importJWK(client.symmetricKeyStore.selectForSign({ alg: 'HS256' })[0]);
16. test/request/jwt_request.test.js:377 test path let [key] = client.symmetricKeyStore.selectForSign({ alg: 'HS256' });
17. test/request/jwt_request.test.js:406 test path let [key] = client.symmetricKeyStore.selectForSign({ alg: 'HS256' });
18. test/request/jwt_request.test.js:433 test path let [key] = client.symmetricKeyStore.selectForSign({ alg: 'HS256' });
19. test/request/jwt_request.test.js:727 test path Buffer.from(JSON.stringify({ alg: 'HS256' })).toString('base64url'),
20. test/request/jwt_request.test.js:913 test path let [key] = client.symmetricKeyStore.selectForSign({ alg: 'HS256' });
21. test/rich_authorization_requests/rich_authorization_requests.test.js:327 test path client.symmetricKeyStore.selectForSign({ alg: 'HS256' })[0],

js.jwt.algorithm · CWE-327

ML-DSA-44 Quantum-safe 16 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. certification/oidc/configuration.js:104 if (SubtleCrypto.supports?.('importKey', 'ML-DSA-44')) {
2. certification/oidc/configuration.js:106 alg: 'ML-DSA-44',
3. lib/consts/jwa.js:12 signingAlgValues.push('ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87');
4. lib/helpers/initialize_keystore.js:82 case 'ML-DSA-44':
5. lib/models/id_token.js:32 case 'ML-DSA-44':
6. test/client_auth/client_auth.test.js:27 test path for (const alg of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) {
7. test/configuration/client_keystore.test.js:108 test path alg: 'ML-DSA-44',
8. test/configuration/client_metadata.test.js:23 test path for (const alg of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) {
9. test/configuration/client_metadata.test.js:1829 test path [[{ kty: 'AKP', alg: 'ML-DSA-44' }], 'jwks.keys[0].pub must be a non-empty string for AKP keys'],
10. test/configuration/client_metadata.test.js:1830 test path [[{ kty: 'AKP', alg: 'ML-DSA-44', pub: 'pub', priv: 'priv' }], 'jwks.keys[0].priv must not be provided for AKP keys'],
11. test/configuration/keystore_configuration.test.js:52 test path if (SubtleCrypto.supports?.('generateKey', 'ML-DSA-44') !== true) {
12. test/configuration/keystore_configuration.test.js:55 test path const { publicKey } = await generateKeyPair('ML-DSA-44');
13. test/keys.js:19 test path for (const alg of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) {
14. test/openid4vci/openid4vci.test.js:2443 test path if (SubtleCrypto.supports?.('generateKey', 'ML-DSA-44')) {
15. test/openid4vci/openid4vci.test.js:2447 test path const { privateKey } = await generateKeyPair('ML-DSA-44', { extractable: true });
16. test/signatures/signatures.test.js:97 test path for (const alg of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) {

jose.algorithm · CWE-327

AES-256 Quantum-safe 12 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. certification/fapi/index.js:332 alg: 'dir',
2. test/encryption/encryption.test.js:467 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'dir' })
3. test/encryption/encryption.test.js:503 test path .setProtectedHeader({ enc: 'A128CBC-HS256', alg: 'dir' })
4. test/formats/jwt.test.js:211 test path alg: 'dir',
5. test/formats/jwt.test.js:270 test path alg: 'dir',
6. test/formats/jwt.test.js:297 test path alg: 'dir',
7. test/formats/jwt.test.js:324 test path alg: 'dir',
8. test/formats/jwt.test.js:351 test path alg: 'dir',
9. test/formats/jwt.test.js:555 test path alg: 'dir',
10. test/formats/jwt.test.js:600 test path alg: 'dir',
11. test/jwt/jsonwebtoken.test.js:166 test path alg: 'dir', enc: 'A128GCM',
12. test/jwt/jsonwebtoken.test.js:187 test path alg: 'dir', enc: 'A128GCM',

js.jwt.algorithm · CWE-327

ML-DSA-65 Quantum-safe 9 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. certification/oidc/configuration.js:113 if (SubtleCrypto.supports?.('importKey', 'ML-DSA-65')) {
2. certification/oidc/configuration.js:115 alg: 'ML-DSA-65',
3. lib/consts/jwa.js:12 signingAlgValues.push('ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87');
4. lib/helpers/initialize_keystore.js:83 case 'ML-DSA-65':
5. lib/models/id_token.js:33 case 'ML-DSA-65':
6. test/client_auth/client_auth.test.js:27 test path for (const alg of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) {
7. test/configuration/client_metadata.test.js:23 test path for (const alg of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) {
8. test/keys.js:19 test path for (const alg of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) {
9. test/signatures/signatures.test.js:97 test path for (const alg of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) {

jose.algorithm · CWE-327

ML-DSA-87 Quantum-safe 9 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. certification/oidc/configuration.js:122 if (SubtleCrypto.supports?.('importKey', 'ML-DSA-87')) {
2. certification/oidc/configuration.js:124 alg: 'ML-DSA-87',
3. lib/consts/jwa.js:12 signingAlgValues.push('ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87');
4. lib/helpers/initialize_keystore.js:84 case 'ML-DSA-87':
5. lib/models/id_token.js:34 case 'ML-DSA-87':
6. test/client_auth/client_auth.test.js:27 test path for (const alg of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) {
7. test/configuration/client_metadata.test.js:23 test path for (const alg of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) {
8. test/keys.js:19 test path for (const alg of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) {
9. test/signatures/signatures.test.js:97 test path for (const alg of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) {

jose.algorithm · CWE-327

ML-DSA-44 Quantum-safe 4 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. certification/oidc/configuration.js:106 alg: 'ML-DSA-44',
2. test/configuration/client_keystore.test.js:108 test path alg: 'ML-DSA-44',
3. test/configuration/client_metadata.test.js:1829 test path [[{ kty: 'AKP', alg: 'ML-DSA-44' }], 'jwks.keys[0].pub must be a non-empty string for AKP keys'],
4. test/configuration/client_metadata.test.js:1830 test path [[{ kty: 'AKP', alg: 'ML-DSA-44', pub: 'pub', priv: 'priv' }], 'jwks.keys[0].priv must not be provided for AKP keys'],

js.jwt.algorithm · CWE-327

ML-DSA-65 Quantum-safe 1 place See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. certification/oidc/configuration.js:115 alg: 'ML-DSA-65',

js.jwt.algorithm · CWE-327

ML-DSA-87 Quantum-safe 1 place See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. certification/oidc/configuration.js:124 alg: 'ML-DSA-87',

js.jwt.algorithm · CWE-327