Crypto-View

andy-goryachev/PasswordSafe

Cryptographic posture

137 cryptographic locations: 24 quantum-vulnerable, 22 reduced-margin, 22 undetermined, 69 quantum-safe

12 establish keys, so traffic protected by them and recorded today becomes readable once the algorithm falls. 713 files analysed.

Quantum-vulnerable 24 Reduced margin 22 Could not be determined 22 Quantum-safe 69
To address12
Key establishment12
Inventory only0
Total findings137
What was analysed
Branch master
Commit 3e58901fcc4130d2423e7aeeace541999cfd6937 2023.0720.2241
Committed 2023-07-21 05:46 UTC
Scanned 2026-09-11 06:53 UTC 1 hour ago
Coverage 713 files, 698 java

Earlier scans of this repository

13 scans · compare any two
0 to 100 locations Quantum-vulnerable 30 → 24 (down 6) Reduced margin 32 → 22 (down 10) Could not be determined 22 → 22 (unchanged) Quantum-safe 84 → 69 (down 15) The filled point is the scan you are reading.
Scanned Commit To address Key establishment
1 hour ago this scan 3e58901fcc41 master 12 12
10 hours ago 3e58901fcc41 master 18 18 Compare
10 hours ago 3e58901fcc41 master 18 18 Compare
1 day ago 3e58901fcc41 master 18 18 Compare
1 day ago 3e58901fcc41 master 18 18 Compare
1 day ago 3e58901fcc41 master 18 18 Compare
1 day ago 3e58901fcc41 master 18 18 Compare
1 day ago 3e58901fcc41 master 18 18 Compare
1 day ago 3e58901fcc41 master 18 18 Compare
3 days ago 3e58901fcc41 master 18 18 Compare
3 days ago 3e58901fcc41 master 18 30 Compare
11 days ago 3e58901fcc41 master 18 30 Compare
11 days ago 3e58901fcc41 master 18 30 Compare

Every repository in this history is re-scanned weekly.

List of cryptographic assets

RSA Quantum-vulnerable Recorded traffic 12 places See details

RSA through the BouncyCastle low-level API

A BouncyCastle RSA engine or key-pair generator. These classes bypass the JCA algorithm strings, so they are invisible to a scan that only reads `getInstance()` arguments.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures.

  1. src/goryachev/crypto/APublicKey.java:13 public APublicKey(RSAKeyParameters key)
  2. src/goryachev/crypto/Crypto.java:174 public static RSAPublicKey toRSAPublicKey(RSAKeyParameters k) throws Exception
  3. src/goryachev/crypto/Crypto.java:180 public static byte[] toByteArray(RSAKeyParameters spec) throws Exception
  4. src/goryachev/crypto/Crypto.java:230 return new APublicKey(new RSAKeyParameters(false, k.getModulus(), k.getPublicExponent()));
  5. src/goryachev/crypto/Crypto.java:271 else if(x instanceof RSAKeyParameters)
  6. src/goryachev/crypto/Crypto.java:273 return toByteArray((RSAKeyParameters)x);
  7. src/goryachev/crypto/Crypto.java:294 RSAKeyPairGenerator g = new RSAKeyPairGenerator();
  8. src/goryachev/crypto/Crypto.java:299 RSAKeyParameters pub = (RSAKeyParameters)kp.getPublic();
  9. src/goryachev/crypto/Crypto.java:308 RSADigestSigner signer = new RSADigestSigner(new SHA256Digest());
  10. src/goryachev/crypto/Crypto.java:321 RSADigestSigner signer = new RSADigestSigner(new SHA256Digest());
  11. src/goryachev/crypto/Crypto.java:330 PKCS1Encoding rsa = new PKCS1Encoding(new RSAEngine());
  12. src/goryachev/crypto/Crypto.java:348 PKCS1Encoding rsa = new PKCS1Encoding(new RSAEngine());
java.bouncycastle.rsa · CWE-327
SHA-256 Reduced margin 11 places See details

Digest through BouncyCastle

A BouncyCastle digest class. The digest name is read from the class, so `MD5Digest` and `SHA512Digest` are the same rule with opposite conclusions.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something long-lived. MD5 and SHA-1 need replacing now.

  1. src/goryachev/crypto/Crypto.java:308 RSADigestSigner signer = new RSADigestSigner(new SHA256Digest());
  2. src/goryachev/crypto/Crypto.java:321 RSADigestSigner signer = new RSADigestSigner(new SHA256Digest());
  3. src/goryachev/crypto/MemCrypt.java:94 SHA256Digest d = new SHA256Digest();
  4. src/goryachev/memsafecrypto/bc/SCrypt.java:124 PKCS5S2ParametersGenerator pGen = new PKCS5S2ParametersGenerator(new SHA256Digest());
  5. src/goryachev/memsafecrypto/bc/SHA256Digest.java:18 public class SHA256Digest
  6. src/goryachev/memsafecrypto/bc/SHA256Digest.java:47 public SHA256Digest()
  7. src/goryachev/memsafecrypto/bc/SHA256Digest.java:57 public SHA256Digest(SHA256Digest t)
  8. src/goryachev/memsafecrypto/bc/SHA256Digest.java:70 public SHA256Digest(CByteArray encodedState)
  9. src/goryachev/memsafecrypto/bc/SHA256Digest.java:92 private void copyIn(SHA256Digest t)
  10. src/goryachev/memsafecrypto/bc/SHA256Digest.java:369 return new SHA256Digest(this);
  11. src/goryachev/memsafecrypto/bc/SHA256Digest.java:375 SHA256Digest d = (SHA256Digest)other;
java.bouncycastle.digest · CWE-328
AES Reduced margin 8 places See details

Symmetric cipher through BouncyCastle

A BouncyCastle symmetric engine or mode. Symmetric encryption is not broken by a quantum computer, so these are inventoried rather than flagged - but a complete cryptographic inventory has to contain them, and the mode is where AES-256 or a 64-bit block shows up.

This is the kind of encryption that quantum computers do not break. It is listed so the inventory is complete.

What to do. Use a 256-bit key. No change of algorithm is required unless the engine is DES, RC4 or Blowfish.

  1. src/goryachev/crypto/MemCrypt.java:33 EAXBlockCipher cipher = new EAXBlockCipher(new AESEngine());
  2. src/goryachev/crypto/MemCrypt.java:64 EAXBlockCipher cipher = new EAXBlockCipher(new AESEngine());
  3. src/goryachev/crypto/eax/EAXCipher.java:21 EAXBlockCipher cipher = new EAXBlockCipher(new AESEngine());
  4. src/goryachev/crypto/eax/EAXCipher.java:46 EAXBlockCipher cipher = new EAXBlockCipher(new AESEngine());
  5. src/goryachev/crypto/eax/EAXDecryptStream.java:20 private EAXBlockCipher cipher;
  6. src/goryachev/crypto/eax/EAXDecryptStream.java:36 this.cipher = new EAXBlockCipher(new AESEngine());
  7. src/goryachev/crypto/eax/EAXEncryptStream.java:18 private EAXBlockCipher cipher;
  8. src/goryachev/crypto/eax/EAXEncryptStream.java:31 this.cipher = new EAXBlockCipher(new AESEngine());
java.bouncycastle.symmetric
PBKDF2 Reduced margin 3 places See details

Password hashing or key derivation

A `SecretKeyFactory` for PBKDF2, or a BouncyCastle password KDF. Not a quantum exposure, and part of a complete inventory.

This is how passwords are stored. Quantum computers do not meaningfully weaken it.

What to do. PBKDF2 needs a high iteration count. Argon2 through BouncyCastle is stronger.

  1. src/goryachev/memsafecrypto/bc/PKCS5S2ParametersGenerator.java:14 public class PKCS5S2ParametersGenerator
  2. src/goryachev/memsafecrypto/bc/PKCS5S2ParametersGenerator.java:21 public PKCS5S2ParametersGenerator(Digest digest)
  3. src/goryachev/memsafecrypto/bc/SCrypt.java:124 PKCS5S2ParametersGenerator pGen = new PKCS5S2ParametersGenerator(new SHA256Digest());
java.kdf
Salsa20 Quantum-safe 18 places See details

Symmetric cipher through BouncyCastle

A BouncyCastle symmetric engine or mode. Symmetric encryption is not broken by a quantum computer, so these are inventoried rather than flagged - but a complete cryptographic inventory has to contain them, and the mode is where AES-256 or a 64-bit block shows up.

This is the kind of encryption that quantum computers do not break. It is listed so the inventory is complete.

What to do. Use a 256-bit key. No change of algorithm is required unless the engine is DES, RC4 or Blowfish.

  1. src/goryachev/memsafecrypto/bc/SCrypt.java:201 Salsa20Engine.salsaCore(8, X2, X1);
  2. src/goryachev/memsafecrypto/bc/Salsa20Engine.java:11 public class Salsa20Engine
  3. src/goryachev/memsafecrypto/bc/Salsa20Engine.java:42 public Salsa20Engine()
  4. src/goryachev/memsafecrypto/bc/Salsa20Engine.java:52 public Salsa20Engine(int rounds)
  5. src/goryachev/memsafecrypto/bc/XSalsa20Engine.java:12 public class XSalsa20Engine
  6. src/goryachev/memsafecrypto/bc/XSalsa20Engine.java:13 extends Salsa20Engine
  7. src/goryachev/memsafecrypto/salsa/XSalsa20Poly1305DecryptStream.java:29 private XSalsa20Engine xsalsa20 = new XSalsa20Engine();
  8. src/goryachev/memsafecrypto/salsa/XSalsa20Poly1305EncryptStream.java:21 private XSalsa20Engine engine = new XSalsa20Engine();
  9. src/goryachev/memsafecrypto/salsa/XSalsaOutputStream.java:23 private final XSalsa20Engine engine;
  10. src/goryachev/memsafecrypto/salsa/XSalsaOutputStream.java:33 this.engine = new XSalsa20Engine();
  11. src/goryachev/memsafecrypto/salsa/XSalsaRandomAccessFile.java:29 private final XSalsa20Engine engine;
  12. src/goryachev/memsafecrypto/salsa/XSalsaRandomAccessFile.java:41 this.engine = new XSalsa20Engine();
  13. src/goryachev/memsafecrypto/salsa/XSalsaTools.java:29 XSalsa20Engine engine = new XSalsa20Engine();
  14. src/goryachev/memsafecrypto/salsa/XSalsaTools.java:67 XSalsa20Engine engine = new XSalsa20Engine();
  15. src/goryachev/memsafecrypto/salsa/XSalsaTools.java:105 XSalsa20Engine engine = new XSalsa20Engine();
  16. src/goryachev/memsafecrypto/salsa/XSalsaTools.java:143 XSalsa20Engine engine = new XSalsa20Engine();
  17. src/goryachev/memsafecrypto/salsa/XSalsaTools.java:190 XSalsa20Engine engine = new XSalsa20Engine();
  18. src/goryachev/memsafecrypto/salsa/XSalsaTools.java:267 XSalsa20Engine engine = new XSalsa20Engine();
java.bouncycastle.symmetric
Argon2 Quantum-safe 17 places See details

Password hashing or key derivation

A `SecretKeyFactory` for PBKDF2, or a BouncyCastle password KDF. Not a quantum exposure, and part of a complete inventory.

This is how passwords are stored. Quantum computers do not meaningfully weaken it.

What to do. PBKDF2 needs a high iteration count. Argon2 through BouncyCastle is stronger.

  1. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:14 public class Argon2BytesGenerator
  2. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:46 public Argon2BytesGenerator()
  3. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:60 if(parameters.getLanes() < Argon2BytesGenerator.MIN_PARALLELISM)
  4. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:62 throw new IllegalStateException("lanes must be greater than " + Argon2BytesGenerator.MIN_PARALLELISM);
  5. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:64 else if(parameters.getLanes() > Argon2BytesGenerator.MAX_PARALLELISM)
  6. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:66 throw new IllegalStateException("lanes must be less than " + Argon2BytesGenerator.MAX_PARALLELISM);
  7. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:72 else if(parameters.getIterations() < Argon2BytesGenerator.MIN_ITERATIONS)
  8. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:74 throw new IllegalStateException("iterations is less than: " + Argon2BytesGenerator.MIN_ITERATIONS);
  9. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:117 if(outLen < Argon2BytesGenerator.MIN_OUTLEN)
  10. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:119 throw new IllegalStateException("output length less than " + Argon2BytesGenerator.MIN_OUTLEN);
  11. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:164 if(memoryBlocks < 2 * Argon2BytesGenerator.ARGON2_SYNC_POINTS * parameters.getLanes())
  12. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:166 memoryBlocks = 2 * Argon2BytesGenerator.ARGON2_SYNC_POINTS * parameters.getLanes();
  13. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:169 this.segmentLength = memoryBlocks / (parameters.getLanes() * Argon2BytesGenerator.ARGON2_SYNC_POINTS);
  14. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:170 this.laneLength = segmentLength * Argon2BytesGenerator.ARGON2_SYNC_POINTS;
  15. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:173 memoryBlocks = segmentLength * (parameters.getLanes() * Argon2BytesGenerator.ARGON2_SYNC_POINTS);
  16. src/goryachev/password/data/v4/EncryptionHandlerV4.java:98 Argon2BytesGenerator ms = new Argon2BytesGenerator();
  17. src/goryachev/password/data/v4/EncryptionHandlerV4.java:187 Argon2BytesGenerator ms = new Argon2BytesGenerator();
java.kdf
BLAKE2 Quantum-safe 17 places See details

Digest through BouncyCastle

A BouncyCastle digest class. The digest name is read from the class, so `MD5Digest` and `SHA512Digest` are the same rule with opposite conclusions.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something long-lived. MD5 and SHA-1 need replacing now.

  1. src/goryachev/memsafecrypto/CDigestBlake2b.java:28 private final Blake2bDigest digest;
  2. src/goryachev/memsafecrypto/CDigestBlake2b.java:33 this.digest = new Blake2bDigest(bits);
  3. src/goryachev/memsafecrypto/CRandomSpi.java:25 generator = new DigestRandomGenerator(new Blake2bDigest(512));
  4. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:433 Blake2bDigest blake = new Blake2bDigest(outLen * 8);
  5. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:441 Blake2bDigest digest = new Blake2bDigest(blake2bLength * 8);
  6. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:467 digest = new Blake2bDigest(lastLength * 8);
  7. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:541 Blake2bDigest blake = new Blake2bDigest(ARGON2_PREHASH_DIGEST_LENGTH * 8);
  8. src/goryachev/memsafecrypto/bc/Blake2bDigest.java:43 public class Blake2bDigest
  9. src/goryachev/memsafecrypto/bc/Blake2bDigest.java:118 public Blake2bDigest()
  10. src/goryachev/memsafecrypto/bc/Blake2bDigest.java:124 public Blake2bDigest(Blake2bDigest digest)
  11. src/goryachev/memsafecrypto/bc/Blake2bDigest.java:145 public Blake2bDigest(int digestSize)
  12. src/goryachev/memsafecrypto/bc/Blake2bDigest.java:168 public Blake2bDigest(byte[] key)
  13. src/goryachev/memsafecrypto/bc/Blake2bDigest.java:201 public Blake2bDigest(byte[] key, int digestLength, byte[] salt, byte[] personalization)
  14. src/goryachev/memsafecrypto/util/MemCrypt.java:75 Blake2bDigest d = new Blake2bDigest(XSalsaTools.KEY_LENGTH_BYTES * 8);
  15. src/goryachev/memsafecrypto/util/MemCrypt.java:92 private static final void update(Blake2bDigest d, int x)
  16. src/goryachev/password/data/v3/EncryptionHandlerV3.java:233 Blake2bDigest d = new Blake2bDigest(NONCE_SIZE_BYTES * 8);
  17. src/goryachev/password/data/v4/EncryptionHandlerV4.java:238 Blake2bDigest d = new Blake2bDigest(NONCE_SIZE_BYTES * 8);
java.bouncycastle.digest · CWE-328
CSPRNG Quantum-safe 9 places See details

Random number generation

`SecureRandom`. A platform CSPRNG is not a quantum exposure; it is recorded because an inventory that omits the randomness source is incomplete. `SHA1PRNG` is named explicitly where it appears, since it is a legacy algorithm even though its output is adequate.

This is where the software gets its random numbers. Quantum computers do not weaken it.

What to do. No action. Prefer the platform default over naming an algorithm.

  1. src/goryachev/common/util/GUID.java:50 new SecureRandom().nextBytes(b);
  2. src/goryachev/crypto/Crypto.java:291 SecureRandom rnd = new SecureRandom();
  3. src/goryachev/crypto/EntropyGathererBase.java:40 jvmRandom = new SecureRandom();
  4. src/goryachev/crypto/MemCrypt.java:36 new SecureRandom().nextBytes(nonce);
  5. src/goryachev/memsafecrypto/CRandomSpi.java:28 SecureRandom r = new SecureRandom();
  6. src/goryachev/memsafecrypto/bc/CryptoServicesRegistrar.java:34 SecureRandom tmp = new SecureRandom();
  7. src/goryachev/memsafecrypto/bc/DigestRandomGenerator.java:13 public class DigestRandomGenerator
  8. src/goryachev/memsafecrypto/util/MemCrypt.java:31 CUtils.nextBytes(new SecureRandom(), nonce);
  9. test/goryachev/password/TestEncryptionHandlers.java:54 test path SecureRandom r = new SecureRandom();
java.rng
scrypt Quantum-safe 7 places See details

Password hashing or key derivation

A `SecretKeyFactory` for PBKDF2, or a BouncyCastle password KDF. Not a quantum exposure, and part of a complete inventory.

This is how passwords are stored. Quantum computers do not meaningfully weaken it.

What to do. PBKDF2 needs a high iteration count. Argon2 through BouncyCastle is stronger.

  1. src/goryachev/memsafecrypto/bc/SCrypt.java:14 public class SCrypt
  2. src/goryachev/memsafecrypto/bc/SCrypt.java:16 private SCrypt()
  3. src/goryachev/password/data/v2/EncryptionHandlerV2.java:86 CByteArray key = SCrypt.generate(pw, salt, n, r, p, KEY_SIZE_BYTES);
  4. src/goryachev/password/data/v2/EncryptionHandlerV2.java:174 CByteArray key = SCrypt.generate(pw, salt, n, r, p, KEY_SIZE_BYTES);
  5. src/goryachev/password/data/v3/EncryptionHandlerV3.java:98 CByteArray key = SCrypt.generate(pw, salt, n, r, p, KEY_SIZE_BYTES);
  6. src/goryachev/password/data/v3/EncryptionHandlerV3.java:183 CByteArray key = SCrypt.generate(pw, salt, n, r, p, KEY_SIZE_BYTES);
  7. test/goryachev/password/TestScryptParameters.java:232 test path SCrypt.generate(pw, s, n, r, p, 32);
java.kdf
SHA-512 Quantum-safe 1 place See details

Digest through BouncyCastle

A BouncyCastle digest class. The digest name is read from the class, so `MD5Digest` and `SHA512Digest` are the same rule with opposite conclusions.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something long-lived. MD5 and SHA-1 need replacing now.

  1. src/goryachev/crypto/EntropyGathererBase.java:42 random = new DigestRandomGenerator(new SHA512Digest());
java.bouncycastle.digest · CWE-328

Cryptographic assets

Algorithm Assessment What it means Occurrences
RSA Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 24
unknown Could not be determined The algorithm could not be established from the source - chosen at runtime, or decided somewhere this scan does not reach. 22
Salsa20 Quantum-safe No known quantum algorithm changes the security margin. The XSalsa20 and XChaCha20 variants share this property. 18
Argon2 Quantum-safe The current recommended password hashing function. Not affected by Shor, and memory-hard against Grover. 17
BLAKE2 Quantum-safe No known quantum algorithm changes the security margin. 17
SHA-256 Reduced margin Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades. 11
CSPRNG Quantum-safe A cryptographically secure random number generator provided by the platform. Not weakened by a quantum computer. 9
AES Reduced margin Grover's algorithm halves the effective strength; the parameter, not the design, is the problem. The key size was not visible at this call site, so the weaker case is assumed. 8
scrypt Quantum-safe No known quantum algorithm changes the security margin. 7
PBKDF2 Reduced margin Not broken by a quantum computer, but weak against modern GPU cracking at low iteration counts, which is a present-day concern. 3
SHA-512 Quantum-safe No known quantum algorithm changes the security margin. 1

Imported cryptographic libraries

Library Files
org.bouncycastle BouncyCastle, whose low-level API bypasses the JCA algorithm strings. It has shipped ML-KEM and ML-DSA since 1.79 12
java.security the JCA 22