Crypto-View

CERT-Polska/Artemis

Readiness score
74 of 100
How this is calculated · previous scan 74
Cryptographic posture
Quantum-vulnerable 10 Reduced margin 8 Quantum-safe 14
To address4
Key establishment8
Inventory only4
Total findings36
What was analysed
Branch main
Commit 31d69dceb7296ccc91f70109a9e8a972c027c4a8 clean nuclei templates grouping (#3125)
Committed 2026-09-07 18:22 UTC
Scanned 2026-09-07 18:36 UTC 3 days ago
Coverage 383 files, 2 go, 295 python, 1 javascript

Earlier scans of this repository

11 scans · score 74 → 74 · compare any two
11 scans · 74 → 74 (unchanged). The filled point is the scan you are reading.
Scanned Commit Score To address
4 hours ago d922f6192629 main 74 4 Compare
5 hours ago d922f6192629 main 74 4 Compare
21 hours ago 24ae4dfcb61c main 74 4 Compare
1 day ago 24ae4dfcb61c main 74 4 Compare
1 day ago 24ae4dfcb61c main 74 4 Compare
1 day ago 24ae4dfcb61c main 74 4 Compare
1 day ago 24ae4dfcb61c main 74 4 Compare
3 days ago 31d69dceb729 main 74 4 Compare
3 days ago this scan 31d69dceb729 main 74 4
4 days ago 1f2f3448f92f main 74 4 Compare
8 days ago f8e92a71c936 main 74 4 Compare

Every repository in this history is re-scanned weekly.

List of cryptographic assets

RSA2048-bit Quantum-vulnerable Recorded traffic 1 place See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

  1. test/images/nginx-with-sni-tls/certs/server.crt:1 test path -----BEGIN CERTIFICATE-----
pem.certificate
RSA2048-bit Quantum-vulnerable Recorded traffic 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

  1. test/images/nginx-with-sni-tls/certs/server.key:1 test path -----BEGIN PRIVATE KEY-----
pem.private-key · CWE-321, CWE-327
TLS Quantum-vulnerable Recorded traffic 1 place See details

TLS protocol version pinned in code

An `ssl.PROTOCOL_*` constant or `ssl.SSLContext(...)`. Versions below TLS 1.2 are broken classically; TLS 1.2 and 1.3 both negotiate a classical key exchange.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Every TLS cipher suite in general use negotiates a classical key exchange, so a recorded session is decryptable once that exchange falls.

What to do. TLS 1.3, and add a hybrid key-exchange group once the platform offers one.

  1. artemis/modules/port_scanner.py:76 SSL_CONTEXT = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
py.ssl.protocol · CWE-757
TLS Quantum-vulnerable Recorded traffic 1 place See details

TLS configuration in code

A `tls.Config` field pinning versions, cipher suites or curve preferences. Every available suite negotiates a classical key exchange.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Every TLS cipher suite in general use negotiates a classical key exchange, so a recorded session is decryptable once that exchange falls.

What to do. Set `MinVersion: tls.VersionTLS13`. Go 1.24 enables the hybrid X25519MLKEM768 group by default, which is the single highest-value change available today.

  1. artemis/modules/utils/wappalyzer/main.go:26 TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
go.tls.config · CWE-757
SHA-256 Reduced margin 4 places See details

Hash function in use

`hashlib.sha256()` and friends. The digest is read from the call, so SHA-384 and above are inventory while the broken ones are reported separately.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something long-lived.

  1. artemis/cpe_tools/cpe_main_process.py:135 h = hashlib.sha256()
  2. artemis/crawling.py:138 return hashlib.sha256("|".join(parts).encode()).hexdigest()
  3. artemis/db.py:546 "deduplication_data": hashlib.sha256(self._get_task_deduplication_data(task).encode("utf-8")).hexdigest(),
  4. artemis/reporting/task_handler.py:42 / (hashlib.sha256(existing_task.output_location.encode("ascii")).hexdigest() + ".json"),
py.hashlib
unknown Could not be determined 3 places See details

Cryptographic library in the dependency manifest

A dependency known to implement classical asymmetric cryptography. Its presence is inventory, not a finding about this codebase: the library may never be called with a quantum-vulnerable algorithm.

The project depends on a cryptography library. Listed so the inventory is complete; it is not by itself a problem.

What to do. Check the version. Several of these libraries have shipped ML-KEM and ML-DSA support since 2024, so the migration may need an upgrade rather than a replacement.

  1. docker/go.mod:417 golang.org/x/crypto v0.53.0 // indirect
  2. docs/requirements.txt:34 cryptography==48.0.1
  3. requirements.txt:33 cryptography==48.0.1
dep.crypto-library
CSPRNG Quantum-safe 11 places See details

Random number generation

`secrets.token_bytes()`, `os.urandom()` or `ssl.RAND_bytes()`. Recorded so the inventory names its randomness source.

This is where the software gets its random numbers. Quantum computers do not weaken it.

What to do. No action. `random.random()` is a separate, present-day defect if it reaches key material.

  1. artemis/auth.py:29 secret = base64.b64encode(os.urandom(32)).decode("ascii")
  2. artemis/command_injection_data.py:25 left = secrets.token_hex(4)
  3. artemis/csrf.py:31 secret = base64.b64encode(os.urandom(32))
  4. artemis/modules/admin_panel_login_bruter.py:460 binascii.hexlify(os.urandom(16)).decode("ascii"),
  5. artemis/modules/api_scanner.py:61 temp_file = f"/tmp/api_spec_{os.urandom(8).hex()}"
  6. artemis/modules/ftp_bruter.py:94 f"STOR {Config.Modules.FTPBruter.FTP_BRUTER_TEST_FILE_NAME_PREFIX}-{binascii.hexlify(os.urandom(10)).decode('ascii')}.txt",
  7. artemis/modules/mail_dns_scanner.py:153 random_token = os.urandom(8).hex()
  8. artemis/modules/removed_domain_existing_vhost.py:91 prefix = binascii.hexlify(os.urandom(3)).decode("ascii")
  9. artemis/modules/subdomain_enumeration.py:225 wildcard_ips.update(lookup(binascii.hexlify(os.urandom(5)).decode("ascii") + "." + domain))
  10. artemis/modules/wordpress_plugins.py:347 cachebuster = "?" + binascii.hexlify(os.urandom(10)).decode("ascii")
  11. test/data/orm_injection/src/settings.py:24 test path SECRET_KEY = binascii.hexlify(os.urandom(32))
py.rng
ML-KEM-768 Quantum-safe 1 place See details

Cryptographic library in the dependency manifest

A dependency known to implement classical asymmetric cryptography. Its presence is inventory, not a finding about this codebase: the library may never be called with a quantum-vulnerable algorithm.

The project depends on a cryptography library. Listed so the inventory is complete; it is not by itself a problem.

What to do. Check the version. Several of these libraries have shipped ML-KEM and ML-DSA support since 2024, so the migration may need an upgrade rather than a replacement.

  1. docker/go.mod:106 github.com/cloudflare/circl v1.6.3 // indirect
dep.crypto-library

Cryptographic assets

Algorithm Assessment What it means Occurrences
CSPRNG Quantum-safe A cryptographically secure random number generator provided by the platform. Not weakened by a quantum computer. 12
SHA-256 Reduced margin Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades. 8
TLS Quantum-vulnerable Every TLS cipher suite in general use negotiates a classical key exchange, so a recorded session is decryptable once that exchange falls. 6
RSA Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 2
HMAC Quantum-safe A keyed MAC is not affected by Shor and only marginally by Grover. 2
Ed25519 Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 2

Imported cryptographic libraries

Library Files
ssl — the TLS client and server 3
paramiko — an SSH client and server 2
crypto/tls — the TLS client and server 1
hashlib — the standard digests, including the broken ones 4
hmac — keyed message authentication 2
secrets — the platform random source 1