Crypto-View

CERT-Polska/drakvuf-sandbox

Readiness score
100 of 100
How this is calculated · previous scan 100
Cryptographic posture
Quantum-vulnerable 1 Reduced margin 2 Quantum-safe 4
To address0
Key establishment0
Inventory only0
Total findings7
What was analysed
Branch master
Commit 7c328ab48bfe07b99c896c8695b7e51edf431ceb Bump version: v0.21.0 (#1220)
Committed 2026-08-19 15:36 UTC
Scanned 2026-09-09 23:57 UTC 1 day ago
Coverage 139 files, 89 python, 29 javascript

Earlier scans of this repository

10 scans · score 100 → 96 · compare any two
10 scans · 100 → 96 (down 4). The filled point is the scan you are reading.
Scanned Commit Score To address
4 hours ago 7c328ab48bfe master 96 2 Compare
5 hours ago 7c328ab48bfe master 99 1 Compare
21 hours ago 7c328ab48bfe master 100 0 Compare
1 day ago 7c328ab48bfe master 100 0 Compare
1 day ago 7c328ab48bfe master 100 0 Compare
1 day ago 7c328ab48bfe master 100 0 Compare
1 day ago this scan 7c328ab48bfe master 100 0
3 days ago 7c328ab48bfe master 100 0 Compare
3 days ago 7c328ab48bfe master 100 0 Compare
8 days ago 7c328ab48bfe master 100 0 Compare

Every repository in this history is re-scanned weekly.

List of cryptographic assets

SHA-256 Reduced margin 1 place See details

Hash function in use

`hashlib.sha256()` and friends. The digest is read from the call, so SHA-384 and above are inventory while the broken ones are reported separately.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something long-lived.

  1. drakrun/analyzer/analysis_metadata.py:19 sample_sha256 = hashlib.sha256()
py.hashlib
CSPRNG Quantum-safe 2 places See details

Random number generation

`secrets.token_bytes()`, `os.urandom()` or `ssl.RAND_bytes()`. Recorded so the inventory names its randomness source.

This is where the software gets its random numbers. Quantum computers do not weaken it.

What to do. No action. `random.random()` is a separate, present-day defect if it reaches key material.

  1. drakrun/analyzer/postprocessing/plugins/karton_integration.py:97 token = secrets.token_urlsafe(32)
  2. drakrun/cli/install.py:86 vnc_passwd = "".join(secrets.choice(passwd_characters) for _ in range(8))
py.rng

Cryptographic assets

Algorithm Assessment What it means Occurrences
CSPRNG Quantum-safe A cryptographically secure random number generator provided by the platform. Not weakened by a quantum computer. 4
SHA-256 Reduced margin Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades. 2
Ed25519 Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 1

Imported cryptographic libraries

Library Files
paramiko — an SSH client and server 1
hashlib — the standard digests, including the broken ones 1
secrets — the platform random source 2