Crypto-View

smallstep/certificates

Cryptographic posture

1287 cryptographic locations: 87 already broken, 944 quantum-vulnerable, 23 reduced-margin, 185 undetermined, 48 quantum-safe

234 establish keys, so traffic protected by them and recorded today becomes readable once the algorithm falls. 1 imported cryptographic library is listed separately. 479 files analysed.

Quantum-vulnerable 944 Already broken 87 Reduced margin 23 Could not be determined 185 Quantum-safe 48
To address902
Key establishment234
Inventory only1
Total findings1288
What was analysed
Branch master
Commit f35d82e63d0b6ba6203d70b3f07209a13afdde36 Merge pull request #2782 from smallstep/dependabot/go_modules/github.com/slackhq/nebula-1.11.1
Committed 2026-09-17 10:59 UTC
Scanned 2026-09-20 03:32 UTC 2 hours ago
Coverage 479 files, 340 go

Earlier scans of this repository

16 scans · compare any two
0 to 1000 locations Already broken 9 → 87 (up 78) Quantum-vulnerable 583 → 944 (up 361) Reduced margin 23 → 23 (unchanged) Could not be determined 182 → 185 (up 3) Quantum-safe 42 → 48 (up 6) The filled point is the scan you are reading.
Scanned Commit To address Key establishment
2 hours ago this scan f35d82e63d0b master 902 234
7 days ago fa946c527a6c master 900 235 Compare
9 days ago fa946c527a6c master 895 233 Compare
9 days ago fa946c527a6c master 444 95 Compare
9 days ago b4518162981a 448 100 Compare
9 days ago fa946c527a6c master 444 96 Compare
10 days ago fa946c527a6c master 444 96 Compare
10 days ago fa946c527a6c master 444 96 Compare
10 days ago fa946c527a6c master 444 96 Compare
10 days ago fa946c527a6c master 444 96 Compare
10 days ago fa946c527a6c master 444 96 Compare
12 days ago bb481fbf670c master 458 150 Compare
12 days ago bb481fbf670c master 458 212 Compare
14 days ago bb481fbf670c master 458 212 Compare
20 days ago 3f006a5d3288 master 458 212 Compare
20 days ago b4518162981a 462 216 Compare

Every repository in this history is re-scanned weekly.

List of cryptographic assets

RSA-10241024-bit Already broken 37 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

  1. authority/provisioner/aws_certificates.pem:6 -----BEGIN CERTIFICATE-----
  2. authority/provisioner/aws_certificates.pem:27 -----BEGIN CERTIFICATE-----
  3. authority/provisioner/aws_certificates.pem:48 -----BEGIN CERTIFICATE-----
  4. authority/provisioner/aws_certificates.pem:69 -----BEGIN CERTIFICATE-----
  5. authority/provisioner/aws_certificates.pem:90 -----BEGIN CERTIFICATE-----
  6. authority/provisioner/aws_certificates.pem:106 -----BEGIN CERTIFICATE-----
  7. authority/provisioner/aws_certificates.pem:123 -----BEGIN CERTIFICATE-----
  8. authority/provisioner/aws_certificates.pem:139 -----BEGIN CERTIFICATE-----
  9. authority/provisioner/aws_certificates.pem:161 -----BEGIN CERTIFICATE-----
  10. authority/provisioner/aws_certificates.pem:182 -----BEGIN CERTIFICATE-----
  11. authority/provisioner/aws_certificates.pem:203 -----BEGIN CERTIFICATE-----
  12. authority/provisioner/aws_certificates.pem:224 -----BEGIN CERTIFICATE-----
  13. authority/provisioner/aws_certificates.pem:240 -----BEGIN CERTIFICATE-----
  14. authority/provisioner/aws_certificates.pem:261 -----BEGIN CERTIFICATE-----
  15. authority/provisioner/aws_certificates.pem:277 -----BEGIN CERTIFICATE-----
  16. authority/provisioner/aws_certificates.pem:298 -----BEGIN CERTIFICATE-----
  17. authority/provisioner/aws_certificates.pem:319 -----BEGIN CERTIFICATE-----
  18. authority/provisioner/aws_certificates.pem:335 -----BEGIN CERTIFICATE-----
  19. authority/provisioner/aws_certificates.pem:351 -----BEGIN CERTIFICATE-----
  20. authority/provisioner/aws_certificates.pem:367 -----BEGIN CERTIFICATE-----
  21. authority/provisioner/aws_certificates.pem:383 -----BEGIN CERTIFICATE-----
  22. authority/provisioner/aws_certificates.pem:399 -----BEGIN CERTIFICATE-----
  23. authority/provisioner/aws_certificates.pem:420 -----BEGIN CERTIFICATE-----
  24. authority/provisioner/aws_certificates.pem:441 -----BEGIN CERTIFICATE-----
  25. authority/provisioner/aws_certificates.pem:457 -----BEGIN CERTIFICATE-----
  26. authority/provisioner/aws_certificates.pem:478 -----BEGIN CERTIFICATE-----
  27. authority/provisioner/aws_certificates.pem:499 -----BEGIN CERTIFICATE-----
  28. authority/provisioner/aws_certificates.pem:515 -----BEGIN CERTIFICATE-----
  29. authority/provisioner/aws_certificates.pem:536 -----BEGIN CERTIFICATE-----
  30. authority/provisioner/aws_certificates.pem:557 -----BEGIN CERTIFICATE-----
  31. authority/provisioner/aws_certificates.pem:578 -----BEGIN CERTIFICATE-----
  32. authority/provisioner/aws_certificates.pem:599 -----BEGIN CERTIFICATE-----
  33. authority/provisioner/aws_certificates.pem:620 -----BEGIN CERTIFICATE-----
  34. authority/provisioner/testdata/certs/aws-test.crt:1 test path -----BEGIN CERTIFICATE-----
  35. authority/provisioner/testdata/certs/aws-test.crt:20 test path -----BEGIN CERTIFICATE-----
  36. authority/provisioner/testdata/certs/aws.crt:1 test path -----BEGIN CERTIFICATE-----
  37. authority/provisioner/utils_test.go:58 test path -----BEGIN CERTIFICATE-----
pem.certificate
RSAES-PKCS1v15 Already broken Recorded traffic 21 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

  1. authority/config/tls_options.go:121 "TLS_RSA_WITH_RC4_128_SHA": tls.TLS_RSA_WITH_RC4_128_SHA, // lgtm[go/insecure-tls]
  2. authority/config/tls_options.go:122 "TLS_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
  3. authority/config/tls_options.go:123 "TLS_RSA_WITH_AES_128_CBC_SHA": tls.TLS_RSA_WITH_AES_128_CBC_SHA,
  4. authority/config/tls_options.go:124 "TLS_RSA_WITH_AES_256_CBC_SHA": tls.TLS_RSA_WITH_AES_256_CBC_SHA,
  5. authority/config/tls_options.go:125 "TLS_RSA_WITH_AES_128_CBC_SHA256": tls.TLS_RSA_WITH_AES_128_CBC_SHA256, // lgtm[go/insecure-tls]
  6. authority/config/tls_options.go:126 "TLS_RSA_WITH_AES_128_GCM_SHA256": tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
  7. authority/config/tls_options.go:127 "TLS_RSA_WITH_AES_256_GCM_SHA384": tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
  8. authority/config/tls_options_test.go:59 test path {"TLS_RSA_WITH_RC4_128_SHA", CipherSuites{"TLS_RSA_WITH_RC4_128_SHA"}, false},
  9. authority/config/tls_options_test.go:60 test path {"TLS_RSA_WITH_3DES_EDE_CBC_SHA", CipherSuites{"TLS_RSA_WITH_3DES_EDE_CBC_SHA"}, false},
  10. authority/config/tls_options_test.go:61 test path {"TLS_RSA_WITH_AES_128_CBC_SHA", CipherSuites{"TLS_RSA_WITH_AES_128_CBC_SHA"}, false},
  11. authority/config/tls_options_test.go:62 test path {"TLS_RSA_WITH_AES_256_CBC_SHA", CipherSuites{"TLS_RSA_WITH_AES_256_CBC_SHA"}, false},
  12. authority/config/tls_options_test.go:63 test path {"TLS_RSA_WITH_AES_128_CBC_SHA256", CipherSuites{"TLS_RSA_WITH_AES_128_CBC_SHA256"}, false},
  13. authority/config/tls_options_test.go:64 test path {"TLS_RSA_WITH_AES_128_GCM_SHA256", CipherSuites{"TLS_RSA_WITH_AES_128_GCM_SHA256"}, false},
  14. authority/config/tls_options_test.go:65 test path {"TLS_RSA_WITH_AES_256_GCM_SHA384", CipherSuites{"TLS_RSA_WITH_AES_256_GCM_SHA384"}, false},
  15. authority/config/tls_options_test.go:98 test path {"TLS_RSA_WITH_RC4_128_SHA", CipherSuites{"TLS_RSA_WITH_RC4_128_SHA"}, []uint16{tls.TLS_RSA_WITH_RC4_128_SHA}},
  16. authority/config/tls_options_test.go:99 test path {"TLS_RSA_WITH_3DES_EDE_CBC_SHA", CipherSuites{"TLS_RSA_WITH_3DES_EDE_CBC_SHA"}, []uint16{tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA}},
  17. authority/config/tls_options_test.go:100 test path {"TLS_RSA_WITH_AES_128_CBC_SHA", CipherSuites{"TLS_RSA_WITH_AES_128_CBC_SHA"}, []uint16{tls.TLS_RSA_WITH_AES_128_CBC_SHA}},
  18. authority/config/tls_options_test.go:101 test path {"TLS_RSA_WITH_AES_256_CBC_SHA", CipherSuites{"TLS_RSA_WITH_AES_256_CBC_SHA"}, []uint16{tls.TLS_RSA_WITH_AES_256_CBC_SHA}},
  19. authority/config/tls_options_test.go:102 test path {"TLS_RSA_WITH_AES_128_CBC_SHA256", CipherSuites{"TLS_RSA_WITH_AES_128_CBC_SHA256"}, []uint16{tls.TLS_RSA_WITH_AES_128_CBC_SHA256}},
  20. authority/config/tls_options_test.go:103 test path {"TLS_RSA_WITH_AES_128_GCM_SHA256", CipherSuites{"TLS_RSA_WITH_AES_128_GCM_SHA256"}, []uint16{tls.TLS_RSA_WITH_AES_128_GCM_SHA256}},
  21. authority/config/tls_options_test.go:104 test path {"TLS_RSA_WITH_AES_256_GCM_SHA384", CipherSuites{"TLS_RSA_WITH_AES_256_GCM_SHA384"}, []uint16{tls.TLS_RSA_WITH_AES_256_GCM_SHA384}},
config.cipher-suite · CWE-757
RC4 Already broken 7 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

  1. authority/config/tls_options.go:121 "TLS_RSA_WITH_RC4_128_SHA": tls.TLS_RSA_WITH_RC4_128_SHA, // lgtm[go/insecure-tls]
  2. authority/config/tls_options.go:128 "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA": tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, // lgtm[go/insecure-tls]
  3. authority/config/tls_options.go:131 "TLS_ECDHE_RSA_WITH_RC4_128_SHA": tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, // lgtm[go/insecure-tls]
  4. authority/config/tls_options_test.go:59 test path {"TLS_RSA_WITH_RC4_128_SHA", CipherSuites{"TLS_RSA_WITH_RC4_128_SHA"}, false},
  5. authority/config/tls_options_test.go:66 test path {"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", CipherSuites{"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"}, false},
  6. authority/config/tls_options_test.go:98 test path {"TLS_RSA_WITH_RC4_128_SHA", CipherSuites{"TLS_RSA_WITH_RC4_128_SHA"}, []uint16{tls.TLS_RSA_WITH_RC4_128_SHA}},
  7. authority/config/tls_options_test.go:105 test path {"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", CipherSuites{"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA}},
config.cipher-suite · CWE-757
3DES Already broken 6 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

  1. authority/config/tls_options.go:122 "TLS_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
  2. authority/config/tls_options.go:132 "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
  3. authority/config/tls_options_test.go:60 test path {"TLS_RSA_WITH_3DES_EDE_CBC_SHA", CipherSuites{"TLS_RSA_WITH_3DES_EDE_CBC_SHA"}, false},
  4. authority/config/tls_options_test.go:73 test path {"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", CipherSuites{"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"}, false},
  5. authority/config/tls_options_test.go:99 test path {"TLS_RSA_WITH_3DES_EDE_CBC_SHA", CipherSuites{"TLS_RSA_WITH_3DES_EDE_CBC_SHA"}, []uint16{tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA}},
  6. authority/config/tls_options_test.go:112 test path {"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", CipherSuites{"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"}, []uint16{tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA}},
config.cipher-suite · CWE-757
RSA-10241024-bit Already broken Recorded traffic 5 places See details

RSA in the Go standard library

`rsa.GenerateKey()`, `rsa.SignPKCS1v15()`, `rsa.EncryptOAEP()` or an import of `crypto/rsa`.

This is already unsafe today, with no quantum computer involved. A modulus of 1024 bits or less is below the NIST SP 800-57 floor and is within reach of classical factorisation. Shor is not the nearest problem here.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Go 1.24 ships ML-KEM as `crypto/mlkem`.

  1. authority/provisioner/aws_test.go:755 test path rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)
  2. authority/provisioner/azure_test.go:667 test path rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)
  3. authority/provisioner/gcp_test.go:649 test path rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)
  4. authority/provisioner/jwk_test.go:423 test path rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)
  5. authority/provisioner/oidc_test.go:559 test path rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)
go.rsa · CWE-327
SHA-1 Already broken 4 places See details

Broken hash function

An import of `crypto/md5` or `crypto/sha1`, or a call to `New()` on either.

This is already unsafe today, with no quantum computer involved. SHAttered and subsequent work produced practical collisions; NIST withdrew SHA-1 in 2030 guidance and it is already unacceptable for signatures.

What to do. `crypto/sha256`, or `crypto/sha512` for long-lived signatures.

  1. authority/provisioner/collection.go:325 sum := sha1.Sum([]byte(p.GetID()))
  2. authority/tls_test.go:224 test path hash := sha1.Sum(info.SubjectPublicKey.Bytes)
  3. ca/ca_test.go:70 test path hash := sha1.Sum(info.SubjectPublicKey.Bytes)
  4. test/integration/scep/common_test.go:456 test path h := sha1.Sum(publicKeyBytes)
go.hash.weak · CWE-328
RSA-10241048-bit Already broken 1 place See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

  1. authority/provisioner/testdata/certs/short-rsa.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----
pem.certificate-request
RSA-10241024-bit Already broken 1 place See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

  1. authority/tls_test.go:372 test path -----BEGIN CERTIFICATE REQUEST-----
pem.certificate-request
ECDSA Quantum-vulnerable 303 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. acme/account_test.go:23 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  2. acme/account_test.go:32 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  3. acme/api/account_test.go:521 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  4. acme/api/account_test.go:541 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  5. acme/api/account_test.go:560 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  6. acme/api/account_test.go:585 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  7. acme/api/account_test.go:660 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  8. acme/api/account_test.go:691 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  9. acme/api/account_test.go:710 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  10. acme/api/account_test.go:750 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  11. acme/api/eab_test.go:20 test path jwkX, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  12. acme/api/eab_test.go:22 test path jwkY, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  13. acme/api/eab_test.go:24 test path wrongJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  14. acme/api/eab_test.go:92 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  15. acme/api/eab_test.go:115 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  16. acme/api/eab_test.go:177 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  17. acme/api/eab_test.go:201 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  18. acme/api/eab_test.go:226 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  19. acme/api/eab_test.go:272 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  20. acme/api/eab_test.go:319 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  21. acme/api/eab_test.go:368 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  22. acme/api/eab_test.go:417 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  23. acme/api/eab_test.go:466 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  24. acme/api/eab_test.go:523 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  25. acme/api/eab_test.go:570 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  26. acme/api/eab_test.go:629 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  27. acme/api/eab_test.go:684 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  28. acme/api/eab_test.go:686 test path differentJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  29. acme/api/eab_test.go:741 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  30. acme/api/eab_test.go:795 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  31. acme/api/eab_test.go:907 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  32. acme/api/eab_test.go:919 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  33. acme/api/eab_test.go:931 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  34. acme/api/eab_test.go:943 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  35. acme/api/eab_test.go:955 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  36. acme/api/eab_test.go:967 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  37. acme/api/eab_test.go:980 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  38. acme/api/eab_test.go:1018 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  39. acme/api/eab_test.go:1055 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  40. acme/api/eab_test.go:1093 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  41. acme/api/handler_test.go:661 test path _jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  42. acme/api/handler_test.go:701 test path _jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  43. acme/api/middleware_test.go:364 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  44. acme/api/middleware_test.go:421 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  45. acme/api/middleware_test.go:476 test path _jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  46. acme/api/middleware_test.go:500 test path _jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  47. acme/api/middleware_test.go:614 test path "alg": "ES256",
  48. acme/api/middleware_test.go:680 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  49. acme/api/middleware_test.go:979 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  50. acme/api/middleware_test.go:1263 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  51. acme/api/middleware_test.go:1379 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  52. acme/api/middleware_test.go:1459 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  53. acme/api/middleware_test.go:1551 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  54. acme/api/middleware_test.go:1627 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  55. acme/api/middleware_test.go:1665 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  56. acme/api/middleware_test.go:1820 test path "alg": "ES256",
  57. acme/api/middleware_test.go:1835 test path "alg": "ES256",
  58. acme/api/middleware_test.go:1850 test path "alg": "ES256",
  59. acme/api/order_test.go:568 test path Algorithms: []string{"ES256"},
  60. acme/api/order_test.go:572 test path SignatureAlgorithms: []string{"ES256"},
  61. acme/api/order_test.go:2012 test path Algorithms: []string{"ES256"},
  62. acme/api/order_test.go:2016 test path SignatureAlgorithms: []string{"ES256"},
  63. acme/api/revoke_test.go:152 test path return "ES256", crypto.SHA256
  64. acme/api/revoke_test.go:154 test path return "ES384", crypto.SHA384
  65. acme/api/revoke_test.go:156 test path return "ES512", crypto.SHA512
  66. acme/api/wire_integration_test.go:132 test path accessTokenSignerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  67. acme/api/wire_integration_test.go:145 test path oidcTokenSignerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  68. acme/api/wire_integration_test.go:173 test path Algorithms: []string{"ES256"},
  69. acme/api/wire_integration_test.go:177 test path SignatureAlgorithms: []string{"ES256"},
  70. acme/challenge_test.go:132 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  71. acme/challenge_test.go:514 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  72. acme/challenge_test.go:525 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  73. acme/challenge_test.go:837 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  74. acme/challenge_test.go:883 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  75. acme/challenge_test.go:1027 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  76. acme/challenge_test.go:1081 test path Algorithms: []string{"ES256"},
  77. acme/challenge_test.go:1085 test path SignatureAlgorithms: []string{"ES256"},
  78. acme/challenge_test.go:1136 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  79. acme/challenge_test.go:1190 test path Algorithms: []string{"ES256"},
  80. acme/challenge_test.go:1194 test path SignatureAlgorithms: []string{"ES256"},
  81. acme/challenge_test.go:1236 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  82. acme/challenge_test.go:1326 test path Algorithms: []string{"ES256"},
  83. acme/challenge_test.go:1330 test path SignatureAlgorithms: []string{"ES256"},
  84. acme/challenge_test.go:1387 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  85. acme/challenge_test.go:1477 test path Algorithms: []string{"ES256"},
  86. acme/challenge_test.go:1481 test path SignatureAlgorithms: []string{"ES256"},
  87. acme/challenge_test.go:1565 test path "id_token_signing_alg_values_supported": ["ES256"]
  88. acme/challenge_test.go:1775 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  89. acme/challenge_test.go:1799 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  90. acme/challenge_test.go:1842 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  91. acme/challenge_test.go:1886 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  92. acme/challenge_test.go:1929 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  93. acme/challenge_test.go:2075 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  94. acme/challenge_test.go:2098 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  95. acme/challenge_test.go:2141 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  96. acme/challenge_test.go:2183 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  97. acme/challenge_test.go:2227 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  98. acme/challenge_test.go:2563 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  99. acme/challenge_test.go:2601 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  100. acme/challenge_test.go:2640 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  101. acme/challenge_test.go:2684 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  102. acme/challenge_test.go:2729 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  103. acme/challenge_test.go:2773 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  104. acme/challenge_test.go:2817 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  105. acme/challenge_test.go:2844 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  106. acme/challenge_test.go:2884 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  107. acme/challenge_test.go:2925 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  108. acme/challenge_test.go:2969 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  109. acme/challenge_test.go:3014 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  110. acme/challenge_test.go:3054 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  111. acme/challenge_test.go:3095 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  112. acme/challenge_test.go:3142 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  113. acme/challenge_test.go:3190 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  114. acme/challenge_test.go:3235 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  115. acme/challenge_test.go:3281 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  116. acme/challenge_test.go:3319 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  117. acme/challenge_test.go:3685 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  118. acme/challenge_test.go:3927 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  119. acme/challenge_test.go:4680 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  120. acme/challenge_test.go:4815 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  121. acme/challenge_tpmsimulator_test.go:485 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  122. acme/challenge_wire_test.go:57 test path Algorithms: []string{"ES256"},
  123. acme/challenge_wire_test.go:61 test path SignatureAlgorithms: []string{"ES256"},
  124. acme/challenge_wire_test.go:88 test path Algorithms: []string{"ES256"},
  125. acme/challenge_wire_test.go:92 test path SignatureAlgorithms: []string{"ES256"},
  126. acme/challenge_wire_test.go:130 test path Algorithms: []string{"ES256"},
  127. acme/challenge_wire_test.go:134 test path SignatureAlgorithms: []string{"ES256"},
  128. acme/challenge_wire_test.go:172 test path Algorithms: []string{"ES256"},
  129. acme/challenge_wire_test.go:176 test path SignatureAlgorithms: []string{"ES256"},
  130. acme/challenge_wire_test.go:226 test path Algorithms: []string{"ES256"},
  131. acme/challenge_wire_test.go:230 test path SignatureAlgorithms: []string{"ES256"},
  132. acme/challenge_wire_test.go:300 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  133. acme/challenge_wire_test.go:391 test path Algorithms: []string{"ES256"},
  134. acme/challenge_wire_test.go:395 test path SignatureAlgorithms: []string{"ES256"},
  135. acme/challenge_wire_test.go:448 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  136. acme/challenge_wire_test.go:539 test path Algorithms: []string{"ES256"},
  137. acme/challenge_wire_test.go:543 test path SignatureAlgorithms: []string{"ES256"},
  138. acme/challenge_wire_test.go:600 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  139. acme/challenge_wire_test.go:691 test path Algorithms: []string{"ES256"},
  140. acme/challenge_wire_test.go:695 test path SignatureAlgorithms: []string{"ES256"},
  141. acme/challenge_wire_test.go:752 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  142. acme/challenge_wire_test.go:843 test path Algorithms: []string{"ES256"},
  143. acme/challenge_wire_test.go:847 test path SignatureAlgorithms: []string{"ES256"},
  144. acme/challenge_wire_test.go:910 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  145. acme/challenge_wire_test.go:1000 test path Algorithms: []string{"ES256"},
  146. acme/challenge_wire_test.go:1004 test path SignatureAlgorithms: []string{"ES256"},
  147. acme/challenge_wire_test.go:1055 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  148. acme/challenge_wire_test.go:1145 test path Algorithms: []string{"ES256"},
  149. acme/challenge_wire_test.go:1149 test path SignatureAlgorithms: []string{"ES256"},
  150. acme/challenge_wire_test.go:1200 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  151. acme/challenge_wire_test.go:1290 test path Algorithms: []string{"ES256"},
  152. acme/challenge_wire_test.go:1294 test path SignatureAlgorithms: []string{"ES256"},
  153. acme/challenge_wire_test.go:1340 test path maliciousJwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  154. acme/challenge_wire_test.go:1347 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  155. acme/challenge_wire_test.go:1437 test path Algorithms: []string{"ES256"},
  156. acme/challenge_wire_test.go:1441 test path SignatureAlgorithms: []string{"ES256"},
  157. acme/challenge_wire_test.go:1488 test path maliciousJwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  158. acme/challenge_wire_test.go:1495 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  159. acme/challenge_wire_test.go:1585 test path Algorithms: []string{"ES256"},
  160. acme/challenge_wire_test.go:1589 test path SignatureAlgorithms: []string{"ES256"},
  161. acme/challenge_wire_test.go:1641 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  162. acme/challenge_wire_test.go:1731 test path Algorithms: []string{"ES256"},
  163. acme/challenge_wire_test.go:1735 test path SignatureAlgorithms: []string{"ES256"},
  164. acme/challenge_wire_test.go:1786 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  165. acme/challenge_wire_test.go:1876 test path Algorithms: []string{"ES256"},
  166. acme/challenge_wire_test.go:1880 test path SignatureAlgorithms: []string{"ES256"},
  167. acme/challenge_wire_test.go:1931 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  168. acme/challenge_wire_test.go:2021 test path Algorithms: []string{"ES256"},
  169. acme/challenge_wire_test.go:2025 test path SignatureAlgorithms: []string{"ES256"},
  170. acme/challenge_wire_test.go:2076 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  171. acme/challenge_wire_test.go:2166 test path Algorithms: []string{"ES256"},
  172. acme/challenge_wire_test.go:2170 test path SignatureAlgorithms: []string{"ES256"},
  173. acme/challenge_wire_test.go:2221 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  174. acme/challenge_wire_test.go:2223 test path maliciousSignerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  175. acme/challenge_wire_test.go:2313 test path Algorithms: []string{"ES256"},
  176. acme/challenge_wire_test.go:2317 test path SignatureAlgorithms: []string{"ES256"},
  177. acme/challenge_wire_test.go:2368 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  178. acme/challenge_wire_test.go:2458 test path Algorithms: []string{"ES256"},
  179. acme/challenge_wire_test.go:2462 test path SignatureAlgorithms: []string{"ES256"},
  180. acme/challenge_wire_test.go:2514 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  181. acme/challenge_wire_test.go:2604 test path Algorithms: []string{"ES256"},
  182. acme/challenge_wire_test.go:2608 test path SignatureAlgorithms: []string{"ES256"},
  183. acme/challenge_wire_test.go:2712 test path Algorithms: []string{"ES256"},
  184. acme/challenge_wire_test.go:2716 test path SignatureAlgorithms: []string{"ES256"},
  185. acme/challenge_wire_test.go:2743 test path Algorithms: []string{"ES256"},
  186. acme/challenge_wire_test.go:2747 test path SignatureAlgorithms: []string{"ES256"},
  187. acme/challenge_wire_test.go:2792 test path Algorithms: []string{"ES256"},
  188. acme/challenge_wire_test.go:2796 test path SignatureAlgorithms: []string{"ES256"},
  189. acme/challenge_wire_test.go:2830 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  190. acme/challenge_wire_test.go:2837 test path anotherSignerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  191. acme/challenge_wire_test.go:2886 test path Algorithms: []string{"ES256"},
  192. acme/challenge_wire_test.go:2890 test path SignatureAlgorithms: []string{"ES256"},
  193. acme/challenge_wire_test.go:2939 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  194. acme/challenge_wire_test.go:2993 test path Algorithms: []string{"ES256"},
  195. acme/challenge_wire_test.go:2997 test path SignatureAlgorithms: []string{"ES256"},
  196. acme/challenge_wire_test.go:3046 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  197. acme/challenge_wire_test.go:3100 test path Algorithms: []string{"ES256"},
  198. acme/challenge_wire_test.go:3104 test path SignatureAlgorithms: []string{"ES256"},
  199. acme/challenge_wire_test.go:3149 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
  200. acme/challenge_wire_test.go:3203 test path Algorithms: []string{"ES256"},

Showing the first 200. The CBOM has every one.

jose.algorithm · CWE-327
ECDH Quantum-vulnerable Recorded traffic 119 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

  1. authority/config/config_test.go:168 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
  2. authority/config/config_test.go:177 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
  3. authority/config/config_test.go:197 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
  4. authority/config/tls_options.go:20 "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
  5. authority/config/tls_options.go:21 "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
  6. authority/config/tls_options.go:26 "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
  7. authority/config/tls_options.go:27 "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
  8. authority/config/tls_options.go:28 "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
  9. authority/config/tls_options.go:29 "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
  10. authority/config/tls_options.go:30 "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
  11. authority/config/tls_options.go:31 "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
  12. authority/config/tls_options.go:34 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
  13. authority/config/tls_options.go:35 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
  14. authority/config/tls_options.go:36 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
  15. authority/config/tls_options.go:37 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
  16. authority/config/tls_options.go:128 "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA": tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, // lgtm[go/insecure-tls]
  17. authority/config/tls_options.go:129 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
  18. authority/config/tls_options.go:130 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
  19. authority/config/tls_options.go:131 "TLS_ECDHE_RSA_WITH_RC4_128_SHA": tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, // lgtm[go/insecure-tls]
  20. authority/config/tls_options.go:132 "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
  21. authority/config/tls_options.go:133 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
  22. authority/config/tls_options.go:134 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
  23. authority/config/tls_options.go:135 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, // lgtm[go/insecure-tls]
  24. authority/config/tls_options.go:136 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, // lgtm[go/insecure-tls]
  25. authority/config/tls_options.go:137 "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
  26. authority/config/tls_options.go:138 "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
  27. authority/config/tls_options.go:139 "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
  28. authority/config/tls_options.go:140 "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
  29. authority/config/tls_options.go:141 "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256": tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
  30. authority/config/tls_options.go:142 "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
  31. authority/config/tls_options.go:150 "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305": tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
  32. authority/config/tls_options.go:151 "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
  33. authority/config/tls_options_test.go:66 test path {"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", CipherSuites{"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"}, false},
  34. authority/config/tls_options_test.go:67 test path {"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA"}, false},
  35. authority/config/tls_options_test.go:68 test path {"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"}, false},
  36. authority/config/tls_options_test.go:69 test path {"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"}, false},
  37. authority/config/tls_options_test.go:70 test path {"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"}, false},
  38. authority/config/tls_options_test.go:71 test path {"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"}, false},
  39. authority/config/tls_options_test.go:72 test path {"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", CipherSuites{"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305"}, false},
  40. authority/config/tls_options_test.go:73 test path {"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", CipherSuites{"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"}, false},
  41. authority/config/tls_options_test.go:74 test path {"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"}, false},
  42. authority/config/tls_options_test.go:75 test path {"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"}, false},
  43. authority/config/tls_options_test.go:76 test path {"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"}, false},
  44. authority/config/tls_options_test.go:77 test path {"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"}, false},
  45. authority/config/tls_options_test.go:78 test path {"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"}, false},
  46. authority/config/tls_options_test.go:79 test path {"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", CipherSuites{"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"}, false},
  47. authority/config/tls_options_test.go:80 test path {"multiple", CipherSuites{"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"}, false},
  48. authority/config/tls_options_test.go:81 test path {"fail", CipherSuites{"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", "TLS_BAD_CIPHERSUITE"}, true},
  49. authority/config/tls_options_test.go:105 test path {"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", CipherSuites{"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA}},
  50. authority/config/tls_options_test.go:106 test path {"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA}},
  51. authority/config/tls_options_test.go:107 test path {"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256}},
  52. authority/config/tls_options_test.go:108 test path {"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256}},
  53. authority/config/tls_options_test.go:109 test path {"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA}},
  54. authority/config/tls_options_test.go:110 test path {"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384}},
  55. authority/config/tls_options_test.go:111 test path {"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", CipherSuites{"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305}},
  56. authority/config/tls_options_test.go:112 test path {"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", CipherSuites{"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"}, []uint16{tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA}},
  57. authority/config/tls_options_test.go:113 test path {"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"}, []uint16{tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA}},
  58. authority/config/tls_options_test.go:114 test path {"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"}, []uint16{tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256}},
  59. authority/config/tls_options_test.go:115 test path {"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"}, []uint16{tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256}},
  60. authority/config/tls_options_test.go:116 test path {"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"}, []uint16{tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA}},
  61. authority/config/tls_options_test.go:117 test path {"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"}, []uint16{tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384}},
  62. authority/config/tls_options_test.go:118 test path {"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", CipherSuites{"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"}, []uint16{tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305}},
  63. authority/config/tls_options_test.go:119 test path {"multiple", CipherSuites{"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256}},
  64. authority/config/tls_options_test.go:120 test path {"fail", CipherSuites{"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", "TLS_BAD_CIPHERSUITE"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, 0}},
  65. authority/config/tls_options_test.go:144 test path CipherSuites: []uint16{tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
  66. authority/config/tls_options_test.go:150 test path CipherSuites: []uint16{tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
  67. authority/tls_test.go:1482 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
  68. authority/tls_test.go:1483 test path "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
  69. ca/identity/testdata/config/ca.json:34 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
  70. ca/identity/testdata/config/ca.json:35 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
  71. ca/testdata/ca.json:15 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
  72. ca/testdata/ca.json:16 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
  73. ca/testdata/federated-ca.json:15 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
  74. ca/testdata/federated-ca.json:16 test path "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
  75. ca/testdata/federated-ca.json:17 test path "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
  76. ca/testdata/rotate-ca-0.json:14 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
  77. ca/testdata/rotate-ca-0.json:15 test path "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
  78. ca/testdata/rotate-ca-0.json:16 test path "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
  79. ca/testdata/rotate-ca-1.json:14 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
  80. ca/testdata/rotate-ca-1.json:15 test path "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
  81. ca/testdata/rotate-ca-1.json:16 test path "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
  82. ca/testdata/rotate-ca-2.json:14 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
  83. ca/testdata/rotate-ca-2.json:15 test path "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
  84. ca/testdata/rotate-ca-2.json:16 test path "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
  85. ca/testdata/rotate-ca-3.json:14 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
  86. ca/testdata/rotate-ca-3.json:15 test path "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
  87. ca/testdata/rotate-ca-3.json:16 test path "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
  88. ca/testdata/rsaca.json:15 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
  89. ca/testdata/rsaca.json:16 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
  90. examples/basic-federation/pki/cloud/config/ca.federated.json:33 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
  91. examples/basic-federation/pki/cloud/config/ca.federated.json:34 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
  92. examples/basic-federation/pki/cloud/config/ca.json:33 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
  93. examples/basic-federation/pki/cloud/config/ca.json:34 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
  94. examples/basic-federation/pki/kubernetes/config/ca.federated.json:33 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
  95. examples/basic-federation/pki/kubernetes/config/ca.federated.json:34 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
  96. examples/basic-federation/pki/kubernetes/config/ca.json:33 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
  97. examples/basic-federation/pki/kubernetes/config/ca.json:34 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
  98. examples/docker/ca/pki/config/ca.json:51 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
  99. examples/docker/ca/pki/config/ca.json:52 test path "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
  100. examples/pki/config/ca.json:87 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
  101. examples/pki/config/ca.json:88 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
  102. pki/testdata/helm/simple.yml:26 test path - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
  103. pki/testdata/helm/simple.yml:27 test path - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  104. pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:27 test path - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
  105. pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:28 test path - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  106. pki/testdata/helm/with-acme.yml:27 test path - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
  107. pki/testdata/helm/with-acme.yml:28 test path - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  108. pki/testdata/helm/with-admin.yml:26 test path - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
  109. pki/testdata/helm/with-admin.yml:27 test path - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  110. pki/testdata/helm/with-provisioner.yml:26 test path - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
  111. pki/testdata/helm/with-provisioner.yml:27 test path - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  112. pki/testdata/helm/with-ssh-and-acme.yml:31 test path - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
  113. pki/testdata/helm/with-ssh-and-acme.yml:32 test path - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  114. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:30 test path - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
  115. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:31 test path - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  116. pki/testdata/helm/with-ssh.yml:30 test path - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
  117. pki/testdata/helm/with-ssh.yml:31 test path - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  118. scripts/install-step-ra.sh:227 "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
  119. scripts/install-step-ra.sh:228 "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
config.cipher-suite · CWE-757
TLS Quantum-vulnerable Recorded traffic 65 places See details

TLS configuration in code

A `tls.Config` field pinning versions, cipher suites or curve preferences. Every available suite negotiates a classical key exchange.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Every TLS cipher suite in general use negotiates a classical key exchange, so a recorded session is decryptable once that exchange falls.

What to do. Set `MinVersion: tls.VersionTLS13`. Go 1.24 enables the hybrid X25519MLKEM768 group by default, which is the single highest-value change available today.

  1. acme/challenge.go:242 config := &tls.Config{
  2. acme/challenge_test.go:2299 test path srv.TLS = &tls.Config{
  3. acme/client.go:59 TLSClientConfig: &tls.Config{
  4. authority/config/config_test.go:167 test path CipherSuites: CipherSuites{
  5. authority/config/config_test.go:176 test path CipherSuites: CipherSuites{
  6. authority/config/config_test.go:196 test path CipherSuites: CipherSuites{
  7. authority/config/tls_options.go:42 CipherSuites: DefaultTLSCipherSuites,
  8. authority/config/tls_options.go:164 func (t *TLSOptions) TLSConfig() *tls.Config {
  9. authority/config/tls_options.go:172 return &tls.Config{
  10. authority/config/tls_options.go:173 CipherSuites: t.CipherSuites.Value(),
  11. authority/config/tls_options_test.go:143 test path {"default", fields{DefaultTLSCipherSuites, DefaultTLSMinVersion, DefaultTLSMaxVersion, DefaultTLSRenegotiation}, &tls.Config{
  12. authority/config/tls_options_test.go:144 test path CipherSuites: []uint16{tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
  13. authority/config/tls_options_test.go:149 test path {"renegotation", fields{DefaultTLSCipherSuites, DefaultTLSMinVersion, DefaultTLSMaxVersion, true}, &tls.Config{
  14. authority/config/tls_options_test.go:150 test path CipherSuites: []uint16{tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
  15. authority/config/tls_options_test.go:159 test path CipherSuites: tt.fields.CipherSuites,
  16. authority/http_client.go:47 tr.TLSClientConfig = &tls.Config{
  17. authority/http_client_test.go:84 test path srv.TLS = &tls.Config{
  18. authority/linkedca.go:482 conn, err := grpc.NewClient(endpoint, grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{
  19. authority/linkedca.go:532 conn, err := grpc.NewClient(endpoint, grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{
  20. authority/linkedca.go:609 return cert, &tls.Config{
  21. authority/provisioner/webhook_test.go:654 test path transport.TLSClientConfig = &tls.Config{
  22. authority/tls_test.go:1481 test path CipherSuites: CipherSuites{
  23. ca/bootstrap_test.go:232 test path {"fail with TLSConfig", args{context.Background(), token(), &http.Server{TLSConfig: &tls.Config{}}}, true},
  24. ca/bootstrap_test.go:290 test path {"fail with TLSConfig", args{context.Background(), token(), &http.Server{TLSConfig: &tls.Config{}}}, true},
  25. ca/ca.go:634 serverTLSConfig = &tls.Config{
  26. ca/client.go:70 Transport: getDefaultTransport(&tls.Config{InsecureSkipVerify: true}),
  27. ca/client.go:257 tr.TLSClientConfig = &tls.Config{
  28. ca/client.go:267 tr.TLSClientConfig = &tls.Config{
  29. ca/client.go:311 TLSClientConfig: &tls.Config{
  30. ca/client.go:433 return getDefaultTransport(&tls.Config{
  31. ca/client.go:451 return getDefaultTransport(&tls.Config{
  32. ca/client.go:462 return getDefaultTransport(&tls.Config{
  33. ca/identity/client.go:65 tr.TLSClientConfig = &tls.Config{
  34. ca/identity/client_test.go:59 test path okServer.TLS = &tls.Config{
  35. ca/identity/client_test.go:135 test path tr.TLSClientConfig = &tls.Config{
  36. ca/identity/identity.go:300 tr.TLSClientConfig = &tls.Config{
  37. ca/tls.go:63 Config: &tls.Config{
  38. ca/tls.go:291 func getDefaultTLSConfig(sign *api.SignResponse) *tls.Config {
  39. ca/tls.go:295 return &tls.Config{
  40. ca/tls_options_test.go:35 test path {"ok", args{client, &tls.Config{}, &api.SignResponse{}}, &TLSOptionCtx{Client: client, Config: &tls.Config{}, Sign: &api.SignResponse{}, mutableConfig: newMutableTLSConfig()}},
  41. ca/tls_options_test.go:66 test path {"ok", fields{&tls.Config{}}, args{[]TLSOption{RequireAndVerifyClientCert()}}, false},
  42. ca/tls_options_test.go:67 test path {"ok", fields{&tls.Config{}}, args{[]TLSOption{VerifyClientCertIfGiven()}}, false},
  43. ca/tls_options_test.go:68 test path {"fail", fields{&tls.Config{}}, args{[]TLSOption{VerifyClientCertIfGiven(), fail()}}, true},
  44. ca/tls_options_test.go:89 test path {"ok", &tls.Config{ClientAuth: tls.RequireAndVerifyClientCert}},
  45. ca/tls_options_test.go:94 test path Config: &tls.Config{},
  46. ca/tls_options_test.go:114 test path {"ok", &tls.Config{ClientAuth: tls.VerifyClientCertIfGiven}},
  47. ca/tls_options_test.go:119 test path Config: &tls.Config{},
  48. ca/tls_options_test.go:147 test path {"ok", args{cert}, &tls.Config{RootCAs: pool}},
  49. ca/tls_options_test.go:152 test path Config: &tls.Config{},
  50. ca/tls_options_test.go:180 test path {"ok", args{cert}, &tls.Config{ClientCAs: pool}},
  51. ca/tls_options_test.go:185 test path Config: &tls.Config{},
  52. ca/tls_options_test.go:227 test path {"ok", args{client, &tls.Config{}}, &tls.Config{RootCAs: pool}, false},
  53. ca/tls_options_test.go:228 test path {"fail", args{clientFail, &tls.Config{}}, &tls.Config{}, true},
  54. ca/tls_options_test.go:276 test path {"ok", args{client, &tls.Config{}}, &tls.Config{ClientCAs: pool}, false},
  55. ca/tls_options_test.go:277 test path {"fail", args{clientFail, &tls.Config{}}, &tls.Config{}, true},
  56. ca/tls_options_test.go:330 test path {"ok", args{client, &tls.Config{}}, &tls.Config{RootCAs: pool}, false},
  57. ca/tls_options_test.go:331 test path {"fail", args{clientFail, &tls.Config{}}, &tls.Config{}, true},
  58. ca/tls_options_test.go:387 test path {"ok", args{client, &tls.Config{}}, &tls.Config{ClientCAs: pool}, false},
  59. ca/tls_options_test.go:388 test path {"fail", args{clientFail, &tls.Config{}}, &tls.Config{}, true},
  60. ca/tls_options_test.go:439 test path {"ok", args{client, &tls.Config{}}, &tls.Config{ClientCAs: pool, RootCAs: pool}, false},
  61. ca/tls_options_test.go:440 test path {"fail", args{clientFail, &tls.Config{}}, &tls.Config{}, true},
  62. ca/tls_options_test.go:493 test path {"ok", args{client, &tls.Config{}}, &tls.Config{ClientCAs: pool, RootCAs: pool}, false},
  63. ca/tls_options_test.go:494 test path {"fail", args{clientFail, &tls.Config{}}, &tls.Config{}, true},
  64. test/integration/requestid_test.go:278 test path srv.TLS = &tls.Config{
  65. test/integration/scep/common_test.go:178 test path transport.TLSClientConfig = &tls.Config{
go.tls.config · CWE-757
ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 56 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

  1. api/api_test.go:71 test path -----BEGIN CERTIFICATE-----
  2. api/api_test.go:121 test path -----BEGIN CERTIFICATE-----
  3. authority/provisioner/testdata/certs/bad-extension.crt:1 test path -----BEGIN CERTIFICATE-----
  4. authority/provisioner/testdata/certs/foo.crt:1 test path -----BEGIN CERTIFICATE-----
  5. authority/provisioner/testdata/certs/good-extension.crt:1 test path -----BEGIN CERTIFICATE-----
  6. authority/provisioner/testdata/certs/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  7. authority/provisioner/testdata/certs/x5c-leaf.crt:1 test path -----BEGIN CERTIFICATE-----
  8. authority/provisioner/testdata/certs/x5c-leaf.crt:13 test path -----BEGIN CERTIFICATE-----
  9. authority/provisioner/utils_test.go:269 test path -----BEGIN CERTIFICATE-----
  10. authority/provisioner/x5c_test.go:105 test path -----BEGIN CERTIFICATE-----
  11. authority/provisioner/x5c_test.go:117 test path -----BEGIN CERTIFICATE-----
  12. authority/provisioner/x5c_test.go:192 test path -----BEGIN CERTIFICATE-----
  13. authority/provisioner/x5c_test.go:220 test path -----BEGIN CERTIFICATE-----
  14. authority/provisioner/x5c_test.go:231 test path -----BEGIN CERTIFICATE-----
  15. authority/provisioner/x5c_test.go:259 test path -----BEGIN CERTIFICATE-----
  16. authority/provisioner/x5c_test.go:271 test path -----BEGIN CERTIFICATE-----
  17. authority/provisioner/x5c_test.go:301 test path -----BEGIN CERTIFICATE-----
  18. authority/provisioner/x5c_test.go:313 test path -----BEGIN CERTIFICATE-----
  19. authority/testdata/certs/foo.crt:1 test path -----BEGIN CERTIFICATE-----
  20. authority/testdata/certs/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  21. authority/testdata/certs/provisioner-not-found.crt:1 test path -----BEGIN CERTIFICATE-----
  22. authority/testdata/certs/renew-disabled.crt:1 test path -----BEGIN CERTIFICATE-----
  23. authority/testdata/certs/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  24. authority/testdata/scep/root.crt:1 test path -----BEGIN CERTIFICATE-----
  25. ca/client_test.go:60 test path -----BEGIN CERTIFICATE-----
  26. ca/identity/testdata/certs/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  27. ca/identity/testdata/certs/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  28. ca/identity/testdata/certs/server.crt:1 test path -----BEGIN CERTIFICATE-----
  29. ca/identity/testdata/certs/server.crt:15 test path -----BEGIN CERTIFICATE-----
  30. ca/identity/testdata/identity/expired.crt:1 test path -----BEGIN CERTIFICATE-----
  31. ca/identity/testdata/identity/expired.crt:15 test path -----BEGIN CERTIFICATE-----
  32. ca/identity/testdata/identity/identity.crt:1 test path -----BEGIN CERTIFICATE-----
  33. ca/identity/testdata/identity/identity.crt:15 test path -----BEGIN CERTIFICATE-----
  34. ca/identity/testdata/identity/not_before.crt:1 test path -----BEGIN CERTIFICATE-----
  35. ca/identity/testdata/identity/not_before.crt:15 test path -----BEGIN CERTIFICATE-----
  36. ca/testdata/rotated/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  37. ca/testdata/rotated/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  38. ca/testdata/secrets/federated_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  39. ca/testdata/secrets/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  40. ca/testdata/secrets/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  41. cas/cloudcas/cloudcas_test.go:54 test path -----BEGIN CERTIFICATE-----
  42. cas/cloudcas/cloudcas_test.go:64 test path -----BEGIN CERTIFICATE-----
  43. cas/cloudcas/cloudcas_test.go:75 test path -----BEGIN CERTIFICATE-----
  44. cas/cloudcas/cloudcas_test.go:87 test path -----BEGIN CERTIFICATE-----
  45. cas/vaultcas/vaultcas_test.go:22 test path -----BEGIN CERTIFICATE-----
  46. cas/vaultcas/vaultcas_test.go:64 test path -----BEGIN CERTIFICATE-----
  47. examples/basic-federation/pki/cloud/certs/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  48. examples/basic-federation/pki/cloud/certs/kubernetes_root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  49. examples/basic-federation/pki/cloud/certs/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  50. examples/basic-federation/pki/kubernetes/certs/cloud_root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  51. examples/basic-federation/pki/kubernetes/certs/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  52. examples/basic-federation/pki/kubernetes/certs/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  53. examples/docker/ca/pki/secrets/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  54. examples/docker/ca/pki/secrets/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  55. examples/pki/secrets/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  56. examples/pki/secrets/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
pem.certificate
ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 42 places See details

ECDSA in the Go standard library

`ecdsa.GenerateKey()` or `ecdsa.Sign*()`. The curve is read from the `elliptic.P###()` argument.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

  1. acme/challenge_test.go:146 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  2. acme/challenge_test.go:203 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  3. acme/challenge_test.go:248 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  4. acme/challenge_test.go:302 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  5. acme/challenge_test.go:3524 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  6. acme/challenge_test.go:3673 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  7. acme/challenge_test.go:3698 test path otherSigner, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  8. acme/challenge_test.go:3917 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  9. acme/challenge_test.go:4678 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  10. acme/challenge_test.go:4813 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  11. acme/challenge_test.go:5110 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  12. acme/challenge_test.go:5195 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  13. acme/challenge_test.go:5277 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  14. api/api_test.go:1469 test path p256, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  15. api/ssh_test.go:39 test path priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  16. authority/provisioner/nebula_test.go:83 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  17. authority/provisioner/nebula_test.go:139 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  18. authority/ssh_test.go:139 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  19. authority/ssh_test.go:143 test path signKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  20. authority/ssh_test.go:321 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  21. authority/ssh_test.go:325 test path signKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  22. authority/ssh_test.go:413 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  23. authority/ssh_test.go:418 test path key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  24. authority/ssh_test.go:455 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  25. authority/ssh_test.go:460 test path key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  26. authority/ssh_test.go:497 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  27. authority/ssh_test.go:505 test path key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  28. authority/ssh_test.go:883 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  29. authority/ssh_test.go:887 test path signKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  30. authority/tls_test.go:86 test path priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  31. authority/tls_test.go:114 test path priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  32. authority/tls_test.go:132 test path priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  33. ca/client.go:1461 pk, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  34. ca/client_test.go:113 test path priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  35. cas/cloudcas/certificate_test.go:118 test path badKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  36. cas/softcas/softcas_test.go:475 test path rootSigner, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  37. cas/stepcas/x5c_issuer_test.go:246 test path p256 := mustSigner(ecdsa.GenerateKey(elliptic.P256(), rand.Reader))
  38. internal/cryptoutil/cryptoutil_test.go:76 test path ecdsaKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  39. templates/templates_test.go:220 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  40. templates/templates_test.go:226 test path key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  41. templates/templates_test.go:291 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  42. templates/templates_test.go:297 test path key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
go.ecdsa · CWE-327
ECDSA Quantum-vulnerable 31 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

  1. authority/provisioner/testdata/secrets/ecdsa.key:1 test path -----BEGIN EC PRIVATE KEY-----
  2. authority/provisioner/testdata/secrets/foo.key:1 test path -----BEGIN EC PRIVATE KEY-----
  3. authority/provisioner/testdata/secrets/x5c-leaf.key:1 test path -----BEGIN EC PRIVATE KEY-----
  4. authority/testdata/scep/root.key:1 test path -----BEGIN EC PRIVATE KEY-----
  5. authority/testdata/secrets/foo.key:1 test path -----BEGIN EC PRIVATE KEY-----
  6. authority/testdata/secrets/provisioner-not-found.key:1 test path -----BEGIN EC PRIVATE KEY-----
  7. authority/testdata/secrets/renew-disabled.key:1 test path -----BEGIN EC PRIVATE KEY-----
  8. cas/cloudcas/cloudcas_test.go:107 test path -----BEGIN EC PRIVATE KEY-----
  9. cas/cloudcas/cloudcas_test.go:113 test path -----BEGIN EC PRIVATE KEY-----
  10. pki/testdata/helm/simple.yml:67 test path -----BEGIN EC PRIVATE KEY-----
  11. pki/testdata/helm/simple.yml:78 test path -----BEGIN EC PRIVATE KEY-----
  12. pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:68 test path -----BEGIN EC PRIVATE KEY-----
  13. pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:79 test path -----BEGIN EC PRIVATE KEY-----
  14. pki/testdata/helm/with-acme.yml:68 test path -----BEGIN EC PRIVATE KEY-----
  15. pki/testdata/helm/with-acme.yml:79 test path -----BEGIN EC PRIVATE KEY-----
  16. pki/testdata/helm/with-admin.yml:67 test path -----BEGIN EC PRIVATE KEY-----
  17. pki/testdata/helm/with-admin.yml:78 test path -----BEGIN EC PRIVATE KEY-----
  18. pki/testdata/helm/with-provisioner.yml:67 test path -----BEGIN EC PRIVATE KEY-----
  19. pki/testdata/helm/with-provisioner.yml:78 test path -----BEGIN EC PRIVATE KEY-----
  20. pki/testdata/helm/with-ssh-and-acme.yml:77 test path -----BEGIN EC PRIVATE KEY-----
  21. pki/testdata/helm/with-ssh-and-acme.yml:88 test path -----BEGIN EC PRIVATE KEY-----
  22. pki/testdata/helm/with-ssh-and-acme.yml:95 test path -----BEGIN EC PRIVATE KEY-----
  23. pki/testdata/helm/with-ssh-and-acme.yml:102 test path -----BEGIN EC PRIVATE KEY-----
  24. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:76 test path -----BEGIN EC PRIVATE KEY-----
  25. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:87 test path -----BEGIN EC PRIVATE KEY-----
  26. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:94 test path -----BEGIN EC PRIVATE KEY-----
  27. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:101 test path -----BEGIN EC PRIVATE KEY-----
  28. pki/testdata/helm/with-ssh.yml:76 test path -----BEGIN EC PRIVATE KEY-----
  29. pki/testdata/helm/with-ssh.yml:87 test path -----BEGIN EC PRIVATE KEY-----
  30. pki/testdata/helm/with-ssh.yml:94 test path -----BEGIN EC PRIVATE KEY-----
  31. pki/testdata/helm/with-ssh.yml:101 test path -----BEGIN EC PRIVATE KEY-----
pem.private-key · CWE-321, CWE-327
ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 30 places See details

Public key declared as a JSON Web Key

A `kty` field, with the curve read from the sibling `crv` where the family needs one. A JWKS document declares a key without naming an algorithm anywhere, so it is invisible to a scan that only looks for `alg`.

This file publishes the public keys other systems use to check this system's signatures. Everyone who trusts these keys has to accept the new kind of key before the old ones can be retired.

What to do. A published JWKS is what relying parties trust. It has to accept a post-quantum key type before the keys behind it can change, so put it early in the migration order.

  1. ca/identity/testdata/config/ca.json:21 test path "kty": "EC",
  2. ca/testdata/ca.json:28 test path "kty": "EC",
  3. ca/testdata/ca.json:41 test path "kty": "EC",
  4. ca/testdata/ca.json:54 test path "kty": "EC",
  5. ca/testdata/ca.json:67 test path "kty": "EC",
  6. ca/testdata/ca.json:83 test path "kty": "EC",
  7. ca/testdata/federated-ca.json:28 test path "kty": "EC",
  8. ca/testdata/rotate-ca-0.json:27 test path "kty": "EC",
  9. ca/testdata/rotate-ca-1.json:27 test path "kty": "EC",
  10. ca/testdata/rotate-ca-2.json:27 test path "kty": "EC",
  11. ca/testdata/rotate-ca-3.json:27 test path "kty": "EC",
  12. ca/testdata/rsaca.json:32 test path "kty": "EC",
  13. examples/basic-federation/pki/cloud/config/ca.federated.json:20 test path "kty": "EC",
  14. examples/basic-federation/pki/cloud/config/ca.json:20 test path "kty": "EC",
  15. examples/basic-federation/pki/kubernetes/config/ca.federated.json:20 test path "kty": "EC",
  16. examples/basic-federation/pki/kubernetes/config/ca.json:20 test path "kty": "EC",
  17. examples/docker/ca/pki/config/ca.json:20 test path "kty": "EC",
  18. examples/docker/ca/pki/config/ca.json:34 test path "kty": "EC",
  19. examples/pki/config/ca.json:20 test path "kty": "EC",
  20. examples/pki/config/ca.json:34 test path "kty": "EC",
  21. examples/pki/config/ca.json:52 test path "kty": "EC",
  22. examples/pki/config/ca.json:70 test path "kty": "EC",
  23. pki/testdata/helm/simple.yml:23 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD
  24. pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:23 test path - {"type":"JWK","name":"acme","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFDOI"}
  25. pki/testdata/helm/with-acme.yml:23 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD
  26. pki/testdata/helm/with-admin.yml:23 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD
  27. pki/testdata/helm/with-provisioner.yml:23 test path - {"type":"JWK","name":"a-provisioner","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvr
  28. pki/testdata/helm/with-ssh-and-acme.yml:26 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD
  29. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:26 test path - {"type":"JWK","name":"sshpop","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFDOI
  30. pki/testdata/helm/with-ssh.yml:26 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD
jose.jwk · CWE-327
RSA2048-bit Quantum-vulnerable Recorded traffic 20 places See details

RSA in the Go standard library

`rsa.GenerateKey()`, `rsa.SignPKCS1v15()`, `rsa.EncryptOAEP()` or an import of `crypto/rsa`.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Go 1.24 ships ML-KEM as `crypto/mlkem`.

  1. acme/challenge_test.go:2338 test path privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
  2. api/api_test.go:1473 test path rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
  3. authority/provisioner/aws_test.go:319 test path badKey, err := rsa.GenerateKey(rand.Reader, 2048)
  4. authority/provisioner/aws_test.go:582 test path badKey, err := rsa.GenerateKey(rand.Reader, 2048)
  5. authority/provisioner/aws_test.go:752 test path rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
  6. authority/provisioner/azure_test.go:664 test path rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
  7. authority/provisioner/gcp_test.go:646 test path rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
  8. authority/provisioner/jwk_test.go:420 test path rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
  9. authority/provisioner/oidc_test.go:556 test path rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
  10. authority/provisioner/scep_test.go:35 test path key, err := rsa.GenerateKey(rand.Reader, 2048)
  11. authority/provisioner/scep_test.go:522 test path key, err := rsa.GenerateKey(rand.Reader, 2048)
  12. authority/provisioner/scep_test.go:524 test path badKey, err := rsa.GenerateKey(rand.Reader, 2048)
  13. cas/softcas/softcas_test.go:414 test path signer, err := rsa.GenerateKey(rand.Reader, 2048)
  14. cas/softcas/softcas_test.go:480 test path intSigner, err := rsa.GenerateKey(rand.Reader, 2048)
  15. cas/stepcas/x5c_issuer_test.go:250 test path rsaKey := mustSigner(rsa.GenerateKey(rand.Reader, 2048))
  16. internal/cryptoutil/cryptoutil_test.go:74 test path rsaKey, err := rsa.GenerateKey(rand.Reader, 2048)
  17. scep/authority_test.go:140 test path return rsa.GenerateKey(rand.Reader, 2048)
  18. test/integration/scep/common_test.go:305 test path signer, err = rsa.GenerateKey(rand.Reader, 2048)
  19. test/integration/scep/windows_go1.23_test.go:47 test path signer, err := rsa.GenerateKey(rand.Reader, 2048)
  20. test/integration/scep/windows_test.go:33 test path signer, err := rsa.GenerateKey(rand.Reader, 2048)
go.rsa · CWE-327
ECDSA Quantum-vulnerable 16 places See details

SSH algorithms pinned in configuration

A `KexAlgorithms`, `HostKeyAlgorithms` or `Ciphers` directive in an SSH configuration. `KexAlgorithms` is the line that decides whether recorded sessions stay confidential.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Put `sntrup761x25519-sha512@openssh.com` first in `KexAlgorithms`. It is a hybrid, so it is no weaker than the classical exchange it replaces.

  1. api/api_test.go:1655 test path fixtureECDSACertificate = `ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgLnkvSk4odlo3b1R+RDw+LmorL3RkN354IilCIVFVen4AAAAIbmlzdHAyNTYAAABBBHjKHss8WM2ffMYlavisoLXR0I6UEIU+cidV1ogEH1U6
  2. api/api_test.go:1675 test path assert.Equal(t, "ecdsa-sha2-nistp256-cert-v01@openssh.com user certificate", fields["certificate-type"])
  3. api/ssh_test.go:469 test path {Name: "known_host.tpl", Type: templates.File, Comment: "#", Path: "ssh/known_host", Content: []byte("@cert-authority * ecdsa-sha2-nistp256 AAAA...=")},
  4. api/ssh_test.go:473 test path {Name: "ca.tpl", Type: templates.File, Comment: "#", Path: "/etc/ssh/ca.pub", Content: []byte("ecdsa-sha2-nistp256 AAAA...=")},
  5. authority/provisioner/testdata/certs/ssh_host_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJj80EJXJR9vxefhdqOLSdzRzBw24t9YKPxb+eCYLf7BU50pJQnB/jK2ZM3qLFbieLaYjngZ86T4DzHxlPAnlAY=
  6. authority/provisioner/testdata/certs/ssh_user_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ8einS88ZaWpcTZG27D5N9JDKfGv0rzjDByLGsZzMsLYl3XcsN9IWKXB6b+5GJ3UaoZf/pFxzRzIdDIh7Ypw3Y=
  7. authority/testdata/certs/ssh_host_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJj80EJXJR9vxefhdqOLSdzRzBw24t9YKPxb+eCYLf7BU50pJQnB/jK2ZM3qLFbieLaYjngZ86T4DzHxlPAnlAY=
  8. authority/testdata/certs/ssh_user_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ8einS88ZaWpcTZG27D5N9JDKfGv0rzjDByLGsZzMsLYl3XcsN9IWKXB6b+5GJ3UaoZf/pFxzRzIdDIh7Ypw3Y=
  9. pki/helm_test.go:239 test path p.Files[p.Ssh.HostPublicKey] = []byte("ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ0IdS5sZm6KITBMZLEJD6b5ROVraYHcAOr3feFel8r1Wp4DRPR1oU0W00J/zjNBRBbANlJoYN4x/8WNNVZ49Ms=")
  10. pki/helm_test.go:244 test path p.Files[p.Ssh.UserPublicKey] = []byte("ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEWA1qUxaGwVNErsvEOGe2d6TvLMF+aiVpuOiIEvpMJ3JeJmecLQctjWqeIbpSvy6/gRa7c82Ge5rLlapYmOChs=")
  11. pki/testdata/helm/with-ssh-and-acme.yml:61 test path ssh_host_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ0IdS5sZm6KITBMZLEJD6b5ROVraYHcAOr3feFel8r1Wp4DRPR1oU0W00J/zjNBRBbANlJoYN4x/8WNNVZ49Ms=
  12. pki/testdata/helm/with-ssh-and-acme.yml:64 test path ssh_user_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEWA1qUxaGwVNErsvEOGe2d6TvLMF+aiVpuOiIEvpMJ3JeJmecLQctjWqeIbpSvy6/gRa7c82Ge5rLlapYmOChs=
  13. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:60 test path ssh_host_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ0IdS5sZm6KITBMZLEJD6b5ROVraYHcAOr3feFel8r1Wp4DRPR1oU0W00J/zjNBRBbANlJoYN4x/8WNNVZ49Ms=
  14. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:63 test path ssh_user_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEWA1qUxaGwVNErsvEOGe2d6TvLMF+aiVpuOiIEvpMJ3JeJmecLQctjWqeIbpSvy6/gRa7c82Ge5rLlapYmOChs=
  15. pki/testdata/helm/with-ssh.yml:60 test path ssh_host_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ0IdS5sZm6KITBMZLEJD6b5ROVraYHcAOr3feFel8r1Wp4DRPR1oU0W00J/zjNBRBbANlJoYN4x/8WNNVZ49Ms=
  16. pki/testdata/helm/with-ssh.yml:63 test path ssh_user_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEWA1qUxaGwVNErsvEOGe2d6TvLMF+aiVpuOiIEvpMJ3JeJmecLQctjWqeIbpSvy6/gRa7c82Ge5rLlapYmOChs=
config.ssh-algorithms · CWE-757
Ed25519255-bitother/Ed25519 Quantum-vulnerable 14 places See details

Ed25519 in the Go standard library

`ed25519.GenerateKey()` or `ed25519.Sign()`.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204). Go 1.24 ships ML-DSA as `crypto/mldsa`.

  1. acme/api/wire_integration_test.go:600 test path _, priv, err := ed25519.GenerateKey(rand.Reader)
  2. acme/challenge.go:1809 if !ed25519.Verify(pub, []byte(keyAuth), sig) {
  3. api/api_test.go:977 test path rootPub, rootPriv, err := ed25519.GenerateKey(rand.Reader)
  4. api/api_test.go:981 test path leafPub, leafPriv, err := ed25519.GenerateKey(rand.Reader)
  5. api/api_test.go:1477 test path edPub, edPriv, err := ed25519.GenerateKey(rand.Reader)
  6. authority/authorize_test.go:1435 test path _, signer, err := ed25519.GenerateKey(rand.Reader)
  7. authority/authorize_test.go:1443 test path _, otherSigner, err := ed25519.GenerateKey(rand.Reader)
  8. authority/provisioner/nebula_test.go:38 test path pub, priv, err := ed25519.GenerateKey(rand.Reader)
  9. authority/provisioner/nebula_test.go:60 test path pub, priv, err := ed25519.GenerateKey(rand.Reader)
  10. cas/cloudcas/certificate_test.go:111 test path edpub, _, err := ed25519.GenerateKey(rand.Reader)
  11. cas/cloudcas/cloudcas_test.go:228 test path pub, _, err := ed25519.GenerateKey(rand.Reader)
  12. cas/stepcas/stepcas_test.go:56 test path pub, priv, err := ed25519.GenerateKey(rand.Reader)
  13. cas/stepcas/x5c_issuer_test.go:249 test path edKey := mustSigner(ed25519.GenerateKey(rand.Reader))
  14. internal/cryptoutil/cryptoutil_test.go:78 test path _, ed25519Key, err := ed25519.GenerateKey(rand.Reader)
go.ed25519 · CWE-327
ECDSAsecp256r1 Quantum-vulnerable 12 places See details

SSH public key

An `ssh-rsa`, `ecdsa-sha2-*`, `ssh-ed25519` or `ssh-dss` key. `ssh-dss` is disabled by default in current OpenSSH and is reported as broken.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Replace `ssh-dss` now. For the rest, enable the `sntrup761x25519-sha512` key exchange, which protects recorded sessions even while host keys stay classical.

  1. authority/provisioner/testdata/certs/ssh_host_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJj80EJX
  2. authority/provisioner/testdata/certs/ssh_user_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ8einS8
  3. authority/testdata/certs/ssh_host_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJj80EJX
  4. authority/testdata/certs/ssh_user_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ8einS8
  5. pki/helm_test.go:239 test path p.Files[p.Ssh.HostPublicKey] = []byte("ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItb
  6. pki/helm_test.go:244 test path p.Files[p.Ssh.UserPublicKey] = []byte("ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItb
  7. pki/testdata/helm/with-ssh-and-acme.yml:61 test path ssh_host_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY
  8. pki/testdata/helm/with-ssh-and-acme.yml:64 test path ssh_user_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY
  9. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:60 test path ssh_host_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY
  10. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:63 test path ssh_user_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY
  11. pki/testdata/helm/with-ssh.yml:60 test path ssh_host_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY
  12. pki/testdata/helm/with-ssh.yml:63 test path ssh_user_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY
ssh.public-key · CWE-327
Ed25519255-bitother/Ed25519 Quantum-vulnerable 10 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

  1. acme/api/order_test.go:560 test path -----BEGIN PUBLIC KEY-----
  2. acme/api/order_test.go:1067 test path -----BEGIN PUBLIC KEY-----
  3. acme/challenge_test.go:561 test path -----BEGIN PUBLIC KEY-----
  4. acme/challenge_wire_test.go:27 test path -----BEGIN PUBLIC KEY-----
  5. acme/challenge_wire_test.go:2681 test path -----BEGIN PUBLIC KEY-----
  6. acme/challenge_wire_test.go:3934 test path -----BEGIN PUBLIC KEY-----
  7. acme/challenge_wire_test.go:4005 test path -----BEGIN PUBLIC KEY-----
  8. acme/challenge_wire_test.go:4056 test path -----BEGIN PUBLIC KEY-----
  9. authority/provisioner/acme_test.go:103 test path -----BEGIN PUBLIC KEY-----
  10. authority/provisioner/wire/wire_options_test.go:11 test path -----BEGIN PUBLIC KEY-----
pem.public-key
Ed25519255-bitother/Ed25519 Quantum-vulnerable 7 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. acme/api/wire_integration_test.go:218 test path jwk, err := jose.GenerateJWK("OKP", "", "EdDSA", "sig", "", 0)
  2. acme/challenge_test.go:3859 test path "x5c": []any{makeLeaf(mustSigner("OKP", "Ed25519", 0), serialNumber).Raw, ca.Intermediate.Raw},
  3. acme/challenge_wire_test.go:3957 test path jwkBytes := []byte(`{"crv": "Ed25519", "kty": "OKP", "x": "1L1eH2a6AgVvzTp5ZalKRfq6pVPOtEjI7h8TPzBYFgM"}`)
  4. api/api_test.go:1500 test path {"ed25519", args{edPub, edPriv, nil}, "Ed25519"},
  5. cas/stepcas/x5c_issuer_test.go:265 test path {"ed25519", args{edKey, nil}, []jose.Header{{Algorithm: "EdDSA"}}, false},
  6. test/integration/scep/internal/x509/x509.go:95 test path Ed25519: "Ed25519",
  7. test/integration/scep/internal/x509/x509.go:204 test path {PureEd25519, "Ed25519", oidSignatureEd25519, emptyRawValue, Ed25519, crypto.Hash(0) /* no pre-hashing */, false},
jose.algorithm · CWE-327
RSA2048-bit Quantum-vulnerable 7 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

  1. acme/challenge.go:1639 -----BEGIN CERTIFICATE-----
  2. acme/challenge.go:1661 -----BEGIN CERTIFICATE-----
  3. api/api_test.go:46 test path -----BEGIN CERTIFICATE-----
  4. authority/provisioner/testdata/certs/yubico-piv-ca.crt:1 test path -----BEGIN CERTIFICATE-----
  5. authority/testdata/scep/intermediate.crt:1 test path -----BEGIN CERTIFICATE-----
  6. ca/client_test.go:35 test path -----BEGIN CERTIFICATE-----
  7. cas/cloudcas/certificate_test.go:28 test path -----BEGIN CERTIFICATE-----
pem.certificate
ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 5 places See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

  1. authority/provisioner/testdata/certs/ecdsa.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----
  2. authority/testdata/certs/badsig.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----
  3. authority/testdata/certs/foo.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----
  4. cas/cloudcas/cloudcas_test.go:100 test path -----BEGIN CERTIFICATE REQUEST-----
  5. cas/vaultcas/vaultcas_test.go:35 test path -----BEGIN CERTIFICATE REQUEST-----
pem.certificate-request
ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 4 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

  1. authority/provisioner/testdata/certs/bar.pub:1 test path -----BEGIN PUBLIC KEY-----
  2. authority/provisioner/testdata/certs/foo.pub:1 test path -----BEGIN PUBLIC KEY-----
  3. cas/cloudcas/certificate_test.go:23 test path -----BEGIN PUBLIC KEY-----
  4. cosign.pub:1 -----BEGIN PUBLIC KEY-----
pem.public-key
ECDSA384-bitsecg/secp384r1 Quantum-vulnerable 3 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

  1. acme/challenge.go:1293 -----BEGIN CERTIFICATE-----
  2. acme/challenge.go:1431 -----BEGIN CERTIFICATE-----
  3. authority/provisioner/testdata/certs/apple-att-ca.crt:1 test path -----BEGIN CERTIFICATE-----
pem.certificate
ECDSA Quantum-vulnerable 3 places See details

Algorithm named in a setting

A setting whose name says it holds an algorithm, given a literal that names one: `withOaepPaddingDigestAlgorithm("SHA-512")`, `signatureAlgorithm = "SHA256withRSA"`, `"digestAlgorithm": "SHA-256"`. The algorithm never reaches a `getInstance()` in this file - it is carried to one somewhere else, often through configuration - so a scan that only reads the factories cannot see it at all.

Something here is configured to use a named algorithm. The code that uses it may be somewhere else entirely, but this is the line that decides which algorithm it is.

What to do. Find what consumes the setting. The migration belongs to that operation; this line is where the choice is actually written down, and usually where it is easiest to change.

  1. webhook/options_test.go:66 test path PublicKeyAlgorithm: "ECDSA",
  2. webhook/options_test.go:84 test path PublicKeyAlgorithm: "ECDSA",
  3. webhook/options_test.go:138 test path PublicKeyAlgorithm: "ECDSA",
config.algorithm-setting · CWE-327
RSA4096-bit Quantum-vulnerable 3 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

  1. acme/challenge.go:1399 -----BEGIN CERTIFICATE-----
  2. ca/testdata/secrets/rsa_intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
  3. ca/testdata/secrets/rsa_root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
pem.certificate
RSA2048-bit Quantum-vulnerable 3 places See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

  1. authority/provisioner/testdata/certs/rsa.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----
  2. ca/ca_test.go:125 test path -----BEGIN CERTIFICATE REQUEST-----
  3. cas/vaultcas/vaultcas_test.go:42 test path -----BEGIN CERTIFICATE REQUEST-----
pem.certificate-request
RSA Quantum-vulnerable Recorded traffic 3 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

  1. authority/provisioner/testdata/secrets/rsa.key:1 test path -----BEGIN RSA PRIVATE KEY-----
  2. authority/provisioner/utils_test.go:73 test path -----BEGIN RSA PRIVATE KEY-----
  3. authority/testdata/scep/intermediate.key:1 test path -----BEGIN RSA PRIVATE KEY-----
pem.private-key · CWE-321, CWE-327
RSASSA-PKCS1v15 Quantum-vulnerable 3 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. acme/api/revoke_test.go:148 test path return "RS256", crypto.SHA256
  2. acme/challenge_wire_test.go:4016 test path SignatureAlgorithms: []string{"RS256"},
  3. cas/stepcas/x5c_issuer_test.go:266 test path {"rsa", args{rsaKey, nil}, []jose.Header{{Algorithm: "RS256"}}, false},
jose.algorithm · CWE-327
DSA Quantum-vulnerable 2 places See details

DSA in the Go standard library

`crypto/dsa`, which the Go team deprecated in 1.16 and froze.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65.

  1. api/api_test.go:1482 test path if err := dsa.GenerateParameters(&dsa2048.Parameters, rand.Reader, dsa.L2048N256); err != nil {
  2. api/api_test.go:1485 test path if err := dsa.GenerateKey(&dsa2048, rand.Reader); err != nil {
go.dsa · CWE-327
ECDSA Quantum-vulnerable 2 places See details

ECDSA in the Go standard library

`ecdsa.GenerateKey()` or `ecdsa.Sign*()`. The curve is read from the `elliptic.P###()` argument.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

  1. acme/api/revoke_test.go:175 test path r, s, err := ecdsa.Sign(rand.Reader, key, digest)
  2. acme/challenge.go:1800 if !ecdsa.VerifyASN1(pub, sum[:], sig) {
go.ecdsa · CWE-327
Ed25519255-bitother/Ed25519 Quantum-vulnerable 2 places See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

  1. authority/provisioner/testdata/certs/ed25519.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----
  2. cas/vaultcas/vaultcas_test.go:58 test path -----BEGIN CERTIFICATE REQUEST-----
pem.certificate-request
RSA4096-bit Quantum-vulnerable 2 places See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

  1. api/api_test.go:94 test path -----BEGIN CERTIFICATE REQUEST-----
  2. ca/client_test.go:83 test path -----BEGIN CERTIFICATE REQUEST-----
pem.certificate-request
EC Quantum-vulnerable 1 place See details

X.509 certificate handling

`x509.CreateCertificate()` or a PKCS#1/PKCS#8/EC key parser. Certificates are the longest-lived cryptographic artefacts most systems own, and their validity periods often outrun the migration.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.

What to do. Shorten certificate lifetimes now so the eventual re-issue with a post-quantum key is routine rather than an incident.

  1. cas/cloudcas/cloudcas_test.go:297 test path key, err := x509.ParseECPrivateKey(block.Bytes)
go.x509
ECDSA224-bitsecg/secp224r1 Quantum-vulnerable 1 place See details

ECDSA in the Go standard library

`ecdsa.GenerateKey()` or `ecdsa.Sign*()`. The curve is read from the `elliptic.P###()` argument.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

  1. cas/stepcas/x5c_issuer_test.go:245 test path p224 := mustSigner(ecdsa.GenerateKey(elliptic.P224(), rand.Reader))
go.ecdsa · CWE-327
ECDSA384-bitsecg/secp384r1 Quantum-vulnerable 1 place See details

ECDSA in the Go standard library

`ecdsa.GenerateKey()` or `ecdsa.Sign*()`. The curve is read from the `elliptic.P###()` argument.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

  1. cas/stepcas/x5c_issuer_test.go:247 test path p384 := mustSigner(ecdsa.GenerateKey(elliptic.P384(), rand.Reader))
go.ecdsa · CWE-327
ECDSA521-bitsecg/secp521r1 Quantum-vulnerable 1 place See details

ECDSA in the Go standard library

`ecdsa.GenerateKey()` or `ecdsa.Sign*()`. The curve is read from the `elliptic.P###()` argument.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

  1. cas/stepcas/x5c_issuer_test.go:248 test path p521 := mustSigner(ecdsa.GenerateKey(elliptic.P521(), rand.Reader))
go.ecdsa · CWE-327
Ed25519255-bitother/Ed25519 Quantum-vulnerable 1 place See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

  1. cas/softcas/softcas_test.go:32 test path -----BEGIN CERTIFICATE-----
pem.certificate
Ed25519255-bitother/Ed25519 Quantum-vulnerable 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

  1. cas/softcas/softcas_test.go:42 test path -----BEGIN PRIVATE KEY-----
pem.private-key · CWE-321, CWE-327
RSA Quantum-vulnerable Recorded traffic 1 place See details

RSA in the Go standard library

`rsa.GenerateKey()`, `rsa.SignPKCS1v15()`, `rsa.EncryptOAEP()` or an import of `crypto/rsa`.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Go 1.24 ships ML-KEM as `crypto/mlkem`.

  1. acme/challenge.go:1805 if err := rsa.VerifyPKCS1v15(pub, crypto.SHA256, sum[:], sig); err != nil {
go.rsa · CWE-327
RSA Quantum-vulnerable 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

  1. cas/cloudcas/certificate_test.go:45 test path -----BEGIN RSA PUBLIC KEY-----
pem.public-key
RSASSA-PKCS1v15 Quantum-vulnerable 1 place See details

SSH algorithms pinned in configuration

A `KexAlgorithms`, `HostKeyAlgorithms` or `Ciphers` directive in an SSH configuration. `KexAlgorithms` is the line that decides whether recorded sessions stay confidential.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both.

What to do. Put `sntrup761x25519-sha512@openssh.com` first in `KexAlgorithms`. It is a hybrid, so it is no weaker than the classical exchange it replaces.

  1. CHANGELOG.md:634 - Replace hash function with an RSA SSH CA to "rsa-sha2-256".
config.ssh-algorithms · CWE-757
unknown Could not be determined 16 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

  1. pki/testdata/helm/simple.yml:43 test path -----BEGIN CERTIFICATE-----
  2. pki/testdata/helm/simple.yml:51 test path -----BEGIN CERTIFICATE-----
  3. pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:44 test path -----BEGIN CERTIFICATE-----
  4. pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:52 test path -----BEGIN CERTIFICATE-----
  5. pki/testdata/helm/with-acme.yml:44 test path -----BEGIN CERTIFICATE-----
  6. pki/testdata/helm/with-acme.yml:52 test path -----BEGIN CERTIFICATE-----
  7. pki/testdata/helm/with-admin.yml:43 test path -----BEGIN CERTIFICATE-----
  8. pki/testdata/helm/with-admin.yml:51 test path -----BEGIN CERTIFICATE-----
  9. pki/testdata/helm/with-provisioner.yml:43 test path -----BEGIN CERTIFICATE-----
  10. pki/testdata/helm/with-provisioner.yml:51 test path -----BEGIN CERTIFICATE-----
  11. pki/testdata/helm/with-ssh-and-acme.yml:48 test path -----BEGIN CERTIFICATE-----
  12. pki/testdata/helm/with-ssh-and-acme.yml:56 test path -----BEGIN CERTIFICATE-----
  13. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:47 test path -----BEGIN CERTIFICATE-----
  14. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:55 test path -----BEGIN CERTIFICATE-----
  15. pki/testdata/helm/with-ssh.yml:47 test path -----BEGIN CERTIFICATE-----
  16. pki/testdata/helm/with-ssh.yml:55 test path -----BEGIN CERTIFICATE-----
pem.certificate
unknown Could not be determined 15 places See details

X.509 certificate handling

`x509.CreateCertificate()` or a PKCS#1/PKCS#8/EC key parser. Certificates are the longest-lived cryptographic artefacts most systems own, and their validity periods often outrun the migration.

The algorithm could not be established from the source. Usually it is selected while the program runs, but it may equally be that the call gives no clue, or that it is decided somewhere this scan does not reach. Somebody has to check.

What to do. Shorten certificate lifetimes now so the eventual re-issue with a post-quantum key is routine rather than an incident.

  1. acme/api/wire_integration_test.go:620 test path csr, err := x509.CreateCertificateRequest(rand.Reader, csrTemplate, priv)
  2. acme/challenge_test.go:2373 test path cert, err := x509.CreateCertificate(rand.Reader, certTemplate, certTemplate, privateKey.Public(), privateKey)
  3. api/api_test.go:1533 test path der, err := x509.CreateCertificate(rand.Reader, &template, &template, pub, priv)
  4. authority/authority_test.go:435 test path cr, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{
  5. authority/provisioner/aws_test.go:317 test path key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
  6. authority/provisioner/aws_test.go:579 test path key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
  7. authority/provisioner/utils_test.go:434 test path key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
  8. authority/provisioner/utils_test.go:542 test path key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
  9. authority/tls_test.go:198 test path csrBytes, err := x509.CreateCertificateRequest(rand.Reader, _csr, priv)
  10. ca/ca_test.go:49 test path csrBytes, err := x509.CreateCertificateRequest(rand.Reader, _csr, priv)
  11. ca/client.go:1482 csr, err := x509.CreateCertificateRequest(rand.Reader, template, pk)
  12. ca/client.go:1548 csr, err := x509.CreateCertificateRequest(rand.Reader, template, key)
  13. internal/cryptoutil/cryptoutil_test.go:180 test path der, err := x509.CreateCertificate(rand.Reader, template, template, signer.Public(), signer)
  14. internal/cryptoutil/cryptoutil_test.go:189 test path der, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{
  15. test/integration/scep/common_test.go:345 test path selfSigned, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, signer.Public(), signer)
go.x509
unknown Could not be determined 12 places See details

SSH implementation in use

`golang.org/x/crypto/ssh`. Host keys are long-lived and awkward to rotate.

The algorithm could not be established from the source. Usually it is selected while the program runs, but it may equally be that the call gives no clue, or that it is decided somewhere this scan does not reach. Somebody has to check.

What to do. OpenSSH's `sntrup761x25519` hybrid key exchange addresses the recorded-traffic half; the host-key signature has no standardised replacement yet.

  1. api/ssh_test.go:47 test path signerKey, err := ssh.NewPublicKey(sshSignerKey.Public())
  2. authority/authorize_test.go:1020 test path cert.Key, err = ssh.NewPublicKey(jwk.Public().Key)
  3. authority/config/ssh.go:77 key, err := ssh.NewPublicKey(k.Key.Key)
  4. authority/config/ssh_test.go:49 test path pub, err := ssh.NewPublicKey(key.Public().Key)
  5. authority/provisioner/jwk_test.go:427 test path sshPub, err := ssh.NewPublicKey(pub)
  6. authority/provisioner/sign_ssh_options_test.go:233 test path sshPub, err := ssh.NewPublicKey(pub)
  7. authority/provisioner/ssh_test.go:49 test path pub, err := ssh.NewPublicKey(key)
  8. authority/provisioner/sshpop_test.go:49 test path cert.Key, err = ssh.NewPublicKey(jwk.Public().Key)
  9. authority/ssh_test.go:141 test path pub, err := ssh.NewPublicKey(key.Public())
  10. ca/client_test.go:796 test path key, err := ssh.NewPublicKey(mustKey(t).Public())
  11. pki/pki.go:681 sshKey, err := ssh.NewPublicKey(resp.PublicKey)
  12. templates/templates_test.go:222 test path user, err := ssh.NewPublicKey(key.Public())
go.ssh · CWE-327
unknown Could not be determined 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

  1. authority/provisioner/testdata/secrets/ed25519.key:1 test path -----BEGIN ENCRYPTED PRIVATE KEY-----
pem.private-key · CWE-321, CWE-327
unknown Could not be determined 1 place See details

Cryptographic library in the dependency manifest

A dependency known to implement classical asymmetric cryptography. Its presence is inventory, not a finding about this codebase: the library may never be called with a quantum-vulnerable algorithm.

The project depends on a cryptography library. Listed so the inventory is complete; it is not by itself a problem.

What to do. Check the version. Several of these libraries have shipped ML-KEM and ML-DSA support since 2024, so the migration may need an upgrade rather than a replacement.

  1. go.mod:43 golang.org/x/crypto v0.57.0
dep.crypto-library
ML-DSA-65 Quantum-safe 4 places See details

Post-quantum algorithm in use

`crypto/mlkem` or `crypto/mldsa`, added in Go 1.24. Recorded so the inventory shows completed migration work.

This is already a quantum-safe algorithm.

What to do. None. Confirm the parameter set matches the required NIST category.

  1. acme/challenge.go:1812 case *mldsa.PublicKey:
  2. api/api.go:664 case *mldsa.PublicKey:
  3. internal/cryptoutil/cryptoutil.go:21 case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey, *mldsa.PublicKey:
  4. internal/cryptoutil/cryptoutil_test.go:32 test path {"mldsa", &mldsa.PublicKey{}, true},
go.pqc
CSPRNG Quantum-safe 2 places See details

Random number generation

`crypto/rand`. Recorded so the inventory names its randomness source. `math/rand` reaching key material would be a present-day defect, and is a different thing entirely.

This is where the software gets its random numbers. Quantum computers do not weaken it.

What to do. No action.

  1. acme/api/revoke_test.go:47 test path return rand.Int(rand.Reader, big.NewInt(1000000000000000000))
  2. acme/db/nosql/eab.go:67 _, err = rand.Read(random)
go.rng
HMAC Quantum-safe 2 places See details

Keyed hash in use

`hmac.New()`. Not broken by Shor and only marginally affected by Grover.

This is a fingerprint proving a message was not altered. Quantum computers do not break it.

What to do. No action, unless the digest is MD5 or SHA-1.

  1. authority/provisioner/webhook.go:240 h := hmac.New(sha256.New, secret)
  2. authority/provisioner/webhook_test.go:582 test path h := hmac.New(sha256.New, secret)
go.hmac
HMAC Quantum-safe 1 place See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. A keyed MAC is not affected by Shor and only marginally by Grover.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. acme/api/account_test.go:119 test path Algorithm: jose.SignatureAlgorithm("HS256"),
jose.algorithm · CWE-327

Cryptographic assets

Algorithm Assessment What it means Occurrences
ECDSA Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 549
unknown Could not be determined The algorithm could not be established from the source - chosen at runtime, or decided somewhere this scan does not reach. 185
ECDH Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 119
Ed25519 Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 99
TLS Quantum-vulnerable Every TLS cipher suite in general use negotiates a classical key exchange, so a recorded session is decryptable once that exchange falls. 97
RSA Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 69
RSA-1024 Already broken A modulus of 1024 bits or less is below the NIST SP 800-57 floor and is within reach of classical factorisation. Shor is not the nearest problem here. 44
CSPRNG Quantum-safe A cryptographically secure random number generator provided by the platform. Not weakened by a quantum computer. 38
SHA-256 Reduced margin Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades. 23
RSAES-PKCS1v15 Already broken PKCS#1 v1.5 encryption padding is vulnerable to Bleichenbacher oracles today, and the underlying RSA is broken by Shor. 21
SHA-1 Already broken SHAttered and subsequent work produced practical collisions; NIST withdrew SHA-1 in 2030 guidance and it is already unacceptable for signatures. 9
RC4 Already broken RC4 keystream biases break it classically; it is prohibited in TLS by RFC 7465. 7
DSA Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 6
3DES Already broken Triple DES is withdrawn by NIST and limited by its 64-bit block, independent of quantum. 6
HMAC Quantum-safe A keyed MAC is not affected by Shor and only marginally by Grover. 5
ML-DSA-65 Quantum-safe No known quantum algorithm changes the security margin. 4
RSASSA-PKCS1v15 Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both. 4
EC Quantum-vulnerable An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both. 1
SHA-512 Quantum-safe No known quantum algorithm changes the security margin. 1

Imported cryptographic libraries

Library Files
crypto/sha1 the SHA-1 digest, which has practical collisions 5
crypto/ed25519 Edwards-curve signatures 59
crypto/ecdsa elliptic-curve signatures 23
crypto/tls the TLS client and server 32
crypto/rsa RSA key generation, signing and OAEP encryption 29
crypto/dsa DSA signatures; frozen by the Go team since 1.16 4
crypto/sha256 the SHA-2 digests 23
crypto/x509 certificate and key parsing 141
crypto/rand the platform random source 36
crypto/hmac keyed message authentication 2
crypto/sha512 the SHA-2 digests 1