google/conscrypt

RSAES-PKCS1v15 Already broken Recorded traffic 84 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. CAPABILITIES.md:55 * `TLS_RSA_WITH_AES_128_CBC_SHA`
2. CAPABILITIES.md:56 * `TLS_RSA_WITH_AES_128_GCM_SHA256`
3. CAPABILITIES.md:57 * `TLS_RSA_WITH_AES_256_CBC_SHA`
4. CAPABILITIES.md:58 * `TLS_RSA_WITH_AES_256_GCM_SHA384`
5. common/src/main/java/org/conscrypt/NativeCrypto.java:1190 if ("TLS_RSA_WITH_3DES_EDE_CBC_SHA".equals(cipherSuite)) {
6. common/src/main/java/org/conscrypt/NativeCrypto.java:1198 return "TLS_RSA_WITH_3DES_EDE_CBC_SHA";
7. common/src/main/java/org/conscrypt/NativeCrypto.java:1286 "TLS_RSA_WITH_AES_128_GCM_SHA256",
8. common/src/main/java/org/conscrypt/NativeCrypto.java:1287 "TLS_RSA_WITH_AES_256_GCM_SHA384",
9. common/src/main/java/org/conscrypt/NativeCrypto.java:1288 "TLS_RSA_WITH_AES_128_CBC_SHA",
10. common/src/main/java/org/conscrypt/NativeCrypto.java:1289 "TLS_RSA_WITH_AES_256_CBC_SHA",
11. common/src/main/java/org/conscrypt/NativeCrypto.java:1302 "TLS_RSA_WITH_AES_128_GCM_SHA256",
12. common/src/main/java/org/conscrypt/NativeCrypto.java:1303 "TLS_RSA_WITH_AES_256_GCM_SHA384",
13. common/src/main/java/org/conscrypt/NativeCrypto.java:1304 "TLS_RSA_WITH_AES_128_CBC_SHA",
14. common/src/main/java/org/conscrypt/NativeCrypto.java:1305 "TLS_RSA_WITH_AES_256_CBC_SHA",
15. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:35 TLS_RSA_WITH_AES_256_CBC_SHA(0x0035),
16. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:38 TLS_RSA_WITH_AES_128_CBC_SHA(0x002F),
17. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:39 TLS_RSA_WITH_3DES_EDE_CBC_SHA(0x000A),
18. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:42 TLS_RSA_WITH_AES_128_GCM_SHA256(0x009C),
19. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:43 TLS_RSA_WITH_AES_256_GCM_SHA384(0x009D),
20. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:75 return TLS_RSA_WITH_3DES_EDE_CBC_SHA;
21. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:257 test path addOpenSsl("TLS_RSA_WITH_AES_256_CBC_SHA");
22. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:260 test path addOpenSsl("TLS_RSA_WITH_AES_128_CBC_SHA");
23. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:263 test path addOpenSsl("TLS_RSA_WITH_AES_128_GCM_SHA256");
24. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:264 test path addOpenSsl("TLS_RSA_WITH_AES_256_GCM_SHA384");
25. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:318 test path "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_CBC_SHA",
26. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:319 test path "TLS_RSA_WITH_AES_256_CBC_SHA", CIPHER_SUITE_SECURE_RENEGOTIATION);
27. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:331 test path "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_CBC_SHA",
28. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:332 test path "TLS_RSA_WITH_AES_256_CBC_SHA", CIPHER_SUITE_SECURE_RENEGOTIATION);
29. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:27 test path new CipherSuite(0x0001, "TLS_RSA_WITH_NULL_MD5", "SSL_RSA_WITH_NULL_MD5"),
30. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:28 test path new CipherSuite(0x0002, "TLS_RSA_WITH_NULL_SHA", "SSL_RSA_WITH_NULL_SHA"),
31. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:29 test path new CipherSuite(0x0003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5",
32. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:31 test path new CipherSuite(0x0004, "TLS_RSA_WITH_RC4_128_MD5", "SSL_RSA_WITH_RC4_128_MD5"),
33. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:32 test path new CipherSuite(0x0005, "TLS_RSA_WITH_RC4_128_SHA", "SSL_RSA_WITH_RC4_128_SHA"),
34. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:33 test path new CipherSuite(0x0006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5"),
35. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:34 test path new CipherSuite(0x0007, "TLS_RSA_WITH_IDEA_CBC_SHA"),
36. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:35 test path new CipherSuite(0x0008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA",
37. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:37 test path new CipherSuite(0x0009, "TLS_RSA_WITH_DES_CBC_SHA", "SSL_RSA_WITH_DES_CBC_SHA"),
38. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:38 test path new CipherSuite(0x000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
39. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:80 test path new CipherSuite(0x002e, "TLS_RSA_PSK_WITH_NULL_SHA"),
40. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:81 test path new CipherSuite(0x002f, "TLS_RSA_WITH_AES_128_CBC_SHA"),
41. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:87 test path new CipherSuite(0x0035, "TLS_RSA_WITH_AES_256_CBC_SHA"),
42. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:93 test path new CipherSuite(0x003b, "TLS_RSA_WITH_NULL_SHA256"),
43. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:94 test path new CipherSuite(0x003c, "TLS_RSA_WITH_AES_128_CBC_SHA256"),
44. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:95 test path new CipherSuite(0x003d, "TLS_RSA_WITH_AES_256_CBC_SHA256"),
45. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:99 test path new CipherSuite(0x0041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA"),
46. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:105 test path new CipherSuite(0x0060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5"),
47. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:106 test path new CipherSuite(0x0061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5"),
48. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:107 test path new CipherSuite(0x0062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA"),
49. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:109 test path new CipherSuite(0x0064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA"),
50. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:119 test path new CipherSuite(0x0084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA"),
51. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:133 test path new CipherSuite(0x0092, "TLS_RSA_PSK_WITH_RC4_128_SHA"),
52. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:134 test path new CipherSuite(0x0093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA"),
53. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:135 test path new CipherSuite(0x0094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA"),
54. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:136 test path new CipherSuite(0x0095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA"),
55. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:137 test path new CipherSuite(0x0096, "TLS_RSA_WITH_SEED_CBC_SHA"),
56. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:143 test path new CipherSuite(0x009c, "TLS_RSA_WITH_AES_128_GCM_SHA256"),
57. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:144 test path new CipherSuite(0x009d, "TLS_RSA_WITH_AES_256_GCM_SHA384"),
58. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:159 test path new CipherSuite(0x00ac, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256"),
59. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:160 test path new CipherSuite(0x00ad, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384"),
60. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:169 test path new CipherSuite(0x00b6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256"),
61. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:170 test path new CipherSuite(0x00b7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384"),
62. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:171 test path new CipherSuite(0x00b8, "TLS_RSA_PSK_WITH_NULL_SHA256"),
63. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:172 test path new CipherSuite(0x00b9, "TLS_RSA_PSK_WITH_NULL_SHA384"),
64. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:173 test path new CipherSuite(0x00ba, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256"),
65. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:179 test path new CipherSuite(0x00c0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256"),
66. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:251 test path new CipherSuite(0xc03c, "TLS_RSA_WITH_ARIA_128_CBC_SHA256"),
67. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:252 test path new CipherSuite(0xc03d, "TLS_RSA_WITH_ARIA_256_CBC_SHA384"),
68. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:271 test path new CipherSuite(0xc050, "TLS_RSA_WITH_ARIA_128_GCM_SHA256"),
69. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:272 test path new CipherSuite(0xc051, "TLS_RSA_WITH_ARIA_256_GCM_SHA384"),
70. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:295 test path new CipherSuite(0xc068, "TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256"),
71. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:296 test path new CipherSuite(0xc069, "TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384"),
72. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:301 test path new CipherSuite(0xc06e, "TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256"),
73. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:302 test path new CipherSuite(0xc06f, "TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384"),
74. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:313 test path new CipherSuite(0xc07a, "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256"),
75. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:314 test path new CipherSuite(0xc07b, "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384"),
76. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:337 test path new CipherSuite(0xc092, "TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256"),
77. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:338 test path new CipherSuite(0xc093, "TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384"),
78. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:343 test path new CipherSuite(0xc098, "TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256"),
79. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:344 test path new CipherSuite(0xc099, "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384"),
80. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:347 test path new CipherSuite(0xc09c, "TLS_RSA_WITH_AES_128_CCM"),
81. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:348 test path new CipherSuite(0xc09d, "TLS_RSA_WITH_AES_256_CCM"),
82. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:351 test path new CipherSuite(0xc0a0, "TLS_RSA_WITH_AES_128_CCM_8"),
83. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:352 test path new CipherSuite(0xc0a1, "TLS_RSA_WITH_AES_256_CCM_8"),
84. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:376 test path new CipherSuite(0xccae, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256"),

config.cipher-suite · CWE-757

SHA-1 Already broken Renamed import 25 places See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

This is already unsafe today, with no quantum computer involved. SHAttered and subsequent work produced practical collisions; NIST withdrew SHA-1 in 2030 guidance and it is already unacceptable for signatures.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:702 test path assertNotNull(Signature.getInstance("SHA1withRSA"));
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:708 test path assertNotNull(Signature.getInstance("SHA1withDSA"));
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:739 test path Signature sig = Signature.getInstance("SHA1withRSA");
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:789 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:804 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:818 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
7. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1009 test path Signature sig = Signature.getInstance("SHA1withRSA");
8. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1029 test path Signature sig = Signature.getInstance("SHA1withRSA");
9. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1047 test path Signature sig = Signature.getInstance("SHA1withRSA");
10. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1074 test path Signature sig = Signature.getInstance("SHA1withRSA");
11. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1106 test path Signature sig = Signature.getInstance("SHA1withRSA");
12. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1130 test path Signature sig = Signature.getInstance("SHA1withRSA");
13. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1152 test path Signature sig = Signature.getInstance("SHA1withRSA");
14. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1213 test path Signature sig = Signature.getInstance("SHA1withRSA");
15. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1294 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
16. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1318 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
17. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1346 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
18. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1359 test path sig = Signature.getInstance("SHA1withRSA/PSS");
19. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1870 test path MessageDigest sha1 = MessageDigest.getInstance("SHA1");
20. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1896 test path MessageDigest sha1 = MessageDigest.getInstance("SHA1");
21. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2041 test path Signature sig = Signature.getInstance("SHA1withDSA");
22. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2061 test path Signature sig = Signature.getInstance("SHA1withDSA");
23. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2177 test path Signature ecdsaVerify = Signature.getInstance("SHA1withECDSA");
24. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2183 test path ecdsaVerify = Signature.getInstance("SHA1withECDSA");
25. common/src/test/java/org/conscrypt/java/security/cert/CertificateFactoryTest.java:877 test path sha1digest = MessageDigest.getInstance("SHA-1");

java.messagedigest · CWE-328

3DES Already broken 16 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. common/src/main/java/org/conscrypt/NativeCrypto.java:1190 if ("TLS_RSA_WITH_3DES_EDE_CBC_SHA".equals(cipherSuite)) {
2. common/src/main/java/org/conscrypt/NativeCrypto.java:1198 return "TLS_RSA_WITH_3DES_EDE_CBC_SHA";
3. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:39 TLS_RSA_WITH_3DES_EDE_CBC_SHA(0x000A),
4. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:75 return TLS_RSA_WITH_3DES_EDE_CBC_SHA;
5. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:38 test path new CipherSuite(0x000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
6. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:42 test path new CipherSuite(0x000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA"),
7. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:45 test path new CipherSuite(0x0010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA"),
8. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:49 test path new CipherSuite(0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
9. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:54 test path new CipherSuite(0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
10. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:130 test path new CipherSuite(0x008f, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA"),
11. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:134 test path new CipherSuite(0x0093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA"),
12. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:194 test path new CipherSuite(0xc003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA"),
13. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:199 test path new CipherSuite(0xc008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA"),
14. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:204 test path new CipherSuite(0xc00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA"),
15. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:209 test path new CipherSuite(0xc012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"),
16. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:243 test path new CipherSuite(0xc034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA"),

config.cipher-suite · CWE-757

NULL Already broken 16 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:27 test path new CipherSuite(0x0001, "TLS_RSA_WITH_NULL_MD5", "SSL_RSA_WITH_NULL_MD5"),
2. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:28 test path new CipherSuite(0x0002, "TLS_RSA_WITH_NULL_SHA", "SSL_RSA_WITH_NULL_SHA"),
3. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:79 test path new CipherSuite(0x002d, "TLS_DHE_PSK_WITH_NULL_SHA"),
4. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:80 test path new CipherSuite(0x002e, "TLS_RSA_PSK_WITH_NULL_SHA"),
5. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:93 test path new CipherSuite(0x003b, "TLS_RSA_WITH_NULL_SHA256"),
6. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:167 test path new CipherSuite(0x00b4, "TLS_DHE_PSK_WITH_NULL_SHA256"),
7. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:168 test path new CipherSuite(0x00b5, "TLS_DHE_PSK_WITH_NULL_SHA384"),
8. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:171 test path new CipherSuite(0x00b8, "TLS_RSA_PSK_WITH_NULL_SHA256"),
9. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:172 test path new CipherSuite(0x00b9, "TLS_RSA_PSK_WITH_NULL_SHA384"),
10. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:192 test path new CipherSuite(0xc001, "TLS_ECDH_ECDSA_WITH_NULL_SHA"),
11. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:197 test path new CipherSuite(0xc006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA"),
12. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:202 test path new CipherSuite(0xc00b, "TLS_ECDH_RSA_WITH_NULL_SHA"),
13. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:207 test path new CipherSuite(0xc010, "TLS_ECDHE_RSA_WITH_NULL_SHA"),
14. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:248 test path new CipherSuite(0xc039, "TLS_ECDHE_PSK_WITH_NULL_SHA"),
15. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:249 test path new CipherSuite(0xc03a, "TLS_ECDHE_PSK_WITH_NULL_SHA256"),
16. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:250 test path new CipherSuite(0xc03b, "TLS_ECDHE_PSK_WITH_NULL_SHA384"),

config.cipher-suite · CWE-757

RC4 Already broken 13 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:29 test path new CipherSuite(0x0003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5",
2. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:31 test path new CipherSuite(0x0004, "TLS_RSA_WITH_RC4_128_MD5", "SSL_RSA_WITH_RC4_128_MD5"),
3. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:32 test path new CipherSuite(0x0005, "TLS_RSA_WITH_RC4_128_SHA", "SSL_RSA_WITH_RC4_128_SHA"),
4. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:105 test path new CipherSuite(0x0060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5"),
5. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:109 test path new CipherSuite(0x0064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA"),
6. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:111 test path new CipherSuite(0x0066, "TLS_DHE_DSS_WITH_RC4_128_SHA"),
7. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:129 test path new CipherSuite(0x008e, "TLS_DHE_PSK_WITH_RC4_128_SHA"),
8. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:133 test path new CipherSuite(0x0092, "TLS_RSA_PSK_WITH_RC4_128_SHA"),
9. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:193 test path new CipherSuite(0xc002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA"),
10. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:198 test path new CipherSuite(0xc007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"),
11. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:203 test path new CipherSuite(0xc00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA"),
12. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:208 test path new CipherSuite(0xc011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA"),
13. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:242 test path new CipherSuite(0xc033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA"),

config.cipher-suite · CWE-757

3DES Already broken 10 places See details

Cipher transformation named away from the call

A JCA transformation string - `algorithm/mode/padding` - written somewhere other than a `getInstance()` argument, which is how a codebase that centralises its cryptography passes the choice to a helper. The string is unambiguous wherever it appears: nothing but a transformation is spelled that way.

This names an encryption method as text, and passes it to code elsewhere that does the work. It is the same choice, made in a different place.

What to do. The same migration applies as to the call that consumes it. Move the constant and the call together, so the inventory keeps naming the algorithm after the change.

1. common/src/main/java/org/conscrypt/OpenSSLProvider.java:669 putSymmetricCipherImplClass("DESEDE/CBC/NoPadding", "OpenSSLEvpCipherDESEDE$CBC$NoPadding");
2. common/src/main/java/org/conscrypt/OpenSSLProvider.java:670 putSymmetricCipherImplClass("DESEDE/CBC/PKCS5Padding",
3. common/src/main/java/org/conscrypt/OpenSSLProvider.java:672 put("Alg.Alias.Cipher.DESEDE/CBC/PKCS7Padding", "DESEDE/CBC/PKCS5Padding");
4. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:64 test path BASIC_CIPHER_TO_TEST_DATA.put("DESEDE/ECB/NoPadding", "crypto/desede-ecb.csv");
5. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:65 test path BASIC_CIPHER_TO_TEST_DATA.put("DESEDE/CBC/NoPadding", "crypto/desede-cbc.csv");
6. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:66 test path BASIC_CIPHER_TO_TEST_DATA.put("DESEDE/CFB8/NoPadding", "crypto/desede-cfb8.csv");
7. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:67 test path BASIC_CIPHER_TO_TEST_DATA.put("DESEDE/CFB64/NoPadding", "crypto/desede-cfb64.csv");
8. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:68 test path BASIC_CIPHER_TO_TEST_DATA.put("DESEDE/OFB/NoPadding", "crypto/desede-ofb.csv");
9. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3687 test path "DESede/CBC/PKCS5Padding", new IvParameterSpec(DES_IV1), DES_112_KEY, null,
10. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3697 test path "DESede/CBC/PKCS5Padding", new IvParameterSpec(DES_IV1), DES_168_KEY, null,

java.transformation · CWE-327

RSAES-PKCS1v15 Already broken Recorded traffic 10 places See details

Cipher transformation named away from the call

A JCA transformation string - `algorithm/mode/padding` - written somewhere other than a `getInstance()` argument, which is how a codebase that centralises its cryptography passes the choice to a helper. The string is unambiguous wherever it appears: nothing but a transformation is spelled that way.

This names an encryption method as text, and passes it to code elsewhere that does the work. It is the same choice, made in a different place.

What to do. The same migration applies as to the call that consumes it. Move the constant and the call together, so the inventory keeps naming the algorithm after the change.

1. common/src/main/java/org/conscrypt/OpenSSLProvider.java:587 putRSACipherImplClass("RSA/ECB/PKCS1Padding", "OpenSSLCipherRSA$PKCS1");
2. common/src/main/java/org/conscrypt/OpenSSLProvider.java:588 put("Alg.Alias.Cipher.RSA/None/PKCS1Padding", "RSA/ECB/PKCS1Padding");
3. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:457 test path setExpectedBlockSize("RSA/ECB/PKCS1Padding", "SunJCE", 0);
4. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:467 test path setExpectedBlockSize("RSA/ECB/PKCS1Padding", Cipher.ENCRYPT_MODE, 245);
5. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:475 test path setExpectedBlockSize("RSA/ECB/PKCS1Padding", Cipher.DECRYPT_MODE, 256);
6. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:747 test path setExpectedOutputSize("RSA/ECB/PKCS1Padding", Cipher.ENCRYPT_MODE, 256);
7. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:751 test path setExpectedOutputSize("RSA/ECB/PKCS1Padding", Cipher.DECRYPT_MODE, 245);
8. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:755 test path setExpectedOutputSize("RSA/ECB/PKCS1Padding", Cipher.DECRYPT_MODE, "SunJCE", 256);
9. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1146 test path algorithm = "RSA/ECB/PKCS1Padding";
10. testing/src/main/java/org/conscrypt/testing/OpaqueProvider.java:159 test path super("RSA/ECB/PKCS1Padding");

java.transformation · CWE-327

SHA-1 Already broken Renamed import 10 places See details

Mask-generation digest named for RSA padding

`MGF1ParameterSpec.SHA256` names the digest inside RSA-OAEP and RSA-PSS padding. It is a separate choice from the digest the signature or the cipher uses, it is frequently left at SHA-1 by default, and a static import of it - `import static java.security.spec.MGF1ParameterSpec.SHA512` - is the only place the choice appears in the file that makes it.

This picks the hash used inside RSA padding. It matters because the default is often SHA-1, which is broken today without any quantum computer.

What to do. The mask-generation digest travels with the RSA key it pads. When that key moves to ML-KEM or ML-DSA the padding goes with it; until then, SHA-256 or better.

1. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:135 test path new OAEPParameterSpec("SHA-1", "MGF1", MGF1ParameterSpec.SHA1,
2. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:149 test path new OAEPParameterSpec("SHA-1", "MGF1", MGF1ParameterSpec.SHA1,
3. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:191 test path assertEquals(MGF1ParameterSpec.SHA1.getDigestAlgorithm(),
4. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:203 test path assertEquals(MGF1ParameterSpec.SHA1.getDigestAlgorithm(),
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:460 test path new PSSParameterSpec("SHA-1", "MGF1", MGF1ParameterSpec.SHA1, 20, 1);
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:477 test path new PSSParameterSpec("SHA-1", "MGF1", MGF1ParameterSpec.SHA1, 0, 1);
7. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:494 test path new PSSParameterSpec("SHA-1", "MGF1", MGF1ParameterSpec.SHA1, 234, 1);
8. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3765 test path addRsaOaepTest("SHA-1", MGF1ParameterSpec.SHA1, RSA_Vector2_OAEP_SHA1_MGF1_SHA1);
9. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3766 test path addRsaOaepTest("SHA-256", MGF1ParameterSpec.SHA1, RSA_Vector2_OAEP_SHA256_MGF1_SHA1);
10. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3771 test path addRsaOaepTest("SHA-256", MGF1ParameterSpec.SHA1, RSA_Vector2_OAEP_SHA256_MGF1_SHA1_LABEL,

java.mgf1 · CWE-327

DES Already broken 7 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:35 test path new CipherSuite(0x0008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA",
2. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:37 test path new CipherSuite(0x0009, "TLS_RSA_WITH_DES_CBC_SHA", "SSL_RSA_WITH_DES_CBC_SHA"),
3. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:41 test path new CipherSuite(0x000c, "TLS_DH_DSS_WITH_DES_CBC_SHA"),
4. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:44 test path new CipherSuite(0x000f, "TLS_DH_RSA_WITH_DES_CBC_SHA"),
5. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:48 test path new CipherSuite(0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA", "SSL_DHE_DSS_WITH_DES_CBC_SHA"),
6. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:53 test path new CipherSuite(0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA", "SSL_DHE_RSA_WITH_DES_CBC_SHA"),
7. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:107 test path new CipherSuite(0x0062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA"),

config.cipher-suite · CWE-757

RSA-10241024-bit Already broken 4 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. openjdk/src/test/resources/ca-cert.pem:44 test path -----BEGIN CERTIFICATE-----
2. openjdk/src/test/resources/cert-ct-embedded.pem:46 test path -----BEGIN CERTIFICATE-----
3. openjdk/src/test/resources/cert-ct-poisoned.pem:46 test path -----BEGIN CERTIFICATE-----
4. openjdk/src/test/resources/cert.pem:44 test path -----BEGIN CERTIFICATE-----

pem.certificate

3DES Already broken 3 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. common/src/main/java/org/conscrypt/DESEDESecretKeyFactory.java:54 return new SecretKeySpec(desKeySpec.getKey(), "DESEDE");
2. common/src/main/java/org/conscrypt/DESEDESecretKeyFactory.java:80 return new SecretKeySpec(secretKey.getEncoded(), "DESEDE");
3. common/src/main/java/org/conscrypt/DESEDESecretKeyFactory.java:84 return new DESedeKeySpec(secretKey.getEncoded());

java.keyspec · CWE-327

MD5 Already broken Renamed import 3 places See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

This is already unsafe today, with no quantum computer involved. Practical chosen-prefix collisions exist; MD5 has no remaining security as a digest.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:707 test path assertNotNull(Signature.getInstance("MD5withRSA"));
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:779 test path Signature sig = Signature.getInstance("MD5withRSA");
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1283 test path Signature sig = Signature.getInstance("MD5withRSA");

java.messagedigest · CWE-328

DES Already broken 2 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. common/src/test/java/org/conscrypt/OpenSslCompositeMlDsaKeyFactoryTest.java:265 test path new DESKeySpec(TestUtils.decodeBase64(tv.getString("pkx509")));
2. common/src/test/java/org/conscrypt/OpenSslCompositeMlDsaKeyFactoryTest.java:330 test path new DESKeySpec(TestUtils.decodeBase64(tv.getString("skpkcs8")));

java.keyspec · CWE-327

RC4 Already broken 2 places See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

This is already unsafe today, with no quantum computer involved. RC4 keystream biases break it classically; it is prohibited in TLS by RFC 7465.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4627 test path KeyGenerator kg = KeyGenerator.getInstance("ARC4");
2. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4651 test path Cipher c = Cipher.getInstance("ARC4", p);

java.cipher · CWE-327

RSAES-PKCS1v15 Already broken Recorded traffic 2 places See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

This is already unsafe today, with no quantum computer involved. PKCS#1 v1.5 encryption padding is vulnerable to Bleichenbacher oracles today, and the underlying RSA is broken by Shor.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1612 test path Cipher decryptCipher = Cipher.getInstance("RSA/ECB/PKCS1Padding", provider);
2. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1638 test path Cipher encryptCipher = Cipher.getInstance("RSA/ECB/PKCS1Padding", provider);

java.cipher · CWE-327

RSA-10241024-bit Already broken Recorded traffic 1 place See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

This is already unsafe today, with no quantum computer involved. A modulus of 1024 bits or less is below the NIST SP 800-57 floor and is within reach of classical factorisation. Shor is not the nearest problem here.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4790 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");

java.keypairgenerator · CWE-327

RSA-10241024-bit Already broken Recorded traffic 1 place See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

This is already unsafe today, with no quantum computer involved. A modulus of 1024 bits or less is below the NIST SP 800-57 floor and is within reach of classical factorisation. Shor is not the nearest problem here.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4792 test path Cipher cipher = Cipher.getInstance("RSA/NONE/OAEPPadding");

java.cipher · CWE-327

SHA-1 Already broken 1 place See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

This is already unsafe today, with no quantum computer involved. SHAttered and subsequent work produced practical collisions; NIST withdrew SHA-1 in 2030 guidance and it is already unacceptable for signatures.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4853 test path SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WITHHMACSHA1");

java.cipher · CWE-327

ECDH Quantum-vulnerable Recorded traffic Renamed import 175 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. CAPABILITIES.md:45 * `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA`
2. CAPABILITIES.md:46 * `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`
3. CAPABILITIES.md:47 * `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA`
4. CAPABILITIES.md:48 * `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`
5. CAPABILITIES.md:49 * `TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256`
6. CAPABILITIES.md:50 * `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`
7. CAPABILITIES.md:51 * `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`
8. CAPABILITIES.md:52 * `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`
9. CAPABILITIES.md:53 * `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`
10. CAPABILITIES.md:54 * `TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256`
11. CAPABILITIES.md:75 * `TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA`
12. CAPABILITIES.md:76 * `TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA`
13. CAPABILITIES.md:77 * `TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256`
14. common/src/main/java/org/conscrypt/NativeCrypto.java:1276 "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
15. common/src/main/java/org/conscrypt/NativeCrypto.java:1277 "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
16. common/src/main/java/org/conscrypt/NativeCrypto.java:1278 "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
17. common/src/main/java/org/conscrypt/NativeCrypto.java:1279 "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
18. common/src/main/java/org/conscrypt/NativeCrypto.java:1280 "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
19. common/src/main/java/org/conscrypt/NativeCrypto.java:1281 "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
20. common/src/main/java/org/conscrypt/NativeCrypto.java:1282 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
21. common/src/main/java/org/conscrypt/NativeCrypto.java:1283 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
22. common/src/main/java/org/conscrypt/NativeCrypto.java:1284 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
23. common/src/main/java/org/conscrypt/NativeCrypto.java:1285 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
24. common/src/main/java/org/conscrypt/NativeCrypto.java:1292 "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
25. common/src/main/java/org/conscrypt/NativeCrypto.java:1293 "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
26. common/src/main/java/org/conscrypt/NativeCrypto.java:1294 "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
27. common/src/main/java/org/conscrypt/NativeCrypto.java:1295 "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
28. common/src/main/java/org/conscrypt/NativeCrypto.java:1296 "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
29. common/src/main/java/org/conscrypt/NativeCrypto.java:1297 "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
30. common/src/main/java/org/conscrypt/NativeCrypto.java:1298 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
31. common/src/main/java/org/conscrypt/NativeCrypto.java:1299 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
32. common/src/main/java/org/conscrypt/NativeCrypto.java:1300 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
33. common/src/main/java/org/conscrypt/NativeCrypto.java:1301 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
34. common/src/main/java/org/conscrypt/NativeCrypto.java:1310 "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256",
35. common/src/main/java/org/conscrypt/NativeCrypto.java:1311 "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA",
36. common/src/main/java/org/conscrypt/NativeCrypto.java:1312 "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA",
37. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:33 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA(0xC00A),
38. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:34 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA(0xC014),
39. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:36 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA(0xC009),
40. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:37 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA(0xC013),
41. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:44 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256(0xC02F),
42. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:45 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384(0xC030),
43. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:46 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256(0xC02B),
44. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:47 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384(0xC02C),
45. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:48 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256(0xCCA9),
46. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:49 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256(0xCCA8),
47. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:54 TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA(0xC035),
48. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:55 TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA(0xC036),
49. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:56 TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256(0xCCAC),
50. common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketTest.java:895 test path new String[] {"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"},
51. common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketTest.java:903 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"},
52. openjdk/src/test/java/org/conscrypt/MockSessionBuilder.java:28 test path static final String DEFAULT_CIPHER_SUITE = "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256";
53. openjdk/src/test/java/org/conscrypt/NativeCryptoTest.java:1351 test path cipherSuites.add("ECDHE-RSA-AES128-SHA");
54. openjdk/src/test/java/org/conscrypt/NativeCryptoTest.java:2938 test path cHooks.enabledCipherSuites = Collections.singletonList("ECDHE-RSA-AES128-GCM-SHA256");
55. openjdk/src/test/java/org/conscrypt/NativeCryptoTest.java:2940 test path Collections.singletonList("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256");
56. openjdk/src/test/java/org/conscrypt/NativeCryptoTest.java:2947 test path assertEquals("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", cHooks.negotiatedCipherSuite);
57. openjdk/src/test/java/org/conscrypt/NativeCryptoTest.java:2948 test path assertEquals("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", sHooks.negotiatedCipherSuite);
58. testing/src/main/java/org/conscrypt/TestUtils.java:94 test path static final String TEST_CIPHER = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256";
59. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:255 test path addOpenSsl("TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA");
60. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:256 test path addOpenSsl("TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA");
61. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:258 test path addOpenSsl("TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA");
62. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:259 test path addOpenSsl("TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA");
63. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:265 test path addOpenSsl("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256");
64. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:266 test path addOpenSsl("TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384");
65. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:267 test path addOpenSsl("TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256");
66. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:268 test path addOpenSsl("TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384");
67. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:269 test path addOpenSsl("TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256");
68. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:270 test path addOpenSsl("TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256");
69. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:275 test path addOpenSsl("TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA");
70. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:276 test path addOpenSsl("TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA");
71. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:277 test path addOpenSsl("TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256");
72. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:312 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
73. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:313 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
74. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:314 test path "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
75. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:315 test path "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
76. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:316 test path "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
77. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:317 test path "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256",
78. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:325 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
79. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:326 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
80. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:327 test path "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
81. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:328 test path "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
82. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:329 test path "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
83. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:330 test path "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256",
84. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:343 test path "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA",
85. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:344 test path "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA", "TLS_PSK_WITH_AES_128_CBC_SHA",
86. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:192 test path new CipherSuite(0xc001, "TLS_ECDH_ECDSA_WITH_NULL_SHA"),
87. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:193 test path new CipherSuite(0xc002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA"),
88. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:194 test path new CipherSuite(0xc003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA"),
89. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:195 test path new CipherSuite(0xc004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA"),
90. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:196 test path new CipherSuite(0xc005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA"),
91. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:197 test path new CipherSuite(0xc006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA"),
92. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:198 test path new CipherSuite(0xc007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"),
93. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:199 test path new CipherSuite(0xc008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA"),
94. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:200 test path new CipherSuite(0xc009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA"),
95. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:201 test path new CipherSuite(0xc00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"),
96. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:202 test path new CipherSuite(0xc00b, "TLS_ECDH_RSA_WITH_NULL_SHA"),
97. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:203 test path new CipherSuite(0xc00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA"),
98. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:204 test path new CipherSuite(0xc00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA"),
99. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:205 test path new CipherSuite(0xc00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA"),
100. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:206 test path new CipherSuite(0xc00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA"),
101. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:207 test path new CipherSuite(0xc010, "TLS_ECDHE_RSA_WITH_NULL_SHA"),
102. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:208 test path new CipherSuite(0xc011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA"),
103. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:209 test path new CipherSuite(0xc012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"),
104. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:210 test path new CipherSuite(0xc013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"),
105. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:211 test path new CipherSuite(0xc014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"),
106. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:226 test path new CipherSuite(0xc023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"),
107. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:227 test path new CipherSuite(0xc024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384"),
108. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:228 test path new CipherSuite(0xc025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256"),
109. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:229 test path new CipherSuite(0xc026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384"),
110. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:230 test path new CipherSuite(0xc027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"),
111. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:231 test path new CipherSuite(0xc028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"),
112. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:232 test path new CipherSuite(0xc029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256"),
113. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:233 test path new CipherSuite(0xc02a, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384"),
114. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:234 test path new CipherSuite(0xc02b, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"),
115. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:235 test path new CipherSuite(0xc02c, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"),
116. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:236 test path new CipherSuite(0xc02d, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256"),
117. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:237 test path new CipherSuite(0xc02e, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384"),
118. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:238 test path new CipherSuite(0xc02f, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"),
119. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:239 test path new CipherSuite(0xc030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"),
120. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:240 test path new CipherSuite(0xc031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256"),
121. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:241 test path new CipherSuite(0xc032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384"),
122. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:242 test path new CipherSuite(0xc033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA"),
123. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:243 test path new CipherSuite(0xc034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA"),
124. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:244 test path new CipherSuite(0xc035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA"),
125. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:245 test path new CipherSuite(0xc036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA"),
126. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:246 test path new CipherSuite(0xc037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256"),
127. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:247 test path new CipherSuite(0xc038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384"),
128. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:248 test path new CipherSuite(0xc039, "TLS_ECDHE_PSK_WITH_NULL_SHA"),
129. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:249 test path new CipherSuite(0xc03a, "TLS_ECDHE_PSK_WITH_NULL_SHA256"),
130. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:250 test path new CipherSuite(0xc03b, "TLS_ECDHE_PSK_WITH_NULL_SHA384"),
131. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:263 test path new CipherSuite(0xc048, "TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256"),
132. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:264 test path new CipherSuite(0xc049, "TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384"),
133. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:265 test path new CipherSuite(0xc04a, "TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256"),
134. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:266 test path new CipherSuite(0xc04b, "TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384"),
135. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:267 test path new CipherSuite(0xc04c, "TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256"),
136. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:268 test path new CipherSuite(0xc04d, "TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384"),
137. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:269 test path new CipherSuite(0xc04e, "TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256"),
138. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:270 test path new CipherSuite(0xc04f, "TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384"),
139. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:283 test path new CipherSuite(0xc05c, "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256"),
140. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:284 test path new CipherSuite(0xc05d, "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384"),
141. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:285 test path new CipherSuite(0xc05e, "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256"),
142. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:286 test path new CipherSuite(0xc05f, "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384"),
143. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:287 test path new CipherSuite(0xc060, "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256"),
144. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:288 test path new CipherSuite(0xc061, "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384"),
145. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:289 test path new CipherSuite(0xc062, "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256"),
146. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:290 test path new CipherSuite(0xc063, "TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384"),
147. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:303 test path new CipherSuite(0xc070, "TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256"),
148. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:304 test path new CipherSuite(0xc071, "TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384"),
149. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:305 test path new CipherSuite(0xc072, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256"),
150. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:306 test path new CipherSuite(0xc073, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384"),
151. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:307 test path new CipherSuite(0xc074, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256"),
152. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:308 test path new CipherSuite(0xc075, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384"),
153. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:309 test path new CipherSuite(0xc076, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256"),
154. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:310 test path new CipherSuite(0xc077, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384"),
155. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:311 test path new CipherSuite(0xc078, "TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256"),
156. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:312 test path new CipherSuite(0xc079, "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384"),
157. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:325 test path new CipherSuite(0xc086, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256"),
158. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:326 test path new CipherSuite(0xc087, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384"),
159. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:327 test path new CipherSuite(0xc088, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256"),
160. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:328 test path new CipherSuite(0xc089, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384"),
161. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:329 test path new CipherSuite(0xc08a, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256"),
162. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:330 test path new CipherSuite(0xc08b, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384"),
163. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:331 test path new CipherSuite(0xc08c, "TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256"),
164. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:332 test path new CipherSuite(0xc08d, "TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384"),
165. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:345 test path new CipherSuite(0xc09a, "TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256"),
166. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:346 test path new CipherSuite(0xc09b, "TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384"),
167. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:363 test path new CipherSuite(0xc0ac, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM"),
168. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:364 test path new CipherSuite(0xc0ad, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM"),
169. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:365 test path new CipherSuite(0xc0ae, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8"),
170. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:366 test path new CipherSuite(0xc0af, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8"),
171. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:367 test path new CipherSuite(0xcc13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_OLD"),
172. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:368 test path new CipherSuite(0xcc14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_OLD"),
173. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:370 test path new CipherSuite(0xcca8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"),
174. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:371 test path new CipherSuite(0xcca9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"),
175. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:374 test path new CipherSuite(0xccac, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256"),

config.cipher-suite · CWE-757

DH Quantum-vulnerable Recorded traffic 105 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:41 test path new CipherSuite(0x000c, "TLS_DH_DSS_WITH_DES_CBC_SHA"),
2. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:42 test path new CipherSuite(0x000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA"),
3. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:44 test path new CipherSuite(0x000f, "TLS_DH_RSA_WITH_DES_CBC_SHA"),
4. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:45 test path new CipherSuite(0x0010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA"),
5. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:48 test path new CipherSuite(0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA", "SSL_DHE_DSS_WITH_DES_CBC_SHA"),
6. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:49 test path new CipherSuite(0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
7. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:53 test path new CipherSuite(0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA", "SSL_DHE_RSA_WITH_DES_CBC_SHA"),
8. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:54 test path new CipherSuite(0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
9. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:79 test path new CipherSuite(0x002d, "TLS_DHE_PSK_WITH_NULL_SHA"),
10. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:82 test path new CipherSuite(0x0030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA"),
11. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:83 test path new CipherSuite(0x0031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA"),
12. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:84 test path new CipherSuite(0x0032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA"),
13. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:85 test path new CipherSuite(0x0033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA"),
14. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:88 test path new CipherSuite(0x0036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA"),
15. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:89 test path new CipherSuite(0x0037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA"),
16. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:90 test path new CipherSuite(0x0038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA"),
17. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:91 test path new CipherSuite(0x0039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA"),
18. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:96 test path new CipherSuite(0x003e, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256"),
19. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:97 test path new CipherSuite(0x003f, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256"),
20. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:98 test path new CipherSuite(0x0040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256"),
21. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:100 test path new CipherSuite(0x0042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA"),
22. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:101 test path new CipherSuite(0x0043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA"),
23. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:102 test path new CipherSuite(0x0044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA"),
24. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:103 test path new CipherSuite(0x0045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA"),
25. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:111 test path new CipherSuite(0x0066, "TLS_DHE_DSS_WITH_RC4_128_SHA"),
26. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:112 test path new CipherSuite(0x0067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256"),
27. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:113 test path new CipherSuite(0x0068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256"),
28. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:114 test path new CipherSuite(0x0069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256"),
29. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:115 test path new CipherSuite(0x006a, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256"),
30. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:116 test path new CipherSuite(0x006b, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256"),
31. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:120 test path new CipherSuite(0x0085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA"),
32. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:121 test path new CipherSuite(0x0086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA"),
33. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:122 test path new CipherSuite(0x0087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA"),
34. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:123 test path new CipherSuite(0x0088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA"),
35. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:129 test path new CipherSuite(0x008e, "TLS_DHE_PSK_WITH_RC4_128_SHA"),
36. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:130 test path new CipherSuite(0x008f, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA"),
37. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:131 test path new CipherSuite(0x0090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA"),
38. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:132 test path new CipherSuite(0x0091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA"),
39. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:138 test path new CipherSuite(0x0097, "TLS_DH_DSS_WITH_SEED_CBC_SHA"),
40. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:139 test path new CipherSuite(0x0098, "TLS_DH_RSA_WITH_SEED_CBC_SHA"),
41. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:140 test path new CipherSuite(0x0099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA"),
42. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:141 test path new CipherSuite(0x009a, "TLS_DHE_RSA_WITH_SEED_CBC_SHA"),
43. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:145 test path new CipherSuite(0x009e, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"),
44. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:146 test path new CipherSuite(0x009f, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"),
45. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:147 test path new CipherSuite(0x00a0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256"),
46. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:148 test path new CipherSuite(0x00a1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384"),
47. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:149 test path new CipherSuite(0x00a2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256"),
48. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:150 test path new CipherSuite(0x00a3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384"),
49. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:151 test path new CipherSuite(0x00a4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256"),
50. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:152 test path new CipherSuite(0x00a5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384"),
51. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:157 test path new CipherSuite(0x00aa, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256"),
52. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:158 test path new CipherSuite(0x00ab, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384"),
53. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:165 test path new CipherSuite(0x00b2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256"),
54. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:166 test path new CipherSuite(0x00b3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384"),
55. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:167 test path new CipherSuite(0x00b4, "TLS_DHE_PSK_WITH_NULL_SHA256"),
56. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:168 test path new CipherSuite(0x00b5, "TLS_DHE_PSK_WITH_NULL_SHA384"),
57. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:174 test path new CipherSuite(0x00bb, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256"),
58. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:175 test path new CipherSuite(0x00bc, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256"),
59. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:176 test path new CipherSuite(0x00bd, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256"),
60. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:177 test path new CipherSuite(0x00be, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256"),
61. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:180 test path new CipherSuite(0x00c1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256"),
62. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:181 test path new CipherSuite(0x00c2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256"),
63. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:182 test path new CipherSuite(0x00c3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256"),
64. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:183 test path new CipherSuite(0x00c4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256"),
65. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:253 test path new CipherSuite(0xc03e, "TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256"),
66. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:254 test path new CipherSuite(0xc03f, "TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384"),
67. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:255 test path new CipherSuite(0xc040, "TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256"),
68. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:256 test path new CipherSuite(0xc041, "TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384"),
69. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:257 test path new CipherSuite(0xc042, "TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256"),
70. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:258 test path new CipherSuite(0xc043, "TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384"),
71. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:259 test path new CipherSuite(0xc044, "TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256"),
72. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:260 test path new CipherSuite(0xc045, "TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384"),
73. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:273 test path new CipherSuite(0xc052, "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256"),
74. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:274 test path new CipherSuite(0xc053, "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384"),
75. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:275 test path new CipherSuite(0xc054, "TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256"),
76. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:276 test path new CipherSuite(0xc055, "TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384"),
77. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:277 test path new CipherSuite(0xc056, "TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256"),
78. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:278 test path new CipherSuite(0xc057, "TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384"),
79. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:279 test path new CipherSuite(0xc058, "TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256"),
80. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:280 test path new CipherSuite(0xc059, "TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384"),
81. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:293 test path new CipherSuite(0xc066, "TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256"),
82. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:294 test path new CipherSuite(0xc067, "TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384"),
83. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:299 test path new CipherSuite(0xc06c, "TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256"),
84. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:300 test path new CipherSuite(0xc06d, "TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384"),
85. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:315 test path new CipherSuite(0xc07c, "TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256"),
86. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:316 test path new CipherSuite(0xc07d, "TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384"),
87. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:317 test path new CipherSuite(0xc07e, "TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256"),
88. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:318 test path new CipherSuite(0xc07f, "TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384"),
89. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:319 test path new CipherSuite(0xc080, "TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256"),
90. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:320 test path new CipherSuite(0xc081, "TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384"),
91. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:321 test path new CipherSuite(0xc082, "TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256"),
92. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:322 test path new CipherSuite(0xc083, "TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384"),
93. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:335 test path new CipherSuite(0xc090, "TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256"),
94. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:336 test path new CipherSuite(0xc091, "TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384"),
95. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:341 test path new CipherSuite(0xc096, "TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256"),
96. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:342 test path new CipherSuite(0xc097, "TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384"),
97. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:349 test path new CipherSuite(0xc09e, "TLS_DHE_RSA_WITH_AES_128_CCM"),
98. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:350 test path new CipherSuite(0xc09f, "TLS_DHE_RSA_WITH_AES_256_CCM"),
99. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:353 test path new CipherSuite(0xc0a2, "TLS_DHE_RSA_WITH_AES_128_CCM_8"),
100. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:354 test path new CipherSuite(0xc0a3, "TLS_DHE_RSA_WITH_AES_256_CCM_8"),
101. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:357 test path new CipherSuite(0xc0a6, "TLS_DHE_PSK_WITH_AES_128_CCM"),
102. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:358 test path new CipherSuite(0xc0a7, "TLS_DHE_PSK_WITH_AES_256_CCM"),
103. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:369 test path new CipherSuite(0xcc15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_OLD"),
104. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:372 test path new CipherSuite(0xccaa, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256"),
105. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:375 test path new CipherSuite(0xccad, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256"),

config.cipher-suite · CWE-757

RSA Quantum-vulnerable Renamed import 71 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:95 test path Signature signature = Signature.getInstance("SHA256withRSA", conscryptProvider);
2. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:110 test path Signature signature = Signature.getInstance("SHA256withRSA/PSS", conscryptProvider);
3. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:125 test path Signature signature = Signature.getInstance("NONEwithRSA", conscryptProvider);
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:288 test path Signature sig = Signature.getInstance("SHA256withRSA");
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:702 test path assertNotNull(Signature.getInstance("SHA1withRSA"));
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:703 test path assertNotNull(Signature.getInstance("SHA256withRSA"));
7. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:704 test path assertNotNull(Signature.getInstance("SHA384withRSA"));
8. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:705 test path assertNotNull(Signature.getInstance("SHA512withRSA"));
9. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:706 test path assertNotNull(Signature.getInstance("NONEwithRSA"));
10. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:707 test path assertNotNull(Signature.getInstance("MD5withRSA"));
11. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:739 test path Signature sig = Signature.getInstance("SHA1withRSA");
12. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:749 test path Signature sig = Signature.getInstance("SHA256withRSA");
13. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:759 test path Signature sig = Signature.getInstance("SHA384withRSA");
14. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:769 test path Signature sig = Signature.getInstance("SHA512withRSA");
15. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:779 test path Signature sig = Signature.getInstance("MD5withRSA");
16. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:789 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
17. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:804 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
18. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:818 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
19. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:832 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
20. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:847 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
21. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:861 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
22. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:875 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
23. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:890 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
24. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:904 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
25. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:918 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
26. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:933 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
27. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:947 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
28. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:961 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
29. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:976 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
30. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:990 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
31. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1009 test path Signature sig = Signature.getInstance("SHA1withRSA");
32. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1029 test path Signature sig = Signature.getInstance("SHA1withRSA");
33. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1047 test path Signature sig = Signature.getInstance("SHA1withRSA");
34. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1074 test path Signature sig = Signature.getInstance("SHA1withRSA");
35. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1106 test path Signature sig = Signature.getInstance("SHA1withRSA");
36. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1130 test path Signature sig = Signature.getInstance("SHA1withRSA");
37. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1152 test path Signature sig = Signature.getInstance("SHA1withRSA");
38. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1213 test path Signature sig = Signature.getInstance("SHA1withRSA");
39. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1227 test path Signature sig = Signature.getInstance("SHA224withRSA");
40. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1241 test path Signature sig = Signature.getInstance("SHA256withRSA");
41. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1255 test path Signature sig = Signature.getInstance("SHA384withRSA");
42. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1269 test path Signature sig = Signature.getInstance("SHA512withRSA");
43. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1283 test path Signature sig = Signature.getInstance("MD5withRSA");
44. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1294 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
45. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1318 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
46. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1346 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
47. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1359 test path sig = Signature.getInstance("SHA1withRSA/PSS");
48. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1373 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
49. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1397 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
50. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1425 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
51. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1438 test path sig = Signature.getInstance("SHA224withRSA/PSS");
52. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1452 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
53. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1476 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
54. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1504 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
55. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1517 test path sig = Signature.getInstance("SHA256withRSA/PSS");
56. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1531 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
57. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1555 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
58. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1583 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
59. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1596 test path sig = Signature.getInstance("SHA384withRSA/PSS");
60. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1610 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
61. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1634 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
62. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1662 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
63. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1675 test path sig = Signature.getInstance("SHA512withRSA/PSS");
64. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1689 test path Signature sig = Signature.getInstance("NONEwithRSA");
65. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1714 test path Signature sig = Signature.getInstance("NONEwithRSA");
66. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1728 test path Signature sig = Signature.getInstance("NONEwithRSA");
67. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1750 test path Signature sig = Signature.getInstance("NONEwithRSA");
68. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1774 test path Signature sig = Signature.getInstance("NONEwithRSA");
69. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1797 test path Signature sig = Signature.getInstance("NONEwithRSA");
70. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1818 test path Signature sig = Signature.getInstance("NONEwithRSA");
71. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1834 test path Signature sig = Signature.getInstance("NONEwithRSA");

java.signature · CWE-327

RSA Quantum-vulnerable Recorded traffic 66 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:91 test path KeyFactory keyFactory = KeyFactory.getInstance("RSA", conscryptProvider);
2. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:106 test path KeyFactory keyFactory = KeyFactory.getInstance("RSA", conscryptProvider);
3. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:121 test path KeyFactory keyFactory = KeyFactory.getInstance("RSA", conscryptProvider);
4. common/src/test/java/org/conscrypt/java/security/KeyFactoryTestRSA.java:83 test path KeyFactory.getInstance("RSA").generatePublic(new X509EncodedKeySpec(longBuffer));
5. common/src/test/java/org/conscrypt/java/security/KeyFactoryTestRSA.java:89 test path final KeyFactory factory = KeyFactory.getInstance("RSA", p);
6. common/src/test/java/org/conscrypt/java/security/KeyFactoryTestRSA.java:144 test path PrivateKey privateKey = KeyFactory.getInstance("RSA").generatePrivate(spec);
7. common/src/test/java/org/conscrypt/java/security/KeyFactoryTestRSACrt.java:69 test path KeyFactory.getInstance("RSA").generatePrivate(new PKCS8EncodedKeySpec(longBuffer));
8. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:285 test path KeyFactory keyFactory = KeyFactory.getInstance("RSA");
9. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:735 test path KeyFactory kf = KeyFactory.getInstance("RSA");
10. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:745 test path KeyFactory kf = KeyFactory.getInstance("RSA");
11. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:755 test path KeyFactory kf = KeyFactory.getInstance("RSA");
12. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:765 test path KeyFactory kf = KeyFactory.getInstance("RSA");
13. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:775 test path KeyFactory kf = KeyFactory.getInstance("RSA");
14. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:785 test path KeyFactory kf = KeyFactory.getInstance("RSA");
15. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:800 test path KeyFactory kf = KeyFactory.getInstance("RSA");
16. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:814 test path KeyFactory kf = KeyFactory.getInstance("RSA");
17. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:828 test path KeyFactory kf = KeyFactory.getInstance("RSA");
18. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:843 test path KeyFactory kf = KeyFactory.getInstance("RSA");
19. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:857 test path KeyFactory kf = KeyFactory.getInstance("RSA");
20. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:871 test path KeyFactory kf = KeyFactory.getInstance("RSA");
21. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:886 test path KeyFactory kf = KeyFactory.getInstance("RSA");
22. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:900 test path KeyFactory kf = KeyFactory.getInstance("RSA");
23. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:914 test path KeyFactory kf = KeyFactory.getInstance("RSA");
24. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:929 test path KeyFactory kf = KeyFactory.getInstance("RSA");
25. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:943 test path KeyFactory kf = KeyFactory.getInstance("RSA");
26. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:957 test path KeyFactory kf = KeyFactory.getInstance("RSA");
27. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:972 test path KeyFactory kf = KeyFactory.getInstance("RSA");
28. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:986 test path KeyFactory kf = KeyFactory.getInstance("RSA");
29. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1000 test path KeyFactory kf = KeyFactory.getInstance("RSA");
30. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1025 test path KeyFactory kf = KeyFactory.getInstance("RSA");
31. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1043 test path KeyFactory kf = KeyFactory.getInstance("RSA");
32. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1056 test path KeyFactory kf = KeyFactory.getInstance("RSA");
33. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1093 test path KeyFactory kf = KeyFactory.getInstance("RSA");
34. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1117 test path KeyFactory kf = KeyFactory.getInstance("RSA");
35. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1141 test path KeyFactory kf = KeyFactory.getInstance("RSA");
36. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1205 test path KeyFactory kf = KeyFactory.getInstance("RSA");
37. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1219 test path KeyFactory kf = KeyFactory.getInstance("RSA");
38. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1233 test path KeyFactory kf = KeyFactory.getInstance("RSA");
39. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1247 test path KeyFactory kf = KeyFactory.getInstance("RSA");
40. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1261 test path KeyFactory kf = KeyFactory.getInstance("RSA");
41. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1275 test path KeyFactory kf = KeyFactory.getInstance("RSA");
42. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1289 test path KeyFactory kf = KeyFactory.getInstance("RSA");
43. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1313 test path KeyFactory kf = KeyFactory.getInstance("RSA");
44. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1341 test path KeyFactory kf = KeyFactory.getInstance("RSA");
45. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1368 test path KeyFactory kf = KeyFactory.getInstance("RSA");
46. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1392 test path KeyFactory kf = KeyFactory.getInstance("RSA");
47. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1420 test path KeyFactory kf = KeyFactory.getInstance("RSA");
48. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1447 test path KeyFactory kf = KeyFactory.getInstance("RSA");
49. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1471 test path KeyFactory kf = KeyFactory.getInstance("RSA");
50. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1499 test path KeyFactory kf = KeyFactory.getInstance("RSA");
51. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1526 test path KeyFactory kf = KeyFactory.getInstance("RSA");
52. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1550 test path KeyFactory kf = KeyFactory.getInstance("RSA");
53. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1578 test path KeyFactory kf = KeyFactory.getInstance("RSA");
54. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1605 test path KeyFactory kf = KeyFactory.getInstance("RSA");
55. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1629 test path KeyFactory kf = KeyFactory.getInstance("RSA");
56. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1657 test path KeyFactory kf = KeyFactory.getInstance("RSA");
57. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1684 test path KeyFactory kf = KeyFactory.getInstance("RSA");
58. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1708 test path KeyFactory kf = KeyFactory.getInstance("RSA");
59. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1723 test path KeyFactory kf = KeyFactory.getInstance("RSA");
60. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1745 test path KeyFactory kf = KeyFactory.getInstance("RSA");
61. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1768 test path KeyFactory kf = KeyFactory.getInstance("RSA");
62. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1791 test path KeyFactory kf = KeyFactory.getInstance("RSA");
63. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1812 test path KeyFactory kf = KeyFactory.getInstance("RSA");
64. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1828 test path KeyFactory kf = KeyFactory.getInstance("RSA");
65. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:328 test path KeyFactory kf = KeyFactory.getInstance("RSA");
66. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:363 test path KeyFactory kf = KeyFactory.getInstance("RSA");

java.keyfactory · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable Renamed import 54 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. common/src/main/java/org/conscrypt/ActiveSession.java:361 "RSASSA-PSS", "Ed25519", "SHA512withRSA", "SHA512withECDSA",
2. common/src/main/java/org/conscrypt/CompositeMlDsaAlgorithm.java:42 "Ed25519", null, null, null, null),
3. common/src/main/java/org/conscrypt/CompositeMlDsaAlgorithm.java:91 "Ed25519", null, null, null, null),
4. common/src/main/java/org/conscrypt/OidData.java:60 OID_TO_NAME_MAP.put("1.3.101.112", "Ed25519");
5. common/src/main/java/org/conscrypt/OpenSSLProvider.java:241 put("Alg.Alias.KeyPairGenerator.1.3.101.112", "EdDSA");
6. common/src/main/java/org/conscrypt/OpenSSLProvider.java:242 put("Alg.Alias.KeyPairGenerator.Ed25519", "EdDSA");
7. common/src/main/java/org/conscrypt/OpenSSLProvider.java:325 put("Alg.Alias.KeyFactory.1.3.101.112", "EdDSA");
8. common/src/main/java/org/conscrypt/OpenSSLProvider.java:326 put("Alg.Alias.KeyFactory.Ed25519", "EdDSA");
9. common/src/main/java/org/conscrypt/OpenSSLProvider.java:510 putSignatureImplClass("EdDSA", "OpenSslSignatureEdDsa");
10. common/src/main/java/org/conscrypt/OpenSSLProvider.java:511 put("Alg.Alias.Signature.1.3.101.112", "EdDSA");
11. common/src/main/java/org/conscrypt/OpenSSLProvider.java:512 put("Alg.Alias.Signature.Ed25519", "EdDSA");
12. common/src/main/java/org/conscrypt/OpenSslCompositeMlDsaKeyPairGenerator.java:171 if (fullAlgorithm.getClassicAlgorithm().equals("Ed25519")) {
13. common/src/main/java/org/conscrypt/OpenSslCompositeMlDsaKeyPairGenerator.java:192 if (fullAlgorithm.getClassicAlgorithm().equals("Ed25519")) {
14. common/src/main/java/org/conscrypt/OpenSslCompositeMlDsaKeyPairGenerator.java:214 if (fullAlgorithm.getClassicAlgorithm().equals("Ed25519")) {
15. common/src/main/java/org/conscrypt/OpenSslCompositeMlDsaPrivateKey.java:57 if (algorithm.getClassicAlgorithm().equals("Ed25519")) {
16. common/src/main/java/org/conscrypt/OpenSslCompositeMlDsaPublicKey.java:56 if (algorithm.getClassicAlgorithm().equals("Ed25519")) {
17. common/src/main/java/org/conscrypt/OpenSslEdDsaKeyFactory.java:68 if (!key.getAlgorithm().equals("EdDSA") && !key.getAlgorithm().equals("Ed25519")
18. common/src/main/java/org/conscrypt/OpenSslEdDsaKeyPairGenerator.java:32 private static final String ALGORITHM = "EdDSA";
19. common/src/main/java/org/conscrypt/OpenSslEdDsaKeyPairGenerator.java:35 super(ALGORITHM);
20. common/src/main/java/org/conscrypt/OpenSslSignatureCompositeMlDsa.java:272 case "Ed25519":
21. common/src/main/java/org/conscrypt/OpenSslSignatureCompositeMlDsa.java:396 case "Ed25519":
22. common/src/main/java/org/conscrypt/SSLUtils.java:657 result.add("Ed25519");
23. common/src/test/java/org/conscrypt/EdDsaTest.java:76 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
24. common/src/test/java/org/conscrypt/EdDsaTest.java:81 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
25. common/src/test/java/org/conscrypt/EdDsaTest.java:95 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
26. common/src/test/java/org/conscrypt/EdDsaTest.java:99 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
27. common/src/test/java/org/conscrypt/EdDsaTest.java:124 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
28. common/src/test/java/org/conscrypt/EdDsaTest.java:128 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
29. common/src/test/java/org/conscrypt/EdDsaTest.java:144 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
30. common/src/test/java/org/conscrypt/EdDsaTest.java:148 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
31. common/src/test/java/org/conscrypt/EdDsaTest.java:177 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
32. common/src/test/java/org/conscrypt/EdDsaTest.java:183 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519");
33. common/src/test/java/org/conscrypt/EdDsaTest.java:187 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
34. common/src/test/java/org/conscrypt/EdDsaTest.java:215 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
35. common/src/test/java/org/conscrypt/EdDsaTest.java:221 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
36. common/src/test/java/org/conscrypt/EdDsaTest.java:237 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
37. common/src/test/java/org/conscrypt/EdDsaTest.java:270 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
38. common/src/test/java/org/conscrypt/EdDsaTest.java:302 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
39. common/src/test/java/org/conscrypt/EdDsaTest.java:325 test path assertEquals(errMsg + ", algorithm:", "Ed25519", algorithm);
40. common/src/test/java/org/conscrypt/EdDsaTest.java:327 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
41. common/src/test/java/org/conscrypt/EdDsaTest.java:329 test path Signature signer = Signature.getInstance("Ed25519", conscryptProvider);
42. common/src/test/java/org/conscrypt/EdDsaTest.java:335 test path Signature verifier = Signature.getInstance("Ed25519", conscryptProvider);
43. common/src/test/java/org/conscrypt/EdDsaTest.java:344 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
44. common/src/test/java/org/conscrypt/EdDsaTest.java:369 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
45. common/src/test/java/org/conscrypt/EdDsaTest.java:428 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
46. common/src/test/java/org/conscrypt/EdDsaTest.java:480 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
47. common/src/test/java/org/conscrypt/EdDsaTest.java:507 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
48. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:136 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
49. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:139 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
50. common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java:164 test path putKeySize("EdDSA", 255);
51. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:106 test path .skipAlgorithm("EdDSA")
52. common/src/test/java/org/conscrypt/java/security/cert/X509CertificateTest.java:937 test path assertEquals("Ed25519", c.getSigAlgName());
53. common/src/test/java/org/conscrypt/javax/net/ssl/KeyManagerFactoryTest.java:94 test path if (s != null && !s.equals("EC_EC") && !s.equals("EdDSA")) {
54. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:193 test path Arrays.asList("RSA", "DSA", "DH_RSA", "DH_DSA", "EC", "EC_EC", "EC_RSA", "EdDSA"));

jose.algorithm · CWE-327

TLS Quantum-vulnerable Recorded traffic 25 places See details

TLS context created in code

`SSLContext.getInstance()`. The protocol version is reported; the key exchange it negotiates is classical in every TLS 1.2 and 1.3 cipher suite available today.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Every TLS cipher suite in general use negotiates a classical key exchange, so a recorded session is decryptable once that exchange falls.

What to do. Keep TLS 1.3, and track the hybrid key-exchange groups as they reach the JDK. TLS is where harvest-now-decrypt-later exposure is largest.

1. common/src/test/java/org/conscrypt/javax/net/ssl/SSLContextTest.java:142 test path SSLContext sslContext = SSLContext.getInstance("TLS");
2. common/src/test/java/org/conscrypt/javax/net/ssl/SSLContextTest.java:156 test path SSLContext sslContext = SSLContext.getInstance("TLS");
3. common/src/test/java/org/conscrypt/javax/net/ssl/SSLContextTest.java:170 test path sslContext = SSLContext.getInstance("TLS");
4. common/src/test/java/org/conscrypt/javax/net/ssl/SSLContextTest.java:183 test path SSLContext sslContext = SSLContext.getInstance("TLS");
5. common/src/test/java/org/conscrypt/javax/net/ssl/SSLContextTest.java:687 test path () -> SSLContext.getInstance("SSLv3", finalDefaultTlsProvider));
6. common/src/test/java/org/conscrypt/javax/net/ssl/SSLContextTest.java:692 test path SSLContext initialContext = SSLContext.getInstance("Default");
7. common/src/test/java/org/conscrypt/javax/net/ssl/SSLContextTest.java:699 test path SSLContext newContext = SSLContext.getInstance("Default");
8. common/src/test/java/org/conscrypt/javax/net/ssl/SSLContextTest.java:704 test path SSLContext finalContext = SSLContext.getInstance("Default");
9. common/src/test/java/org/conscrypt/javax/net/ssl/SSLEngineTest.java:409 test path SSLContext context = SSLContext.getInstance("TLSv1.2");
10. common/src/test/java/org/conscrypt/javax/net/ssl/SSLEngineTest.java:445 test path SSLContext context = SSLContext.getInstance("TLSv1.3");
11. common/src/test/java/org/conscrypt/javax/net/ssl/SSLServerSocketTest.java:48 test path SSLContext context = SSLContext.getInstance("TLSv1.2");
12. common/src/test/java/org/conscrypt/javax/net/ssl/SSLServerSocketTest.java:103 test path SSLContext context = SSLContext.getInstance("TLSv1.3");
13. common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketTest.java:391 test path SSLContext context = SSLContext.getInstance("TLSv1.2");
14. common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketTest.java:412 test path SSLContext context = SSLContext.getInstance("TLSv1.3");
15. common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketVersionCompatibilityTest.java:700 test path SSLContext clientContext = SSLContext.getInstance("TLS");
16. common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketVersionCompatibilityTest.java:771 test path SSLContext clientContext = SSLContext.getInstance("TLS");
17. openjdk/src/test/java/org/conscrypt/ConscryptTest.java:96 test path SSLContext context = SSLContext.getInstance("TLS");
18. openjdk/src/test/java/org/conscrypt/ConscryptTest.java:102 test path context = SSLContext.getInstance("Default");
19. platform/src/test/java/org/conscrypt/SpakeTest.java:88 test path SSLContext contextClient = SSLContext.getInstance("TlsV1.3");
20. platform/src/test/java/org/conscrypt/SpakeTest.java:99 test path SSLContext contextServer = SSLContext.getInstance("TlsV1.3");
21. platform/src/test/java/org/conscrypt/SpakeTest.java:119 test path SSLContext contextClient = SSLContext.getInstance("TlsV1.3");
22. platform/src/test/java/org/conscrypt/SpakeTest.java:138 test path SSLContext contextServer = SSLContext.getInstance("TlsV1.3");
23. platform/src/test/java/org/conscrypt/SpakeTest.java:489 test path SSLContext sslContext = SSLContext.getInstance("TlsV1.3");
24. platform/src/test/java/org/conscrypt/SpakeTest.java:518 test path SSLContext sslContext = SSLContext.getInstance("TlsV1.3");
25. testing/src/main/java/org/conscrypt/TestUtils.java:432 test path return SSLContext.getInstance("TLS", provider);

java.sslcontext · CWE-757

RSA-OAEP Quantum-vulnerable Recorded traffic 20 places See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1604 test path Cipher encryptCipher = Cipher.getInstance("RSA/ECB/NoPadding", provider);
2. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1641 test path Cipher decryptCipher = Cipher.getInstance("RSA/ECB/NoPadding", provider);
3. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2642 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
4. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2671 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
5. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2703 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
6. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2739 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
7. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2775 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
8. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2802 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
9. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2839 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
10. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2869 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
11. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2902 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
12. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2930 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
13. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2977 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
14. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3009 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
15. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3043 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
16. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3077 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
17. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3102 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
18. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3121 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
19. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3140 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
20. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3157 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);

java.cipher · CWE-327

RSA2048-bit Quantum-vulnerable 15 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. openjdk/src/test/resources/blocklist_test_chain.pem:1 test path -----BEGIN CERTIFICATE-----
2. openjdk/src/test/resources/blocklist_test_chain.pem:20 test path -----BEGIN CERTIFICATE-----
3. openjdk/src/test/resources/blocklist_test_valid_ca.pem:1 test path -----BEGIN CERTIFICATE-----
4. openjdk/src/test/resources/blocklist_test_valid_chain.pem:1 test path -----BEGIN CERTIFICATE-----
5. openjdk/src/test/resources/blocklist_test_valid_chain.pem:20 test path -----BEGIN CERTIFICATE-----
6. openjdk/src/test/resources/blocklist_test_valid_chain.pem:39 test path -----BEGIN CERTIFICATE-----
7. openjdk/src/test/resources/blocklist_test_valid_chain.pem:58 test path -----BEGIN CERTIFICATE-----
8. openjdk/src/test/resources/blocklist_test_valid_chain.pem:77 test path -----BEGIN CERTIFICATE-----
9. openjdk/src/test/resources/test_blocklist_ca.pem:1 test path -----BEGIN CERTIFICATE-----
10. openjdk/src/test/resources/test_blocklist_ca2.pem:1 test path -----BEGIN CERTIFICATE-----
11. openjdk/src/test/resources/test_intermediate_blockedroot.pem:1 test path -----BEGIN CERTIFICATE-----
12. openjdk/src/test/resources/test_intermediate_nonblockedroot.pem:1 test path -----BEGIN CERTIFICATE-----
13. openjdk/src/test/resources/test_leaf_blockedroot.pem:1 test path -----BEGIN CERTIFICATE-----
14. openjdk/src/test/resources/test_leaf_intermediate.pem:1 test path -----BEGIN CERTIFICATE-----
15. openjdk/src/test/resources/test_nonblocklist_ca.pem:1 test path -----BEGIN CERTIFICATE-----

pem.certificate

X25519255-bitother/Curve25519 Quantum-vulnerable Recorded traffic 15 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/HpkeFixture.java:88 test path final KeyFactory factory = KeyFactory.getInstance("XDH");
2. common/src/test/java/org/conscrypt/HpkeFixture.java:98 test path final KeyFactory factory = KeyFactory.getInstance("XDH");
3. common/src/test/java/org/conscrypt/X25519Test.java:102 test path KeyFactory keyFactory = KeyFactory.getInstance("X25519", conscryptProvider);
4. common/src/test/java/org/conscrypt/X25519Test.java:116 test path KeyFactory keyFactory = KeyFactory.getInstance("X25519", conscryptProvider);
5. common/src/test/java/org/conscrypt/X25519Test.java:142 test path KeyFactory keyFactory = KeyFactory.getInstance("X25519", conscryptProvider);
6. common/src/test/java/org/conscrypt/X25519Test.java:157 test path KeyFactory keyFactory = KeyFactory.getInstance("X25519", conscryptProvider);
7. common/src/test/java/org/conscrypt/X25519Test.java:204 test path KeyFactory keyFactory = KeyFactory.getInstance("X25519", conscryptProvider);
8. common/src/test/java/org/conscrypt/X25519Test.java:229 test path KeyFactory keyFactory = KeyFactory.getInstance("X25519", conscryptProvider);
9. common/src/test/java/org/conscrypt/X25519Test.java:254 test path KeyFactory keyFactory = KeyFactory.getInstance("X25519", conscryptProvider);
10. common/src/test/java/org/conscrypt/X25519Test.java:285 test path KeyFactory keyFactory = KeyFactory.getInstance("X25519", conscryptProvider);
11. common/src/test/java/org/conscrypt/javax/crypto/XDHKeyAgreementTest.java:69 test path KeyFactory kf = KeyFactory.getInstance("XDH", p);
12. common/src/test/java/org/conscrypt/javax/crypto/XDHKeyAgreementTest.java:95 test path KeyFactory kf = KeyFactory.getInstance("X25519", p);
13. common/src/test/java/org/conscrypt/javax/crypto/XdhKeyFactoryTest.java:62 test path KeyFactory.getInstance("XDH", TestUtils.getConscryptProvider());
14. common/src/test/java/org/conscrypt/javax/crypto/XdhKeyFactoryTest.java:188 test path KeyFactory sunKf = KeyFactory.getInstance("XDH", "SunEC");
15. common/src/test/java/org/conscrypt/javax/crypto/XdhKeyFactoryTest.java:239 test path KeyFactory sunKf = KeyFactory.getInstance("XDH", "SunEC");

java.keyfactory · CWE-327

ECDSA Quantum-vulnerable 10 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:36 test path Signature signature = Signature.getInstance("SHA256withECDSA", conscryptProvider);
2. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:51 test path Signature signature = Signature.getInstance("NONEwithECDSA", conscryptProvider);
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1854 test path Signature sig = Signature.getInstance("NONEwithECDSA");
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1871 test path Signature sig = Signature.getInstance("NONEwithECDSA");
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1883 test path Signature sig = Signature.getInstance("NONEwithECDSA");
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1897 test path Signature sig = Signature.getInstance("NONEwithECDSA");
7. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1924 test path Signature.getInstance("NONEwithECDSA", TestUtils.getConscryptProvider());
8. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1952 test path Signature.getInstance("NONEwithECDSA", TestUtils.getConscryptProvider());
9. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2177 test path Signature ecdsaVerify = Signature.getInstance("SHA1withECDSA");
10. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2183 test path ecdsaVerify = Signature.getInstance("SHA1withECDSA");

java.signature · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable 10 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/EdDsaTest.java:76 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
2. common/src/test/java/org/conscrypt/EdDsaTest.java:95 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
3. common/src/test/java/org/conscrypt/EdDsaTest.java:124 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
4. common/src/test/java/org/conscrypt/EdDsaTest.java:144 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
5. common/src/test/java/org/conscrypt/EdDsaTest.java:177 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
6. common/src/test/java/org/conscrypt/EdDsaTest.java:183 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519");
7. common/src/test/java/org/conscrypt/EdDsaTest.java:344 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
8. common/src/test/java/org/conscrypt/EdDsaTest.java:480 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
9. common/src/test/java/org/conscrypt/EdDsaTest.java:507 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
10. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:136 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);

java.keypairgenerator · CWE-327

RSA Quantum-vulnerable Recorded traffic 10 places See details

Cipher transformation named away from the call

A JCA transformation string - `algorithm/mode/padding` - written somewhere other than a `getInstance()` argument, which is how a codebase that centralises its cryptography passes the choice to a helper. The string is unambiguous wherever it appears: nothing but a transformation is spelled that way.

This names an encryption method as text, and passes it to code elsewhere that does the work. It is the same choice, made in a different place.

What to do. The same migration applies as to the call that consumes it. Move the constant and the call together, so the inventory keeps naming the algorithm after the change.

1. common/src/main/java/org/conscrypt/OpenSSLProvider.java:585 putRSACipherImplClass("RSA/ECB/NoPadding", "OpenSSLCipherRSA$Raw");
2. common/src/main/java/org/conscrypt/OpenSSLProvider.java:586 put("Alg.Alias.Cipher.RSA/None/NoPadding", "RSA/ECB/NoPadding");
3. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:456 test path setExpectedBlockSize("RSA/ECB/NoPadding", "SunJCE", 0);
4. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:466 test path setExpectedBlockSize("RSA/ECB/NoPadding", Cipher.ENCRYPT_MODE, 256);
5. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:471 test path setExpectedBlockSize("RSA/ECB/NoPadding", Cipher.ENCRYPT_MODE, "BC", 255);
6. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:474 test path setExpectedBlockSize("RSA/ECB/NoPadding", Cipher.DECRYPT_MODE, 256);
7. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:746 test path setExpectedOutputSize("RSA/ECB/NoPadding", Cipher.ENCRYPT_MODE, 256);
8. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:750 test path setExpectedOutputSize("RSA/ECB/NoPadding", Cipher.DECRYPT_MODE, 256);
9. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:759 test path setExpectedOutputSize("RSA/ECB/NoPadding", Cipher.DECRYPT_MODE, "BC", 255);
10. testing/src/main/java/org/conscrypt/testing/OpaqueProvider.java:153 test path super("RSA/ECB/NoPadding");

java.transformation · CWE-327

RSA-OAEP Quantum-vulnerable Recorded traffic 10 places See details

Cipher transformation named away from the call

A JCA transformation string - `algorithm/mode/padding` - written somewhere other than a `getInstance()` argument, which is how a codebase that centralises its cryptography passes the choice to a helper. The string is unambiguous wherever it appears: nothing but a transformation is spelled that way.

This names an encryption method as text, and passes it to code elsewhere that does the work. It is the same choice, made in a different place.

What to do. The same migration applies as to the call that consumes it. Move the constant and the call together, so the inventory keeps naming the algorithm after the change.

1. common/src/main/java/org/conscrypt/OpenSSLProvider.java:590 putRSACipherImplClass("RSA/ECB/OAEPPadding", "OpenSSLCipherRSA$OAEP$SHA1");
2. common/src/main/java/org/conscrypt/OpenSSLProvider.java:591 put("Alg.Alias.Cipher.RSA/None/OAEPPadding", "RSA/ECB/OAEPPadding");
3. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:134 test path super("OAEP", new AlgorithmParameterAsymmetricHelper("RSA/ECB/OAEPPadding"),
4. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:458 test path setExpectedBlockSize("RSA/ECB/OAEPPadding", "SunJCE", 0);
5. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:478 test path setExpectedBlockSize("RSA/ECB/OAEPPadding", Cipher.ENCRYPT_MODE, 214);
6. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:485 test path setExpectedBlockSize("RSA/ECB/OAEPPadding", Cipher.DECRYPT_MODE, 256);
7. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:752 test path setExpectedOutputSize("RSA/ECB/OAEPPadding", Cipher.DECRYPT_MODE, 256);
8. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:762 test path setExpectedOutputSize("RSA/ECB/OAEPPadding", Cipher.DECRYPT_MODE, 214);
9. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:769 test path setExpectedOutputSize("RSA/ECB/OAEPPadding", Cipher.ENCRYPT_MODE, 256);
10. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3805 test path "RSA/ECB/OAEPPadding", new OAEPParameterSpec(digest, "MGF1", mgf1Spec, pSource),

java.transformation · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable 9 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. common/src/test/java/org/conscrypt/EdDsaTest.java:81 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
2. common/src/test/java/org/conscrypt/EdDsaTest.java:99 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
3. common/src/test/java/org/conscrypt/EdDsaTest.java:128 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
4. common/src/test/java/org/conscrypt/EdDsaTest.java:148 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
5. common/src/test/java/org/conscrypt/EdDsaTest.java:187 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
6. common/src/test/java/org/conscrypt/EdDsaTest.java:221 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
7. common/src/test/java/org/conscrypt/EdDsaTest.java:329 test path Signature signer = Signature.getInstance("Ed25519", conscryptProvider);
8. common/src/test/java/org/conscrypt/EdDsaTest.java:335 test path Signature verifier = Signature.getInstance("Ed25519", conscryptProvider);
9. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:139 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);

java.signature · CWE-327

DSA Quantum-vulnerable Renamed import 8 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:708 test path assertNotNull(Signature.getInstance("SHA1withDSA"));
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2041 test path Signature sig = Signature.getInstance("SHA1withDSA");
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2061 test path Signature sig = Signature.getInstance("SHA1withDSA");
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2074 test path Signature sig = Signature.getInstance("SHA224withDSA");
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2095 test path Signature sig = Signature.getInstance("SHA224withDSA");
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2108 test path Signature sig = Signature.getInstance("SHA256withDSA");
7. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2129 test path Signature sig = Signature.getInstance("SHA256withDSA");
8. testing/src/main/java/org/conscrypt/TestUtils.java:231 test path Signature.getInstance("SHA256withDSA");

java.signature · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable 7 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/EdDsaTest.java:215 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
2. common/src/test/java/org/conscrypt/EdDsaTest.java:237 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
3. common/src/test/java/org/conscrypt/EdDsaTest.java:270 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
4. common/src/test/java/org/conscrypt/EdDsaTest.java:302 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
5. common/src/test/java/org/conscrypt/EdDsaTest.java:327 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
6. common/src/test/java/org/conscrypt/EdDsaTest.java:369 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
7. common/src/test/java/org/conscrypt/EdDsaTest.java:428 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);

java.keyfactory · CWE-327

DSA Quantum-vulnerable 6 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2037 test path KeyFactory kf = KeyFactory.getInstance("DSA");
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2057 test path KeyFactory kf = KeyFactory.getInstance("DSA");
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2070 test path KeyFactory kf = KeyFactory.getInstance("DSA");
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2091 test path KeyFactory kf = KeyFactory.getInstance("DSA");
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2104 test path KeyFactory kf = KeyFactory.getInstance("DSA");
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2125 test path KeyFactory kf = KeyFactory.getInstance("DSA");

java.keyfactory · CWE-327

X25519255-bitother/Curve25519 Quantum-vulnerable Recorded traffic 6 places See details

Classical key agreement through the JCA

`KeyAgreement.getInstance()` with ECDH, DH or XDH. Key agreement is the highest-priority class of finding: traffic recorded today is decrypted once the key exchange is broken.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 (FIPS 203), or a hybrid X25519+ML-KEM-768 construction that keeps the classical guarantee while adding the quantum one.

1. common/src/test/java/org/conscrypt/X25519Test.java:75 test path KeyAgreement ka1 = KeyAgreement.getInstance("X25519", conscryptProvider);
2. common/src/test/java/org/conscrypt/X25519Test.java:79 test path KeyAgreement ka2 = KeyAgreement.getInstance("X25519", conscryptProvider);
3. common/src/test/java/org/conscrypt/X25519Test.java:106 test path KeyAgreement ka = KeyAgreement.getInstance("X25519", conscryptProvider);
4. common/src/test/java/org/conscrypt/javax/crypto/XDHKeyAgreementTest.java:75 test path KeyAgreement ka = KeyAgreement.getInstance("XDH", p);
5. common/src/test/java/org/conscrypt/javax/crypto/XDHKeyAgreementTest.java:101 test path KeyAgreement ka = KeyAgreement.getInstance("X25519", p);
6. common/src/test/java/org/conscrypt/javax/crypto/XdhKeyTest.java:182 test path KeyAgreement ka = KeyAgreement.getInstance("XDH");

java.keyagreement · CWE-327

ECDSA256-bit Quantum-vulnerable 4 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:32 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("EC", conscryptProvider);
2. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:47 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("EC", conscryptProvider);
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1915 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1942 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");

java.keypairgenerator · CWE-327

RSA Quantum-vulnerable Recorded traffic 4 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/java/security/cert/CertificateFactoryTest.java:809 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
2. common/src/test/java/org/conscrypt/javax/crypto/XdhKeyFactoryTest.java:167 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
3. common/src/test/java/org/conscrypt/javax/crypto/XdhKeyFactoryTest.java:279 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
4. common/src/test/java/org/conscrypt/javax/crypto/XdhKeyTest.java:165 test path KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");

java.keypairgenerator · CWE-327

RSA2048-bit Quantum-vulnerable Recorded traffic 4 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. openjdk/src/test/resources/test_blocklist_ca2_key.pem:1 test path -----BEGIN PRIVATE KEY-----
2. openjdk/src/test/resources/test_blocklist_ca_key.pem:1 test path -----BEGIN PRIVATE KEY-----
3. openjdk/src/test/resources/test_intermediate_key.pem:1 test path -----BEGIN PRIVATE KEY-----
4. openjdk/src/test/resources/test_nonblocklist_ca_key.pem:1 test path -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

EC Quantum-vulnerable 3 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:517 test path KeyFactory keyFactory = KeyFactory.getInstance("EC", provider);
2. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:523 test path KeyFactory keyFactory = KeyFactory.getInstance("EC", provider);
3. testing/src/main/java/org/conscrypt/TestUtils.java:306 test path return KeyFactory.getInstance("EC").generatePublic(

java.keyfactory · CWE-327

RSA Quantum-vulnerable Recorded traffic 3 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:297 test path -----BEGIN RSA PRIVATE KEY-----
2. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1761 test path -----BEGIN RSA PRIVATE KEY-----
3. openjdk/src/test/resources/cert-key.pem:1 test path -----BEGIN RSA PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

RSA Quantum-vulnerable Recorded traffic 3 places See details

Algorithm named in a setting

A setting whose name says it holds an algorithm, given a literal that names one: `withOaepPaddingDigestAlgorithm("SHA-512")`, `signatureAlgorithm = "SHA256withRSA"`, `"digestAlgorithm": "SHA-256"`. The algorithm never reaches a `getInstance()` in this file - it is carried to one somewhere else, often through configuration - so a scan that only reads the factories cannot see it at all.

Something here is configured to use a named algorithm. The code that uses it may be somewhere else entirely, but this is the line that decides which algorithm it is.

What to do. Find what consumes the setting. The migration belongs to that operation; this line is where the choice is actually written down, and usually where it is easiest to change.

1. common/src/test/java/org/conscrypt/java/security/cert/CertificateFactoryTest.java:845 test path certGen.setSignatureAlgorithm("SHA1withRSA");
2. testing/src/main/java/org/conscrypt/java/security/TestKeyStore.java:708 test path signatureAlgorithm = "sha256WithRSA";
3. testing/src/main/java/org/conscrypt/java/security/TestKeyStore.java:714 test path signatureAlgorithm = "sha256WithRSA";

config.algorithm-setting · CWE-327

X25519255-bitother/Curve25519 Quantum-vulnerable Recorded traffic 3 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/X25519Test.java:71 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("X25519", conscryptProvider);
2. common/src/test/java/org/conscrypt/X25519Test.java:88 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("X25519", conscryptProvider);
3. common/src/test/java/org/conscrypt/X25519Test.java:182 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("X25519", conscryptProvider);

java.keypairgenerator · CWE-327

EC384-bitsecg/secp384r1 Quantum-vulnerable From a constant 2 places See details

Named elliptic curve requested

`ECGenParameterSpec` names a curve explicitly. Every standardised prime curve is broken by Shor regardless of its size, so a larger curve is not a mitigation.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.

What to do. ML-DSA-65 for signatures, ML-KEM-768 for key establishment.

1. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestEC.java:55 test path new ECGenParameterSpec(CURVE_NAME));
2. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestEC.java:64 test path params.init(new ECGenParameterSpec(CURVE_NAME));

java.eccurve · CWE-327

ECDH Quantum-vulnerable Recorded traffic 2 places See details

Classical key agreement through the JCA

`KeyAgreement.getInstance()` with ECDH, DH or XDH. Key agreement is the highest-priority class of finding: traffic recorded today is decrypted once the key exchange is broken.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 (FIPS 203), or a hybrid X25519+ML-KEM-768 construction that keeps the classical guarantee while adding the quantum one.

1. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:424 test path KeyAgreement kaA = KeyAgreement.getInstance("ECDH", provider);
2. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:539 test path return KeyAgreement.getInstance("ECDH", provider);

java.keyagreement · CWE-327

ECDH Quantum-vulnerable Recorded traffic 2 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:529 test path KeyFactory keyFactory = KeyFactory.getInstance("EC");
2. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:534 test path KeyFactory keyFactory = KeyFactory.getInstance("EC");

java.keyfactory · CWE-327

RSA2048-bit Quantum-vulnerable Recorded traffic 2 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/MacTest.java:188 test path KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
2. openjdk/src/test/java/org/conscrypt/NativeCryptoTest.java:189 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");

java.keypairgenerator · CWE-327

RSA2048-bit Quantum-vulnerable 2 places See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

1. openjdk/src/test/resources/test_intermediate.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----
2. openjdk/src/test/resources/test_leaf.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----

pem.certificate-request

DSA Quantum-vulnerable 1 place See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java:516 test path final KeyPairGenerator kpg = KeyPairGenerator.getInstance("DSA", p);

java.keypairgenerator · CWE-327

DSA Quantum-vulnerable 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1969 test path -----BEGIN DSA PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

DSA Quantum-vulnerable 1 place See details

Algorithm named in a setting

A setting whose name says it holds an algorithm, given a literal that names one: `withOaepPaddingDigestAlgorithm("SHA-512")`, `signatureAlgorithm = "SHA256withRSA"`, `"digestAlgorithm": "SHA-256"`. The algorithm never reaches a `getInstance()` in this file - it is carried to one somewhere else, often through configuration - so a scan that only reads the factories cannot see it at all.

Something here is configured to use a named algorithm. The code that uses it may be somewhere else entirely, but this is the line that decides which algorithm it is.

What to do. Find what consumes the setting. The migration belongs to that operation; this line is where the choice is actually written down, and usually where it is easiest to change.

1. testing/src/main/java/org/conscrypt/java/security/TestKeyStore.java:710 test path signatureAlgorithm = "sha256WithDSA";

config.algorithm-setting · CWE-327

EC256-bitsecg/secp256r1 Quantum-vulnerable 1 place See details

Named elliptic curve requested

`ECGenParameterSpec` names a curve explicitly. Every standardised prime curve is broken by Shor regardless of its size, so a larger curve is not a mitigation.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.

What to do. ML-DSA-65 for signatures, ML-KEM-768 for key establishment.

1. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:211 test path getKeyAgreement(provider).init(KAT_PRIVATE_KEY1, new ECGenParameterSpec("prime256v1"));

java.eccurve · CWE-327

EC Quantum-vulnerable 1 place See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:411 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC", provider);

java.keypairgenerator · CWE-327

ECDH256-bitsecg/secp256r1 Quantum-vulnerable Recorded traffic 1 place See details

Named elliptic curve requested

`ECGenParameterSpec` names a curve explicitly. Every standardised prime curve is broken by Shor regardless of its size, so a larger curve is not a mitigation.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 for signatures, ML-KEM-768 for key establishment.

1. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:412 test path ECGenParameterSpec ecSpec256 = new ECGenParameterSpec("secp256r1");

java.eccurve · CWE-327

ECDH224-bitsecg/secp224r1 Quantum-vulnerable Recorded traffic 1 place See details

Named elliptic curve requested

`ECGenParameterSpec` names a curve explicitly. Every standardised prime curve is broken by Shor regardless of its size, so a larger curve is not a mitigation.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 for signatures, ML-KEM-768 for key establishment.

1. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:416 test path ECGenParameterSpec ecSpec224 = new ECGenParameterSpec("secp224r1");

java.eccurve · CWE-327

ECDSA Quantum-vulnerable 1 place See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2168 test path final KeyFactory factory = KeyFactory.getInstance("EC");

java.keyfactory · CWE-327

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

1. openjdk/src/test/resources/ct-server-key-public.pem:1 test path -----BEGIN PUBLIC KEY-----

pem.public-key

ECDSA Quantum-vulnerable 1 place See details

Algorithm named in a setting

A setting whose name says it holds an algorithm, given a literal that names one: `withOaepPaddingDigestAlgorithm("SHA-512")`, `signatureAlgorithm = "SHA256withRSA"`, `"digestAlgorithm": "SHA-256"`. The algorithm never reaches a `getInstance()` in this file - it is carried to one somewhere else, often through configuration - so a scan that only reads the factories cannot see it at all.

Something here is configured to use a named algorithm. The code that uses it may be somewhere else entirely, but this is the line that decides which algorithm it is.

What to do. Find what consumes the setting. The migration belongs to that operation; this line is where the choice is actually written down, and usually where it is easiest to change.

1. testing/src/main/java/org/conscrypt/java/security/TestKeyStore.java:712 test path signatureAlgorithm = "sha256WithECDSA";

config.algorithm-setting · CWE-327

EdDSA Quantum-vulnerable 1 place See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:105 test path .skipAlgorithm("Ed448")

jose.algorithm · CWE-327

RSA Quantum-vulnerable Recorded traffic 1 place See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1718 test path Cipher cipher = Cipher.getInstance("RSA");

java.cipher · CWE-327

AES Reduced margin 28 places See details

Cipher transformation named away from the call

A JCA transformation string - `algorithm/mode/padding` - written somewhere other than a `getInstance()` argument, which is how a codebase that centralises its cryptography passes the choice to a helper. The string is unambiguous wherever it appears: nothing but a transformation is spelled that way.

This names an encryption method as text, and passes it to code elsewhere that does the work. It is the same choice, made in a different place.

What to do. The same migration applies as to the call that consumes it. Move the constant and the call together, so the inventory keeps naming the algorithm after the change.

1. common/src/main/java/org/conscrypt/OpenSSLProvider.java:625 putSymmetricCipherImplClass("AES/ECB/NoPadding", "OpenSSLEvpCipherAES$AES$ECB$NoPadding");
2. common/src/main/java/org/conscrypt/OpenSSLProvider.java:626 putSymmetricCipherImplClass("AES/ECB/PKCS5Padding",
3. common/src/main/java/org/conscrypt/OpenSSLProvider.java:628 put("Alg.Alias.Cipher.AES/ECB/PKCS7Padding", "AES/ECB/PKCS5Padding");
4. common/src/main/java/org/conscrypt/OpenSSLProvider.java:629 putSymmetricCipherImplClass("AES/CBC/NoPadding", "OpenSSLEvpCipherAES$AES$CBC$NoPadding");
5. common/src/main/java/org/conscrypt/OpenSSLProvider.java:630 putSymmetricCipherImplClass("AES/CBC/PKCS5Padding",
6. common/src/main/java/org/conscrypt/OpenSSLProvider.java:632 put("Alg.Alias.Cipher.AES/CBC/PKCS7Padding", "AES/CBC/PKCS5Padding");
7. common/src/main/java/org/conscrypt/OpenSSLProvider.java:633 putSymmetricCipherImplClass("AES/CTR/NoPadding", "OpenSSLEvpCipherAES$AES$CTR");
8. common/src/main/java/org/conscrypt/OpenSSLProvider.java:680 putSymmetricCipherImplClass("AES/GCM/NoPadding", "OpenSSLAeadCipherAES$GCM");
9. common/src/main/java/org/conscrypt/OpenSSLProvider.java:681 put("Alg.Alias.Cipher.GCM", "AES/GCM/NoPadding");
10. common/src/main/java/org/conscrypt/OpenSSLProvider.java:682 put("Alg.Alias.Cipher.2.16.840.1.101.3.4.1.6", "AES/GCM/NoPadding");
11. common/src/main/java/org/conscrypt/OpenSSLProvider.java:683 put("Alg.Alias.Cipher.2.16.840.1.101.3.4.1.26", "AES/GCM/NoPadding");
12. common/src/main/java/org/conscrypt/OpenSSLProvider.java:684 put("Alg.Alias.Cipher.2.16.840.1.101.3.4.1.46", "AES/GCM/NoPadding");
13. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:54 test path new CipherParam("AES/GCM/NoPadding", new SecretKeySpec(new byte[16], "AES"),
14. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:59 test path BASIC_CIPHER_TO_TEST_DATA.put("AES/ECB/NoPadding", "crypto/aes-ecb.csv");
15. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:60 test path BASIC_CIPHER_TO_TEST_DATA.put("AES/CBC/NoPadding", "crypto/aes-cbc.csv");
16. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:61 test path BASIC_CIPHER_TO_TEST_DATA.put("AES/CFB8/NoPadding", "crypto/aes-cfb8.csv");
17. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:62 test path BASIC_CIPHER_TO_TEST_DATA.put("AES/CFB128/NoPadding", "crypto/aes-cfb128.csv");
18. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:63 test path BASIC_CIPHER_TO_TEST_DATA.put("AES/OFB/NoPadding", "crypto/aes-ofb.csv");
19. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:74 test path AEAD_CIPHER_TO_TEST_DATA.put("AES/GCM/NoPadding", "crypto/aes-gcm.csv");
20. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:214 test path && transformation.equals("AES/ECB/NoPadding")) {
21. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3723 test path new CipherTestParam("AES/ECB/PKCS5Padding", null, AES_128_KEY, null,
22. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3729 test path new CipherTestParam("AES/ECB/PKCS7Padding", null, AES_128_KEY, null,
23. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3744 test path "AES/CTR/NoPadding", new IvParameterSpec(AES_192_CTR_NoPadding_TestVector_1_IV),
24. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3749 test path "AES/CBC/PKCS5Padding",
25. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3755 test path "AES/CBC/PKCS7Padding",
26. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4564 test path String algorithm = "AES/ECB/NoPadding";
27. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4605 test path String algorithm = "AES/ECB/NoPadding";
28. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4732 test path String testedCipher = "AES/ECB/PKCS7Padding";

java.transformation · CWE-327

SHA-256 Reduced margin Renamed import 20 places See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. common/src/main/java/org/conscrypt/ct/CertificateEntry.java:106 MessageDigest md = MessageDigest.getInstance("SHA-256");
2. common/src/main/java/org/conscrypt/ct/LogInfo.java:84 this.logId = MessageDigest.getInstance("SHA-256").digest(publicKey.getEncoded());
3. common/src/test/java/org/conscrypt/MacTest.java:227 test path final Mac mac = Mac.getInstance("HMACSHA256", conscryptProvider);
4. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:36 test path Signature signature = Signature.getInstance("SHA256withECDSA", conscryptProvider);
5. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:95 test path Signature signature = Signature.getInstance("SHA256withRSA", conscryptProvider);
6. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:110 test path Signature signature = Signature.getInstance("SHA256withRSA/PSS", conscryptProvider);
7. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:288 test path Signature sig = Signature.getInstance("SHA256withRSA");
8. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:703 test path assertNotNull(Signature.getInstance("SHA256withRSA"));
9. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:749 test path Signature sig = Signature.getInstance("SHA256withRSA");
10. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:875 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
11. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:890 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
12. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:904 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
13. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1241 test path Signature sig = Signature.getInstance("SHA256withRSA");
14. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1452 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
15. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1476 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
16. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1504 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
17. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1517 test path sig = Signature.getInstance("SHA256withRSA/PSS");
18. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2108 test path Signature sig = Signature.getInstance("SHA256withDSA");
19. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2129 test path Signature sig = Signature.getInstance("SHA256withDSA");
20. testing/src/main/java/org/conscrypt/TestUtils.java:231 test path Signature.getInstance("SHA256withDSA");

java.messagedigest · CWE-328

AES Reduced margin 14 places See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Grover's algorithm halves the effective strength; the parameter, not the design, is the problem. The key size was not visible at this call site, so the weaker case is assumed.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestGCM.java:141 test path Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
2. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:602 test path Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
3. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4176 test path Cipher c = Cipher.getInstance("AES/ECB/NoPadding");
4. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4212 test path Cipher c = Cipher.getInstance("AES/ECB/NoPadding");
5. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4364 test path Cipher c = Cipher.getInstance("AES/ECB/NoPadding");
6. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4469 test path Cipher c = Cipher.getInstance("AES/ECB/PKCS5Padding", provider);
7. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4523 test path Cipher enc = Cipher.getInstance("AES/ECB/PKCS5Padding", provider);
8. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4528 test path Cipher c = Cipher.getInstance("AES/ECB/PKCS5Padding", provider);
9. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4734 test path Cipher encCipher = Cipher.getInstance(testedCipher);
10. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4742 test path Cipher cipher = Cipher.getInstance(testedCipher);
11. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4807 test path Cipher c1 = Cipher.getInstance("AES/GCM/NoPadding");
12. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4808 test path Cipher c2 = Cipher.getInstance("AES/GCM/NoPadding");
13. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4868 test path final Cipher c = Cipher.getInstance("AES/ECB/NoPadding");
14. common/src/test/java/org/conscrypt/javax/crypto/ScryptTest.java:117 test path Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");

java.cipher · CWE-327

AES Reduced margin 11 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestGCM.java:131 test path SecretKeySpec skeySpec = new SecretKeySpec(randomBytes(16), "AES");
2. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:54 test path new CipherParam("AES/GCM/NoPadding", new SecretKeySpec(new byte[16], "AES"),
3. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:56 test path new CipherParam("AES/GCM-SIV/NoPadding", new SecretKeySpec(new byte[16], "AES"),
4. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:600 test path SecretKeySpec key = new SecretKeySpec(new byte[16], "AES");
5. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4213 test path c.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(new byte[128 / 8], "AES"));
6. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4524 test path enc.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(new byte[16], "AES"));
7. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4529 test path c.init(Cipher.DECRYPT_MODE, new SecretKeySpec(new byte[16], "AES"));
8. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4735 test path encCipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(testKey, "AES"));
9. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4743 test path cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(testKey, "AES"));
10. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4803 test path SecretKeySpec key = new SecretKeySpec(new byte[16], "AES");
11. common/src/test/java/org/conscrypt/javax/crypto/ScryptTest.java:112 test path return new SecretKeySpec(bytes, 0, len, "AES");

java.keyspec · CWE-327

AES-128 Reduced margin 7 places See details

Cipher transformation named away from the call

A JCA transformation string - `algorithm/mode/padding` - written somewhere other than a `getInstance()` argument, which is how a codebase that centralises its cryptography passes the choice to a helper. The string is unambiguous wherever it appears: nothing but a transformation is spelled that way.

This names an encryption method as text, and passes it to code elsewhere that does the work. It is the same choice, made in a different place.

What to do. The same migration applies as to the call that consumes it. Move the constant and the call together, so the inventory keeps naming the algorithm after the change.

1. common/src/main/java/org/conscrypt/OpenSSLProvider.java:635 putSymmetricCipherImplClass("AES_128/ECB/NoPadding",
2. common/src/main/java/org/conscrypt/OpenSSLProvider.java:637 putSymmetricCipherImplClass("AES_128/ECB/PKCS5Padding",
3. common/src/main/java/org/conscrypt/OpenSSLProvider.java:639 put("Alg.Alias.Cipher.AES_128/ECB/PKCS7Padding", "AES_128/ECB/PKCS5Padding");
4. common/src/main/java/org/conscrypt/OpenSSLProvider.java:640 putSymmetricCipherImplClass("AES_128/CBC/NoPadding",
5. common/src/main/java/org/conscrypt/OpenSSLProvider.java:642 putSymmetricCipherImplClass("AES_128/CBC/PKCS5Padding",
6. common/src/main/java/org/conscrypt/OpenSSLProvider.java:644 put("Alg.Alias.Cipher.AES_128/CBC/PKCS7Padding", "AES_128/CBC/PKCS5Padding");
7. common/src/main/java/org/conscrypt/OpenSSLProvider.java:685 putSymmetricCipherImplClass("AES_128/GCM/NoPadding", "OpenSSLAeadCipherAES$GCM$AES_128");

java.transformation · CWE-327

SHA-256 Reduced margin 5 places See details

Mask-generation digest named for RSA padding

`MGF1ParameterSpec.SHA256` names the digest inside RSA-OAEP and RSA-PSS padding. It is a separate choice from the digest the signature or the cipher uses, it is frequently left at SHA-1 by default, and a static import of it - `import static java.security.spec.MGF1ParameterSpec.SHA512` - is the only place the choice appears in the file that makes it.

This picks the hash used inside RSA padding. It matters because the default is often SHA-1, which is broken today without any quantum computer.

What to do. The mask-generation digest travels with the RSA key it pads. When that key moves to ML-KEM or ML-DSA the padding goes with it; until then, SHA-256 or better.

1. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersPSSTest.java:49 test path new PSSParameterSpec("SHA-224", "MGF1", MGF1ParameterSpec.SHA256, 32, 1);
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:562 test path new PSSParameterSpec("SHA-256", "MGF1", MGF1ParameterSpec.SHA256, 32, 1);
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:579 test path new PSSParameterSpec("SHA-256", "MGF1", MGF1ParameterSpec.SHA256, 0, 1);
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:596 test path new PSSParameterSpec("SHA-256", "MGF1", MGF1ParameterSpec.SHA256, 222, 1);
5. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3768 test path addRsaOaepTest("SHA-256", MGF1ParameterSpec.SHA256, RSA_Vector2_OAEP_SHA256_MGF1_SHA256);

java.mgf1 · CWE-327

AES-128128-bit Reduced margin 4 places See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Grover's algorithm halves the effective strength; the parameter, not the design, is the problem.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1303 test path KeyGenerator kg = KeyGenerator.getInstance("AES");
2. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4130 test path KeyGenerator kg = KeyGenerator.getInstance("AES");
3. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4393 test path KeyGenerator kg = KeyGenerator.getInstance("AES");
4. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4424 test path KeyGenerator kg = KeyGenerator.getInstance("AES");

java.cipher · CWE-327

SHA-224 Reduced margin 4 places See details

Mask-generation digest named for RSA padding

`MGF1ParameterSpec.SHA256` names the digest inside RSA-OAEP and RSA-PSS padding. It is a separate choice from the digest the signature or the cipher uses, it is frequently left at SHA-1 by default, and a static import of it - `import static java.security.spec.MGF1ParameterSpec.SHA512` - is the only place the choice appears in the file that makes it.

This picks the hash used inside RSA padding. It matters because the default is often SHA-1, which is broken today without any quantum computer.

What to do. The mask-generation digest travels with the RSA key it pads. When that key moves to ML-KEM or ML-DSA the padding goes with it; until then, SHA-256 or better.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:511 test path new PSSParameterSpec("SHA-224", "MGF1", new MGF1ParameterSpec("SHA-224"), 28, 1);
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:528 test path new PSSParameterSpec("SHA-224", "MGF1", new MGF1ParameterSpec("SHA-224"), 0, 1);
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:545 test path new PSSParameterSpec("SHA-224", "MGF1", new MGF1ParameterSpec("SHA-224"), 226, 1);
4. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3767 test path addRsaOaepTest("SHA-224", MGF1ParameterSpec.SHA224, RSA_Vector2_OAEP_SHA224_MGF1_SHA224);

java.mgf1 · CWE-327

PBKDF2 Reduced margin 2 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:334 test path key = skf.generateSecret(new PBEKeySpec("secret".toCharArray()));
2. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4854 test path PBEKeySpec pbeks = new PBEKeySpec("password".toCharArray(),

java.keyspec · CWE-327

SHA-224 Reduced margin 10 places See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Grover's algorithm halves the effective strength; the parameter, not the design, is the problem.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:832 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:847 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:861 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1227 test path Signature sig = Signature.getInstance("SHA224withRSA");
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1373 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1397 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
7. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1425 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
8. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1438 test path sig = Signature.getInstance("SHA224withRSA/PSS");
9. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2074 test path Signature sig = Signature.getInstance("SHA224withDSA");
10. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2095 test path Signature sig = Signature.getInstance("SHA224withDSA");

java.messagedigest · CWE-328

unknown Could not be determined 103 places See details

Key pair algorithm chosen at runtime

`KeyPairGenerator.getInstance(x)` where the argument is an identifier. The algorithm cannot be resolved without running the program, so this is reported as an unknown rather than assumed to be classical.

This code picks its encryption method while it runs, so a scan cannot tell which one it ends up using. Somebody has to check the configuration.

What to do. Trace the value to its configuration source and record the concrete algorithm in the cryptographic inventory by hand.

1. common/src/main/java/org/conscrypt/CryptoUpcalls.java:80 signature = Signature.getInstance(algorithm);
2. common/src/main/java/org/conscrypt/CryptoUpcalls.java:103 signature = Signature.getInstance(algorithm, p);
3. common/src/main/java/org/conscrypt/CryptoUpcalls.java:180 c = Cipher.getInstance(transformation);
4. common/src/main/java/org/conscrypt/CryptoUpcalls.java:201 c = Cipher.getInstance(transformation, p);
5. common/src/main/java/org/conscrypt/OpenSSLCipher.java:362 KeyFactory keyFactory = KeyFactory.getInstance(wrappedKeyAlgorithm);
6. common/src/main/java/org/conscrypt/OpenSSLCipher.java:365 KeyFactory keyFactory = KeyFactory.getInstance(wrappedKeyAlgorithm);
7. common/src/main/java/org/conscrypt/OpenSSLCipherRSA.java:360 KeyFactory keyFactory = KeyFactory.getInstance(wrappedKeyAlgorithm);
8. common/src/main/java/org/conscrypt/OpenSSLCipherRSA.java:363 KeyFactory keyFactory = KeyFactory.getInstance(wrappedKeyAlgorithm);
9. common/src/main/java/org/conscrypt/OpenSSLX509CRL.java:237 sig = Signature.getInstance(sigAlg);
10. common/src/main/java/org/conscrypt/OpenSSLX509CRL.java:239 sig = Signature.getInstance(sigAlg, sigProvider);
11. common/src/main/java/org/conscrypt/OpenSSLX509Certificate.java:474 KeyFactory kf = KeyFactory.getInstance(oid);
12. common/src/main/java/org/conscrypt/ct/LogInfo.java:196 signature = Signature.getInstance(algorithm);
13. common/src/test/java/org/conscrypt/MlDsaTest.java:188 test path Signature ss = Signature.getInstance(signAlgorithm, conscryptProvider);
14. common/src/test/java/org/conscrypt/MlDsaTest.java:195 test path Signature sv = Signature.getInstance(verifyAlgorithm, conscryptProvider);
15. common/src/test/java/org/conscrypt/MlDsaTest.java:221 test path Signature ss = Signature.getInstance(signAlgorithm, conscryptProvider);
16. common/src/test/java/org/conscrypt/MlDsaTest.java:228 test path Signature sv = Signature.getInstance(verifyAlgorithm, conscryptProvider);
17. common/src/test/java/org/conscrypt/MlDsaTest.java:254 test path Signature ss = Signature.getInstance(signAlgorithm, conscryptProvider);
18. common/src/test/java/org/conscrypt/MlDsaTest.java:261 test path Signature sv = Signature.getInstance(verifyAlgorithm, conscryptProvider);
19. common/src/test/java/org/conscrypt/MlDsaTest.java:284 test path Signature ss = Signature.getInstance(signAlgorithm, conscryptProvider);
20. common/src/test/java/org/conscrypt/MlDsaTest.java:291 test path Signature sv = Signature.getInstance(verifyAlgorithm, conscryptProvider);
21. common/src/test/java/org/conscrypt/MlDsaTest.java:314 test path Signature ss = Signature.getInstance(signAlgorithm, conscryptProvider);
22. common/src/test/java/org/conscrypt/MlDsaTest.java:321 test path Signature sv = Signature.getInstance(verifyAlgorithm, conscryptProvider);
23. common/src/test/java/org/conscrypt/MlDsaTest.java:341 test path KeyFactory keyFactory = KeyFactory.getInstance(keyFactoryAlgorithm, conscryptProvider);
24. common/src/test/java/org/conscrypt/MlDsaTest.java:398 test path KeyFactory keyFactory = KeyFactory.getInstance(keyFactoryAlgorithm, conscryptProvider);
25. common/src/test/java/org/conscrypt/MlDsaTest.java:431 test path KeyFactory keyFactory = KeyFactory.getInstance(keyFactoryAlgorithm, conscryptProvider);
26. common/src/test/java/org/conscrypt/MlDsaTest.java:486 test path KeyFactory keyFactory = KeyFactory.getInstance(keyFactoryAlgorithm, conscryptProvider);
27. common/src/test/java/org/conscrypt/MlDsaTest.java:510 test path KeyFactory keyFactory = KeyFactory.getInstance(algorithm, conscryptProvider);
28. common/src/test/java/org/conscrypt/MlDsaTest.java:574 test path KeyFactory keyFactory = KeyFactory.getInstance(algorithm, conscryptProvider);
29. common/src/test/java/org/conscrypt/MlDsaTest.java:638 test path KeyFactory keyFactory = KeyFactory.getInstance(algorithm, conscryptProvider);
30. common/src/test/java/org/conscrypt/MlDsaTest.java:955 test path KeyFactory keyFactory = KeyFactory.getInstance(algorithm, conscryptProvider);
31. common/src/test/java/org/conscrypt/MlDsaTest.java:957 test path Signature signer = Signature.getInstance(algorithm, conscryptProvider);
32. common/src/test/java/org/conscrypt/MlDsaTest.java:964 test path Signature verifier = Signature.getInstance(algorithm, conscryptProvider);
33. common/src/test/java/org/conscrypt/MlKemTest.java:88 test path KeyPairGenerator.getInstance(keyGenAlgorithm, conscryptProvider);
34. common/src/test/java/org/conscrypt/MlKemTest.java:116 test path KeyFactory keyFactory = KeyFactory.getInstance(factoryAlgorithm, conscryptProvider);
35. common/src/test/java/org/conscrypt/MlKemTest.java:225 test path KeyFactory keyFactory = KeyFactory.getInstance(algorithm, conscryptProvider);
36. common/src/test/java/org/conscrypt/MlKemTest.java:291 test path KeyFactory keyFactory = KeyFactory.getInstance(algorithm, conscryptProvider);
37. common/src/test/java/org/conscrypt/MlKemTest.java:703 test path KeyFactory keyFactory = KeyFactory.getInstance(keyAlgorithm, conscryptProvider);
38. common/src/test/java/org/conscrypt/MlKemTest.java:736 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance(algorithm, conscryptProvider);
39. common/src/test/java/org/conscrypt/OpenSslCompositeMlDsaKeyFactoryTest.java:63 test path return KeyFactory.getInstance(algName, PROVIDER);
40. common/src/test/java/org/conscrypt/SlhDsaTest.java:459 test path Signature signer = Signature.getInstance(algorithm, conscryptProvider);
41. common/src/test/java/org/conscrypt/SlhDsaTest.java:464 test path Signature verifier = Signature.getInstance(algorithm, conscryptProvider);
42. common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java:114 test path KeyPairGenerator kpg1 = KeyPairGenerator.getInstance(algorithm);
43. common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java:122 test path KeyPairGenerator kpg2 = KeyPairGenerator.getInstance(algorithm, provider);
44. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:120 test path Signature sig1 = Signature.getInstance(algorithm);
45. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:125 test path Signature sig2 = Signature.getInstance(algorithm, provider);
46. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:131 test path Signature sig3 = Signature.getInstance(algorithm, provider.getName());
47. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:176 test path kpg = KeyPairGenerator.getInstance(kpAlgorithm, "SunEC");
48. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:178 test path kpg = KeyPairGenerator.getInstance(kpAlgorithm);
49. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:71 test path Cipher c = Cipher.getInstance(param.name);
50. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:79 test path Cipher c = Cipher.getInstance(param.name);
51. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:92 test path Cipher c1 = Cipher.getInstance(param.name);
52. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:93 test path Cipher c2 = Cipher.getInstance(param.name);
53. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:130 test path Cipher c1 = Cipher.getInstance(param.name);
54. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:131 test path Cipher c2 = Cipher.getInstance(param.name);
55. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:132 test path Cipher c3 = Cipher.getInstance(param.name);
56. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:188 test path Cipher c1 = Cipher.getInstance(param.name);
57. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:189 test path Cipher c2 = Cipher.getInstance(param.name);
58. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:190 test path Cipher c3 = Cipher.getInstance(param.name);
59. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:253 test path Cipher c1 = Cipher.getInstance(param.name);
60. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:254 test path Cipher c2 = Cipher.getInstance(param.name);
61. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:255 test path Cipher c3 = Cipher.getInstance(param.name);
62. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:321 test path Cipher c1 = Cipher.getInstance(param.name);
63. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:322 test path Cipher c2 = Cipher.getInstance(param.name);
64. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:323 test path Cipher c3 = Cipher.getInstance(param.name);
65. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:370 test path Cipher c1 = Cipher.getInstance(param.name);
66. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:371 test path Cipher c2 = Cipher.getInstance(param.name);
67. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:226 test path cipher = Cipher.getInstance(transformation, p);
68. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:379 test path cipher = Cipher.getInstance(transformation, p);
69. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1022 test path Cipher.getInstance(algorithm).init(getEncryptMode(algorithm),
70. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1156 test path Cipher c1 = Cipher.getInstance(algorithm);
71. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1163 test path Cipher c2 = Cipher.getInstance(algorithm, provider);
72. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1169 test path Cipher c3 = Cipher.getInstance(algorithm, provider.getName());
73. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3936 test path Cipher c = Cipher.getInstance(p.transformation, provider);
74. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3960 test path c = Cipher.getInstance(p.transformation, provider);
75. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4135 test path c = Cipher.getInstance(p.transformation, provider);
76. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4568 test path Cipher c = Cipher.getInstance(algorithm, provider);
77. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4609 test path Cipher c = Cipher.getInstance(algorithm, provider);
78. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4762 test path Cipher cipher = Cipher.getInstance(c);
79. common/src/test/java/org/conscrypt/javax/crypto/KeyGeneratorTest.java:71 test path KeyGenerator kg1 = KeyGenerator.getInstance(algorithm);
80. common/src/test/java/org/conscrypt/javax/crypto/KeyGeneratorTest.java:76 test path KeyGenerator kg2 = KeyGenerator.getInstance(algorithm, provider);
81. common/src/test/java/org/conscrypt/javax/crypto/KeyGeneratorTest.java:82 test path KeyGenerator kg3 = KeyGenerator.getInstance(algorithm, provider.getName());
82. testing/src/main/java/org/conscrypt/java/security/AbstractKeyFactoryTest.java:60 test path final KeyFactory factory = KeyFactory.getInstance(algorithm, p);
83. testing/src/main/java/org/conscrypt/java/security/AbstractKeyFactoryTest.java:83 test path KeyFactory.getInstance(algorithm, p2);
84. testing/src/main/java/org/conscrypt/java/security/AbstractKeyPairGeneratorTest.java:40 test path generator = KeyPairGenerator.getInstance(algorithmName);
85. testing/src/main/java/org/conscrypt/java/security/AlgorithmParameterAsymmetricHelper.java:47 test path Cipher cipher = Cipher.getInstance(algorithmName);
86. testing/src/main/java/org/conscrypt/java/security/AlgorithmParameterKeyAgreementHelper.java:36 test path KeyPairGenerator generator = KeyPairGenerator.getInstance(algorithmName);
87. testing/src/main/java/org/conscrypt/java/security/AlgorithmParameterKeyAgreementHelper.java:40 test path KeyAgreement keyAgreement = KeyAgreement.getInstance(algorithmName);
88. testing/src/main/java/org/conscrypt/java/security/AlgorithmParameterSignatureHelper.java:50 test path Signature signature = Signature.getInstance(algorithmName);
89. testing/src/main/java/org/conscrypt/java/security/AlgorithmParameterSignatureHelper.java:52 test path KeyPairGenerator generator = KeyPairGenerator.getInstance(keyPairAlgorithmName);
90. testing/src/main/java/org/conscrypt/java/security/AlgorithmParameterSymmetricHelper.java:46 test path KeyGenerator generator = KeyGenerator.getInstance(algorithmName);
91. testing/src/main/java/org/conscrypt/java/security/AlgorithmParameterSymmetricHelper.java:55 test path Cipher cipher = Cipher.getInstance(transformation);
92. testing/src/main/java/org/conscrypt/java/security/CipherHelper.java:40 test path Cipher cipher = Cipher.getInstance(algorithmName);
93. testing/src/main/java/org/conscrypt/java/security/DefaultKeys.java:491 test path KeyFactory factory = KeyFactory.getInstance(algorithmName);
94. testing/src/main/java/org/conscrypt/java/security/DefaultKeys.java:497 test path KeyFactory factory = KeyFactory.getInstance(algorithmName);
95. testing/src/main/java/org/conscrypt/java/security/KeyAgreementHelper.java:40 test path KeyAgreement keyAgreement = KeyAgreement.getInstance(algorithmName);
96. testing/src/main/java/org/conscrypt/java/security/SignatureHelper.java:41 test path Signature signature = Signature.getInstance(algorithmName);
97. testing/src/main/java/org/conscrypt/java/security/TestKeyStore.java:616 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance(keyAlgorithm);
98. testing/src/main/java/org/conscrypt/javax/net/ssl/RandomPrivateKeyX509ExtendedKeyManager.java:51 test path KeyFactory keyFactory = KeyFactory.getInstance(keyAlgorithm);
99. testing/src/main/java/org/conscrypt/javax/net/ssl/RandomPrivateKeyX509ExtendedKeyManager.java:60 test path KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(keyAlgorithm);
100. testing/src/main/java/org/conscrypt/javax/net/ssl/RandomPrivateKeyX509ExtendedKeyManager.java:68 test path KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(keyAlgorithm);
101. testing/src/main/java/org/conscrypt/javax/net/ssl/RandomPrivateKeyX509ExtendedKeyManager.java:73 test path KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(keyAlgorithm);
102. testing/src/main/java/org/conscrypt/testing/OpaqueProvider.java:102 test path delegate = Signature.getInstance(algorithm);
103. testing/src/main/java/org/conscrypt/testing/OpaqueProvider.java:202 test path delegate = Cipher.getInstance(algorithm, StandardNames.JSSE_PROVIDER_NAME);

java.keypairgenerator.variable · CWE-327

unknown Could not be determined Renamed import 11 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. common/src/main/java/org/conscrypt/Hkdf.java:126 mac.init(new SecretKeySpec(key, "RAW"));
2. common/src/test/java/org/conscrypt/MacTest.java:86 test path SecretKeySpec secretKey = new SecretKeySpec(keyBytes, "RawBytes");
3. common/src/test/java/org/conscrypt/MacTest.java:246 test path SecretKeySpec key = new SecretKeySpec(keyBytes, "RawBytes");
4. common/src/test/java/org/conscrypt/MacTest.java:335 test path return new SecretKeySpec(decodeHex(entry[KEY_INDEX]), "RawBytes");
5. common/src/test/java/org/conscrypt/MacTest.java:349 test path SecretKeySpec key = new SecretKeySpec(keyBytes, "RawBytes");
6. common/src/test/java/org/conscrypt/MacTest.java:420 test path SecretKeySpec otherKey = new SecretKeySpec(otherKeyBytes, "RawBytes");
7. common/src/test/java/org/conscrypt/MacTest.java:427 test path SecretKeySpec key = new SecretKeySpec(keyBytes, "RawBytes");
8. common/src/test/java/org/conscrypt/javax/net/ssl/SSLEngineTest.java:153 test path return new SecretKeySpec("Just an arbitrary key".getBytes(UTF_8), "RAW");
9. common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketTest.java:203 test path return new SecretKeySpec("Just an arbitrary key".getBytes(UTF_8), "RAW");
10. common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketVersionCompatibilityTest.java:1919 test path return new SecretKeySpec("Just an arbitrary key".getBytes(UTF_8), "RAW");
11. openjdk/src/test/java/org/conscrypt/DuckTypedPSKKeyManagerTest.java:158 test path SecretKey key = new SecretKeySpec("arbitrary".getBytes(StandardCharsets.UTF_8), "RAW");

java.keyspec · CWE-327

SEED Could not be determined 5 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:137 test path new CipherSuite(0x0096, "TLS_RSA_WITH_SEED_CBC_SHA"),
2. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:138 test path new CipherSuite(0x0097, "TLS_DH_DSS_WITH_SEED_CBC_SHA"),
3. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:139 test path new CipherSuite(0x0098, "TLS_DH_RSA_WITH_SEED_CBC_SHA"),
4. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:140 test path new CipherSuite(0x0099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA"),
5. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:141 test path new CipherSuite(0x009a, "TLS_DHE_RSA_WITH_SEED_CBC_SHA"),

config.cipher-suite · CWE-757

unknown Could not be determined 5 places See details

Non-cryptographic randomness near key material

`new Random()` or `Math.random()` in a file that also imports `java.security`, `javax.crypto` or BouncyCastle. `java.util.Random` is a linear congruential generator and its output is predictable from a handful of samples. The import check is what keeps this from firing on every retry jitter and test fixture in the tree.

Part of this code uses a predictable source of random numbers. If any key comes from it, that key can be guessed today, with no quantum computer needed.

What to do. `java.security.SecureRandom`. This is a classical defect, not a quantum one, and it is worth fixing first.

1. common/src/test/java/org/conscrypt/MacTest.java:66 test path private final Random random = new Random(System.currentTimeMillis());
2. common/src/test/java/org/conscrypt/javax/net/ssl/SSLEngineVersionCompatibilityTest.java:823 test path Random random = new Random(System.currentTimeMillis());
3. openjdk/src/test/java/org/conscrypt/ConscryptSocketTest.java:242 test path private final Random random = new Random(System.currentTimeMillis());
4. platform/src/test/java/org/conscrypt/TrustedCertificateStoreTest.java:71 test path private static final Random tempFileRandom = new Random();
5. testing/src/main/java/org/conscrypt/TestUtils.java:109 test path private static final Random random = new Random(System.currentTimeMillis());

java.random.insecure · CWE-338

RC2 Could not be determined 2 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:33 test path new CipherSuite(0x0006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5"),
2. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:106 test path new CipherSuite(0x0061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5"),

config.cipher-suite · CWE-757

unknown Could not be determined 2 places See details

Release signed by the build

`apksigner sign`, `jarsigner`, `codesign` or `signtool` in a build script or a CI workflow. The key it uses signs what customers install, so it outlives every key inside the application and is usually the last one anybody thinks to migrate. The algorithm is deliberately not claimed: a keystore can hold RSA, DSA or EC and the command does not say which.

This is where a release gets signed. The signing key is not in the code, but the code says it exists - and a signing key is usually the hardest one to replace.

What to do. Find the key this command loads and record its algorithm in the inventory. Platform signing formats move on the platform's schedule, not yours, so the useful work now is knowing which key it is and who holds it.

1. gradle/publishing.gradle:81 def command = 'jarsigner -keystore ' + rootProject.signingKeystore +
2. release/README.md:125 gpg --armor --detach-sign "$f"

build.code-signing · CWE-327

IDEA Could not be determined 1 place See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:34 test path new CipherSuite(0x0007, "TLS_RSA_WITH_IDEA_CBC_SHA"),

config.cipher-suite · CWE-757

ML-DSA-65 Quantum-safe Renamed import 36 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. common/src/main/java/org/conscrypt/MlDsaAlgorithm.java:22 ML_DSA_65("ML-DSA-65", 1952),
2. common/src/main/java/org/conscrypt/MlDsaAlgorithm.java:46 case "ML-DSA-65":
3. common/src/main/java/org/conscrypt/OidData.java:64 OID_TO_NAME_MAP.put("2.16.840.1.101.3.4.3.18", "ML-DSA-65");
4. common/src/main/java/org/conscrypt/OpenSSLProvider.java:249 put("Alg.Alias.KeyPairGenerator.2.16.840.1.101.3.4.3.18", "ML-DSA-65");
5. common/src/main/java/org/conscrypt/OpenSSLProvider.java:250 put("Alg.Alias.KeyPairGenerator.OID.2.16.840.1.101.3.4.3.18", "ML-DSA-65");
6. common/src/main/java/org/conscrypt/OpenSSLProvider.java:333 put("Alg.Alias.KeyFactory.2.16.840.1.101.3.4.3.18", "ML-DSA-65");
7. common/src/main/java/org/conscrypt/OpenSSLProvider.java:334 put("Alg.Alias.KeyFactory.OID.2.16.840.1.101.3.4.3.18", "ML-DSA-65");
8. common/src/main/java/org/conscrypt/OpenSSLProvider.java:518 putSignatureImplClass("ML-DSA-65", "OpenSslSignatureMlDsa$MlDsa65");
9. common/src/main/java/org/conscrypt/OpenSSLProvider.java:519 put("Alg.Alias.Signature.2.16.840.1.101.3.4.3.18", "ML-DSA-65");
10. common/src/main/java/org/conscrypt/OpenSSLProvider.java:520 put("Alg.Alias.Signature.OID.2.16.840.1.101.3.4.3.18", "ML-DSA-65");
11. common/src/main/java/org/conscrypt/OpenSslMlDsaKeyPairGenerator.java:54 super("ML-DSA-65");
12. common/src/test/java/org/conscrypt/MlDsaTest.java:101 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
13. common/src/test/java/org/conscrypt/MlDsaTest.java:106 test path Signature signature = Signature.getInstance("ML-DSA-65", conscryptProvider);
14. common/src/test/java/org/conscrypt/MlDsaTest.java:204 test path Signature s65 = Signature.getInstance("ML-DSA-65", conscryptProvider);
15. common/src/test/java/org/conscrypt/MlDsaTest.java:211 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
16. common/src/test/java/org/conscrypt/MlDsaTest.java:219 test path for (String signAlgorithm : new String[] {"ML-DSA-65", "ML-DSA", ML_DSA_65_OID}) {
17. common/src/test/java/org/conscrypt/MlDsaTest.java:227 test path for (String verifyAlgorithm : new String[] {"ML-DSA-65", "ML-DSA", ML_DSA_65_OID}) {
18. common/src/test/java/org/conscrypt/MlDsaTest.java:270 test path Signature s65 = Signature.getInstance("ML-DSA-65", conscryptProvider);
19. common/src/test/java/org/conscrypt/MlDsaTest.java:307 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
20. common/src/test/java/org/conscrypt/MlDsaTest.java:312 test path for (String signAlgorithm : new String[] {"ML-DSA-65", "ML-DSA"}) {
21. common/src/test/java/org/conscrypt/MlDsaTest.java:320 test path for (String verifyAlgorithm : new String[] {"ML-DSA-65", "ML-DSA"}) {
22. common/src/test/java/org/conscrypt/MlDsaTest.java:394 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
23. common/src/test/java/org/conscrypt/MlDsaTest.java:397 test path for (String keyFactoryAlgorithm : new String[] {"ML-DSA-65", "ML-DSA", ML_DSA_65_OID}) {
24. common/src/test/java/org/conscrypt/MlDsaTest.java:475 test path KeyFactory keyFactory65 = KeyFactory.getInstance("ML-DSA-65", conscryptProvider);
25. common/src/test/java/org/conscrypt/MlDsaTest.java:485 test path new String[] {"ML-DSA-44", "ML-DSA-65", "ML-DSA-87", "ML-DSA"}) {
26. common/src/test/java/org/conscrypt/MlDsaTest.java:565 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
27. common/src/test/java/org/conscrypt/MlDsaTest.java:573 test path for (String algorithm : new String[] {"ML-DSA-65", "ML-DSA"}) {
28. common/src/test/java/org/conscrypt/MlDsaTest.java:666 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-65", conscryptProvider);
29. common/src/test/java/org/conscrypt/MlDsaTest.java:831 test path Signature signer = Signature.getInstance("ML-DSA-65", conscryptProvider);
30. common/src/test/java/org/conscrypt/MlDsaTest.java:837 test path Signature verifier = Signature.getInstance("ML-DSA-65", conscryptProvider);
31. common/src/test/java/org/conscrypt/MlDsaTest.java:999 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
32. common/src/test/java/org/conscrypt/MlDsaTest.java:1100 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-65", conscryptProvider);
33. common/src/test/java/org/conscrypt/MlDsaTest.java:1267 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-65", conscryptProvider);
34. common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java:171 test path putKeySize("ML-DSA-65", -1);
35. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:110 test path .skipAlgorithm("ML-DSA-65")
36. common/src/test/java/org/conscrypt/java/security/cert/X509CertificateTest.java:971 test path assertEquals("ML-DSA-65", c.getSigAlgName());

jose.algorithm · CWE-327

ML-DSA-87 Quantum-safe Renamed import 35 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. common/src/main/java/org/conscrypt/MlDsaAlgorithm.java:23 ML_DSA_87("ML-DSA-87", 2592);
2. common/src/main/java/org/conscrypt/MlDsaAlgorithm.java:48 case "ML-DSA-87":
3. common/src/main/java/org/conscrypt/OidData.java:65 OID_TO_NAME_MAP.put("2.16.840.1.101.3.4.3.19", "ML-DSA-87");
4. common/src/main/java/org/conscrypt/OpenSSLProvider.java:252 put("Alg.Alias.KeyPairGenerator.2.16.840.1.101.3.4.3.19", "ML-DSA-87");
5. common/src/main/java/org/conscrypt/OpenSSLProvider.java:253 put("Alg.Alias.KeyPairGenerator.OID.2.16.840.1.101.3.4.3.19", "ML-DSA-87");
6. common/src/main/java/org/conscrypt/OpenSSLProvider.java:336 put("Alg.Alias.KeyFactory.2.16.840.1.101.3.4.3.19", "ML-DSA-87");
7. common/src/main/java/org/conscrypt/OpenSSLProvider.java:337 put("Alg.Alias.KeyFactory.OID.2.16.840.1.101.3.4.3.19", "ML-DSA-87");
8. common/src/main/java/org/conscrypt/OpenSSLProvider.java:521 putSignatureImplClass("ML-DSA-87", "OpenSslSignatureMlDsa$MlDsa87");
9. common/src/main/java/org/conscrypt/OpenSSLProvider.java:522 put("Alg.Alias.Signature.2.16.840.1.101.3.4.3.19", "ML-DSA-87");
10. common/src/main/java/org/conscrypt/OpenSSLProvider.java:523 put("Alg.Alias.Signature.OID.2.16.840.1.101.3.4.3.19", "ML-DSA-87");
11. common/src/main/java/org/conscrypt/OpenSslMlDsaKeyPairGenerator.java:82 super("ML-DSA-87");
12. common/src/test/java/org/conscrypt/MlDsaTest.java:237 test path Signature s87 = Signature.getInstance("ML-DSA-87", conscryptProvider);
13. common/src/test/java/org/conscrypt/MlDsaTest.java:244 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-87", conscryptProvider);
14. common/src/test/java/org/conscrypt/MlDsaTest.java:252 test path for (String signAlgorithm : new String[] {"ML-DSA-87", "ML-DSA", ML_DSA_87_OID}) {
15. common/src/test/java/org/conscrypt/MlDsaTest.java:260 test path for (String verifyAlgorithm : new String[] {"ML-DSA-87", "ML-DSA", ML_DSA_87_OID}) {
16. common/src/test/java/org/conscrypt/MlDsaTest.java:300 test path Signature s87 = Signature.getInstance("ML-DSA-87", conscryptProvider);
17. common/src/test/java/org/conscrypt/MlDsaTest.java:330 test path Signature s87 = Signature.getInstance("ML-DSA-87", conscryptProvider);
18. common/src/test/java/org/conscrypt/MlDsaTest.java:385 test path KeyFactory keyFactory87 = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
19. common/src/test/java/org/conscrypt/MlDsaTest.java:418 test path KeyFactory keyFactory87 = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
20. common/src/test/java/org/conscrypt/MlDsaTest.java:427 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-87", conscryptProvider);
21. common/src/test/java/org/conscrypt/MlDsaTest.java:430 test path for (String keyFactoryAlgorithm : new String[] {"ML-DSA-87", ML_DSA_87_OID}) {
22. common/src/test/java/org/conscrypt/MlDsaTest.java:485 test path new String[] {"ML-DSA-44", "ML-DSA-65", "ML-DSA-87", "ML-DSA"}) {
23. common/src/test/java/org/conscrypt/MlDsaTest.java:538 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
24. common/src/test/java/org/conscrypt/MlDsaTest.java:602 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
25. common/src/test/java/org/conscrypt/MlDsaTest.java:629 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-87", conscryptProvider);
26. common/src/test/java/org/conscrypt/MlDsaTest.java:637 test path for (String algorithm : new String[] {"ML-DSA-87", "ML-DSA"}) {
27. common/src/test/java/org/conscrypt/MlDsaTest.java:1019 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-87", conscryptProvider);
28. common/src/test/java/org/conscrypt/MlDsaTest.java:1156 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
29. common/src/test/java/org/conscrypt/MlDsaTest.java:1319 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
30. common/src/test/java/org/conscrypt/MlDsaTest.java:1374 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
31. common/src/test/java/org/conscrypt/MlDsaTest.java:1407 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
32. common/src/test/java/org/conscrypt/MlDsaTest.java:1440 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
33. common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java:172 test path putKeySize("ML-DSA-87", -1);
34. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:111 test path .skipAlgorithm("ML-DSA-87")
35. common/src/test/java/org/conscrypt/java/security/cert/X509CertificateTest.java:988 test path assertEquals("ML-DSA-87", c.getSigAlgName());

jose.algorithm · CWE-327

ML-DSA-44 Quantum-safe Renamed import 32 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. common/src/main/java/org/conscrypt/MlDsaAlgorithm.java:21 ML_DSA_44("ML-DSA-44", 1312),
2. common/src/main/java/org/conscrypt/MlDsaAlgorithm.java:44 case "ML-DSA-44":
3. common/src/main/java/org/conscrypt/OidData.java:63 OID_TO_NAME_MAP.put("2.16.840.1.101.3.4.3.17", "ML-DSA-44");
4. common/src/main/java/org/conscrypt/OpenSSLProvider.java:246 put("Alg.Alias.KeyPairGenerator.2.16.840.1.101.3.4.3.17", "ML-DSA-44");
5. common/src/main/java/org/conscrypt/OpenSSLProvider.java:247 put("Alg.Alias.KeyPairGenerator.OID.2.16.840.1.101.3.4.3.17", "ML-DSA-44");
6. common/src/main/java/org/conscrypt/OpenSSLProvider.java:330 put("Alg.Alias.KeyFactory.2.16.840.1.101.3.4.3.17", "ML-DSA-44");
7. common/src/main/java/org/conscrypt/OpenSSLProvider.java:331 put("Alg.Alias.KeyFactory.OID.2.16.840.1.101.3.4.3.17", "ML-DSA-44");
8. common/src/main/java/org/conscrypt/OpenSSLProvider.java:515 putSignatureImplClass("ML-DSA-44", "OpenSslSignatureMlDsa$MlDsa44");
9. common/src/main/java/org/conscrypt/OpenSSLProvider.java:516 put("Alg.Alias.Signature.2.16.840.1.101.3.4.3.17", "ML-DSA-44");
10. common/src/main/java/org/conscrypt/OpenSSLProvider.java:517 put("Alg.Alias.Signature.OID.2.16.840.1.101.3.4.3.17", "ML-DSA-44");
11. common/src/main/java/org/conscrypt/OpenSslMlDsaKeyPairGenerator.java:37 super("ML-DSA-44");
12. common/src/test/java/org/conscrypt/MlDsaTest.java:178 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
13. common/src/test/java/org/conscrypt/MlDsaTest.java:186 test path for (String signAlgorithm : new String[] {"ML-DSA-44", "ML-DSA", ML_DSA_44_OID}) {
14. common/src/test/java/org/conscrypt/MlDsaTest.java:194 test path for (String verifyAlgorithm : new String[] {"ML-DSA-44", "ML-DSA", ML_DSA_44_OID}) {
15. common/src/test/java/org/conscrypt/MlDsaTest.java:277 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
16. common/src/test/java/org/conscrypt/MlDsaTest.java:282 test path for (String signAlgorithm : new String[] {"ML-DSA-44", "ML-DSA"}) {
17. common/src/test/java/org/conscrypt/MlDsaTest.java:290 test path for (String verifyAlgorithm : new String[] {"ML-DSA-44", "ML-DSA"}) {
18. common/src/test/java/org/conscrypt/MlDsaTest.java:337 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
19. common/src/test/java/org/conscrypt/MlDsaTest.java:340 test path for (String keyFactoryAlgorithm : new String[] {"ML-DSA-44", ML_DSA_44_OID}) {
20. common/src/test/java/org/conscrypt/MlDsaTest.java:485 test path new String[] {"ML-DSA-44", "ML-DSA-65", "ML-DSA-87", "ML-DSA"}) {
21. common/src/test/java/org/conscrypt/MlDsaTest.java:501 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
22. common/src/test/java/org/conscrypt/MlDsaTest.java:509 test path for (String algorithm : new String[] {"ML-DSA-44", "ML-DSA"}) {
23. common/src/test/java/org/conscrypt/MlDsaTest.java:748 test path Signature signer = Signature.getInstance("ML-DSA-44", conscryptProvider);
24. common/src/test/java/org/conscrypt/MlDsaTest.java:754 test path Signature verifier = Signature.getInstance("ML-DSA-44", conscryptProvider);
25. common/src/test/java/org/conscrypt/MlDsaTest.java:979 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
26. common/src/test/java/org/conscrypt/MlDsaTest.java:1042 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-44", conscryptProvider);
27. common/src/test/java/org/conscrypt/MlDsaTest.java:1213 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-44", conscryptProvider);
28. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:150 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
29. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:153 test path Signature signature = Signature.getInstance("ML-DSA-44", conscryptProvider);
30. common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java:170 test path putKeySize("ML-DSA-44", -1);
31. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:109 test path .skipAlgorithm("ML-DSA-44")
32. common/src/test/java/org/conscrypt/java/security/cert/X509CertificateTest.java:954 test path assertEquals("ML-DSA-44", c.getSigAlgName());

jose.algorithm · CWE-327

SLH-DSA Quantum-safe 12 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. common/src/test/java/org/conscrypt/SlhDsaTest.java:81 test path Signature ss = Signature.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
2. common/src/test/java/org/conscrypt/SlhDsaTest.java:87 test path Signature sv = Signature.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
3. common/src/test/java/org/conscrypt/SlhDsaTest.java:102 test path Signature signature = Signature.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
4. common/src/test/java/org/conscrypt/SlhDsaTest.java:134 test path Signature.getInstance("SLH-DSA-SHA2-128S-WITH-SHA384", conscryptProvider);
5. common/src/test/java/org/conscrypt/SlhDsaTest.java:141 test path Signature.getInstance("SLH-DSA-SHA2-128S-WITH-SHA384", conscryptProvider);
6. common/src/test/java/org/conscrypt/SlhDsaTest.java:168 test path Signature rawSigner = Signature.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
7. common/src/test/java/org/conscrypt/SlhDsaTest.java:177 test path Signature rawVerifier = Signature.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
8. common/src/test/java/org/conscrypt/SlhDsaTest.java:192 test path Signature.getInstance("SLH-DSA-SHA2-128S-WITH-SHA384", conscryptProvider);
9. common/src/test/java/org/conscrypt/SlhDsaTest.java:227 test path Signature.getInstance("SLH-DSA-SHA2-128S-WITH-SHA384", conscryptProvider);
10. common/src/test/java/org/conscrypt/SlhDsaTest.java:234 test path Signature.getInstance("SLH-DSA-SHA2-128S-WITH-SHA384", conscryptProvider);
11. common/src/test/java/org/conscrypt/SlhDsaTest.java:243 test path Signature.getInstance("SLH-DSA-SHA2-128S-WITH-SHA384", conscryptProvider);
12. common/src/test/java/org/conscrypt/SlhDsaTest.java:259 test path () -> Signature.getInstance("SLH-DSA", conscryptProvider));

java.signature · CWE-327

SHA-384 Quantum-safe Renamed import 11 places See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:704 test path assertNotNull(Signature.getInstance("SHA384withRSA"));
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:759 test path Signature sig = Signature.getInstance("SHA384withRSA");
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:918 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:933 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:947 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1255 test path Signature sig = Signature.getInstance("SHA384withRSA");
7. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1531 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
8. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1555 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
9. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1583 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
10. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1596 test path sig = Signature.getInstance("SHA384withRSA/PSS");
11. openjdk/src/test/java/org/conscrypt/NativeCryptoTest.java:4832 test path MessageDigest md = MessageDigest.getInstance("SHA-384");

java.messagedigest · CWE-328

SLH-DSA Quantum-safe 11 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/SlhDsaTest.java:261 test path () -> KeyFactory.getInstance("SLH-DSA", conscryptProvider));
2. common/src/test/java/org/conscrypt/SlhDsaTest.java:270 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
3. common/src/test/java/org/conscrypt/SlhDsaTest.java:292 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
4. common/src/test/java/org/conscrypt/SlhDsaTest.java:303 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
5. common/src/test/java/org/conscrypt/SlhDsaTest.java:374 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
6. common/src/test/java/org/conscrypt/SlhDsaTest.java:422 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
7. common/src/test/java/org/conscrypt/SlhDsaTest.java:457 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
8. common/src/test/java/org/conscrypt/SlhDsaTest.java:499 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
9. common/src/test/java/org/conscrypt/SlhDsaTest.java:526 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
10. common/src/test/java/org/conscrypt/SlhDsaTest.java:551 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
11. common/src/test/java/org/conscrypt/SlhDsaTest.java:577 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);

java.keyfactory · CWE-327

SHA-512 Quantum-safe Renamed import 10 places See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:705 test path assertNotNull(Signature.getInstance("SHA512withRSA"));
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:769 test path Signature sig = Signature.getInstance("SHA512withRSA");
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:961 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:976 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:990 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1269 test path Signature sig = Signature.getInstance("SHA512withRSA");
7. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1610 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
8. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1634 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
9. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1662 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
10. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1675 test path sig = Signature.getInstance("SHA512withRSA/PSS");

java.messagedigest · CWE-328

ML-DSA-65 Quantum-safe 9 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. common/src/test/java/org/conscrypt/MlDsaTest.java:87 test path Signature ss = Signature.getInstance("ML-DSA", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlDsaTest.java:92 test path Signature sv = Signature.getInstance("ML-DSA", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlDsaTest.java:106 test path Signature signature = Signature.getInstance("ML-DSA-65", conscryptProvider);
4. common/src/test/java/org/conscrypt/MlDsaTest.java:204 test path Signature s65 = Signature.getInstance("ML-DSA-65", conscryptProvider);
5. common/src/test/java/org/conscrypt/MlDsaTest.java:270 test path Signature s65 = Signature.getInstance("ML-DSA-65", conscryptProvider);
6. common/src/test/java/org/conscrypt/MlDsaTest.java:831 test path Signature signer = Signature.getInstance("ML-DSA-65", conscryptProvider);
7. common/src/test/java/org/conscrypt/MlDsaTest.java:837 test path Signature verifier = Signature.getInstance("ML-DSA-65", conscryptProvider);
8. common/src/test/java/org/conscrypt/MlDsaTest.java:927 test path Signature signer = Signature.getInstance("ML-DSA", conscryptProvider);
9. common/src/test/java/org/conscrypt/MlDsaTest.java:933 test path Signature verifier = Signature.getInstance("ML-DSA", conscryptProvider);

java.signature · CWE-327

ML-DSA-65 Quantum-safe 9 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/MlDsaTest.java:362 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlDsaTest.java:452 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlDsaTest.java:475 test path KeyFactory keyFactory65 = KeyFactory.getInstance("ML-DSA-65", conscryptProvider);
4. common/src/test/java/org/conscrypt/MlDsaTest.java:666 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-65", conscryptProvider);
5. common/src/test/java/org/conscrypt/MlDsaTest.java:693 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA", conscryptProvider);
6. common/src/test/java/org/conscrypt/MlDsaTest.java:762 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA", conscryptProvider);
7. common/src/test/java/org/conscrypt/MlDsaTest.java:845 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA", conscryptProvider);
8. common/src/test/java/org/conscrypt/MlDsaTest.java:1100 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-65", conscryptProvider);
9. common/src/test/java/org/conscrypt/MlDsaTest.java:1267 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-65", conscryptProvider);

java.keyfactory · CWE-327

ML-DSA-87 Quantum-safe 9 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/MlDsaTest.java:385 test path KeyFactory keyFactory87 = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlDsaTest.java:418 test path KeyFactory keyFactory87 = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlDsaTest.java:538 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
4. common/src/test/java/org/conscrypt/MlDsaTest.java:602 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
5. common/src/test/java/org/conscrypt/MlDsaTest.java:1156 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
6. common/src/test/java/org/conscrypt/MlDsaTest.java:1319 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
7. common/src/test/java/org/conscrypt/MlDsaTest.java:1374 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
8. common/src/test/java/org/conscrypt/MlDsaTest.java:1407 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
9. common/src/test/java/org/conscrypt/MlDsaTest.java:1440 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);

java.keyfactory · CWE-327

SLH-DSA Quantum-safe 9 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/SlhDsaTest.java:75 test path KeyPairGenerator.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
2. common/src/test/java/org/conscrypt/SlhDsaTest.java:97 test path KeyPairGenerator.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
3. common/src/test/java/org/conscrypt/SlhDsaTest.java:127 test path KeyPairGenerator.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
4. common/src/test/java/org/conscrypt/SlhDsaTest.java:186 test path KeyPairGenerator.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
5. common/src/test/java/org/conscrypt/SlhDsaTest.java:217 test path KeyPairGenerator.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
6. common/src/test/java/org/conscrypt/SlhDsaTest.java:257 test path () -> KeyPairGenerator.getInstance("SLH-DSA", conscryptProvider));
7. common/src/test/java/org/conscrypt/SlhDsaTest.java:267 test path KeyPairGenerator.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
8. common/src/test/java/org/conscrypt/SlhDsaTest.java:363 test path KeyPairGenerator.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
9. common/src/test/java/org/conscrypt/SlhDsaTest.java:478 test path KeyPairGenerator.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);

java.keypairgenerator · CWE-327

CSPRNG Quantum-safe 8 places See details

Random number generation

`SecureRandom`. A platform CSPRNG is not a quantum exposure; it is recorded because an inventory that omits the randomness source is incomplete. `SHA1PRNG` is named explicitly where it appears, since it is a legacy algorithm even though its output is adequate.

This is where the software gets its random numbers. Quantum computers do not weaken it.

What to do. No action. Prefer the platform default over naming an algorithm.

1. common/src/main/java/org/conscrypt/KeyGeneratorImpl.java:81 secureRandom = new SecureRandom();
2. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestGCM.java:113 test path new SecureRandom().nextBytes(bytes);
3. common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java:239 test path kpg.initialize(keySize, new SecureRandom());
4. common/src/test/java/org/conscrypt/java/security/SecureRandomTest.java:50 test path final SecureRandom random = SecureRandom.getInstance("SHA1PRNG", provider);
5. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:941 test path new SecureRandom().nextBytes(salt);
6. common/src/test/java/org/conscrypt/javax/crypto/KeyGeneratorTest.java:148 test path kg.init(new SecureRandom());
7. testing/src/main/java/org/conscrypt/java/security/TestKeyStore.java:721 test path new SecureRandom().nextBytes(serialBytes);
8. testing/src/main/java/org/conscrypt/javax/net/ssl/TestSSLContext.java:396 test path context.init(keyManagers, trustManagers, new SecureRandom());

java.rng

SHA-512 Quantum-safe Renamed import 8 places See details

Mask-generation digest named for RSA padding

`MGF1ParameterSpec.SHA256` names the digest inside RSA-OAEP and RSA-PSS padding. It is a separate choice from the digest the signature or the cipher uses, it is frequently left at SHA-1 by default, and a static import of it - `import static java.security.spec.MGF1ParameterSpec.SHA512` - is the only place the choice appears in the file that makes it.

This picks the hash used inside RSA padding. It matters because the default is often SHA-1, which is broken today without any quantum computer.

What to do. The mask-generation digest travels with the RSA key it pads. When that key moves to ML-KEM or ML-DSA the padding goes with it; until then, SHA-256 or better.

1. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:171 test path spec = new OAEPParameterSpec("SHA-1", "MGF1", MGF1ParameterSpec.SHA512,
2. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:227 test path assertEquals(MGF1ParameterSpec.SHA512.getDigestAlgorithm(),
3. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:239 test path assertEquals(MGF1ParameterSpec.SHA512.getDigestAlgorithm(),
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:664 test path new PSSParameterSpec("SHA-512", "MGF1", MGF1ParameterSpec.SHA512, 64, 1);
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:681 test path new PSSParameterSpec("SHA-512", "MGF1", MGF1ParameterSpec.SHA512, 0, 1);
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:698 test path new PSSParameterSpec("SHA-512", "MGF1", MGF1ParameterSpec.SHA512, 190, 1);
7. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3770 test path addRsaOaepTest("SHA-512", MGF1ParameterSpec.SHA512, RSA_Vector2_OAEP_SHA512_MGF1_SHA512);
8. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3773 test path addRsaOaepTest("SHA-512", MGF1ParameterSpec.SHA512,

java.mgf1 · CWE-327

AES-256 Quantum-safe 7 places See details

Cipher transformation named away from the call

A JCA transformation string - `algorithm/mode/padding` - written somewhere other than a `getInstance()` argument, which is how a codebase that centralises its cryptography passes the choice to a helper. The string is unambiguous wherever it appears: nothing but a transformation is spelled that way.

This names an encryption method as text, and passes it to code elsewhere that does the work. It is the same choice, made in a different place.

What to do. The same migration applies as to the call that consumes it. Move the constant and the call together, so the inventory keeps naming the algorithm after the change.

1. common/src/main/java/org/conscrypt/OpenSSLProvider.java:652 putSymmetricCipherImplClass("AES_256/ECB/NoPadding",
2. common/src/main/java/org/conscrypt/OpenSSLProvider.java:654 putSymmetricCipherImplClass("AES_256/ECB/PKCS5Padding",
3. common/src/main/java/org/conscrypt/OpenSSLProvider.java:656 put("Alg.Alias.Cipher.AES_256/ECB/PKCS7Padding", "AES_256/ECB/PKCS5Padding");
4. common/src/main/java/org/conscrypt/OpenSSLProvider.java:657 putSymmetricCipherImplClass("AES_256/CBC/NoPadding",
5. common/src/main/java/org/conscrypt/OpenSSLProvider.java:659 putSymmetricCipherImplClass("AES_256/CBC/PKCS5Padding",
6. common/src/main/java/org/conscrypt/OpenSSLProvider.java:661 put("Alg.Alias.Cipher.AES_256/CBC/PKCS7Padding", "AES_256/CBC/PKCS5Padding");
7. common/src/main/java/org/conscrypt/OpenSSLProvider.java:686 putSymmetricCipherImplClass("AES_256/GCM/NoPadding", "OpenSSLAeadCipherAES$GCM$AES_256");

java.transformation · CWE-327

ML-DSA-65 Quantum-safe 7 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/MlDsaTest.java:81 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlDsaTest.java:101 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlDsaTest.java:211 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
4. common/src/test/java/org/conscrypt/MlDsaTest.java:307 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
5. common/src/test/java/org/conscrypt/MlDsaTest.java:394 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
6. common/src/test/java/org/conscrypt/MlDsaTest.java:565 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
7. common/src/test/java/org/conscrypt/MlDsaTest.java:999 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);

java.keypairgenerator · CWE-327

ML-DSA-44 Quantum-safe 6 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/MlDsaTest.java:178 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlDsaTest.java:277 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlDsaTest.java:337 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
4. common/src/test/java/org/conscrypt/MlDsaTest.java:501 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
5. common/src/test/java/org/conscrypt/MlDsaTest.java:979 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
6. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:150 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);

java.keypairgenerator · CWE-327

SHA-384 Quantum-safe Renamed import 6 places See details

Mask-generation digest named for RSA padding

`MGF1ParameterSpec.SHA256` names the digest inside RSA-OAEP and RSA-PSS padding. It is a separate choice from the digest the signature or the cipher uses, it is frequently left at SHA-1 by default, and a static import of it - `import static java.security.spec.MGF1ParameterSpec.SHA512` - is the only place the choice appears in the file that makes it.

This picks the hash used inside RSA padding. It matters because the default is often SHA-1, which is broken today without any quantum computer.

What to do. The mask-generation digest travels with the RSA key it pads. When that key moves to ML-KEM or ML-DSA the padding goes with it; until then, SHA-256 or better.

1. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:164 test path "SHA-256", "MGF1", MGF1ParameterSpec.SHA384,
2. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:215 test path assertEquals(MGF1ParameterSpec.SHA384.getDigestAlgorithm(),
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:613 test path new PSSParameterSpec("SHA-384", "MGF1", MGF1ParameterSpec.SHA384, 48, 1);
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:630 test path new PSSParameterSpec("SHA-384", "MGF1", MGF1ParameterSpec.SHA384, 0, 1);
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:647 test path new PSSParameterSpec("SHA-384", "MGF1", MGF1ParameterSpec.SHA384, 206, 1);
6. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3769 test path addRsaOaepTest("SHA-384", MGF1ParameterSpec.SHA384, RSA_Vector2_OAEP_SHA384_MGF1_SHA384);

java.mgf1 · CWE-327

ML-DSA-87 Quantum-safe 4 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/MlDsaTest.java:244 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-87", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlDsaTest.java:427 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-87", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlDsaTest.java:629 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-87", conscryptProvider);
4. common/src/test/java/org/conscrypt/MlDsaTest.java:1019 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-87", conscryptProvider);

java.keypairgenerator · CWE-327

ML-DSA-44 Quantum-safe 3 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. common/src/test/java/org/conscrypt/MlDsaTest.java:748 test path Signature signer = Signature.getInstance("ML-DSA-44", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlDsaTest.java:754 test path Signature verifier = Signature.getInstance("ML-DSA-44", conscryptProvider);
3. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:153 test path Signature signature = Signature.getInstance("ML-DSA-44", conscryptProvider);

java.signature · CWE-327

ML-DSA-87 Quantum-safe 3 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. common/src/test/java/org/conscrypt/MlDsaTest.java:237 test path Signature s87 = Signature.getInstance("ML-DSA-87", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlDsaTest.java:300 test path Signature s87 = Signature.getInstance("ML-DSA-87", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlDsaTest.java:330 test path Signature s87 = Signature.getInstance("ML-DSA-87", conscryptProvider);

java.signature · CWE-327

ML-KEM-1024 Quantum-safe 3 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/MlKemTest.java:253 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-KEM-1024", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlKemTest.java:375 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-KEM-1024", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlKemTest.java:491 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-KEM-1024", conscryptProvider);

java.keyfactory · CWE-327

ML-KEM-768 Quantum-safe 3 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/MlKemTest.java:214 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-KEM-768", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlKemTest.java:602 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-KEM-768", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlKemTest.java:657 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-KEM-768", conscryptProvider);

java.keypairgenerator · CWE-327

ML-KEM-768 Quantum-safe 3 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/MlKemTest.java:319 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-KEM-768", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlKemTest.java:346 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-KEM-768", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlKemTest.java:404 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-KEM-768", conscryptProvider);

java.keyfactory · CWE-327

ML-DSA-44 Quantum-safe 2 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/MlDsaTest.java:1042 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-44", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlDsaTest.java:1213 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-44", conscryptProvider);

java.keyfactory · CWE-327

ML-DSA-65 Quantum-safe 2 places See details

Post-quantum algorithm through BouncyCastle

A `org.bouncycastle.pqc` class. This is migration work already in progress and is recorded so the inventory shows what has been done, not only what is outstanding.

This is already a quantum-safe algorithm. It is listed so the report shows the work that has been completed.

What to do. None. Confirm the parameter set matches the required NIST category.

1. common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java:312 test path if (expectedAlgorithm.equals("ML-DSA") || expectedAlgorithm.startsWith("MLDSA")) {
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:163 test path } else if (sigAlgorithmUpperCase.startsWith("MLDSA")) {

java.bouncycastle.pqc

ML-KEM-1024 Quantum-safe 2 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/MlKemTest.java:280 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-KEM-1024", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlKemTest.java:630 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-KEM-1024", conscryptProvider);

java.keypairgenerator · CWE-327

ChaCha20-Poly1305 Quantum-safe 1 place See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:59 test path new SecretKeySpec(new byte[32], "ChaCha20"),

java.keyspec · CWE-327

HMAC Quantum-safe 1 place See details

Message authentication code through the JCA

`Mac.getInstance()`. HMAC is not broken by Shor and is only marginally affected by Grover; it is inventoried, not flagged, unless the underlying digest is broken.

This is a fingerprint used to prove a message was not altered. Quantum computers do not break it.

What to do. No action beyond avoiding HmacMD5 and HmacSHA1.

1. common/src/test/java/org/conscrypt/MacTest.java:227 test path final Mac mac = Mac.getInstance("HMACSHA256", conscryptProvider);

java.mac