Crypto-View

auth0/node-jsonwebtoken

Cryptographic posture

228 cryptographic locations: 4 already broken, 95 quantum-vulnerable, 16 undetermined, 113 quantum-safe

8 establish keys, so traffic protected by them and recorded today becomes readable once the algorithm falls. 76 files analysed.

Quantum-vulnerable 95 Already broken 4 Could not be determined 16 Quantum-safe 113
To address108
Key establishment8
Inventory only0
Total findings228
What was analysed
Branch master
Commit b924272f29192e12926b5414546f7c5bfcc9579d ci: replace npx changelog call with npm script and fix prepare-release workflow (#1037)
Committed 2026-06-25 15:22 UTC
Scanned 2026-09-21 10:59 UTC 9 hours ago
Coverage 76 files, 46 javascript

List of cryptographic assets

RSA-10241024-bit Already broken Recorded traffic Renamed import 4 places See details

Classical key pair generated with Node crypto

`crypto.generateKeyPair()` or its synchronous form. The detector resolves the algorithm through a `promisify()` wrapper and through an import alias, both of which are common enough that missing them would leave real key generation unreported.

This is already unsafe today, with no quantum computer involved. A modulus of 1024 bits or less is below the NIST SP 800-57 floor and is within reach of classical factorisation. Shor is not the nearest problem here.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Node exposes neither yet, so this usually means an addon or a service boundary.

  1. test/async_sign.tests.js:64 test path const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 1024 });
  2. test/async_sign.tests.js:73 test path const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 1024 });
  3. test/rsa-public-key.tests.js:19 test path const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 1024 });
  4. test/rsa-public-key.tests.js:29 test path const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 1024 });
js.generatekeypair · CWE-327
RSASSA-PKCS1v15 Quantum-vulnerable 20 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. lib/validateAsymmetricKey.js:6 'rsa': ['RS256', 'PS256', 'RS384', 'PS384', 'RS512', 'PS512'],
  2. sign.js:14 const SUPPORTED_ALGS = ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512', 'HS256', 'HS384', 'HS512', 'none'];
  3. test/async_sign.tests.js:57 test path jwt.sign({ foo: 'bar' }, secret, { algorithm: 'RS256' }, function (err) {
  4. test/async_sign.tests.js:66 test path jwt.sign({ foo: 'bar' }, privateKey, { algorithm: 'RS256' }, function (err) {
  5. test/async_sign.tests.js:75 test path jwt.sign({ foo: 'bar' }, privateKey, { algorithm: 'RS256', allowInsecureKeySizes: true }, done);
  6. test/issue_70.tests.js:10 test path var token = jwt.sign({ foo: 'bar' }, cert_priv, { algorithm: 'RS256'});
  7. test/jwt.asymmetric_signing.tests.js:179 test path const algorithm = 'RS256';
  8. test/jwt.malicious.tests.js:15 test path const options = {algorithms: ['RS256', 'HS256']};
  9. test/option-complete.test.js:13 test path const header = { alg: 'RS256' };
  10. test/rsa-public-key.tests.js:13 test path var token = jwt.sign({ foo: 'bar' }, cert_priv, { algorithm: 'RS256'});
  11. test/rsa-public-key.tests.js:22 test path jwt.sign({ foo: 'bar' }, privateKey, { algorithm: 'RS256'})
  12. test/rsa-public-key.tests.js:31 test path jwt.sign({ foo: 'bar' }, privateKey, { algorithm: 'RS256', allowInsecureKeySizes: true}, done)
  13. test/schema.tests.js:23 test path sign({algorithm: 'RS256'}, cert_rsa_priv);
  14. test/schema.tests.js:24 test path sign({algorithm: 'RS384'}, cert_rsa_priv);
  15. test/schema.tests.js:25 test path sign({algorithm: 'RS512'}, cert_rsa_priv);
  16. test/validateAsymmetricKey.tests.js:62 test path const algorithm = 'RS256';
  17. test/verify.tests.js:16 test path const header = { alg: 'RS256' };
  18. test/wrong_alg.tests.js:28 test path jwt.verify(TOKEN, pub, {algorithms: ['RS256']});
  19. verify.js:11 const PUB_KEY_ALGS = ['RS256', 'RS384', 'RS512'];
  20. verify.js:13 const RSA_KEY_ALGS = ['RS256', 'RS384', 'RS512'];
jose.algorithm · CWE-327
ECDSA Quantum-vulnerable 14 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. lib/validateAsymmetricKey.js:5 'ec': ['ES256', 'ES384', 'ES512'],
  2. sign.js:14 const SUPPORTED_ALGS = ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512', 'HS256', 'HS384', 'HS512', 'none'];
  3. test/jwt.asymmetric_signing.tests.js:191 test path const algorithm = 'ES256';
  4. test/jwt.asymmetric_signing.tests.js:201 test path const algorithm = 'ES256';
  5. test/schema.tests.js:31 test path sign({algorithm: 'ES256'}, cert_ecdsa_priv);
  6. test/schema.tests.js:32 test path sign({algorithm: 'ES384'}, cert_secp384r1_priv);
  7. test/schema.tests.js:33 test path sign({algorithm: 'ES512'}, cert_secp521r1_priv);
  8. test/validateAsymmetricKey.tests.js:50 test path const algorithm = 'ES256';
  9. test/validateAsymmetricKey.tests.js:74 test path { algorithm: 'ES256', curve: 'prime256v1' },
  10. test/validateAsymmetricKey.tests.js:75 test path { algorithm: 'ES384', curve: 'secp384r1' },
  11. test/validateAsymmetricKey.tests.js:76 test path { algorithm: 'ES512', curve: 'secp521r1' },
  12. test/verify.tests.js:288 test path jwt.verify(token, key, { algorithms: ['ES256'] });
  13. test/verify.tests.js:297 test path jwt.verify(token, key, { algorithms: ['ES256'], allowInvalidAsymmetricKeyTypes: true });
  14. verify.js:12 const EC_KEY_ALGS = ['ES256', 'ES384', 'ES512'];
jose.algorithm · CWE-327
RSA-PSS Quantum-vulnerable 14 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. lib/validateAsymmetricKey.js:6 'rsa': ['RS256', 'PS256', 'RS384', 'PS384', 'RS512', 'PS512'],
  2. lib/validateAsymmetricKey.js:7 'rsa-pss': ['PS256', 'PS384', 'PS512']
  3. sign.js:16 SUPPORTED_ALGS.splice(3, 0, 'PS256', 'PS384', 'PS512');
  4. test/async_sign.tests.js:81 test path jwt.sign({ foo: 'bar' }, secret, { algorithm: 'PS256' }, function (err) {
  5. test/rsa-public-key.tests.js:40 test path var token = jwt.sign({ foo: 'bar' }, cert_priv, { algorithm: 'PS256'});
  6. test/schema.tests.js:27 test path sign({algorithm: 'PS256'}, cert_rsa_priv);
  7. test/schema.tests.js:28 test path sign({algorithm: 'PS384'}, cert_rsa_priv);
  8. test/schema.tests.js:29 test path sign({algorithm: 'PS512'}, cert_rsa_priv);
  9. test/validateAsymmetricKey.tests.js:120 test path const algorithm = 'PS512';
  10. test/validateAsymmetricKey.tests.js:127 test path const algorithm = 'PS256';
  11. test/validateAsymmetricKey.tests.js:136 test path const algorithm = 'PS256';
  12. test/wrong_alg.tests.js:37 test path jwt.verify(TOKEN, pub, {algorithms: ['PS256']});
  13. verify.js:17 PUB_KEY_ALGS.splice(PUB_KEY_ALGS.length, 0, 'PS256', 'PS384', 'PS512');
  14. verify.js:18 RSA_KEY_ALGS.splice(RSA_KEY_ALGS.length, 0, 'PS256', 'PS384', 'PS512');
jose.algorithm · CWE-327
RSASSA-PKCS1v15 Quantum-vulnerable 14 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. test/async_sign.tests.js:57 test path jwt.sign({ foo: 'bar' }, secret, { algorithm: 'RS256' }, function (err) {
  2. test/async_sign.tests.js:66 test path jwt.sign({ foo: 'bar' }, privateKey, { algorithm: 'RS256' }, function (err) {
  3. test/async_sign.tests.js:75 test path jwt.sign({ foo: 'bar' }, privateKey, { algorithm: 'RS256', allowInsecureKeySizes: true }, done);
  4. test/issue_70.tests.js:10 test path var token = jwt.sign({ foo: 'bar' }, cert_priv, { algorithm: 'RS256'});
  5. test/jwt.malicious.tests.js:15 test path const options = {algorithms: ['RS256', 'HS256']};
  6. test/option-complete.test.js:13 test path const header = { alg: 'RS256' };
  7. test/rsa-public-key.tests.js:13 test path var token = jwt.sign({ foo: 'bar' }, cert_priv, { algorithm: 'RS256'});
  8. test/rsa-public-key.tests.js:22 test path jwt.sign({ foo: 'bar' }, privateKey, { algorithm: 'RS256'})
  9. test/rsa-public-key.tests.js:31 test path jwt.sign({ foo: 'bar' }, privateKey, { algorithm: 'RS256', allowInsecureKeySizes: true}, done)
  10. test/schema.tests.js:23 test path sign({algorithm: 'RS256'}, cert_rsa_priv);
  11. test/schema.tests.js:24 test path sign({algorithm: 'RS384'}, cert_rsa_priv);
  12. test/schema.tests.js:25 test path sign({algorithm: 'RS512'}, cert_rsa_priv);
  13. test/verify.tests.js:16 test path const header = { alg: 'RS256' };
  14. test/wrong_alg.tests.js:28 test path jwt.verify(TOKEN, pub, {algorithms: ['RS256']});
js.jwt.algorithm · CWE-327
ECDSA Quantum-vulnerable 8 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. test/schema.tests.js:31 test path sign({algorithm: 'ES256'}, cert_ecdsa_priv);
  2. test/schema.tests.js:32 test path sign({algorithm: 'ES384'}, cert_secp384r1_priv);
  3. test/schema.tests.js:33 test path sign({algorithm: 'ES512'}, cert_secp521r1_priv);
  4. test/validateAsymmetricKey.tests.js:74 test path { algorithm: 'ES256', curve: 'prime256v1' },
  5. test/validateAsymmetricKey.tests.js:75 test path { algorithm: 'ES384', curve: 'secp384r1' },
  6. test/validateAsymmetricKey.tests.js:76 test path { algorithm: 'ES512', curve: 'secp521r1' },
  7. test/verify.tests.js:288 test path jwt.verify(token, key, { algorithms: ['ES256'] });
  8. test/verify.tests.js:297 test path jwt.verify(token, key, { algorithms: ['ES256'], allowInvalidAsymmetricKeyTypes: true });
js.jwt.algorithm · CWE-327
RSA-PSS Quantum-vulnerable 6 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. test/async_sign.tests.js:81 test path jwt.sign({ foo: 'bar' }, secret, { algorithm: 'PS256' }, function (err) {
  2. test/rsa-public-key.tests.js:40 test path var token = jwt.sign({ foo: 'bar' }, cert_priv, { algorithm: 'PS256'});
  3. test/schema.tests.js:27 test path sign({algorithm: 'PS256'}, cert_rsa_priv);
  4. test/schema.tests.js:28 test path sign({algorithm: 'PS384'}, cert_rsa_priv);
  5. test/schema.tests.js:29 test path sign({algorithm: 'PS512'}, cert_rsa_priv);
  6. test/wrong_alg.tests.js:37 test path jwt.verify(TOKEN, pub, {algorithms: ['PS256']});
js.jwt.algorithm · CWE-327
ECDSA Quantum-vulnerable 4 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

  1. test/ecdsa-private.pem:9 test path -----BEGIN EC PRIVATE KEY-----
  2. test/prime256v1-private.pem:1 test path -----BEGIN EC PRIVATE KEY-----
  3. test/secp384r1-private.pem:1 test path -----BEGIN EC PRIVATE KEY-----
  4. test/secp521r1-private.pem:1 test path -----BEGIN EC PRIVATE KEY-----
pem.private-key · CWE-321, CWE-327
ECDSA Quantum-vulnerable 2 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

  1. test/ecdsa-public-invalid.pem:1 test path -----BEGIN PUBLIC KEY-----
  2. test/ecdsa-public.pem:1 test path -----BEGIN PUBLIC KEY-----
pem.public-key
RSA2048-bit Quantum-vulnerable 2 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

  1. test/invalid_pub.pem:1 test path -----BEGIN CERTIFICATE-----
  2. test/pub.pem:1 test path -----BEGIN CERTIFICATE-----
pem.certificate
RSA2048-bit Quantum-vulnerable Recorded traffic Renamed import 2 places See details

Classical key pair generated with Node crypto

`crypto.generateKeyPair()` or its synchronous form. The detector resolves the algorithm through a `promisify()` wrapper and through an import alias, both of which are common enough that missing them would leave real key generation unreported.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Node exposes neither yet, so this usually means an addon or a service boundary.

  1. test/jwt.hs.tests.js:12 test path const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
  2. test/jwt.malicious.tests.js:19 test path } = crypto.generateKeyPairSync('rsa', {modulusLength: 2048});
js.generatekeypair · CWE-327
RSA Quantum-vulnerable Recorded traffic 2 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

  1. test/priv.pem:1 test path -----BEGIN RSA PRIVATE KEY-----
  2. test/rsa-private.pem:1 test path -----BEGIN RSA PRIVATE KEY-----
pem.private-key · CWE-321, CWE-327
RSA-PSS2048-bit Quantum-vulnerable 2 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

  1. test/rsa-pss-invalid-salt-length-private.pem:1 test path -----BEGIN PRIVATE KEY-----
  2. test/rsa-pss-private.pem:1 test path -----BEGIN PRIVATE KEY-----
pem.private-key · CWE-321, CWE-327
DSA Quantum-vulnerable 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

  1. test/dsa-private.pem:1 test path -----BEGIN DSA PRIVATE KEY-----
pem.private-key · CWE-321, CWE-327
DSA Quantum-vulnerable 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

  1. test/dsa-public.pem:1 test path -----BEGIN PUBLIC KEY-----
pem.public-key
ECDSA Quantum-vulnerable 1 place See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

  1. test/ecdsa-public-x509.pem:1 test path -----BEGIN CERTIFICATE-----
pem.certificate
RSA Quantum-vulnerable 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

  1. test/rsa-public-key.pem:1 test path -----BEGIN RSA PUBLIC KEY-----
pem.public-key
RSA2048-bit Quantum-vulnerable 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

  1. test/rsa-public.pem:1 test path -----BEGIN PUBLIC KEY-----
pem.public-key
unknown Could not be determined 9 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

The algorithm could not be established from the source. Usually it is selected while the program runs, but it may equally be that the call gives no clue, or that it is decided somewhere this scan does not reach. Somebody has to check.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. test/async_sign.tests.js:38 test path jwt.sign({ foo: 'bar' }, 'secret', { algorithm: 'none' }, function(err, token) {
  2. test/async_sign.tests.js:48 test path jwt.sign({ foo: 'bar' }, undefined, { algorithm: 'none' }, function(err, token) {
  3. test/jwt.hs.tests.js:69 test path const header = { alg: 'none' };
  4. test/jwt.hs.tests.js:80 test path const header = { alg: 'none' };
  5. test/schema.tests.js:22 test path sign({ algorithm: 'none' }, null);
  6. test/verify.tests.js:34 test path const header = { alg: 'none' };
  7. test/verify.tests.js:50 test path const header = { alg: 'none' };
  8. test/verify.tests.js:66 test path const header = { alg: 'none' };
  9. test/verify.tests.js:76 test path jwt.verify(signed, null, {typ: 'JWT', algorithms: ['none']}, function(err, p) {
js.jwt.algorithm · CWE-327
HMAC Quantum-safe 60 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. A keyed MAC is not affected by Shor and only marginally by Grover.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. sign.js:14 const SUPPORTED_ALGS = ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512', 'HS256', 'HS384', 'HS512', 'none'];
  2. sign.js:98 alg: options.algorithm || 'HS256',
  3. test/async_sign.tests.js:13 test path jwt.sign({ foo: 'bar' }, secret, { algorithm: 'HS256' }, function (err, asyncToken) {
  4. test/async_sign.tests.js:15 test path var syncToken = jwt.sign({ foo: 'bar' }, secret, { algorithm: 'HS256' });
  5. test/claim-aud.test.js:9 test path const options = {algorithm: 'HS256'};
  6. test/claim-aud.test.js:50 test path testUtils.signJWTHelper({}, 'secret', {audience: undefined, algorithm: 'HS256'}, (err) => {
  7. test/claim-exp.test.js:11 test path const options = {algorithm: 'HS256'};
  8. test/claim-exp.test.js:50 test path testUtils.signJWTHelper({}, 'secret', {expiresIn: undefined, algorithm: 'HS256'}, (err) => {
  9. test/claim-exp.test.js:134 test path const header = { alg: 'HS256' };
  10. test/claim-iat.test.js:15 test path const opts = Object.assign({algorithm: 'HS256'}, options);
  11. test/claim-iat.test.js:51 test path testUtils.signJWTHelper({iat: undefined}, 'secret', {algorithm: 'HS256'}, (err) => {
  12. test/claim-iat.test.js:77 test path const header = { alg: 'HS256' };
  13. test/claim-iat.test.js:190 test path const token = jwt.sign({}, 'secret', {algorithm: 'HS256'});
  14. test/claim-iat.test.js:237 test path const token = jwt.sign({}, 'secret', {algorithm: 'HS256'});
  15. test/claim-iat.test.js:254 test path const options = {algorithm: 'HS256'};
  16. test/claim-iat.test.js:266 test path const options = {algorithm: 'HS256', header: {typ: 'JWT'}};
  17. test/claim-iss.test.js:9 test path const options = {algorithm: 'HS256'};
  18. test/claim-iss.test.js:47 test path testUtils.signJWTHelper({}, 'secret', {issuer: undefined, algorithm: 'HS256'}, (err) => {
  19. test/claim-jti.test.js:9 test path const options = {algorithm: 'HS256'};
  20. test/claim-jti.test.js:47 test path testUtils.signJWTHelper({}, 'secret', {jwtid: undefined, algorithm: 'HS256'}, (err) => {
  21. test/claim-nbf.test.js:11 test path const options = {algorithm: 'HS256'};
  22. test/claim-nbf.test.js:50 test path testUtils.signJWTHelper({}, 'secret', {notBefore: undefined, algorithm: 'HS256'}, (err) => {
  23. test/claim-nbf.test.js:134 test path const header = { alg: 'HS256' };
  24. test/claim-private.tests.js:8 test path testUtils.signJWTHelper(payload, 'secret', {algorithm: 'HS256'}, callback);
  25. test/claim-sub.tests.js:9 test path const options = {algorithm: 'HS256'};
  26. test/claim-sub.tests.js:47 test path testUtils.signJWTHelper({}, 'secret', {subject: undefined, algorithm: 'HS256'}, (err) => {
  27. test/header-kid.test.js:9 test path const options = {algorithm: 'HS256'};
  28. test/header-kid.test.js:47 test path testUtils.signJWTHelper({}, 'secret', {keyid: undefined, algorithm: 'HS256'}, (err) => {
  29. test/jwt.hs.tests.js:8 test path describe('HS256', function() {
  30. test/jwt.hs.tests.js:15 test path jwt.sign({ foo: 'bar' }, privateKey, { algorithm: 'HS256' })
  31. test/jwt.hs.tests.js:21 test path jwt.sign(undefined, "secret", { algorithm: 'HS256' })
  32. test/jwt.hs.tests.js:27 test path jwt.sign({ foo: 'bar' }, "secret", ['HS256'])
  33. test/jwt.hs.tests.js:35 test path var token = jwt.sign({ foo: 'bar' }, secret, { algorithm: 'HS256' });
  34. test/jwt.hs.tests.js:99 test path var token = jwt.sign({ exp: 1 }, secret, { algorithm: 'HS256' });
  35. test/jwt.hs.tests.js:100 test path jwt.verify(token, secret, { algorithm: 'HS256' }, function(err, decoded) {
  36. test/jwt.hs.tests.js:108 test path var token = jwt.sign({ exp: 1, foo: 'bar' }, secret, { algorithm: 'HS256' });
  37. test/jwt.hs.tests.js:109 test path jwt.verify(token, secret, { algorithm: 'HS256', ignoreExpiration: true }, function(err, decoded) {
  38. test/jwt.hs.tests.js:127 test path var token = jwt.sign({ foo: 'bar' }, secret, { algorithm: 'HS256' });
  39. test/jwt.hs.tests.js:131 test path jwt.verify(malformedToken, secret, { algorithm: 'HS256', ignoreExpiration: true }, function(err) {
  40. test/jwt.malicious.tests.js:15 test path const options = {algorithms: ['RS256', 'HS256']};
  41. test/option-maxAge.test.js:14 test path token = jwt.sign({iat: 70}, 'secret', {algorithm: 'HS256'});
  42. test/option-maxAge.test.js:40 test path expect(jwt.verify(token, 'secret', {maxAge: '3s', algorithm: 'HS256'})).to.not.throw;
  43. test/option-maxAge.test.js:41 test path jwt.verify(token, 'secret', {maxAge: testCase.maxAge, algorithm: 'HS256'}, (err) => {
  44. test/option-maxAge.test.js:57 test path expect(() => jwt.verify(token, 'secret', {maxAge, algorithm: 'HS256'})).to.throw(
  45. test/option-maxAge.test.js:61 test path jwt.verify(token, 'secret', {maxAge, algorithm: 'HS256'}, (err) => {
  46. test/option-nonce.test.js:12 test path token = jwt.sign({ nonce: 'abcde' }, 'secret', { algorithm: 'HS256' });
  47. test/schema.tests.js:34 test path sign({algorithm: 'HS256'}, 'superSecret');
  48. test/schema.tests.js:35 test path sign({algorithm: 'HS384'}, 'superSecret');
  49. test/schema.tests.js:36 test path sign({algorithm: 'HS512'}, 'superSecret');
  50. test/set_headers.tests.js:13 test path var token = jwt.sign({foo: 123}, '123', { header: { alg: 'HS512' } });
  51. test/set_headers.tests.js:15 test path expect(decoded.header.alg).to.equal('HS512');
  52. test/verify.tests.js:84 test path const header = { alg: 'HS256' };
  53. test/verify.tests.js:106 test path const options = {algorithms: ['HS256'], ignoreExpiration: true};
  54. test/verify.tests.js:118 test path assert.deepEqual(header, { alg: 'HS256', typ: 'JWT' });
  55. test/verify.tests.js:197 test path const options = {algorithms: ['HS256']};
  56. test/verify.tests.js:211 test path const options = {algorithms: ['HS256'], clockTolerance: 5 }
  57. test/verify.tests.js:256 test path const options = {algorithms: ['HS256'], clockTimestamp: clockTimestamp, maxAge: '1000y'};
  58. test/wrong_alg.tests.js:46 test path var token = jwt.sign({foo: 'bar'}, 'secret', {algorithm: 'HS256'});
  59. test/wrong_alg.tests.js:47 test path jwt.verify(token, 'some secret', {algorithms: ['HS384']});
  60. verify.js:14 const HS_ALGS = ['HS256', 'HS384', 'HS512'];
jose.algorithm · CWE-327
HMAC Quantum-safe 53 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

No known quantum attack changes how strong this is. A keyed MAC is not affected by Shor and only marginally by Grover.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. test/async_sign.tests.js:13 test path jwt.sign({ foo: 'bar' }, secret, { algorithm: 'HS256' }, function (err, asyncToken) {
  2. test/async_sign.tests.js:15 test path var syncToken = jwt.sign({ foo: 'bar' }, secret, { algorithm: 'HS256' });
  3. test/claim-aud.test.js:9 test path const options = {algorithm: 'HS256'};
  4. test/claim-aud.test.js:50 test path testUtils.signJWTHelper({}, 'secret', {audience: undefined, algorithm: 'HS256'}, (err) => {
  5. test/claim-exp.test.js:11 test path const options = {algorithm: 'HS256'};
  6. test/claim-exp.test.js:50 test path testUtils.signJWTHelper({}, 'secret', {expiresIn: undefined, algorithm: 'HS256'}, (err) => {
  7. test/claim-exp.test.js:134 test path const header = { alg: 'HS256' };
  8. test/claim-iat.test.js:15 test path const opts = Object.assign({algorithm: 'HS256'}, options);
  9. test/claim-iat.test.js:51 test path testUtils.signJWTHelper({iat: undefined}, 'secret', {algorithm: 'HS256'}, (err) => {
  10. test/claim-iat.test.js:77 test path const header = { alg: 'HS256' };
  11. test/claim-iat.test.js:190 test path const token = jwt.sign({}, 'secret', {algorithm: 'HS256'});
  12. test/claim-iat.test.js:237 test path const token = jwt.sign({}, 'secret', {algorithm: 'HS256'});
  13. test/claim-iat.test.js:254 test path const options = {algorithm: 'HS256'};
  14. test/claim-iat.test.js:266 test path const options = {algorithm: 'HS256', header: {typ: 'JWT'}};
  15. test/claim-iss.test.js:9 test path const options = {algorithm: 'HS256'};
  16. test/claim-iss.test.js:47 test path testUtils.signJWTHelper({}, 'secret', {issuer: undefined, algorithm: 'HS256'}, (err) => {
  17. test/claim-jti.test.js:9 test path const options = {algorithm: 'HS256'};
  18. test/claim-jti.test.js:47 test path testUtils.signJWTHelper({}, 'secret', {jwtid: undefined, algorithm: 'HS256'}, (err) => {
  19. test/claim-nbf.test.js:11 test path const options = {algorithm: 'HS256'};
  20. test/claim-nbf.test.js:50 test path testUtils.signJWTHelper({}, 'secret', {notBefore: undefined, algorithm: 'HS256'}, (err) => {
  21. test/claim-nbf.test.js:134 test path const header = { alg: 'HS256' };
  22. test/claim-private.tests.js:8 test path testUtils.signJWTHelper(payload, 'secret', {algorithm: 'HS256'}, callback);
  23. test/claim-sub.tests.js:9 test path const options = {algorithm: 'HS256'};
  24. test/claim-sub.tests.js:47 test path testUtils.signJWTHelper({}, 'secret', {subject: undefined, algorithm: 'HS256'}, (err) => {
  25. test/header-kid.test.js:9 test path const options = {algorithm: 'HS256'};
  26. test/header-kid.test.js:47 test path testUtils.signJWTHelper({}, 'secret', {keyid: undefined, algorithm: 'HS256'}, (err) => {
  27. test/jwt.hs.tests.js:15 test path jwt.sign({ foo: 'bar' }, privateKey, { algorithm: 'HS256' })
  28. test/jwt.hs.tests.js:21 test path jwt.sign(undefined, "secret", { algorithm: 'HS256' })
  29. test/jwt.hs.tests.js:35 test path var token = jwt.sign({ foo: 'bar' }, secret, { algorithm: 'HS256' });
  30. test/jwt.hs.tests.js:99 test path var token = jwt.sign({ exp: 1 }, secret, { algorithm: 'HS256' });
  31. test/jwt.hs.tests.js:100 test path jwt.verify(token, secret, { algorithm: 'HS256' }, function(err, decoded) {
  32. test/jwt.hs.tests.js:108 test path var token = jwt.sign({ exp: 1, foo: 'bar' }, secret, { algorithm: 'HS256' });
  33. test/jwt.hs.tests.js:109 test path jwt.verify(token, secret, { algorithm: 'HS256', ignoreExpiration: true }, function(err, decoded) {
  34. test/jwt.hs.tests.js:127 test path var token = jwt.sign({ foo: 'bar' }, secret, { algorithm: 'HS256' });
  35. test/jwt.hs.tests.js:131 test path jwt.verify(malformedToken, secret, { algorithm: 'HS256', ignoreExpiration: true }, function(err) {
  36. test/option-maxAge.test.js:14 test path token = jwt.sign({iat: 70}, 'secret', {algorithm: 'HS256'});
  37. test/option-maxAge.test.js:40 test path expect(jwt.verify(token, 'secret', {maxAge: '3s', algorithm: 'HS256'})).to.not.throw;
  38. test/option-maxAge.test.js:41 test path jwt.verify(token, 'secret', {maxAge: testCase.maxAge, algorithm: 'HS256'}, (err) => {
  39. test/option-maxAge.test.js:57 test path expect(() => jwt.verify(token, 'secret', {maxAge, algorithm: 'HS256'})).to.throw(
  40. test/option-maxAge.test.js:61 test path jwt.verify(token, 'secret', {maxAge, algorithm: 'HS256'}, (err) => {
  41. test/option-nonce.test.js:12 test path token = jwt.sign({ nonce: 'abcde' }, 'secret', { algorithm: 'HS256' });
  42. test/schema.tests.js:34 test path sign({algorithm: 'HS256'}, 'superSecret');
  43. test/schema.tests.js:35 test path sign({algorithm: 'HS384'}, 'superSecret');
  44. test/schema.tests.js:36 test path sign({algorithm: 'HS512'}, 'superSecret');
  45. test/set_headers.tests.js:13 test path var token = jwt.sign({foo: 123}, '123', { header: { alg: 'HS512' } });
  46. test/verify.tests.js:84 test path const header = { alg: 'HS256' };
  47. test/verify.tests.js:106 test path const options = {algorithms: ['HS256'], ignoreExpiration: true};
  48. test/verify.tests.js:118 test path assert.deepEqual(header, { alg: 'HS256', typ: 'JWT' });
  49. test/verify.tests.js:197 test path const options = {algorithms: ['HS256']};
  50. test/verify.tests.js:211 test path const options = {algorithms: ['HS256'], clockTolerance: 5 }
  51. test/verify.tests.js:256 test path const options = {algorithms: ['HS256'], clockTimestamp: clockTimestamp, maxAge: '1000y'};
  52. test/wrong_alg.tests.js:46 test path var token = jwt.sign({foo: 'bar'}, 'secret', {algorithm: 'HS256'});
  53. test/wrong_alg.tests.js:47 test path jwt.verify(token, 'some secret', {algorithms: ['HS384']});
js.jwt.algorithm · CWE-327

Cryptographic assets

Algorithm Assessment What it means Occurrences
HMAC Quantum-safe A keyed MAC is not affected by Shor and only marginally by Grover. 113
RSASSA-PKCS1v15 Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both. 34
ECDSA Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 29
RSA-PSS Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 22
unknown Could not be determined The algorithm could not be established from the source - chosen at runtime, or decided somewhere this scan does not reach. 16
RSA Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 8
RSA-1024 Already broken A modulus of 1024 bits or less is below the NIST SP 800-57 floor and is within reach of classical factorisation. Shor is not the nearest problem here. 4
DSA Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 2

Imported cryptographic libraries

Library Files
crypto the Node crypto module 7