Crypto-View

CERT-Polska/drakvuf-sandbox

Readiness score
99 of 100
How this is calculated · previous scan 100
Cryptographic posture
Quantum-vulnerable 1 Reduced margin 2 Could not be determined 1 Quantum-safe 4
To address1
Key establishment0
Inventory only0
Total findings8
What was analysed
Branch master
Commit 7c328ab48bfe07b99c896c8695b7e51edf431ceb Bump version: v0.21.0 (#1220)
Committed 2026-08-19 15:36 UTC
Scanned 2026-09-10 21:49 UTC 5 hours ago
Coverage 139 files, 89 python, 29 javascript

Earlier scans of this repository

10 scans · score 100 → 96 · compare any two
10 scans · 100 → 96 (down 4). The filled point is the scan you are reading.
Scanned Commit Score To address
4 hours ago 7c328ab48bfe master 96 2 Compare
5 hours ago this scan 7c328ab48bfe master 99 1
21 hours ago 7c328ab48bfe master 100 0 Compare
1 day ago 7c328ab48bfe master 100 0 Compare
1 day ago 7c328ab48bfe master 100 0 Compare
1 day ago 7c328ab48bfe master 100 0 Compare
1 day ago 7c328ab48bfe master 100 0 Compare
3 days ago 7c328ab48bfe master 100 0 Compare
3 days ago 7c328ab48bfe master 100 0 Compare
8 days ago 7c328ab48bfe master 100 0 Compare

Every repository in this history is re-scanned weekly.

List of cryptographic assets

SHA-256 Reduced margin 1 place See details

Hash function in use

`hashlib.sha256()` and friends. The digest is read from the call, so SHA-384 and above are inventory while the broken ones are reported separately.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something long-lived.

  1. drakrun/analyzer/analysis_metadata.py:19 sample_sha256 = hashlib.sha256()
py.hashlib
unknown Could not be determined Renamed import 1 place See details

SSH key handled by paramiko

`paramiko.RSAKey`, `ECDSAKey` or `Ed25519Key`. SSH host and user keys are long-lived, which makes them a slow and awkward thing to rotate later.

The algorithm could not be established from the source. Usually it is selected while the program runs, but it may equally be that the call gives no clue, or that it is decided somewhere this scan does not reach. Somebody has to check.

What to do. No post-quantum SSH signature is standardised yet. OpenSSH already supports the `sntrup761x25519` hybrid key exchange, which addresses the recorded-traffic half.

  1. test/vm-runner-client/vm_runner_client/client.py:132 test path vm_ssh_key = RSAKey.generate(bits=2048)
py.paramiko.key · CWE-327
CSPRNG Quantum-safe 2 places See details

Random number generation

`secrets.token_bytes()`, `os.urandom()` or `ssl.RAND_bytes()`. Recorded so the inventory names its randomness source.

This is where the software gets its random numbers. Quantum computers do not weaken it.

What to do. No action. `random.random()` is a separate, present-day defect if it reaches key material.

  1. drakrun/analyzer/postprocessing/plugins/karton_integration.py:97 token = secrets.token_urlsafe(32)
  2. drakrun/cli/install.py:86 vnc_passwd = "".join(secrets.choice(passwd_characters) for _ in range(8))
py.rng

Cryptographic assets

Algorithm Assessment What it means Occurrences
CSPRNG Quantum-safe A cryptographically secure random number generator provided by the platform. Not weakened by a quantum computer. 4
SHA-256 Reduced margin Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades. 2
Ed25519 Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 1
unknown Could not be determined The algorithm could not be established from the source - chosen at runtime, or decided somewhere this scan does not reach. 1

Imported cryptographic libraries

Library Files
paramiko an SSH client and server 1
hashlib the standard digests, including the broken ones 1
secrets the platform random source 2