Crypto-View

letsencrypt/boulder

Cryptographic posture

841 cryptographic locations: 3 already broken, 450 quantum-vulnerable, 35 reduced-margin, 222 undetermined, 131 quantum-safe

71 establish keys, so traffic protected by them and recorded today becomes readable once the algorithm falls. 2 imported cryptographic libraries are listed separately. 800 files analysed.

Quantum-vulnerable 450 Already broken 3 Reduced margin 35 Could not be determined 222 Quantum-safe 131
To address371
Key establishment71
Inventory only2
Total findings843
What was analysed
Branch main
Commit 2a9172754e0cf221421e17aa7f77aba73e4ed190 MTCProof: use 24-bit length for signatures (#9017)
Committed 2026-09-17 04:26 UTC
Scanned 2026-09-21 10:59 UTC 9 hours ago
Coverage 800 files, 504 go, 10 python, 1 javascript

List of cryptographic assets

RSA-10241024-bit Already broken Recorded traffic 3 places See details

RSA in the Go standard library

`rsa.GenerateKey()`, `rsa.SignPKCS1v15()`, `rsa.EncryptOAEP()` or an import of `crypto/rsa`.

This is already unsafe today, with no quantum computer involved. A modulus of 1024 bits or less is below the NIST SP 800-57 floor and is within reach of classical factorisation. Shor is not the nearest problem here.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Go 1.24 ships ML-KEM as `crypto/mlkem`.

  1. cmd/ceremony/key_test.go:49 test path rsaPriv, err := rsa.GenerateKey(rand.Reader, 1024)
  2. cmd/ceremony/rsa_test.go:47 test path priv, err := rsa.GenerateKey(rand.Reader, 1024)
  3. wfe2/wfe_test.go:4075 test path testKey, _ := rsa.GenerateKey(rand.Reader, 1024)
go.rsa · CWE-327
ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 108 places See details

ECDSA in the Go standard library

`ecdsa.GenerateKey()` or `ecdsa.Sign*()`. The curve is read from the `elliptic.P###()` argument.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

  1. ca/ca_test.go:948 test path testKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  2. ca/ca_test.go:959 test path testKey2, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  3. ca/testdata/testcsr.go:16 test path priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  4. cmd/admin/cert_test.go:108 test path privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  5. cmd/admin/key_test.go:35 test path ecdsaKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  6. cmd/admin/key_test.go:169 test path privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  7. cmd/ceremony/cert_test.go:49 test path key, err := ecdsa.GenerateKey(elliptic.P256(), nil)
  8. cmd/ceremony/cert_test.go:92 test path key, err := ecdsa.GenerateKey(elliptic.P256(), nil)
  9. cmd/ceremony/cert_test.go:171 test path key, err := ecdsa.GenerateKey(elliptic.P256(), nil)
  10. cmd/ceremony/cert_test.go:229 test path key, err := ecdsa.GenerateKey(elliptic.P256(), nil)
  11. cmd/ceremony/cert_test.go:302 test path key, err := ecdsa.GenerateKey(elliptic.P256(), nil)
  12. cmd/ceremony/cert_test.go:562 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  13. cmd/ceremony/crl_test.go:64 test path k, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  14. cmd/ceremony/crl_test.go:105 test path k, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  15. cmd/ceremony/ecdsa_test.go:43 test path priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  16. cmd/ceremony/key_test.go:77 test path ecPriv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  17. cmd/ceremony/main_test.go:25 test path key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  18. cmd/ceremony/main_test.go:1298 test path testKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  19. cmd/cert-checker/main_test.go:150 test path testKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  20. cmd/cert-checker/main_test.go:310 test path return ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  21. cmd/cert-checker/main_test.go:513 test path testKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  22. core/util_test.go:130 test path key1, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  23. core/util_test.go:153 test path priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  24. crl/storer/storer_test.go:272 test path fakeSigner, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  25. goodkey/good_key_test.go:263 test path k, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  26. goodkey/good_key_test.go:278 test path k, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  27. goodkey/sagoodkey/good_key_test.go:27 test path k, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  28. goodkey/sagoodkey/good_key_test.go:42 test path k, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  29. grpc/creds/creds_test.go:83 test path priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  30. issuance/cert_test.go:353 test path return ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  31. issuance/cert_test.go:413 test path pk, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  32. issuance/cert_test.go:459 test path pk, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  33. issuance/cert_test.go:503 test path pk, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  34. issuance/cert_test.go:550 test path pk, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  35. issuance/cert_test.go:596 test path pk, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  36. issuance/cert_test.go:669 test path pk, err := ecdsa.GenerateKey(elliptic.P256(), nil)
  37. issuance/cert_test.go:768 test path pk, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  38. issuance/cert_test.go:818 test path pk, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  39. issuance/cert_test.go:888 test path pk, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  40. issuance/cert_test.go:968 test path pk, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  41. issuance/cert_test.go:1019 test path pk, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  42. issuance/issuer_test.go:54 test path tk, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  43. linter/config_test.go:23 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  44. linter/linter_test.go:56 test path key, err := ecdsa.GenerateKey(elliptic.P256(), nil)
  45. linter/linter_test.go:95 test path eeKey, err := ecdsa.GenerateKey(elliptic.P256(), nil)
  46. linter/linter_test.go:118 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  47. mtca/mtca_test.go:222 test path key, err := ecdsa.GenerateKey(elliptic.P256(), nil)
  48. observer/probers/aia/aia_test.go:24 test path privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  49. pkcs11helpers/helpers_test.go:252 test path tk, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  50. precert/corr_test.go:105 test path issuerKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  51. precert/corr_test.go:112 test path untrustedIssuerKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  52. precert/corr_test.go:117 test path subscriberKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  53. privatekey/privatekey_test.go:31 test path privKey1, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  54. privatekey/privatekey_test.go:37 test path privKey2, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  55. publisher/publisher_test.go:153 test path k, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  56. publisher/publisher_test.go:278 test path k1, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  57. publisher/publisher_test.go:285 test path k2, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  58. ra/ra_test.go:2824 test path testKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  59. ra/ra_test.go:2888 test path testKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  60. ra/ra_test.go:3285 test path testKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  61. sa/model_test.go:351 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  62. sa/sa_test.go:127 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  63. sa/sa_test.go:4579 test path key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  64. test/integration/account_test.go:57 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  65. test/integration/account_test.go:93 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  66. test/integration/account_test.go:152 test path acctKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  67. test/integration/ari_test.go:23 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  68. test/integration/ari_test.go:71 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  69. test/integration/ari_test.go:97 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  70. test/integration/ari_test.go:121 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  71. test/integration/cert_storage_failed_test.go:121 test path certKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  72. test/integration/common_test.go:52 test path privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  73. test/integration/common_test.go:164 test path k, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  74. test/integration/email_exporter_test.go:157 test path acctKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  75. test/integration/errors_test.go:267 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  76. test/integration/issuance_test.go:38 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  77. test/integration/issuance_test.go:75 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  78. test/integration/issuance_test.go:109 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  79. test/integration/issuance_test.go:151 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  80. test/integration/issuance_test.go:201 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  81. test/integration/issuance_test.go:301 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  82. test/integration/issuance_test.go:388 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  83. test/integration/key_rollover_test.go:29 test path key1, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  84. test/integration/observer_test.go:78 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  85. test/integration/otel_test.go:285 test path privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  86. test/integration/revocation_test.go:276 test path certKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  87. test/integration/revocation_test.go:479 test path certKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  88. test/integration/revocation_test.go:582 test path certKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  89. test/integration/revocation_test.go:625 test path certKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  90. test/integration/revocation_test.go:666 test path certKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  91. test/integration/revocation_test.go:751 test path certKeyRed, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  92. test/integration/revocation_test.go:753 test path certKeyBlue, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  93. test/integration/subordinate_ca_chains_test.go:23 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  94. test/integration/validation_test.go:329 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  95. test/load-generator/boulder-calls.go:91 test path signKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  96. test/load-generator/state.go:284 test path certKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  97. test/sunlight/genkeys/main.go:89 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  98. trees/pubkey/pubkey_test.go:20 test path generatedPubkey, err := ecdsa.GenerateKey(elliptic.P256(), nil)
  99. trees/tiles/tiles_test.go:91 test path testPubkeyGenerated, err := ecdsa.GenerateKey(elliptic.P256(), nil)
  100. va/tlsalpn_test.go:68 test path key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  101. va/tlsalpn_test.go:335 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  102. va/tlsalpn_test.go:670 test path eeKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  103. va/tlsalpn_test.go:683 test path issuerKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  104. va/tlsalpn_test.go:743 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  105. wfe2/wfe_test.go:2409 test path newKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  106. wfe2/wfe_test.go:3418 test path k, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  107. wfe2/wfe_test.go:4236 test path testKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
  108. wfe2/wfe_test.go:4302 test path testKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
go.ecdsa · CWE-327
RSA2048-bit Quantum-vulnerable Recorded traffic 23 places See details

RSA in the Go standard library

`rsa.GenerateKey()`, `rsa.SignPKCS1v15()`, `rsa.EncryptOAEP()` or an import of `crypto/rsa`.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Go 1.24 ships ML-KEM as `crypto/mlkem`.

  1. cmd/admin/key_test.go:40 test path rsaKey, err := rsa.GenerateKey(rand.Reader, 2048)
  2. cmd/cert-checker/main_test.go:186 test path testKey, _ := rsa.GenerateKey(rand.Reader, 2048)
  3. cmd/cert-checker/main_test.go:316 test path return rsa.GenerateKey(rand.Reader, 2048)
  4. cmd/cert-checker/main_test.go:747 test path testKey, _ := rsa.GenerateKey(rand.Reader, 2048)
  5. cmd/cert-checker/main_test.go:822 test path testKey, _ := rsa.GenerateKey(rand.Reader, 2048)
  6. csr/csr_test.go:49 test path private, err := rsa.GenerateKey(rand.Reader, 2048)
  7. csr/csr_test.go:261 test path private, err := rsa.GenerateKey(rand.Reader, 2048)
  8. csr/csr_test.go:287 test path private, err := rsa.GenerateKey(rand.Reader, 2048)
  9. goodkey/good_key_test.go:126 test path private, err := rsa.GenerateKey(rand.Reader, 2048)
  10. goodkey/good_key_test.go:248 test path private, err := rsa.GenerateKey(rand.Reader, 2048)
  11. issuance/cert_test.go:346 test path return rsa.GenerateKey(rand.Reader, 2048)
  12. issuance/cert_test.go:737 test path pk, err := rsa.GenerateKey(rand.Reader, 2048)
  13. issuance/cert_test.go:919 test path pk, err := rsa.GenerateKey(rand.Reader, 2048)
  14. linter/lints/cpcps/lint_cross_certified_subordinate_ca_certificate_test.go:75 test path rsa2048Key, err := rsa.GenerateKey(rand.Reader, 2048)
  15. privatekey/privatekey_test.go:14 test path privKey1, err := rsa.GenerateKey(rand.Reader, 2048)
  16. privatekey/privatekey_test.go:20 test path privKey2, err := rsa.GenerateKey(rand.Reader, 2048)
  17. ra/ra_test.go:2354 test path testKey, err := rsa.GenerateKey(rand.Reader, 2048)
  18. ra/ra_test.go:2663 test path testKey, err := rsa.GenerateKey(rand.Reader, 2048)
  19. ra/ra_test.go:2709 test path testKey, err := rsa.GenerateKey(rand.Reader, 2048)
  20. ra/ra_test.go:2958 test path testKey, err := rsa.GenerateKey(rand.Reader, 2048)
  21. ra/ra_test.go:3100 test path testKey, err := rsa.GenerateKey(rand.Reader, 2048)
  22. test/integration/key_rollover_test.go:35 test path key2, err := rsa.GenerateKey(rand.Reader, 2048)
  23. wfe2/wfe_test.go:3126 test path existingKey, err := rsa.GenerateKey(rand.Reader, 2048)
go.rsa · CWE-327
TLS Quantum-vulnerable Recorded traffic 19 places See details

TLS configuration in code

A `tls.Config` field pinning versions, cipher suites or curve preferences. Every available suite negotiates a classical key exchange.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Every TLS cipher suite in general use negotiates a classical key exchange, so a recorded session is decryptable once that exchange falls.

What to do. Set `MinVersion: tls.VersionTLS13`. Go 1.24 enables the hybrid X25519MLKEM768 group by default, which is the single highest-value change available today.

  1. bdns/dns_test.go:270 test path tlsConfig = &tls.Config{
  2. cmd/config.go:218 return &tls.Config{
  3. grpc/client_test.go:28 test path client, err := ClientSetup(tt.cfg, &tls.Config{}, metrics.NoopRegisterer, clock.NewFake())
  4. grpc/creds/creds.go:68 conn := tls.Client(rawConn, &tls.Config{
  5. grpc/creds/creds_test.go:30 test path servTLSConfig := &tls.Config{}
  6. grpc/creds/creds_test.go:108 test path serverA.TLS = &tls.Config{Certificates: []tls.Certificate{{Certificate: [][]byte{derA}, PrivateKey: priv}}}
  7. grpc/creds/creds_test.go:110 test path serverB.TLS = &tls.Config{Certificates: []tls.Certificate{{Certificate: [][]byte{derB}, PrivateKey: priv}}}
  8. observer/obsclient/obsclient.go:27 t.TLSClientConfig = &tls.Config{InsecureSkipVerify: insecure}
  9. observer/probers/tls/tls.go:175 Config: &tls.Config{
  10. observer/probers/tls/tls.go:234 Config: &tls.Config{
  11. test/load-generator/acme/directory.go:131 test path TLSClientConfig: &tls.Config{
  12. test/load-generator/state.go:306 test path TLSClientConfig: &tls.Config{
  13. va/http.go:148 TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
  14. va/tlsalpn.go:169 dialer := &tls.Dialer{Config: &tls.Config{
  15. va/tlsalpn_test.go:89 test path tlsConfig := &tls.Config{
  16. va/tlsalpn_test.go:128 test path server.TLS = &tls.Config{
  17. va/tlsalpn_test.go:257 test path server.TLS = &tls.Config{
  18. va/tlsalpn_test.go:475 test path hs.TLS = &tls.Config{
  19. va/tlsalpn_test.go:904 test path tlsConfig := &tls.Config{
go.tls.config · CWE-757
ECDSA Quantum-vulnerable 18 places See details

ECDSA in the Go standard library

`ecdsa.GenerateKey()` or `ecdsa.Sign*()`. The curve is read from the `elliptic.P###()` argument.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

  1. cmd/ceremony/ecdsa_test.go:95 test path r, s, err := ecdsa.Sign(rand.Reader, priv, msg[:])
  2. goodkey/good_key_test.go:133 test path private, err := ecdsa.GenerateKey(curve, rand.Reader)
  3. goodkey/good_key_test.go:153 test path private, err := ecdsa.GenerateKey(curve, rand.Reader)
  4. goodkey/good_key_test.go:162 test path private, err := ecdsa.GenerateKey(curve, rand.Reader)
  5. goodkey/good_key_test.go:175 test path private, err := ecdsa.GenerateKey(curve, rand.Reader)
  6. goodkey/good_key_test.go:189 test path private, err := ecdsa.GenerateKey(curve, rand.Reader)
  7. goodkey/good_key_test.go:209 test path private, err := ecdsa.GenerateKey(curve, rand.Reader)
  8. goodkey/good_key_test.go:222 test path private, err := ecdsa.GenerateKey(curve, rand.Reader)
  9. linter/lints/cpcps/helpers_test.go:36 test path key, err := ecdsa.GenerateKey(curve, rand.Reader)
  10. linter/makesigner.go:23 lintSigner, err = ecdsa.GenerateKey(k.Curve, rand.Reader)
  11. linter/makesigner_go127.go:27 lintSigner, err = ecdsa.GenerateKey(k.Curve, rand.Reader)
  12. pkcs11helpers/helpers_test.go:255 test path r, s, err := ecdsa.Sign(rand.Reader, tk, digest[:])
  13. pkcs11helpers/helpers_test.go:287 test path verified := ecdsa.Verify(&tk.PublicKey, digest[:], rfcFormat.R, rfcFormat.S)
  14. privatekey/privatekey.go:48 r, s, err := ecdsa.Sign(rand.Reader, privKey, msgHash.Sum(nil))
  15. privatekey/privatekey.go:53 verify := ecdsa.Verify(pubKey, msgHash.Sum(nil), r, s)
  16. publisher/publisher.go:378 ecdsaSig.R, ecdsaSig.S, _ = ecdsa.Sign(rand.Reader, k, hashed[:])
  17. publisher/publisher_test.go:279 test path test.AssertNotError(t, err, "ecdsa.GenerateKey() failed for k1")
  18. publisher/publisher_test.go:286 test path test.AssertNotError(t, err, "ecdsa.GenerateKey() failed for k2")
go.ecdsa · CWE-327
RSA2048-bit Quantum-vulnerable 14 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

  1. cmd/cert-checker/testdata/quite_invalid.pem:1 test path -----BEGIN CERTIFICATE-----
  2. precert/testdata/good/final.pem:1 test path -----BEGIN CERTIFICATE-----
  3. precert/testdata/good/precert.pem:1 test path -----BEGIN CERTIFICATE-----
  4. publisher/test/testIntermediate.pem:1 test path -----BEGIN CERTIFICATE-----
  5. ra/ra_test.go:3395 test path -----BEGIN CERTIFICATE-----
  6. test/hierarchy/ee-e1.cert.pem:1 test path -----BEGIN CERTIFICATE-----
  7. test/hierarchy/ee-e2.cert.pem:1 test path -----BEGIN CERTIFICATE-----
  8. test/hierarchy/ee-r3.cert.pem:1 test path -----BEGIN CERTIFICATE-----
  9. test/hierarchy/ee-r4.cert.pem:1 test path -----BEGIN CERTIFICATE-----
  10. test/hierarchy/int-r3-cross.cert.pem:1 test path -----BEGIN CERTIFICATE-----
  11. test/hierarchy/int-r3.cert.pem:1 test path -----BEGIN CERTIFICATE-----
  12. test/hierarchy/int-r4-cross.cert.pem:1 test path -----BEGIN CERTIFICATE-----
  13. test/hierarchy/int-r4.cert.pem:1 test path -----BEGIN CERTIFICATE-----
  14. test/hierarchy/root-dst.cert.pem:1 test path -----BEGIN CERTIFICATE-----
pem.certificate
RSA Quantum-vulnerable Recorded traffic 7 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

  1. test/hierarchy/ee-e1.key.pem:1 test path -----BEGIN RSA PRIVATE KEY-----
  2. test/hierarchy/ee-e2.key.pem:1 test path -----BEGIN RSA PRIVATE KEY-----
  3. test/hierarchy/ee-r3.key.pem:1 test path -----BEGIN RSA PRIVATE KEY-----
  4. test/hierarchy/ee-r4.key.pem:1 test path -----BEGIN RSA PRIVATE KEY-----
  5. wfe2/wfe_test.go:76 test path -----BEGIN RSA PRIVATE KEY-----
  6. wfe2/wfe_test.go:112 test path -----BEGIN RSA PRIVATE KEY-----
  7. wfe2/wfe_test.go:141 test path -----BEGIN RSA PRIVATE KEY-----
pem.private-key · CWE-321, CWE-327
RSASSA-PKCS1v15 Quantum-vulnerable 7 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. wfe2/verify_test.go:261 test path Algorithm: "RS256",
  2. wfe2/verify_test.go:302 test path Algorithm: "RS256",
  3. wfe2/verify_test.go:325 test path Algorithm: "RS256",
  4. wfe2/verify_test.go:346 test path Algorithm: "RS256",
  5. wfe2/verify_test.go:352 test path Algorithm: "RS256",
  6. wfe2/verify_test.go:486 test path "alg": "RS256",
  7. wfe2/verify_test.go:862 test path "alg": "RS256",
jose.algorithm · CWE-327
RSA Quantum-vulnerable Recorded traffic 6 places See details

RSA in the Go standard library

`rsa.GenerateKey()`, `rsa.SignPKCS1v15()`, `rsa.EncryptOAEP()` or an import of `crypto/rsa`.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Go 1.24 ships ML-KEM as `crypto/mlkem`.

  1. cmd/ceremony/key_test.go:59 test path return rsa.SignPKCS1v15(rand.Reader, rsaPriv, crypto.SHA256, msg[19:])
  2. cmd/ceremony/rsa_test.go:89 test path return rsa.SignPKCS1v15(rand.Reader, priv, crypto.SHA256, msg[19:])
  3. linter/makesigner.go:18 lintSigner, err = rsa.GenerateKey(rand.Reader, k.Size()*8)
  4. linter/makesigner_go127.go:22 lintSigner, err = rsa.GenerateKey(rand.Reader, k.Size()*8)
  5. privatekey/privatekey.go:34 signatureRSA, err := rsa.SignPSS(rand.Reader, privKey, crypto.SHA256, msgHash.Sum(nil), nil)
  6. privatekey/privatekey.go:39 err = rsa.VerifyPSS(pubKey, crypto.SHA256, msgHash.Sum(nil), signatureRSA, nil)
go.rsa · CWE-327
ECDSA224-bitsecg/secp224r1 Quantum-vulnerable 5 places See details

ECDSA in the Go standard library

`ecdsa.GenerateKey()` or `ecdsa.Sign*()`. The curve is read from the `elliptic.P###()` argument.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

  1. cmd/config_test.go:70 test path rootKey, err := ecdsa.GenerateKey(elliptic.P224(), rand.Reader)
  2. cmd/config_test.go:84 test path intKey, err := ecdsa.GenerateKey(elliptic.P224(), rand.Reader)
  3. issuance/issuer_test.go:110 test path fakeKey, err := ecdsa.GenerateKey(elliptic.P224(), rand.Reader)
  4. ra/ra_test.go:3492 test path key, err := ecdsa.GenerateKey(elliptic.P224(), rand.Reader)
  5. test/certs.go:40 test path key, err := ecdsa.GenerateKey(elliptic.P224(), rand.Reader)
go.ecdsa · CWE-327
ECDSA Quantum-vulnerable 5 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. wfe2/verify_test.go:286 test path Algorithm: "ES256",
  2. wfe2/verify_test.go:293 test path Algorithm: "ES512",
  3. wfe2/verify_test.go:309 test path Algorithm: "ES512",
  4. wfe2/verify_test.go:370 test path Algorithm: "ES256",
  5. wfe2/verify_test.go:376 test path Algorithm: "ES256",
jose.algorithm · CWE-327
EC Quantum-vulnerable 4 places See details

X.509 certificate handling

`x509.CreateCertificate()` or a PKCS#1/PKCS#8/EC key parser. Certificates are the longest-lived cryptographic artefacts most systems own, and their validity periods often outrun the migration.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.

What to do. Shorten certificate lifetimes now so the eventual re-issue with a post-quantum key is routine rather than an incident.

  1. privatekey/privatekey.go:111 ecdsaSigner, err := x509.ParseECPrivateKey(keyDER.Bytes)
  2. test/ct-test-srv/main.go:221 test path key, err := x509.ParseECPrivateKey(keyDER)
  3. test/load-generator/state.go:259 test path key, err := x509.ParseECPrivateKey(a.RawKey)
  4. wfe2/wfe_test.go:344 test path if ecdsaKey, err := x509.ParseECPrivateKey(block.Bytes); err == nil {
go.x509
ECDH384-bitsecg/secp384r1 Quantum-vulnerable Recorded traffic 4 places See details

Key agreement in Go

`ecdh.P256()`, `ecdh.X25519()` or `curve25519.X25519()`. Key agreement is the highest priority: recorded traffic is decrypted retrospectively.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 (`crypto/mlkem` in Go 1.24), or a hybrid construction.

  1. linter/lints/cpcps/lint_cross_certified_subordinate_ca_certificate.go:190 _, err = ecdh.P384().NewPublicKey(key.Raw.Bytes)
  2. linter/lints/cpcps/lint_root_ca_certificate.go:170 _, err = ecdh.P384().NewPublicKey(key.Raw.Bytes)
  3. linter/lints/cpcps/lint_subscriber_server_certificate.go:269 ecdhCurve = ecdh.P384()
  4. linter/lints/cpcps/lint_tls_subordinate_ca_certificate.go:190 _, err = ecdh.P384().NewPublicKey(key.Raw.Bytes)
go.ecdh · CWE-327
ECDSA384-bitsecg/secp384r1 Quantum-vulnerable 4 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

  1. test/hierarchy/int-e1.cert.pem:1 test path -----BEGIN CERTIFICATE-----
  2. test/hierarchy/int-e2.cert.pem:1 test path -----BEGIN CERTIFICATE-----
  3. test/hierarchy/root-x2-cross.cert.pem:1 test path -----BEGIN CERTIFICATE-----
  4. test/hierarchy/root-x2.cert.pem:1 test path -----BEGIN CERTIFICATE-----
pem.certificate
RSA4096-bit Quantum-vulnerable 4 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

  1. precert/testdata/bad/final.pem:1 test path -----BEGIN CERTIFICATE-----
  2. precert/testdata/bad/precert.pem:1 test path -----BEGIN CERTIFICATE-----
  3. test/hierarchy/root-x1-cross.cert.pem:1 test path -----BEGIN CERTIFICATE-----
  4. test/hierarchy/root-x1.cert.pem:1 test path -----BEGIN CERTIFICATE-----
pem.certificate
ECDSA384-bitsecg/secp384r1 Quantum-vulnerable 2 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

  1. test/hierarchy/int-e1.key.pem:1 test path -----BEGIN PRIVATE KEY-----
  2. test/hierarchy/int-e2.key.pem:1 test path -----BEGIN PRIVATE KEY-----
pem.private-key · CWE-321, CWE-327
ECDSA Quantum-vulnerable 2 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

  1. wfe2/wfe_test.go:171 test path -----BEGIN EC PRIVATE KEY-----
  2. wfe2/wfe_test.go:179 test path -----BEGIN EC PRIVATE KEY-----
pem.private-key · CWE-321, CWE-327
Ed25519255-bitother/Ed25519 Quantum-vulnerable 2 places See details

Ed25519 in the Go standard library

`ed25519.GenerateKey()` or `ed25519.Sign()`.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204). Go 1.24 ships ML-DSA as `crypto/mldsa`.

  1. linter/linter_test.go:50 test path realSigner := ed25519.NewKeyFromSeed([]byte("0123456789abcdef0123456789abcdef"))
  2. trees/cosignature/cosignature_test.go:295 test path _, edKey, err := ed25519.GenerateKey(rand.Reader)
go.ed25519 · CWE-327
RSA Quantum-vulnerable Recorded traffic 2 places See details

Algorithm named in a setting

A setting whose name says it holds an algorithm, given a literal that names one: `withOaepPaddingDigestAlgorithm("SHA-512")`, `signatureAlgorithm = "SHA256withRSA"`, `"digestAlgorithm": "SHA-256"`. The algorithm never reaches a `getInstance()` in this file - it is carried to one somewhere else, often through configuration - so a scan that only reads the factories cannot see it at all.

Something here is configured to use a named algorithm. The code that uses it may be somewhere else entirely, but this is the line that decides which algorithm it is.

What to do. Find what consumes the setting. The migration belongs to that operation; this line is where the choice is actually written down, and usually where it is easiest to change.

  1. cmd/ceremony/cert_test.go:248 test path profile.SignatureAlgorithm = "SHA256WithRSA"
  2. cmd/ceremony/cert_test.go:308 test path SignatureAlgorithm: "SHA256WithRSA",
config.algorithm-setting · CWE-327
RSA2048-bit Quantum-vulnerable 2 places See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

  1. ra/ra_test.go:3375 test path -----BEGIN CERTIFICATE REQUEST-----
  2. test/integration/testdata/fermat_csr.pem:1 test path -----BEGIN CERTIFICATE REQUEST-----
pem.certificate-request
RSA Quantum-vulnerable Recorded traffic 2 places See details

Key generated through pyOpenSSL

`crypto.PKey()` with `TYPE_RSA` or `TYPE_EC`. pyOpenSSL is deprecated upstream in favour of pyca/cryptography.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Move to pyca/cryptography first, then to ML-KEM/ML-DSA.

  1. test/chisel2.py:111 test path key = OpenSSL.crypto.PKey()
  2. test/chisel2.py:112 test path key.generate_key(OpenSSL.crypto.TYPE_RSA, 2048)
py.pyopenssl.key · CWE-327
RSA2048-bit Quantum-vulnerable Recorded traffic 2 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

  1. test/hierarchy/int-r3.key.pem:1 test path -----BEGIN PRIVATE KEY-----
  2. test/hierarchy/int-r4.key.pem:1 test path -----BEGIN PRIVATE KEY-----
pem.private-key · CWE-321, CWE-327
ECDH256-bitsecg/secp256r1 Quantum-vulnerable Recorded traffic 1 place See details

Key agreement in Go

`ecdh.P256()`, `ecdh.X25519()` or `curve25519.X25519()`. Key agreement is the highest priority: recorded traffic is decrypted retrospectively.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 (`crypto/mlkem` in Go 1.24), or a hybrid construction.

  1. linter/lints/cpcps/lint_subscriber_server_certificate.go:266 ecdhCurve = ecdh.P256()
go.ecdh · CWE-327
ECDH521-bitsecg/secp521r1 Quantum-vulnerable Recorded traffic 1 place See details

Key agreement in Go

`ecdh.P256()`, `ecdh.X25519()` or `curve25519.X25519()`. Key agreement is the highest priority: recorded traffic is decrypted retrospectively.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 (`crypto/mlkem` in Go 1.24), or a hybrid construction.

  1. linter/lints/cpcps/lint_subscriber_server_certificate.go:272 ecdhCurve = ecdh.P521()
go.ecdh · CWE-327
ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 1 place See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

  1. cmd/admin/key_test.go:88 test path -----BEGIN CERTIFICATE REQUEST-----
pem.certificate-request
ECDSA384-bitsecg/secp384r1 Quantum-vulnerable 1 place See details

ECDSA in the Go standard library

`ecdsa.GenerateKey()` or `ecdsa.Sign*()`. The curve is read from the `elliptic.P###()` argument.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

  1. test/integration/key_rollover_test.go:42 test path key3, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
go.ecdsa · CWE-327
RSA Quantum-vulnerable Recorded traffic 1 place See details

RSA key generated with pyca/cryptography

`rsa.generate_private_key()`. The `key_size` argument is read where it is a literal and reported on the finding; it does not change the classification, because Shor is polynomial in the modulus size.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption and ML-DSA-65 for signatures.

  1. test/chisel2.py:47 test path key = josepy.JWKRSA(key=rsa.generate_private_key(65537, 2048, default_backend()))
py.cryptography.rsa · CWE-327
SHA-256 Reduced margin 3 places See details

Algorithm named in a setting

A setting whose name says it holds an algorithm, given a literal that names one: `withOaepPaddingDigestAlgorithm("SHA-512")`, `signatureAlgorithm = "SHA256withRSA"`, `"digestAlgorithm": "SHA-256"`. The algorithm never reaches a `getInstance()` in this file - it is carried to one somewhere else, often through configuration - so a scan that only reads the factories cannot see it at all.

Something here is configured to use a named algorithm. The code that uses it may be somewhere else entirely, but this is the line that decides which algorithm it is.

What to do. Find what consumes the setting. The migration belongs to that operation; this line is where the choice is actually written down, and usually where it is easiest to change.

  1. cmd/ceremony/cert_test.go:57 test path SignatureAlgorithm: "ECDSAWithSHA256",
  2. cmd/ceremony/cert_test.go:112 test path SignatureAlgorithm: "ECDSAWithSHA256",
  3. cmd/ceremony/cert_test.go:179 test path SignatureAlgorithm: "ECDSAWithSHA256",
config.algorithm-setting · CWE-327
AES Reduced margin 1 place See details

AES block cipher

`aes.NewCipher(key)`. Not broken by a quantum computer; the key length is what matters.

This is the kind of encryption that quantum computers do not break.

What to do. Use a 32-byte key. No change of algorithm is required.

  1. nonce/nonce.go:128 c, err := aes.NewCipher(key)
go.aes
unknown Could not be determined 118 places See details

X.509 certificate handling

`x509.CreateCertificate()` or a PKCS#1/PKCS#8/EC key parser. Certificates are the longest-lived cryptographic artefacts most systems own, and their validity periods often outrun the migration.

The algorithm could not be established from the source. Usually it is selected while the program runs, but it may equally be that the call gives no clue, or that it is decided somewhere this scan does not reach. Somebody has to check.

What to do. Shorten certificate lifetimes now so the eventual re-issue with a post-quantum key is routine rather than an incident.

  1. ca/ca_test.go:955 test path certDer1, err := x509.CreateCertificate(rand.Reader, template, template, &testKey.PublicKey, testKey)
  2. ca/ca_test.go:966 test path certDer2, err := x509.CreateCertificate(rand.Reader, template2, template2, &testKey2.PublicKey, testKey2)
  3. ca/testdata/testcsr.go:32 test path csr, err := x509.CreateCertificateRequest(rand.Reader, req, priv)
  4. cmd/ceremony/cert.go:353 csrDER, err := x509.CreateCertificateRequest(&failReader{}, &x509.CertificateRequest{
  5. cmd/ceremony/crl_test.go:77 test path certBytes, err := x509.CreateCertificate(rand.Reader, cert, cert, k.Public(), k)
  6. cmd/ceremony/crl_test.go:119 test path certBytes, err := x509.CreateCertificate(rand.Reader, template, template, k.Public(), k)
  7. cmd/ceremony/main.go:529 certBytes, err := x509.CreateCertificate(&failReader{}, tbs, issuer, subjectPubKey, signer)
  8. cmd/ceremony/main_test.go:1305 test path certDer, err := x509.CreateCertificate(rand.Reader, template, template, &testKey.PublicKey, testKey)
  9. cmd/cert-checker/main_test.go:139 test path issuerDer, err := x509.CreateCertificate(rand.Reader, issuerTemplate, issuerTemplate, signer.Public(), signer)
  10. cmd/cert-checker/main_test.go:161 test path certDer, _ := x509.CreateCertificate(rand.Reader, &rawCert, &rawCert, &testKey.PublicKey, testKey)
  11. cmd/cert-checker/main_test.go:229 test path wildcardCertDer, err := x509.CreateCertificate(rand.Reader, &wildcardCert, issuerCert, &testKey.PublicKey, testKey)
  12. cmd/cert-checker/main_test.go:249 test path blockedWildcardCertDer, err := x509.CreateCertificate(rand.Reader, &wildcardCert, issuerCert, &testKey.PublicKey, testKey)
  13. cmd/cert-checker/main_test.go:407 test path brokenCertDer, err := x509.CreateCertificate(rand.Reader, &rawCert, issuerCert, testKey.Public(), testKey)
  14. cmd/cert-checker/main_test.go:483 test path goodCertDer, err := x509.CreateCertificate(rand.Reader, &rawCert, issuerCert, testKey.Public(), testKey)
  15. cmd/cert-checker/main_test.go:530 test path certDER, err := x509.CreateCertificate(rand.Reader, &rawCert, &rawCert, &testKey.PublicKey, testKey)
  16. cmd/cert-checker/main_test.go:772 test path subjectCertDer, err := x509.CreateCertificate(rand.Reader, template, issuerCert, testKey.Public(), testKey)
  17. cmd/cert-checker/main_test.go:833 test path certDer, _ := x509.CreateCertificate(rand.Reader, &rawCert, &rawCert, &testKey.PublicKey, testKey)
  18. cmd/config_test.go:79 test path rootCert, err := x509.CreateCertificate(rand.Reader, rootTemplate, rootTemplate, rootKey.Public(), rootKey)
  19. cmd/config_test.go:98 test path intCert, err := x509.CreateCertificate(rand.Reader, intTemplate, rootTemplate, intKey.Public(), rootKey)
  20. core/util_test.go:165 test path certDER, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &priv.PublicKey, priv)
  21. csr/csr_test.go:51 test path signedReqBytes, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{PublicKey: private.PublicKey, SignatureAlgorithm: x509.SHA256WithRSA}, private)
  22. csr/csr_test.go:265 test path csrBytes, err := x509.CreateCertificateRequest(rand.Reader,
  23. csr/csr_test.go:290 test path csrBytes, err := x509.CreateCertificateRequest(rand.Reader,
  24. grpc/creds/creds_test.go:94 test path derA, err := x509.CreateCertificate(rand.Reader, temp, temp, priv.Public(), priv)
  25. grpc/creds/creds_test.go:99 test path derB, err := x509.CreateCertificate(rand.Reader, temp, temp, priv.Public(), priv)
  26. issuance/cert.go:421 return x509.CreateCertificate(rand.Reader, template, i.Cert.Certificate, token.pubKey.PublicKey, i.Signer)
  27. issuance/issuer_test.go:66 test path issuer, err := x509.CreateCertificate(rand.Reader, template, template, tk.Public(), tk)
  28. linter/config_test.go:33 test path der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, key.Public(), key)
  29. linter/linter.go:239 lintIssuerBytes, err := x509.CreateCertificate(rand.Reader, lintIssuerTBS, lintIssuerTBS, lintSigner.Public(), lintSigner)
  30. linter/linter.go:270 lintCertBytes, err := x509.CreateCertificate(rand.Reader, tbs, issuer, subjectPubKey, signer)
  31. linter/linter_test.go:72 test path realIssuerBytes, err := x509.CreateCertificate(rand.Reader, template, template, key.Public(), key)
  32. linter/lints/cpcps/helpers_test.go:212 test path der, err := x509.CreateCertificate(rand.Reader, tmpl, testRootTemplate(t, key.Public()), key.Public(), key)
  33. linter/lints/cpcps/helpers_test.go:273 test path intDER, err := x509.CreateCertificate(rand.Reader, intTmpl, intTmpl, intKey.Public(), intKey)
  34. linter/lints/cpcps/helpers_test.go:281 test path otherDER, err := x509.CreateCertificate(rand.Reader, otherTmpl, otherTmpl, otherKey.Public(), otherKey)
  35. linter/lints/cpcps/helpers_test.go:287 test path leafDER, err := x509.CreateCertificate(rand.Reader, testLeafTemplate(t), intTmpl, leafKey.Public(), intKey)
  36. linter/lints/cpcps/helpers_test.go:345 test path intDER, err := x509.CreateCertificate(rand.Reader, intTmpl, intTmpl, intKey.Public(), intKey)
  37. linter/lints/cpcps/helpers_test.go:351 test path leafDER, err := x509.CreateCertificate(rand.Reader, testLeafTemplate(t), intTmpl, leafKey.Public(), intKey)
  38. linter/lints/cpcps/helpers_test.go:386 test path rootDER, err := x509.CreateCertificate(rand.Reader, rootTmpl, rootTmpl, rootKey.Public(), rootKey)
  39. linter/lints/cpcps/helpers_test.go:394 test path existingDER, err := x509.CreateCertificate(rand.Reader, existingTmpl, existingTmpl, existingKey.Public(), existingKey)
  40. linter/lints/cpcps/helpers_test.go:448 test path der, err := x509.CreateCertificate(rand.Reader, tmpl, rootTmpl, existingKey.Public(), rootKey)
  41. linter/lints/cpcps/helpers_test.go:480 test path der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, key.Public(), key)
  42. linter/lints/cpcps/lint_cert_matches_exactly_one_cps_profile_test.go:18 test path rootDER, err := x509.CreateCertificate(rand.Reader, rootTmpl, rootTmpl, rootKey.Public(), rootKey)
  43. linter/lints/cpcps/lint_cert_matches_exactly_one_cps_profile_test.go:25 test path intDER, err := x509.CreateCertificate(rand.Reader, intTmpl, rootTmpl, intKey.Public(), rootKey)
  44. linter/lints/cpcps/lint_cert_matches_exactly_one_cps_profile_test.go:31 test path existingDER, err := x509.CreateCertificate(rand.Reader, testCrossCertTemplate(t, crossKey.Public()), testCrossCertTemplate(t, crossKey.Public()), crossKey.Public(), crossKey)
  45. linter/lints/cpcps/lint_cert_matches_exactly_one_cps_profile_test.go:35 test path crossDER, err := x509.CreateCertificate(rand.Reader, testCrossCertTemplate(t, crossKey.Public()), rootTmpl, crossKey.Public(), rootKey)
  46. linter/lints/cpcps/lint_cert_matches_exactly_one_cps_profile_test.go:41 test path leafDER, err := x509.CreateCertificate(rand.Reader, testLeafTemplate(t), intTmpl, leafKey.Public(), intKey)
  47. linter/lints/cpcps/lint_cert_matches_exactly_one_cps_profile_test.go:46 test path precertDER, err := x509.CreateCertificate(rand.Reader, testPrecertTemplate(t), intTmpl, leafKey.Public(), intKey)
  48. linter/lints/cpcps/lint_cert_matches_exactly_one_cps_profile_test.go:57 test path smimeDER, err := x509.CreateCertificate(rand.Reader, smimeTmpl, intTmpl, leafKey.Public(), intKey)
  49. linter/lints/cpcps/lint_cert_matches_exactly_one_cps_profile_test.go:66 test path selfSignedDER, err := x509.CreateCertificate(rand.Reader, selfSignedTmpl, selfSignedTmpl, leafKey.Public(), leafKey)
  50. linter/lints/cpcps/lint_cross_certified_subordinate_ca_certificate_test.go:60 test path _, err := x509.CreateCertificate(rand.Reader, existingIssuerTmpl, existingIssuerTmpl, existingIssuerKey.Public(), existingIssuerKey)
  51. linter/lints/cpcps/lint_cross_certified_subordinate_ca_certificate_test.go:68 test path issuerDER, err := x509.CreateCertificate(rand.Reader, issuerTmpl, issuerTmpl, issuerKey.Public(), issuerKey)
  52. linter/lints/cpcps/lint_cross_certified_subordinate_ca_certificate_test.go:363 test path existingDER, err := x509.CreateCertificate(rand.Reader, existingTmpl, existingIssuerTmpl, existingTmpl.PublicKey, existingIssuerKey)
  53. linter/lints/cpcps/lint_cross_certified_subordinate_ca_certificate_test.go:368 test path crossDER, err := x509.CreateCertificate(rand.Reader, crossTmpl, issuerTmpl, crossTmpl.PublicKey, issuerKey)
  54. linter/lints/cpcps/lint_cross_certified_subordinate_ca_certificate_test.go:404 test path der, err := x509.CreateCertificate(rand.Reader, intTmpl, rootTmpl, intKey.Public(), rootKey)
  55. linter/lints/cpcps/lint_precertificate_test.go:35 test path intDER, err := x509.CreateCertificate(rand.Reader, intTmpl, intTmpl, intKey.Public(), intKey)
  56. linter/lints/cpcps/lint_precertificate_test.go:114 test path der, err := x509.CreateCertificate(rand.Reader, tmpl, intTmpl, leafKey.Public(), intKey)
  57. linter/lints/cpcps/lint_precertificate_test.go:147 test path der, err := x509.CreateCertificate(rand.Reader, tmpl, intTmpl, leafKey.Public(), intKey)
  58. linter/lints/cpcps/lint_root_ca_certificate_test.go:179 test path der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, key.Public(), key)
  59. linter/lints/cpcps/lint_root_ca_certificate_test.go:210 test path intDER, err := x509.CreateCertificate(rand.Reader, intTmpl, rootTmpl, intKey.Public(), rootKey)
  60. linter/lints/cpcps/lint_subscriber_server_certificate_test.go:27 test path intDER, err := x509.CreateCertificate(rand.Reader, intTmpl, intTmpl, intKey.Public(), intKey)
  61. linter/lints/cpcps/lint_subscriber_server_certificate_test.go:445 test path der, err := x509.CreateCertificate(rand.Reader, tmpl, intTmpl, pub, intKey)
  62. linter/lints/cpcps/lint_subscriber_server_certificate_test.go:481 test path der, err := x509.CreateCertificate(rand.Reader, tmpl, intTmpl, leafKey.Public(), intKey)
  63. linter/lints/cpcps/lint_tls_subordinate_ca_certificate_test.go:25 test path rootDER, err := x509.CreateCertificate(rand.Reader, rootTmpl, rootTmpl, rootKey.Public(), rootKey)
  64. linter/lints/cpcps/lint_tls_subordinate_ca_certificate_test.go:339 test path der, err := x509.CreateCertificate(rand.Reader, tmpl, rootTmpl, pub, rootKey)
  65. linter/lints/cpcps/lint_tls_subordinate_ca_certificate_test.go:368 test path intDER, err := x509.CreateCertificate(rand.Reader, testIntermediateTemplate(t, intKey.Public()), rootTmpl, intKey.Public(), rootKey)
  66. linter/lints/cpcps/lint_tls_subordinate_ca_certificate_test.go:391 test path rootDER, err := x509.CreateCertificate(rand.Reader, rootTmpl, rootTmpl, rootKey.Public(), rootKey)
  67. mocks/sa.go:109 test path test5KeyPriv, err := x509.ParsePKCS1PrivateKey(test5KeyBytes)
  68. observer/probers/aia/aia_test.go:40 test path certDER, err := x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey)
  69. observer/probers/aia/aia_test.go:57 test path nonCACertDER, err := x509.CreateCertificate(rand.Reader, &nonCATemplate, &nonCATemplate, &privateKey.PublicKey, privateKey)
  70. precert/corr_test.go:144 test path precertDER, err := x509.CreateCertificate(rand.Reader, &precertTemplate, &issuer, &subscriberKey.PublicKey, issuerKey)
  71. precert/corr_test.go:168 test path finalCertDER, err := x509.CreateCertificate(rand.Reader, finalCertTemplate,
  72. precert/corr_test.go:204 test path precertDER2, err := x509.CreateCertificate(rand.Reader, &precertTemplate2, &issuer, &subscriberKey.PublicKey, issuerKey)
  73. privatekey/privatekey.go:93 signer, err := x509.ParsePKCS8PrivateKey(keyDER.Bytes)
  74. privatekey/privatekey.go:102 rsaSigner, err := x509.ParsePKCS1PrivateKey(keyDER.Bytes)
  75. publisher/publisher_test.go:176 test path rootBytes, err := x509.CreateCertificate(rand.Reader, &rootTmpl, &rootTmpl, k.Public(), k)
  76. publisher/publisher_test.go:190 test path precert, err := x509.CreateCertificate(rand.Reader, &precertTmpl, root, k.Public(), k)
  77. ra/ra_test.go:824 test path csrBytes, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{
  78. ra/ra_test.go:2357 test path policyForbidCSR, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{
  79. ra/ra_test.go:2364 test path oneDomainCSR, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{
  80. ra/ra_test.go:2371 test path twoDomainCSR, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{
  81. ra/ra_test.go:2378 test path validCSR, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{
  82. ra/ra_test.go:2394 test path certDER, err := x509.CreateCertificate(rand.Reader, expectedCert, expectedCert, testKey.Public(), testKey)
  83. ra/ra_test.go:2665 test path mixedCSR, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{
  84. ra/ra_test.go:2681 test path cert, err := x509.CreateCertificate(rand.Reader, template, template, testKey.Public(), testKey)
  85. ra/ra_test.go:2711 test path wildcardCSR, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{
  86. ra/ra_test.go:2729 test path certBytes, err := x509.CreateCertificate(rand.Reader, template, template, testKey.Public(), testKey)
  87. ra/ra_test.go:2826 test path csr, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{
  88. ra/ra_test.go:2891 test path csr, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{
  89. ra/ra_test.go:2910 test path cert, err := x509.CreateCertificate(rand.Reader, template, template, testKey.Public(), testKey)
  90. ra/ra_test.go:2960 test path csr, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{
  91. ra/ra_test.go:2980 test path cert, err := x509.CreateCertificate(rand.Reader, template, template, testKey.Public(), testKey)
  92. ra/ra_test.go:3102 test path csr, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{
  93. ra/ra_test.go:3122 test path cert, err := x509.CreateCertificate(rand.Reader, template, template, testKey.Public(), testKey)
  94. ra/ra_test.go:3287 test path csrDER, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{DNSNames: []string{"example.com"}}, testKey)
  95. ra/ra_test.go:3291 test path certDER, err := x509.CreateCertificate(rand.Reader, &x509.Certificate{
  96. ra/ra_test.go:3506 test path testCertDER, err := x509.CreateCertificate(rand.Reader, template, template, key.Public(), key)
  97. sa/model_test.go:355 test path certDer, err := x509.CreateCertificate(rand.Reader, &template, &template, key.Public(), key)
  98. test/certs.go:53 test path testCertDER, err := x509.CreateCertificate(rand.Reader, template, template, key.Public(), key)
  99. test/certs/genmtpki/genmtpki.go:89 test path certBytes, err := x509.CreateCertificate(rand.Reader, template, template, key.Public(), key)
  100. test/integration/common_test.go:194 test path csrDer, err := x509.CreateCertificateRequest(rand.Reader, tmpl, k)
  101. test/integration/issuance_test.go:399 test path csrDer, err := x509.CreateCertificateRequest(rand.Reader, csrTemplate, key)
  102. test/integration/testdata/fermat_csr.go:83 test path csrDER, err := x509.CreateCertificateRequest(
  103. test/load-generator/boulder-calls.go:497 test path csr, err := x509.CreateCertificateRequest(
  104. test/sunlight/genkeys/main.go:102 test path certBytes, err := x509.CreateCertificate(rand.Reader, template, template, key.Public(), key)
  105. va/tlsalpn_test.go:69 test path certBytes, _ := x509.CreateCertificate(rand.Reader, template, template, key.Public(), key)
  106. va/tlsalpn_test.go:337 test path certBytes, err := x509.CreateCertificate(rand.Reader, template, template, key.Public(), key)
  107. va/tlsalpn_test.go:688 test path certBytes, err := x509.CreateCertificate(rand.Reader, eeTemplate, issuerCert, eeKey.Public(), eeKey)
  108. va/tlsalpn_test.go:706 test path certBytes, err = x509.CreateCertificate(rand.Reader, eeTemplate, eeTemplate, eeKey.Public(), issuerKey)
  109. va/tlsalpn_test.go:745 test path certBytes, err := x509.CreateCertificate(rand.Reader, template, template, key.Public(), key)
  110. wfe2/wfe_test.go:328 test path if rsaKey, err := x509.ParsePKCS1PrivateKey(block.Bytes); err == nil {
  111. wfe2/wfe_test.go:333 test path if key, err := x509.ParsePKCS8PrivateKey(block.Bytes); err == nil {
  112. wfe2/wfe_test.go:2424 test path certDER, err := x509.CreateCertificate(rand.Reader, template, issuer, &newKey.PublicKey, issuerKey)
  113. wfe2/wfe_test.go:3131 test path newKeyPriv, err := x509.ParsePKCS1PrivateKey(newKeyBytes)
  114. wfe2/wfe_test.go:3219 test path newKeyPriv, err := x509.ParsePKCS1PrivateKey(newKeyBytes)
  115. wfe2/wfe_test.go:3429 test path certDER, err := x509.CreateCertificate(rand.Reader, template, template, k.Public(), k)
  116. wfe2/wfe_test.go:4081 test path mockDer, err := x509.CreateCertificate(rand.Reader, &rawCert, &rawCert, &testKey.PublicKey, testKey)
  117. wfe2/wfe_test.go:4247 test path expectDer, err := x509.CreateCertificate(rand.Reader, expectCert, expectCert, &testKey.PublicKey, testKey)
  118. wfe2/wfe_test.go:4313 test path extantDer, err := x509.CreateCertificate(rand.Reader, extantCert, extantCert, &testKey.PublicKey, testKey)
go.x509
unknown Could not be determined 2 places See details

Cryptographic library in the dependency manifest

A dependency known to implement classical asymmetric cryptography. Its presence is inventory, not a finding about this codebase: the library may never be called with a quantum-vulnerable algorithm.

The project depends on a cryptography library. Listed so the inventory is complete; it is not by itself a problem.

What to do. Check the version. Several of these libraries have shipped ML-KEM and ML-DSA support since 2024, so the migration may need an upgrade rather than a replacement.

  1. go.mod:41 golang.org/x/crypto v0.55.0
  2. test/boulder-tools/requirements.txt:2 test path cryptography >= 0.7
dep.crypto-library
CSPRNG Quantum-safe 18 places See details

Random number generation

`crypto/rand`. Recorded so the inventory names its randomness source. `math/rand` reaching key material would be a present-day defect, and is a different thing entirely.

This is where the software gets its random numbers. Quantum computers do not weaken it.

What to do. No action.

  1. ca/ca.go:484 rand.Read(serialBytes[1:])
  2. cmd/bad-key-revoker/main_test.go:32 test path _, err := rand.Read(h)
  3. cmd/ceremony/cert_test.go:26 test path _, err := rand.Read(r)
  4. linter/lints/cpcps/helpers_test.go:47 test path _, err := rand.Read(bytes)
  5. mtca/mtca_test.go:232 test path _, err = rand.Read(buf[:])
  6. nonce/nonce.go:124 if _, err := rand.Read(key); err != nil {
  7. privatekey/privatekey.go:19 _, err := rand.Read(randBytes)
  8. ra/ra_test.go:74 test path _, err := rand.Read(bytes[:])
  9. sa/saa_test.go:28 test path _, err := rand.Read(b[:])
  10. test/certs.go:26 test path _, _ = rand.Read(nameBytes[:])
  11. test/integration/common_test.go:38 test path rand.Read(bytes[:])
  12. test/integration/email_exporter_test.go:29 test path _, err := rand.Read(bytes[:])
  13. test/integration/ratelimit_test.go:42 test path rand.Read(bytes[:])
  14. test/integration/testdata/fermat_csr.go:28 test path q, err := rand.Prime(rand.Reader, (bits+1)/2)
  15. test/load-generator/boulder-calls.go:155 test path _, _ = rand.Read(bytes[:])
  16. test/salesforce-test-srv/main.go:194 test path _, err = rand.Read(tokenBytes)
  17. test/sunlight/genkeys/main.go:126 test path _, err = rand.Read(seed)
  18. trees/proof/proof_test.go:72 test path _, _ = rand.Read(hash1[:])
go.rng
ML-DSA-65 Quantum-safe Renamed import 14 places See details

Post-quantum algorithm in use

`crypto/mlkem` or `crypto/mldsa`, added in Go 1.24. Recorded so the inventory shows completed migration work.

This is already a quantum-safe algorithm.

What to do. None. Confirm the parameter set matches the required NIST category.

  1. cmd/boulder-mtpublisher/main.go:71 func loadMLDSAPublicKey(filename string) (*mldsa.PublicKey, error) {
  2. issuance/pubkeyparams_go127.go:19 case *mldsa.PublicKey:
  3. linter/makesigner_go127.go:31 case *mldsa.PublicKey:
  4. mtca/mtca.go:92 pubKey, ok := issuer.Signer.Public().(*mldsa.PublicKey)
  5. mtca/mtca_test.go:472 test path caPub, ok := m.issuer.Signer.Public().(*mldsa.PublicKey)
  6. mtpublisher/mirror.go:67 func NewMirrorClient(baseURL string, src *Source, mirrorID string, mirrorPublicKey *mldsa.PublicKey, timeout time.Duration) (*MirrorClient, error) {
  7. mtpublisher/mtpublisher.go:49 func New(dbMap *db.WrappedMap, interval time.Duration, logID issuancelog.ID, mtcaPublicKey *mldsa.PublicKey, mirror Mirror, log blog.Logger) (*mtpublisher, error) {
  8. mtpublisher/mtpublisher_test.go:73 test path func testPublisher(t *testing.T, key *mldsa.PrivateKey, checkpoints *fakeCheckpointDB) *mtpublisher {
  9. mtpublisher/mtpublishertest/mtpublishertest_test.go:22 test path func testMirror(t *testing.T) (*TestMirror, *mldsa.PrivateKey) {
  10. privatekey/verify_go127.go:35 case *mldsa.PrivateKey:
  11. test/certs/genmtpki/genmtpki.go:46 test path key, err := mldsa.GenerateKey(mldsa.MLDSA44())
  12. test/sunlight/genkeys/main.go:45 test path func cosignatureVKey(name string, publicKey *mldsa.PublicKey) string {
  13. trees/cosignature/cosignature.go:36 const timestampedSignatureSize = timestampSize + mldsa.MLDSA44SignatureSize
  14. trees/cosignature/cosignature_test.go:44 test path key, err := mldsa.NewPrivateKey(mldsa.MLDSA44(), seed)
go.pqc
HMAC Quantum-safe 5 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. A keyed MAC is not affected by Shor and only marginally by Grover.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. wfe2/verify_test.go:232 test path "alg": "HS256",
  2. wfe2/verify_test.go:270 test path Algorithm: "HS256",
  3. wfe2/verify_test.go:277 test path Algorithm: "HS256",
  4. wfe2/verify_test.go:318 test path Algorithm: "HS256",
  5. wfe2/verify_test.go:1225 test path Algorithm: "HS256",
jose.algorithm · CWE-327
HKDF Quantum-safe From a constant 1 place See details

Password hashing or key derivation

`golang.org/x/crypto/bcrypt`, `scrypt`, `argon2` or `pbkdf2`. Not a quantum exposure, and part of a complete inventory.

This is how passwords are stored. Quantum computers do not meaningfully weaken it.

What to do. Argon2id for new work.

  1. test/sunlight/genkeys/main.go:150 test path mirrorSecret, err := hkdf.Key(sha256.New, seed, []byte("sunlight ML-DSA-44 mirror key"), mirrorName, 32)
go.kdf
HMAC Quantum-safe 1 place See details

Keyed hash in use

`hmac.New()`. Not broken by Shor and only marginally affected by Grover.

This is a fingerprint proving a message was not altered. Quantum computers do not break it.

What to do. No action, unless the digest is MD5 or SHA-1.

  1. nonce/nonce.go:61 h := hmac.New(sha256.New, key)
go.hmac

Cryptographic assets

Algorithm Assessment What it means Occurrences
ECDSA Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 282
unknown Could not be determined The algorithm could not be established from the source - chosen at runtime, or decided somewhere this scan does not reach. 222
RSA Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 101
CSPRNG Quantum-safe A cryptographically secure random number generator provided by the platform. Not weakened by a quantum computer. 95
TLS Quantum-vulnerable Every TLS cipher suite in general use negotiates a classical key exchange, so a recorded session is decryptable once that exchange falls. 39
SHA-256 Reduced margin Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades. 32
ML-DSA-65 Quantum-safe No known quantum algorithm changes the security margin. 28
ECDH Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 10
HMAC Quantum-safe A keyed MAC is not affected by Shor and only marginally by Grover. 7
RSASSA-PKCS1v15 Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both. 7
Ed25519 Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 5
EC Quantum-vulnerable An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both. 4
AES Reduced margin Grover's algorithm halves the effective strength; the parameter, not the design, is the problem. The key size was not visible at this call site, so the weaker case is assumed. 3
RSA-1024 Already broken A modulus of 1024 bits or less is below the NIST SP 800-57 floor and is within reach of classical factorisation. Shor is not the nearest problem here. 3
DSA Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 2
HKDF Quantum-safe No known quantum algorithm changes the security margin. 1

Imported cryptographic libraries

Library Files
crypto/ecdsa elliptic-curve signatures 79
crypto/rsa RSA key generation, signing and OAEP encryption 35
crypto/tls the TLS client and server 20
crypto/ecdh elliptic-curve key agreement 4
crypto/ed25519 Edwards-curve signatures 3
cryptography pyca/cryptography 2
crypto/dsa DSA signatures; frozen by the Go team since 1.16 2
crypto/sha256 the SHA-2 digests 29
crypto/aes the AES block cipher 1
crypto/x509 certificate and key parsing 104
crypto/rand the platform random source 77
crypto/mldsa ML-DSA (FIPS 204), added in Go 1.24 14
crypto/hmac keyed message authentication 1