google/conscrypt

RSAES-PKCS1v15 Already broken Recorded traffic 84 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. CAPABILITIES.md:55 * `TLS_RSA_WITH_AES_128_CBC_SHA`
2. CAPABILITIES.md:56 * `TLS_RSA_WITH_AES_128_GCM_SHA256`
3. CAPABILITIES.md:57 * `TLS_RSA_WITH_AES_256_CBC_SHA`
4. CAPABILITIES.md:58 * `TLS_RSA_WITH_AES_256_GCM_SHA384`
5. common/src/main/java/org/conscrypt/NativeCrypto.java:1238 if ("TLS_RSA_WITH_3DES_EDE_CBC_SHA".equals(cipherSuite)) {
6. common/src/main/java/org/conscrypt/NativeCrypto.java:1246 return "TLS_RSA_WITH_3DES_EDE_CBC_SHA";
7. common/src/main/java/org/conscrypt/NativeCrypto.java:1334 "TLS_RSA_WITH_AES_128_GCM_SHA256",
8. common/src/main/java/org/conscrypt/NativeCrypto.java:1335 "TLS_RSA_WITH_AES_256_GCM_SHA384",
9. common/src/main/java/org/conscrypt/NativeCrypto.java:1336 "TLS_RSA_WITH_AES_128_CBC_SHA",
10. common/src/main/java/org/conscrypt/NativeCrypto.java:1337 "TLS_RSA_WITH_AES_256_CBC_SHA",
11. common/src/main/java/org/conscrypt/NativeCrypto.java:1350 "TLS_RSA_WITH_AES_128_GCM_SHA256",
12. common/src/main/java/org/conscrypt/NativeCrypto.java:1351 "TLS_RSA_WITH_AES_256_GCM_SHA384",
13. common/src/main/java/org/conscrypt/NativeCrypto.java:1352 "TLS_RSA_WITH_AES_128_CBC_SHA",
14. common/src/main/java/org/conscrypt/NativeCrypto.java:1353 "TLS_RSA_WITH_AES_256_CBC_SHA",
15. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:35 TLS_RSA_WITH_AES_256_CBC_SHA(0x0035),
16. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:38 TLS_RSA_WITH_AES_128_CBC_SHA(0x002F),
17. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:39 TLS_RSA_WITH_3DES_EDE_CBC_SHA(0x000A),
18. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:42 TLS_RSA_WITH_AES_128_GCM_SHA256(0x009C),
19. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:43 TLS_RSA_WITH_AES_256_GCM_SHA384(0x009D),
20. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:75 return TLS_RSA_WITH_3DES_EDE_CBC_SHA;
21. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:257 test path addOpenSsl("TLS_RSA_WITH_AES_256_CBC_SHA");
22. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:260 test path addOpenSsl("TLS_RSA_WITH_AES_128_CBC_SHA");
23. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:263 test path addOpenSsl("TLS_RSA_WITH_AES_128_GCM_SHA256");
24. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:264 test path addOpenSsl("TLS_RSA_WITH_AES_256_GCM_SHA384");
25. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:318 test path "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_CBC_SHA",
26. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:319 test path "TLS_RSA_WITH_AES_256_CBC_SHA", CIPHER_SUITE_SECURE_RENEGOTIATION);
27. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:331 test path "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_CBC_SHA",
28. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:332 test path "TLS_RSA_WITH_AES_256_CBC_SHA", CIPHER_SUITE_SECURE_RENEGOTIATION);
29. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:27 test path new CipherSuite(0x0001, "TLS_RSA_WITH_NULL_MD5", "SSL_RSA_WITH_NULL_MD5"),
30. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:28 test path new CipherSuite(0x0002, "TLS_RSA_WITH_NULL_SHA", "SSL_RSA_WITH_NULL_SHA"),
31. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:29 test path new CipherSuite(0x0003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5",
32. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:31 test path new CipherSuite(0x0004, "TLS_RSA_WITH_RC4_128_MD5", "SSL_RSA_WITH_RC4_128_MD5"),
33. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:32 test path new CipherSuite(0x0005, "TLS_RSA_WITH_RC4_128_SHA", "SSL_RSA_WITH_RC4_128_SHA"),
34. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:33 test path new CipherSuite(0x0006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5"),
35. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:34 test path new CipherSuite(0x0007, "TLS_RSA_WITH_IDEA_CBC_SHA"),
36. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:35 test path new CipherSuite(0x0008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA",
37. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:37 test path new CipherSuite(0x0009, "TLS_RSA_WITH_DES_CBC_SHA", "SSL_RSA_WITH_DES_CBC_SHA"),
38. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:38 test path new CipherSuite(0x000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
39. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:80 test path new CipherSuite(0x002e, "TLS_RSA_PSK_WITH_NULL_SHA"),
40. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:81 test path new CipherSuite(0x002f, "TLS_RSA_WITH_AES_128_CBC_SHA"),
41. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:87 test path new CipherSuite(0x0035, "TLS_RSA_WITH_AES_256_CBC_SHA"),
42. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:93 test path new CipherSuite(0x003b, "TLS_RSA_WITH_NULL_SHA256"),
43. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:94 test path new CipherSuite(0x003c, "TLS_RSA_WITH_AES_128_CBC_SHA256"),
44. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:95 test path new CipherSuite(0x003d, "TLS_RSA_WITH_AES_256_CBC_SHA256"),
45. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:99 test path new CipherSuite(0x0041, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA"),
46. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:105 test path new CipherSuite(0x0060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5"),
47. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:106 test path new CipherSuite(0x0061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5"),
48. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:107 test path new CipherSuite(0x0062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA"),
49. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:109 test path new CipherSuite(0x0064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA"),
50. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:119 test path new CipherSuite(0x0084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA"),
51. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:133 test path new CipherSuite(0x0092, "TLS_RSA_PSK_WITH_RC4_128_SHA"),
52. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:134 test path new CipherSuite(0x0093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA"),
53. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:135 test path new CipherSuite(0x0094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA"),
54. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:136 test path new CipherSuite(0x0095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA"),
55. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:137 test path new CipherSuite(0x0096, "TLS_RSA_WITH_SEED_CBC_SHA"),
56. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:143 test path new CipherSuite(0x009c, "TLS_RSA_WITH_AES_128_GCM_SHA256"),
57. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:144 test path new CipherSuite(0x009d, "TLS_RSA_WITH_AES_256_GCM_SHA384"),
58. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:159 test path new CipherSuite(0x00ac, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256"),
59. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:160 test path new CipherSuite(0x00ad, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384"),
60. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:169 test path new CipherSuite(0x00b6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256"),
61. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:170 test path new CipherSuite(0x00b7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384"),
62. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:171 test path new CipherSuite(0x00b8, "TLS_RSA_PSK_WITH_NULL_SHA256"),
63. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:172 test path new CipherSuite(0x00b9, "TLS_RSA_PSK_WITH_NULL_SHA384"),
64. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:173 test path new CipherSuite(0x00ba, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256"),
65. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:179 test path new CipherSuite(0x00c0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256"),
66. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:251 test path new CipherSuite(0xc03c, "TLS_RSA_WITH_ARIA_128_CBC_SHA256"),
67. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:252 test path new CipherSuite(0xc03d, "TLS_RSA_WITH_ARIA_256_CBC_SHA384"),
68. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:271 test path new CipherSuite(0xc050, "TLS_RSA_WITH_ARIA_128_GCM_SHA256"),
69. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:272 test path new CipherSuite(0xc051, "TLS_RSA_WITH_ARIA_256_GCM_SHA384"),
70. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:295 test path new CipherSuite(0xc068, "TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256"),
71. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:296 test path new CipherSuite(0xc069, "TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384"),
72. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:301 test path new CipherSuite(0xc06e, "TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256"),
73. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:302 test path new CipherSuite(0xc06f, "TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384"),
74. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:313 test path new CipherSuite(0xc07a, "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256"),
75. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:314 test path new CipherSuite(0xc07b, "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384"),
76. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:337 test path new CipherSuite(0xc092, "TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256"),
77. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:338 test path new CipherSuite(0xc093, "TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384"),
78. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:343 test path new CipherSuite(0xc098, "TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256"),
79. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:344 test path new CipherSuite(0xc099, "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384"),
80. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:347 test path new CipherSuite(0xc09c, "TLS_RSA_WITH_AES_128_CCM"),
81. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:348 test path new CipherSuite(0xc09d, "TLS_RSA_WITH_AES_256_CCM"),
82. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:351 test path new CipherSuite(0xc0a0, "TLS_RSA_WITH_AES_128_CCM_8"),
83. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:352 test path new CipherSuite(0xc0a1, "TLS_RSA_WITH_AES_256_CCM_8"),
84. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:376 test path new CipherSuite(0xccae, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256"),

config.cipher-suite · CWE-757

SHA-1 Already broken Renamed import 25 places See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

This is already unsafe today, with no quantum computer involved. SHAttered and subsequent work produced practical collisions; NIST withdrew SHA-1 in 2030 guidance and it is already unacceptable for signatures.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:704 test path assertNotNull(Signature.getInstance("SHA1withRSA"));
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:710 test path assertNotNull(Signature.getInstance("SHA1withDSA"));
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:741 test path Signature sig = Signature.getInstance("SHA1withRSA");
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:791 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:806 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:820 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
7. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1011 test path Signature sig = Signature.getInstance("SHA1withRSA");
8. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1031 test path Signature sig = Signature.getInstance("SHA1withRSA");
9. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1049 test path Signature sig = Signature.getInstance("SHA1withRSA");
10. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1076 test path Signature sig = Signature.getInstance("SHA1withRSA");
11. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1108 test path Signature sig = Signature.getInstance("SHA1withRSA");
12. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1132 test path Signature sig = Signature.getInstance("SHA1withRSA");
13. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1154 test path Signature sig = Signature.getInstance("SHA1withRSA");
14. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1215 test path Signature sig = Signature.getInstance("SHA1withRSA");
15. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1296 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
16. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1320 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
17. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1348 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
18. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1361 test path sig = Signature.getInstance("SHA1withRSA/PSS");
19. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1872 test path MessageDigest sha1 = MessageDigest.getInstance("SHA1");
20. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1898 test path MessageDigest sha1 = MessageDigest.getInstance("SHA1");
21. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2043 test path Signature sig = Signature.getInstance("SHA1withDSA");
22. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2063 test path Signature sig = Signature.getInstance("SHA1withDSA");
23. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2179 test path Signature ecdsaVerify = Signature.getInstance("SHA1withECDSA");
24. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2185 test path ecdsaVerify = Signature.getInstance("SHA1withECDSA");
25. common/src/test/java/org/conscrypt/java/security/cert/CertificateFactoryTest.java:877 test path sha1digest = MessageDigest.getInstance("SHA-1");

java.messagedigest · CWE-328

3DES Already broken 16 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. common/src/main/java/org/conscrypt/NativeCrypto.java:1238 if ("TLS_RSA_WITH_3DES_EDE_CBC_SHA".equals(cipherSuite)) {
2. common/src/main/java/org/conscrypt/NativeCrypto.java:1246 return "TLS_RSA_WITH_3DES_EDE_CBC_SHA";
3. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:39 TLS_RSA_WITH_3DES_EDE_CBC_SHA(0x000A),
4. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:75 return TLS_RSA_WITH_3DES_EDE_CBC_SHA;
5. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:38 test path new CipherSuite(0x000a, "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
6. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:42 test path new CipherSuite(0x000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA"),
7. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:45 test path new CipherSuite(0x0010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA"),
8. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:49 test path new CipherSuite(0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
9. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:54 test path new CipherSuite(0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
10. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:130 test path new CipherSuite(0x008f, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA"),
11. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:134 test path new CipherSuite(0x0093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA"),
12. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:194 test path new CipherSuite(0xc003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA"),
13. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:199 test path new CipherSuite(0xc008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA"),
14. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:204 test path new CipherSuite(0xc00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA"),
15. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:209 test path new CipherSuite(0xc012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"),
16. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:243 test path new CipherSuite(0xc034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA"),

config.cipher-suite · CWE-757

NULL Already broken 16 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:27 test path new CipherSuite(0x0001, "TLS_RSA_WITH_NULL_MD5", "SSL_RSA_WITH_NULL_MD5"),
2. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:28 test path new CipherSuite(0x0002, "TLS_RSA_WITH_NULL_SHA", "SSL_RSA_WITH_NULL_SHA"),
3. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:79 test path new CipherSuite(0x002d, "TLS_DHE_PSK_WITH_NULL_SHA"),
4. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:80 test path new CipherSuite(0x002e, "TLS_RSA_PSK_WITH_NULL_SHA"),
5. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:93 test path new CipherSuite(0x003b, "TLS_RSA_WITH_NULL_SHA256"),
6. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:167 test path new CipherSuite(0x00b4, "TLS_DHE_PSK_WITH_NULL_SHA256"),
7. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:168 test path new CipherSuite(0x00b5, "TLS_DHE_PSK_WITH_NULL_SHA384"),
8. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:171 test path new CipherSuite(0x00b8, "TLS_RSA_PSK_WITH_NULL_SHA256"),
9. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:172 test path new CipherSuite(0x00b9, "TLS_RSA_PSK_WITH_NULL_SHA384"),
10. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:192 test path new CipherSuite(0xc001, "TLS_ECDH_ECDSA_WITH_NULL_SHA"),
11. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:197 test path new CipherSuite(0xc006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA"),
12. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:202 test path new CipherSuite(0xc00b, "TLS_ECDH_RSA_WITH_NULL_SHA"),
13. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:207 test path new CipherSuite(0xc010, "TLS_ECDHE_RSA_WITH_NULL_SHA"),
14. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:248 test path new CipherSuite(0xc039, "TLS_ECDHE_PSK_WITH_NULL_SHA"),
15. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:249 test path new CipherSuite(0xc03a, "TLS_ECDHE_PSK_WITH_NULL_SHA256"),
16. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:250 test path new CipherSuite(0xc03b, "TLS_ECDHE_PSK_WITH_NULL_SHA384"),

config.cipher-suite · CWE-757

RC4 Already broken 13 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:29 test path new CipherSuite(0x0003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5",
2. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:31 test path new CipherSuite(0x0004, "TLS_RSA_WITH_RC4_128_MD5", "SSL_RSA_WITH_RC4_128_MD5"),
3. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:32 test path new CipherSuite(0x0005, "TLS_RSA_WITH_RC4_128_SHA", "SSL_RSA_WITH_RC4_128_SHA"),
4. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:105 test path new CipherSuite(0x0060, "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5"),
5. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:109 test path new CipherSuite(0x0064, "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA"),
6. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:111 test path new CipherSuite(0x0066, "TLS_DHE_DSS_WITH_RC4_128_SHA"),
7. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:129 test path new CipherSuite(0x008e, "TLS_DHE_PSK_WITH_RC4_128_SHA"),
8. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:133 test path new CipherSuite(0x0092, "TLS_RSA_PSK_WITH_RC4_128_SHA"),
9. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:193 test path new CipherSuite(0xc002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA"),
10. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:198 test path new CipherSuite(0xc007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"),
11. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:203 test path new CipherSuite(0xc00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA"),
12. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:208 test path new CipherSuite(0xc011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA"),
13. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:242 test path new CipherSuite(0xc033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA"),

config.cipher-suite · CWE-757

3DES Already broken 10 places See details

Cipher transformation named away from the call

A JCA transformation string - `algorithm/mode/padding` - written somewhere other than a `getInstance()` argument, which is how a codebase that centralises its cryptography passes the choice to a helper. The string is unambiguous wherever it appears: nothing but a transformation is spelled that way.

This names an encryption method as text, and passes it to code elsewhere that does the work. It is the same choice, made in a different place.

What to do. The same migration applies as to the call that consumes it. Move the constant and the call together, so the inventory keeps naming the algorithm after the change.

1. common/src/main/java/org/conscrypt/OpenSSLProvider.java:671 putSymmetricCipherImplClass("DESEDE/CBC/NoPadding", "OpenSSLEvpCipherDESEDE$CBC$NoPadding");
2. common/src/main/java/org/conscrypt/OpenSSLProvider.java:672 putSymmetricCipherImplClass("DESEDE/CBC/PKCS5Padding",
3. common/src/main/java/org/conscrypt/OpenSSLProvider.java:674 put("Alg.Alias.Cipher.DESEDE/CBC/PKCS7Padding", "DESEDE/CBC/PKCS5Padding");
4. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:64 test path BASIC_CIPHER_TO_TEST_DATA.put("DESEDE/ECB/NoPadding", "crypto/desede-ecb.csv");
5. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:65 test path BASIC_CIPHER_TO_TEST_DATA.put("DESEDE/CBC/NoPadding", "crypto/desede-cbc.csv");
6. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:66 test path BASIC_CIPHER_TO_TEST_DATA.put("DESEDE/CFB8/NoPadding", "crypto/desede-cfb8.csv");
7. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:67 test path BASIC_CIPHER_TO_TEST_DATA.put("DESEDE/CFB64/NoPadding", "crypto/desede-cfb64.csv");
8. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:68 test path BASIC_CIPHER_TO_TEST_DATA.put("DESEDE/OFB/NoPadding", "crypto/desede-ofb.csv");
9. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3700 test path "DESede/CBC/PKCS5Padding", new IvParameterSpec(DES_IV1), DES_112_KEY, null,
10. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3710 test path "DESede/CBC/PKCS5Padding", new IvParameterSpec(DES_IV1), DES_168_KEY, null,

java.transformation · CWE-327

RSAES-PKCS1v15 Already broken Recorded traffic 10 places See details

Cipher transformation named away from the call

A JCA transformation string - `algorithm/mode/padding` - written somewhere other than a `getInstance()` argument, which is how a codebase that centralises its cryptography passes the choice to a helper. The string is unambiguous wherever it appears: nothing but a transformation is spelled that way.

This names an encryption method as text, and passes it to code elsewhere that does the work. It is the same choice, made in a different place.

What to do. The same migration applies as to the call that consumes it. Move the constant and the call together, so the inventory keeps naming the algorithm after the change.

1. common/src/main/java/org/conscrypt/OpenSSLProvider.java:589 putRSACipherImplClass("RSA/ECB/PKCS1Padding", "OpenSSLCipherRSA$PKCS1");
2. common/src/main/java/org/conscrypt/OpenSSLProvider.java:590 put("Alg.Alias.Cipher.RSA/None/PKCS1Padding", "RSA/ECB/PKCS1Padding");
3. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:462 test path setExpectedBlockSize("RSA/ECB/PKCS1Padding", "SunJCE", 0);
4. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:472 test path setExpectedBlockSize("RSA/ECB/PKCS1Padding", Cipher.ENCRYPT_MODE, 245);
5. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:480 test path setExpectedBlockSize("RSA/ECB/PKCS1Padding", Cipher.DECRYPT_MODE, 256);
6. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:753 test path setExpectedOutputSize("RSA/ECB/PKCS1Padding", Cipher.ENCRYPT_MODE, 256);
7. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:757 test path setExpectedOutputSize("RSA/ECB/PKCS1Padding", Cipher.DECRYPT_MODE, 245);
8. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:761 test path setExpectedOutputSize("RSA/ECB/PKCS1Padding", Cipher.DECRYPT_MODE, "SunJCE", 256);
9. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1159 test path algorithm = "RSA/ECB/PKCS1Padding";
10. testing/src/main/java/org/conscrypt/testing/OpaqueProvider.java:159 test path super("RSA/ECB/PKCS1Padding");

java.transformation · CWE-327

SHA-1 Already broken Renamed import 10 places See details

Mask-generation digest named for RSA padding

`MGF1ParameterSpec.SHA256` names the digest inside RSA-OAEP and RSA-PSS padding. It is a separate choice from the digest the signature or the cipher uses, it is frequently left at SHA-1 by default, and a static import of it - `import static java.security.spec.MGF1ParameterSpec.SHA512` - is the only place the choice appears in the file that makes it.

This picks the hash used inside RSA padding. It matters because the default is often SHA-1, which is broken today without any quantum computer.

What to do. The mask-generation digest travels with the RSA key it pads. When that key moves to ML-KEM or ML-DSA the padding goes with it; until then, SHA-256 or better.

1. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:135 test path new OAEPParameterSpec("SHA-1", "MGF1", MGF1ParameterSpec.SHA1,
2. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:149 test path new OAEPParameterSpec("SHA-1", "MGF1", MGF1ParameterSpec.SHA1,
3. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:191 test path assertEquals(MGF1ParameterSpec.SHA1.getDigestAlgorithm(),
4. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:203 test path assertEquals(MGF1ParameterSpec.SHA1.getDigestAlgorithm(),
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:462 test path new PSSParameterSpec("SHA-1", "MGF1", MGF1ParameterSpec.SHA1, 20, 1);
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:479 test path new PSSParameterSpec("SHA-1", "MGF1", MGF1ParameterSpec.SHA1, 0, 1);
7. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:496 test path new PSSParameterSpec("SHA-1", "MGF1", MGF1ParameterSpec.SHA1, 234, 1);
8. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3778 test path addRsaOaepTest("SHA-1", MGF1ParameterSpec.SHA1, RSA_Vector2_OAEP_SHA1_MGF1_SHA1);
9. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3779 test path addRsaOaepTest("SHA-256", MGF1ParameterSpec.SHA1, RSA_Vector2_OAEP_SHA256_MGF1_SHA1);
10. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3784 test path addRsaOaepTest("SHA-256", MGF1ParameterSpec.SHA1, RSA_Vector2_OAEP_SHA256_MGF1_SHA1_LABEL,

java.mgf1 · CWE-327

DES Already broken 7 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:35 test path new CipherSuite(0x0008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA",
2. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:37 test path new CipherSuite(0x0009, "TLS_RSA_WITH_DES_CBC_SHA", "SSL_RSA_WITH_DES_CBC_SHA"),
3. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:41 test path new CipherSuite(0x000c, "TLS_DH_DSS_WITH_DES_CBC_SHA"),
4. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:44 test path new CipherSuite(0x000f, "TLS_DH_RSA_WITH_DES_CBC_SHA"),
5. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:48 test path new CipherSuite(0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA", "SSL_DHE_DSS_WITH_DES_CBC_SHA"),
6. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:53 test path new CipherSuite(0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA", "SSL_DHE_RSA_WITH_DES_CBC_SHA"),
7. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:107 test path new CipherSuite(0x0062, "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA"),

config.cipher-suite · CWE-757

RSA-10241024-bit Already broken 4 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. openjdk/src/test/resources/ca-cert.pem:44 test path -----BEGIN CERTIFICATE-----
2. openjdk/src/test/resources/cert-ct-embedded.pem:46 test path -----BEGIN CERTIFICATE-----
3. openjdk/src/test/resources/cert-ct-poisoned.pem:46 test path -----BEGIN CERTIFICATE-----
4. openjdk/src/test/resources/cert.pem:44 test path -----BEGIN CERTIFICATE-----

pem.certificate

3DES Already broken 3 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. common/src/main/java/org/conscrypt/DESEDESecretKeyFactory.java:54 return new SecretKeySpec(desKeySpec.getKey(), "DESEDE");
2. common/src/main/java/org/conscrypt/DESEDESecretKeyFactory.java:80 return new SecretKeySpec(secretKey.getEncoded(), "DESEDE");
3. common/src/main/java/org/conscrypt/DESEDESecretKeyFactory.java:84 return new DESedeKeySpec(secretKey.getEncoded());

java.keyspec · CWE-327

MD5 Already broken Renamed import 3 places See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

This is already unsafe today, with no quantum computer involved. Practical chosen-prefix collisions exist; MD5 has no remaining security as a digest.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:709 test path assertNotNull(Signature.getInstance("MD5withRSA"));
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:781 test path Signature sig = Signature.getInstance("MD5withRSA");
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1285 test path Signature sig = Signature.getInstance("MD5withRSA");

java.messagedigest · CWE-328

DES Already broken 2 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. common/src/test/java/org/conscrypt/OpenSslCompositeMlDsaKeyFactoryTest.java:265 test path new DESKeySpec(TestUtils.decodeBase64(tv.getString("pkx509")));
2. common/src/test/java/org/conscrypt/OpenSslCompositeMlDsaKeyFactoryTest.java:330 test path new DESKeySpec(TestUtils.decodeBase64(tv.getString("skpkcs8")));

java.keyspec · CWE-327

RC4 Already broken 2 places See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

This is already unsafe today, with no quantum computer involved. RC4 keystream biases break it classically; it is prohibited in TLS by RFC 7465.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4640 test path KeyGenerator kg = KeyGenerator.getInstance("ARC4");
2. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4664 test path Cipher c = Cipher.getInstance("ARC4", p);

java.cipher · CWE-327

RSAES-PKCS1v15 Already broken Recorded traffic 2 places See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

This is already unsafe today, with no quantum computer involved. PKCS#1 v1.5 encryption padding is vulnerable to Bleichenbacher oracles today, and the underlying RSA is broken by Shor.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1625 test path Cipher decryptCipher = Cipher.getInstance("RSA/ECB/PKCS1Padding", provider);
2. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1651 test path Cipher encryptCipher = Cipher.getInstance("RSA/ECB/PKCS1Padding", provider);

java.cipher · CWE-327

RSA-10241024-bit Already broken Recorded traffic 1 place See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

This is already unsafe today, with no quantum computer involved. A modulus of 1024 bits or less is below the NIST SP 800-57 floor and is within reach of classical factorisation. Shor is not the nearest problem here.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4803 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");

java.keypairgenerator · CWE-327

RSA-10241024-bit Already broken Recorded traffic 1 place See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

This is already unsafe today, with no quantum computer involved. A modulus of 1024 bits or less is below the NIST SP 800-57 floor and is within reach of classical factorisation. Shor is not the nearest problem here.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4805 test path Cipher cipher = Cipher.getInstance("RSA/NONE/OAEPPadding");

java.cipher · CWE-327

SHA-1 Already broken 1 place See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

This is already unsafe today, with no quantum computer involved. SHAttered and subsequent work produced practical collisions; NIST withdrew SHA-1 in 2030 guidance and it is already unacceptable for signatures.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4866 test path SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WITHHMACSHA1");

java.cipher · CWE-327

SHA-1 Already broken 1 place See details

Broken hash function

`hashlib.md5()` or `hashlib.sha1()`. Both have practical collisions. Where the call is annotated `usedforsecurity=False` the finding is recorded as inventory instead.

This is already unsafe today, with no quantum computer involved. SHAttered and subsequent work produced practical collisions; NIST withdrew SHA-1 in 2030 guidance and it is already unacceptable for signatures.

What to do. SHA-256, or SHA-384 for long-lived signatures.

1. scripts/export_to_ag.py:1191 change_id = "I" + hashlib.sha1(seed.encode("utf-8")).hexdigest()

py.hashlib.weak · CWE-328

ECDH Quantum-vulnerable Recorded traffic Renamed import 175 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. CAPABILITIES.md:45 * `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA`
2. CAPABILITIES.md:46 * `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`
3. CAPABILITIES.md:47 * `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA`
4. CAPABILITIES.md:48 * `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`
5. CAPABILITIES.md:49 * `TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256`
6. CAPABILITIES.md:50 * `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`
7. CAPABILITIES.md:51 * `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`
8. CAPABILITIES.md:52 * `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`
9. CAPABILITIES.md:53 * `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`
10. CAPABILITIES.md:54 * `TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256`
11. CAPABILITIES.md:75 * `TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA`
12. CAPABILITIES.md:76 * `TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA`
13. CAPABILITIES.md:77 * `TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256`
14. common/src/main/java/org/conscrypt/NativeCrypto.java:1324 "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
15. common/src/main/java/org/conscrypt/NativeCrypto.java:1325 "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
16. common/src/main/java/org/conscrypt/NativeCrypto.java:1326 "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
17. common/src/main/java/org/conscrypt/NativeCrypto.java:1327 "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
18. common/src/main/java/org/conscrypt/NativeCrypto.java:1328 "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
19. common/src/main/java/org/conscrypt/NativeCrypto.java:1329 "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
20. common/src/main/java/org/conscrypt/NativeCrypto.java:1330 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
21. common/src/main/java/org/conscrypt/NativeCrypto.java:1331 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
22. common/src/main/java/org/conscrypt/NativeCrypto.java:1332 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
23. common/src/main/java/org/conscrypt/NativeCrypto.java:1333 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
24. common/src/main/java/org/conscrypt/NativeCrypto.java:1340 "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
25. common/src/main/java/org/conscrypt/NativeCrypto.java:1341 "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
26. common/src/main/java/org/conscrypt/NativeCrypto.java:1342 "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
27. common/src/main/java/org/conscrypt/NativeCrypto.java:1343 "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
28. common/src/main/java/org/conscrypt/NativeCrypto.java:1344 "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
29. common/src/main/java/org/conscrypt/NativeCrypto.java:1345 "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
30. common/src/main/java/org/conscrypt/NativeCrypto.java:1346 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
31. common/src/main/java/org/conscrypt/NativeCrypto.java:1347 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
32. common/src/main/java/org/conscrypt/NativeCrypto.java:1348 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
33. common/src/main/java/org/conscrypt/NativeCrypto.java:1349 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
34. common/src/main/java/org/conscrypt/NativeCrypto.java:1358 "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256",
35. common/src/main/java/org/conscrypt/NativeCrypto.java:1359 "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA",
36. common/src/main/java/org/conscrypt/NativeCrypto.java:1360 "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA",
37. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:33 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA(0xC00A),
38. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:34 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA(0xC014),
39. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:36 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA(0xC009),
40. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:37 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA(0xC013),
41. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:44 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256(0xC02F),
42. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:45 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384(0xC030),
43. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:46 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256(0xC02B),
44. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:47 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384(0xC02C),
45. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:48 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256(0xCCA9),
46. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:49 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256(0xCCA8),
47. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:54 TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA(0xC035),
48. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:55 TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA(0xC036),
49. common/src/main/java/org/conscrypt/metrics/CipherSuite.java:56 TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256(0xCCAC),
50. common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketTest.java:895 test path new String[] {"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"},
51. common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketTest.java:903 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"},
52. openjdk/src/test/java/org/conscrypt/MockSessionBuilder.java:28 test path static final String DEFAULT_CIPHER_SUITE = "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256";
53. openjdk/src/test/java/org/conscrypt/NativeCryptoTest.java:1363 test path cipherSuites.add("ECDHE-RSA-AES128-SHA");
54. openjdk/src/test/java/org/conscrypt/NativeCryptoTest.java:2950 test path cHooks.enabledCipherSuites = Collections.singletonList("ECDHE-RSA-AES128-GCM-SHA256");
55. openjdk/src/test/java/org/conscrypt/NativeCryptoTest.java:2952 test path Collections.singletonList("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256");
56. openjdk/src/test/java/org/conscrypt/NativeCryptoTest.java:2959 test path assertEquals("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", cHooks.negotiatedCipherSuite);
57. openjdk/src/test/java/org/conscrypt/NativeCryptoTest.java:2960 test path assertEquals("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", sHooks.negotiatedCipherSuite);
58. testing/src/main/java/org/conscrypt/TestUtils.java:94 test path static final String TEST_CIPHER = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256";
59. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:255 test path addOpenSsl("TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA");
60. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:256 test path addOpenSsl("TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA");
61. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:258 test path addOpenSsl("TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA");
62. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:259 test path addOpenSsl("TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA");
63. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:265 test path addOpenSsl("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256");
64. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:266 test path addOpenSsl("TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384");
65. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:267 test path addOpenSsl("TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256");
66. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:268 test path addOpenSsl("TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384");
67. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:269 test path addOpenSsl("TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256");
68. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:270 test path addOpenSsl("TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256");
69. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:275 test path addOpenSsl("TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA");
70. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:276 test path addOpenSsl("TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA");
71. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:277 test path addOpenSsl("TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256");
72. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:312 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
73. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:313 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
74. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:314 test path "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
75. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:315 test path "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
76. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:316 test path "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
77. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:317 test path "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256",
78. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:325 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
79. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:326 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
80. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:327 test path "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
81. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:328 test path "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
82. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:329 test path "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
83. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:330 test path "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256",
84. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:343 test path "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA",
85. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:344 test path "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA", "TLS_PSK_WITH_AES_128_CBC_SHA",
86. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:192 test path new CipherSuite(0xc001, "TLS_ECDH_ECDSA_WITH_NULL_SHA"),
87. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:193 test path new CipherSuite(0xc002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA"),
88. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:194 test path new CipherSuite(0xc003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA"),
89. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:195 test path new CipherSuite(0xc004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA"),
90. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:196 test path new CipherSuite(0xc005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA"),
91. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:197 test path new CipherSuite(0xc006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA"),
92. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:198 test path new CipherSuite(0xc007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"),
93. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:199 test path new CipherSuite(0xc008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA"),
94. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:200 test path new CipherSuite(0xc009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA"),
95. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:201 test path new CipherSuite(0xc00a, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"),
96. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:202 test path new CipherSuite(0xc00b, "TLS_ECDH_RSA_WITH_NULL_SHA"),
97. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:203 test path new CipherSuite(0xc00c, "TLS_ECDH_RSA_WITH_RC4_128_SHA"),
98. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:204 test path new CipherSuite(0xc00d, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA"),
99. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:205 test path new CipherSuite(0xc00e, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA"),
100. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:206 test path new CipherSuite(0xc00f, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA"),
101. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:207 test path new CipherSuite(0xc010, "TLS_ECDHE_RSA_WITH_NULL_SHA"),
102. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:208 test path new CipherSuite(0xc011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA"),
103. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:209 test path new CipherSuite(0xc012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"),
104. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:210 test path new CipherSuite(0xc013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"),
105. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:211 test path new CipherSuite(0xc014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"),
106. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:226 test path new CipherSuite(0xc023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"),
107. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:227 test path new CipherSuite(0xc024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384"),
108. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:228 test path new CipherSuite(0xc025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256"),
109. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:229 test path new CipherSuite(0xc026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384"),
110. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:230 test path new CipherSuite(0xc027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"),
111. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:231 test path new CipherSuite(0xc028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"),
112. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:232 test path new CipherSuite(0xc029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256"),
113. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:233 test path new CipherSuite(0xc02a, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384"),
114. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:234 test path new CipherSuite(0xc02b, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"),
115. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:235 test path new CipherSuite(0xc02c, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"),
116. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:236 test path new CipherSuite(0xc02d, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256"),
117. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:237 test path new CipherSuite(0xc02e, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384"),
118. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:238 test path new CipherSuite(0xc02f, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"),
119. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:239 test path new CipherSuite(0xc030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"),
120. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:240 test path new CipherSuite(0xc031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256"),
121. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:241 test path new CipherSuite(0xc032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384"),
122. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:242 test path new CipherSuite(0xc033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA"),
123. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:243 test path new CipherSuite(0xc034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA"),
124. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:244 test path new CipherSuite(0xc035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA"),
125. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:245 test path new CipherSuite(0xc036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA"),
126. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:246 test path new CipherSuite(0xc037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256"),
127. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:247 test path new CipherSuite(0xc038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384"),
128. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:248 test path new CipherSuite(0xc039, "TLS_ECDHE_PSK_WITH_NULL_SHA"),
129. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:249 test path new CipherSuite(0xc03a, "TLS_ECDHE_PSK_WITH_NULL_SHA256"),
130. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:250 test path new CipherSuite(0xc03b, "TLS_ECDHE_PSK_WITH_NULL_SHA384"),
131. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:263 test path new CipherSuite(0xc048, "TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256"),
132. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:264 test path new CipherSuite(0xc049, "TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384"),
133. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:265 test path new CipherSuite(0xc04a, "TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256"),
134. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:266 test path new CipherSuite(0xc04b, "TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384"),
135. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:267 test path new CipherSuite(0xc04c, "TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256"),
136. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:268 test path new CipherSuite(0xc04d, "TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384"),
137. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:269 test path new CipherSuite(0xc04e, "TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256"),
138. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:270 test path new CipherSuite(0xc04f, "TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384"),
139. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:283 test path new CipherSuite(0xc05c, "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256"),
140. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:284 test path new CipherSuite(0xc05d, "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384"),
141. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:285 test path new CipherSuite(0xc05e, "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256"),
142. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:286 test path new CipherSuite(0xc05f, "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384"),
143. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:287 test path new CipherSuite(0xc060, "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256"),
144. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:288 test path new CipherSuite(0xc061, "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384"),
145. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:289 test path new CipherSuite(0xc062, "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256"),
146. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:290 test path new CipherSuite(0xc063, "TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384"),
147. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:303 test path new CipherSuite(0xc070, "TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256"),
148. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:304 test path new CipherSuite(0xc071, "TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384"),
149. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:305 test path new CipherSuite(0xc072, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256"),
150. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:306 test path new CipherSuite(0xc073, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384"),
151. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:307 test path new CipherSuite(0xc074, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256"),
152. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:308 test path new CipherSuite(0xc075, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384"),
153. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:309 test path new CipherSuite(0xc076, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256"),
154. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:310 test path new CipherSuite(0xc077, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384"),
155. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:311 test path new CipherSuite(0xc078, "TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256"),
156. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:312 test path new CipherSuite(0xc079, "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384"),
157. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:325 test path new CipherSuite(0xc086, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256"),
158. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:326 test path new CipherSuite(0xc087, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384"),
159. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:327 test path new CipherSuite(0xc088, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256"),
160. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:328 test path new CipherSuite(0xc089, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384"),
161. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:329 test path new CipherSuite(0xc08a, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256"),
162. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:330 test path new CipherSuite(0xc08b, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384"),
163. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:331 test path new CipherSuite(0xc08c, "TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256"),
164. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:332 test path new CipherSuite(0xc08d, "TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384"),
165. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:345 test path new CipherSuite(0xc09a, "TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256"),
166. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:346 test path new CipherSuite(0xc09b, "TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384"),
167. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:363 test path new CipherSuite(0xc0ac, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM"),
168. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:364 test path new CipherSuite(0xc0ad, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM"),
169. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:365 test path new CipherSuite(0xc0ae, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8"),
170. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:366 test path new CipherSuite(0xc0af, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8"),
171. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:367 test path new CipherSuite(0xcc13, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_OLD"),
172. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:368 test path new CipherSuite(0xcc14, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_OLD"),
173. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:370 test path new CipherSuite(0xcca8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"),
174. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:371 test path new CipherSuite(0xcca9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"),
175. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:374 test path new CipherSuite(0xccac, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256"),

config.cipher-suite · CWE-757

DH Quantum-vulnerable Recorded traffic 105 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:41 test path new CipherSuite(0x000c, "TLS_DH_DSS_WITH_DES_CBC_SHA"),
2. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:42 test path new CipherSuite(0x000d, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA"),
3. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:44 test path new CipherSuite(0x000f, "TLS_DH_RSA_WITH_DES_CBC_SHA"),
4. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:45 test path new CipherSuite(0x0010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA"),
5. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:48 test path new CipherSuite(0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA", "SSL_DHE_DSS_WITH_DES_CBC_SHA"),
6. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:49 test path new CipherSuite(0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
7. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:53 test path new CipherSuite(0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA", "SSL_DHE_RSA_WITH_DES_CBC_SHA"),
8. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:54 test path new CipherSuite(0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
9. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:79 test path new CipherSuite(0x002d, "TLS_DHE_PSK_WITH_NULL_SHA"),
10. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:82 test path new CipherSuite(0x0030, "TLS_DH_DSS_WITH_AES_128_CBC_SHA"),
11. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:83 test path new CipherSuite(0x0031, "TLS_DH_RSA_WITH_AES_128_CBC_SHA"),
12. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:84 test path new CipherSuite(0x0032, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA"),
13. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:85 test path new CipherSuite(0x0033, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA"),
14. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:88 test path new CipherSuite(0x0036, "TLS_DH_DSS_WITH_AES_256_CBC_SHA"),
15. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:89 test path new CipherSuite(0x0037, "TLS_DH_RSA_WITH_AES_256_CBC_SHA"),
16. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:90 test path new CipherSuite(0x0038, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA"),
17. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:91 test path new CipherSuite(0x0039, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA"),
18. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:96 test path new CipherSuite(0x003e, "TLS_DH_DSS_WITH_AES_128_CBC_SHA256"),
19. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:97 test path new CipherSuite(0x003f, "TLS_DH_RSA_WITH_AES_128_CBC_SHA256"),
20. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:98 test path new CipherSuite(0x0040, "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256"),
21. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:100 test path new CipherSuite(0x0042, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA"),
22. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:101 test path new CipherSuite(0x0043, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA"),
23. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:102 test path new CipherSuite(0x0044, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA"),
24. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:103 test path new CipherSuite(0x0045, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA"),
25. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:111 test path new CipherSuite(0x0066, "TLS_DHE_DSS_WITH_RC4_128_SHA"),
26. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:112 test path new CipherSuite(0x0067, "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256"),
27. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:113 test path new CipherSuite(0x0068, "TLS_DH_DSS_WITH_AES_256_CBC_SHA256"),
28. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:114 test path new CipherSuite(0x0069, "TLS_DH_RSA_WITH_AES_256_CBC_SHA256"),
29. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:115 test path new CipherSuite(0x006a, "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256"),
30. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:116 test path new CipherSuite(0x006b, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256"),
31. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:120 test path new CipherSuite(0x0085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA"),
32. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:121 test path new CipherSuite(0x0086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA"),
33. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:122 test path new CipherSuite(0x0087, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA"),
34. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:123 test path new CipherSuite(0x0088, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA"),
35. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:129 test path new CipherSuite(0x008e, "TLS_DHE_PSK_WITH_RC4_128_SHA"),
36. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:130 test path new CipherSuite(0x008f, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA"),
37. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:131 test path new CipherSuite(0x0090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA"),
38. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:132 test path new CipherSuite(0x0091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA"),
39. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:138 test path new CipherSuite(0x0097, "TLS_DH_DSS_WITH_SEED_CBC_SHA"),
40. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:139 test path new CipherSuite(0x0098, "TLS_DH_RSA_WITH_SEED_CBC_SHA"),
41. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:140 test path new CipherSuite(0x0099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA"),
42. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:141 test path new CipherSuite(0x009a, "TLS_DHE_RSA_WITH_SEED_CBC_SHA"),
43. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:145 test path new CipherSuite(0x009e, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"),
44. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:146 test path new CipherSuite(0x009f, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"),
45. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:147 test path new CipherSuite(0x00a0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256"),
46. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:148 test path new CipherSuite(0x00a1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384"),
47. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:149 test path new CipherSuite(0x00a2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256"),
48. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:150 test path new CipherSuite(0x00a3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384"),
49. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:151 test path new CipherSuite(0x00a4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256"),
50. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:152 test path new CipherSuite(0x00a5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384"),
51. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:157 test path new CipherSuite(0x00aa, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256"),
52. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:158 test path new CipherSuite(0x00ab, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384"),
53. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:165 test path new CipherSuite(0x00b2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256"),
54. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:166 test path new CipherSuite(0x00b3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384"),
55. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:167 test path new CipherSuite(0x00b4, "TLS_DHE_PSK_WITH_NULL_SHA256"),
56. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:168 test path new CipherSuite(0x00b5, "TLS_DHE_PSK_WITH_NULL_SHA384"),
57. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:174 test path new CipherSuite(0x00bb, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256"),
58. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:175 test path new CipherSuite(0x00bc, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256"),
59. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:176 test path new CipherSuite(0x00bd, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256"),
60. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:177 test path new CipherSuite(0x00be, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256"),
61. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:180 test path new CipherSuite(0x00c1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256"),
62. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:181 test path new CipherSuite(0x00c2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256"),
63. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:182 test path new CipherSuite(0x00c3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256"),
64. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:183 test path new CipherSuite(0x00c4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256"),
65. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:253 test path new CipherSuite(0xc03e, "TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256"),
66. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:254 test path new CipherSuite(0xc03f, "TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384"),
67. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:255 test path new CipherSuite(0xc040, "TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256"),
68. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:256 test path new CipherSuite(0xc041, "TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384"),
69. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:257 test path new CipherSuite(0xc042, "TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256"),
70. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:258 test path new CipherSuite(0xc043, "TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384"),
71. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:259 test path new CipherSuite(0xc044, "TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256"),
72. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:260 test path new CipherSuite(0xc045, "TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384"),
73. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:273 test path new CipherSuite(0xc052, "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256"),
74. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:274 test path new CipherSuite(0xc053, "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384"),
75. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:275 test path new CipherSuite(0xc054, "TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256"),
76. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:276 test path new CipherSuite(0xc055, "TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384"),
77. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:277 test path new CipherSuite(0xc056, "TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256"),
78. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:278 test path new CipherSuite(0xc057, "TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384"),
79. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:279 test path new CipherSuite(0xc058, "TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256"),
80. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:280 test path new CipherSuite(0xc059, "TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384"),
81. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:293 test path new CipherSuite(0xc066, "TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256"),
82. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:294 test path new CipherSuite(0xc067, "TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384"),
83. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:299 test path new CipherSuite(0xc06c, "TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256"),
84. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:300 test path new CipherSuite(0xc06d, "TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384"),
85. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:315 test path new CipherSuite(0xc07c, "TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256"),
86. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:316 test path new CipherSuite(0xc07d, "TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384"),
87. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:317 test path new CipherSuite(0xc07e, "TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256"),
88. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:318 test path new CipherSuite(0xc07f, "TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384"),
89. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:319 test path new CipherSuite(0xc080, "TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256"),
90. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:320 test path new CipherSuite(0xc081, "TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384"),
91. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:321 test path new CipherSuite(0xc082, "TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256"),
92. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:322 test path new CipherSuite(0xc083, "TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384"),
93. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:335 test path new CipherSuite(0xc090, "TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256"),
94. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:336 test path new CipherSuite(0xc091, "TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384"),
95. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:341 test path new CipherSuite(0xc096, "TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256"),
96. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:342 test path new CipherSuite(0xc097, "TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384"),
97. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:349 test path new CipherSuite(0xc09e, "TLS_DHE_RSA_WITH_AES_128_CCM"),
98. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:350 test path new CipherSuite(0xc09f, "TLS_DHE_RSA_WITH_AES_256_CCM"),
99. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:353 test path new CipherSuite(0xc0a2, "TLS_DHE_RSA_WITH_AES_128_CCM_8"),
100. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:354 test path new CipherSuite(0xc0a3, "TLS_DHE_RSA_WITH_AES_256_CCM_8"),
101. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:357 test path new CipherSuite(0xc0a6, "TLS_DHE_PSK_WITH_AES_128_CCM"),
102. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:358 test path new CipherSuite(0xc0a7, "TLS_DHE_PSK_WITH_AES_256_CCM"),
103. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:369 test path new CipherSuite(0xcc15, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_OLD"),
104. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:372 test path new CipherSuite(0xccaa, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256"),
105. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:375 test path new CipherSuite(0xccad, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256"),

config.cipher-suite · CWE-757

RSA Quantum-vulnerable Renamed import 71 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:95 test path Signature signature = Signature.getInstance("SHA256withRSA", conscryptProvider);
2. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:110 test path Signature signature = Signature.getInstance("SHA256withRSA/PSS", conscryptProvider);
3. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:125 test path Signature signature = Signature.getInstance("NONEwithRSA", conscryptProvider);
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:290 test path Signature sig = Signature.getInstance("SHA256withRSA");
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:704 test path assertNotNull(Signature.getInstance("SHA1withRSA"));
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:705 test path assertNotNull(Signature.getInstance("SHA256withRSA"));
7. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:706 test path assertNotNull(Signature.getInstance("SHA384withRSA"));
8. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:707 test path assertNotNull(Signature.getInstance("SHA512withRSA"));
9. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:708 test path assertNotNull(Signature.getInstance("NONEwithRSA"));
10. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:709 test path assertNotNull(Signature.getInstance("MD5withRSA"));
11. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:741 test path Signature sig = Signature.getInstance("SHA1withRSA");
12. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:751 test path Signature sig = Signature.getInstance("SHA256withRSA");
13. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:761 test path Signature sig = Signature.getInstance("SHA384withRSA");
14. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:771 test path Signature sig = Signature.getInstance("SHA512withRSA");
15. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:781 test path Signature sig = Signature.getInstance("MD5withRSA");
16. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:791 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
17. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:806 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
18. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:820 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
19. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:834 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
20. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:849 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
21. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:863 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
22. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:877 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
23. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:892 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
24. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:906 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
25. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:920 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
26. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:935 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
27. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:949 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
28. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:963 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
29. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:978 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
30. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:992 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
31. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1011 test path Signature sig = Signature.getInstance("SHA1withRSA");
32. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1031 test path Signature sig = Signature.getInstance("SHA1withRSA");
33. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1049 test path Signature sig = Signature.getInstance("SHA1withRSA");
34. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1076 test path Signature sig = Signature.getInstance("SHA1withRSA");
35. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1108 test path Signature sig = Signature.getInstance("SHA1withRSA");
36. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1132 test path Signature sig = Signature.getInstance("SHA1withRSA");
37. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1154 test path Signature sig = Signature.getInstance("SHA1withRSA");
38. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1215 test path Signature sig = Signature.getInstance("SHA1withRSA");
39. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1229 test path Signature sig = Signature.getInstance("SHA224withRSA");
40. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1243 test path Signature sig = Signature.getInstance("SHA256withRSA");
41. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1257 test path Signature sig = Signature.getInstance("SHA384withRSA");
42. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1271 test path Signature sig = Signature.getInstance("SHA512withRSA");
43. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1285 test path Signature sig = Signature.getInstance("MD5withRSA");
44. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1296 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
45. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1320 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
46. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1348 test path Signature sig = Signature.getInstance("SHA1withRSA/PSS");
47. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1361 test path sig = Signature.getInstance("SHA1withRSA/PSS");
48. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1375 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
49. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1399 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
50. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1427 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
51. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1440 test path sig = Signature.getInstance("SHA224withRSA/PSS");
52. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1454 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
53. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1478 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
54. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1506 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
55. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1519 test path sig = Signature.getInstance("SHA256withRSA/PSS");
56. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1533 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
57. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1557 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
58. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1585 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
59. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1598 test path sig = Signature.getInstance("SHA384withRSA/PSS");
60. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1612 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
61. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1636 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
62. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1664 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
63. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1677 test path sig = Signature.getInstance("SHA512withRSA/PSS");
64. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1691 test path Signature sig = Signature.getInstance("NONEwithRSA");
65. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1716 test path Signature sig = Signature.getInstance("NONEwithRSA");
66. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1730 test path Signature sig = Signature.getInstance("NONEwithRSA");
67. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1752 test path Signature sig = Signature.getInstance("NONEwithRSA");
68. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1776 test path Signature sig = Signature.getInstance("NONEwithRSA");
69. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1799 test path Signature sig = Signature.getInstance("NONEwithRSA");
70. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1820 test path Signature sig = Signature.getInstance("NONEwithRSA");
71. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1836 test path Signature sig = Signature.getInstance("NONEwithRSA");

java.signature · CWE-327

RSA Quantum-vulnerable Recorded traffic 66 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:91 test path KeyFactory keyFactory = KeyFactory.getInstance("RSA", conscryptProvider);
2. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:106 test path KeyFactory keyFactory = KeyFactory.getInstance("RSA", conscryptProvider);
3. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:121 test path KeyFactory keyFactory = KeyFactory.getInstance("RSA", conscryptProvider);
4. common/src/test/java/org/conscrypt/java/security/KeyFactoryTestRSA.java:83 test path KeyFactory.getInstance("RSA").generatePublic(new X509EncodedKeySpec(longBuffer));
5. common/src/test/java/org/conscrypt/java/security/KeyFactoryTestRSA.java:89 test path final KeyFactory factory = KeyFactory.getInstance("RSA", p);
6. common/src/test/java/org/conscrypt/java/security/KeyFactoryTestRSA.java:144 test path PrivateKey privateKey = KeyFactory.getInstance("RSA").generatePrivate(spec);
7. common/src/test/java/org/conscrypt/java/security/KeyFactoryTestRSACrt.java:69 test path KeyFactory.getInstance("RSA").generatePrivate(new PKCS8EncodedKeySpec(longBuffer));
8. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:287 test path KeyFactory keyFactory = KeyFactory.getInstance("RSA");
9. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:737 test path KeyFactory kf = KeyFactory.getInstance("RSA");
10. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:747 test path KeyFactory kf = KeyFactory.getInstance("RSA");
11. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:757 test path KeyFactory kf = KeyFactory.getInstance("RSA");
12. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:767 test path KeyFactory kf = KeyFactory.getInstance("RSA");
13. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:777 test path KeyFactory kf = KeyFactory.getInstance("RSA");
14. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:787 test path KeyFactory kf = KeyFactory.getInstance("RSA");
15. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:802 test path KeyFactory kf = KeyFactory.getInstance("RSA");
16. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:816 test path KeyFactory kf = KeyFactory.getInstance("RSA");
17. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:830 test path KeyFactory kf = KeyFactory.getInstance("RSA");
18. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:845 test path KeyFactory kf = KeyFactory.getInstance("RSA");
19. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:859 test path KeyFactory kf = KeyFactory.getInstance("RSA");
20. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:873 test path KeyFactory kf = KeyFactory.getInstance("RSA");
21. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:888 test path KeyFactory kf = KeyFactory.getInstance("RSA");
22. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:902 test path KeyFactory kf = KeyFactory.getInstance("RSA");
23. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:916 test path KeyFactory kf = KeyFactory.getInstance("RSA");
24. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:931 test path KeyFactory kf = KeyFactory.getInstance("RSA");
25. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:945 test path KeyFactory kf = KeyFactory.getInstance("RSA");
26. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:959 test path KeyFactory kf = KeyFactory.getInstance("RSA");
27. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:974 test path KeyFactory kf = KeyFactory.getInstance("RSA");
28. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:988 test path KeyFactory kf = KeyFactory.getInstance("RSA");
29. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1002 test path KeyFactory kf = KeyFactory.getInstance("RSA");
30. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1027 test path KeyFactory kf = KeyFactory.getInstance("RSA");
31. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1045 test path KeyFactory kf = KeyFactory.getInstance("RSA");
32. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1058 test path KeyFactory kf = KeyFactory.getInstance("RSA");
33. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1095 test path KeyFactory kf = KeyFactory.getInstance("RSA");
34. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1119 test path KeyFactory kf = KeyFactory.getInstance("RSA");
35. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1143 test path KeyFactory kf = KeyFactory.getInstance("RSA");
36. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1207 test path KeyFactory kf = KeyFactory.getInstance("RSA");
37. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1221 test path KeyFactory kf = KeyFactory.getInstance("RSA");
38. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1235 test path KeyFactory kf = KeyFactory.getInstance("RSA");
39. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1249 test path KeyFactory kf = KeyFactory.getInstance("RSA");
40. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1263 test path KeyFactory kf = KeyFactory.getInstance("RSA");
41. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1277 test path KeyFactory kf = KeyFactory.getInstance("RSA");
42. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1291 test path KeyFactory kf = KeyFactory.getInstance("RSA");
43. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1315 test path KeyFactory kf = KeyFactory.getInstance("RSA");
44. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1343 test path KeyFactory kf = KeyFactory.getInstance("RSA");
45. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1370 test path KeyFactory kf = KeyFactory.getInstance("RSA");
46. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1394 test path KeyFactory kf = KeyFactory.getInstance("RSA");
47. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1422 test path KeyFactory kf = KeyFactory.getInstance("RSA");
48. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1449 test path KeyFactory kf = KeyFactory.getInstance("RSA");
49. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1473 test path KeyFactory kf = KeyFactory.getInstance("RSA");
50. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1501 test path KeyFactory kf = KeyFactory.getInstance("RSA");
51. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1528 test path KeyFactory kf = KeyFactory.getInstance("RSA");
52. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1552 test path KeyFactory kf = KeyFactory.getInstance("RSA");
53. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1580 test path KeyFactory kf = KeyFactory.getInstance("RSA");
54. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1607 test path KeyFactory kf = KeyFactory.getInstance("RSA");
55. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1631 test path KeyFactory kf = KeyFactory.getInstance("RSA");
56. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1659 test path KeyFactory kf = KeyFactory.getInstance("RSA");
57. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1686 test path KeyFactory kf = KeyFactory.getInstance("RSA");
58. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1710 test path KeyFactory kf = KeyFactory.getInstance("RSA");
59. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1725 test path KeyFactory kf = KeyFactory.getInstance("RSA");
60. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1747 test path KeyFactory kf = KeyFactory.getInstance("RSA");
61. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1770 test path KeyFactory kf = KeyFactory.getInstance("RSA");
62. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1793 test path KeyFactory kf = KeyFactory.getInstance("RSA");
63. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1814 test path KeyFactory kf = KeyFactory.getInstance("RSA");
64. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1830 test path KeyFactory kf = KeyFactory.getInstance("RSA");
65. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:332 test path KeyFactory kf = KeyFactory.getInstance("RSA");
66. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:367 test path KeyFactory kf = KeyFactory.getInstance("RSA");

java.keyfactory · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable Renamed import 54 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. common/src/main/java/org/conscrypt/ActiveSession.java:361 "RSASSA-PSS", "Ed25519", "SHA512withRSA", "SHA512withECDSA",
2. common/src/main/java/org/conscrypt/CompositeMlDsaAlgorithm.java:42 "Ed25519", null, null, null, null),
3. common/src/main/java/org/conscrypt/CompositeMlDsaAlgorithm.java:91 "Ed25519", null, null, null, null),
4. common/src/main/java/org/conscrypt/OidData.java:60 OID_TO_NAME_MAP.put("1.3.101.112", "Ed25519");
5. common/src/main/java/org/conscrypt/OpenSSLProvider.java:243 put("Alg.Alias.KeyPairGenerator.1.3.101.112", "EdDSA");
6. common/src/main/java/org/conscrypt/OpenSSLProvider.java:244 put("Alg.Alias.KeyPairGenerator.Ed25519", "EdDSA");
7. common/src/main/java/org/conscrypt/OpenSSLProvider.java:327 put("Alg.Alias.KeyFactory.1.3.101.112", "EdDSA");
8. common/src/main/java/org/conscrypt/OpenSSLProvider.java:328 put("Alg.Alias.KeyFactory.Ed25519", "EdDSA");
9. common/src/main/java/org/conscrypt/OpenSSLProvider.java:512 putSignatureImplClass("EdDSA", "OpenSslSignatureEdDsa");
10. common/src/main/java/org/conscrypt/OpenSSLProvider.java:513 put("Alg.Alias.Signature.1.3.101.112", "EdDSA");
11. common/src/main/java/org/conscrypt/OpenSSLProvider.java:514 put("Alg.Alias.Signature.Ed25519", "EdDSA");
12. common/src/main/java/org/conscrypt/OpenSslCompositeMlDsaKeyPairGenerator.java:171 if (fullAlgorithm.getClassicAlgorithm().equals("Ed25519")) {
13. common/src/main/java/org/conscrypt/OpenSslCompositeMlDsaKeyPairGenerator.java:192 if (fullAlgorithm.getClassicAlgorithm().equals("Ed25519")) {
14. common/src/main/java/org/conscrypt/OpenSslCompositeMlDsaKeyPairGenerator.java:214 if (fullAlgorithm.getClassicAlgorithm().equals("Ed25519")) {
15. common/src/main/java/org/conscrypt/OpenSslCompositeMlDsaPrivateKey.java:57 if (algorithm.getClassicAlgorithm().equals("Ed25519")) {
16. common/src/main/java/org/conscrypt/OpenSslCompositeMlDsaPublicKey.java:56 if (algorithm.getClassicAlgorithm().equals("Ed25519")) {
17. common/src/main/java/org/conscrypt/OpenSslEdDsaKeyFactory.java:68 if (!key.getAlgorithm().equals("EdDSA") && !key.getAlgorithm().equals("Ed25519")
18. common/src/main/java/org/conscrypt/OpenSslEdDsaKeyPairGenerator.java:32 private static final String ALGORITHM = "EdDSA";
19. common/src/main/java/org/conscrypt/OpenSslEdDsaKeyPairGenerator.java:35 super(ALGORITHM);
20. common/src/main/java/org/conscrypt/OpenSslSignatureCompositeMlDsa.java:272 case "Ed25519":
21. common/src/main/java/org/conscrypt/OpenSslSignatureCompositeMlDsa.java:396 case "Ed25519":
22. common/src/main/java/org/conscrypt/SSLUtils.java:657 result.add("Ed25519");
23. common/src/test/java/org/conscrypt/EdDsaTest.java:76 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
24. common/src/test/java/org/conscrypt/EdDsaTest.java:81 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
25. common/src/test/java/org/conscrypt/EdDsaTest.java:95 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
26. common/src/test/java/org/conscrypt/EdDsaTest.java:99 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
27. common/src/test/java/org/conscrypt/EdDsaTest.java:124 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
28. common/src/test/java/org/conscrypt/EdDsaTest.java:128 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
29. common/src/test/java/org/conscrypt/EdDsaTest.java:144 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
30. common/src/test/java/org/conscrypt/EdDsaTest.java:148 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
31. common/src/test/java/org/conscrypt/EdDsaTest.java:177 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
32. common/src/test/java/org/conscrypt/EdDsaTest.java:183 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519");
33. common/src/test/java/org/conscrypt/EdDsaTest.java:187 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
34. common/src/test/java/org/conscrypt/EdDsaTest.java:215 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
35. common/src/test/java/org/conscrypt/EdDsaTest.java:221 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
36. common/src/test/java/org/conscrypt/EdDsaTest.java:237 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
37. common/src/test/java/org/conscrypt/EdDsaTest.java:270 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
38. common/src/test/java/org/conscrypt/EdDsaTest.java:302 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
39. common/src/test/java/org/conscrypt/EdDsaTest.java:325 test path assertEquals(errMsg + ", algorithm:", "Ed25519", algorithm);
40. common/src/test/java/org/conscrypt/EdDsaTest.java:327 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
41. common/src/test/java/org/conscrypt/EdDsaTest.java:329 test path Signature signer = Signature.getInstance("Ed25519", conscryptProvider);
42. common/src/test/java/org/conscrypt/EdDsaTest.java:335 test path Signature verifier = Signature.getInstance("Ed25519", conscryptProvider);
43. common/src/test/java/org/conscrypt/EdDsaTest.java:344 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
44. common/src/test/java/org/conscrypt/EdDsaTest.java:369 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
45. common/src/test/java/org/conscrypt/EdDsaTest.java:428 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
46. common/src/test/java/org/conscrypt/EdDsaTest.java:480 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
47. common/src/test/java/org/conscrypt/EdDsaTest.java:507 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
48. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:136 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
49. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:139 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
50. common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java:164 test path putKeySize("EdDSA", 255);
51. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:108 test path .skipAlgorithm("EdDSA")
52. common/src/test/java/org/conscrypt/java/security/cert/X509CertificateTest.java:936 test path assertEquals("Ed25519", c.getSigAlgName());
53. common/src/test/java/org/conscrypt/javax/net/ssl/KeyManagerFactoryTest.java:94 test path if (s != null && !s.equals("EC_EC") && !s.equals("EdDSA")) {
54. testing/src/main/java/org/conscrypt/java/security/StandardNames.java:193 test path Arrays.asList("RSA", "DSA", "DH_RSA", "DH_DSA", "EC", "EC_EC", "EC_RSA", "EdDSA"));

jose.algorithm · CWE-327

TLS Quantum-vulnerable Recorded traffic 25 places See details

TLS context created in code

`SSLContext.getInstance()`. The protocol version is reported; the key exchange it negotiates is classical in every TLS 1.2 and 1.3 cipher suite available today.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Every TLS cipher suite in general use negotiates a classical key exchange, so a recorded session is decryptable once that exchange falls.

What to do. Keep TLS 1.3, and track the hybrid key-exchange groups as they reach the JDK. TLS is where harvest-now-decrypt-later exposure is largest.

1. common/src/test/java/org/conscrypt/javax/net/ssl/SSLContextTest.java:142 test path SSLContext sslContext = SSLContext.getInstance("TLS");
2. common/src/test/java/org/conscrypt/javax/net/ssl/SSLContextTest.java:156 test path SSLContext sslContext = SSLContext.getInstance("TLS");
3. common/src/test/java/org/conscrypt/javax/net/ssl/SSLContextTest.java:170 test path sslContext = SSLContext.getInstance("TLS");
4. common/src/test/java/org/conscrypt/javax/net/ssl/SSLContextTest.java:183 test path SSLContext sslContext = SSLContext.getInstance("TLS");
5. common/src/test/java/org/conscrypt/javax/net/ssl/SSLContextTest.java:687 test path () -> SSLContext.getInstance("SSLv3", finalDefaultTlsProvider));
6. common/src/test/java/org/conscrypt/javax/net/ssl/SSLContextTest.java:692 test path SSLContext initialContext = SSLContext.getInstance("Default");
7. common/src/test/java/org/conscrypt/javax/net/ssl/SSLContextTest.java:699 test path SSLContext newContext = SSLContext.getInstance("Default");
8. common/src/test/java/org/conscrypt/javax/net/ssl/SSLContextTest.java:704 test path SSLContext finalContext = SSLContext.getInstance("Default");
9. common/src/test/java/org/conscrypt/javax/net/ssl/SSLEngineTest.java:409 test path SSLContext context = SSLContext.getInstance("TLSv1.2");
10. common/src/test/java/org/conscrypt/javax/net/ssl/SSLEngineTest.java:445 test path SSLContext context = SSLContext.getInstance("TLSv1.3");
11. common/src/test/java/org/conscrypt/javax/net/ssl/SSLServerSocketTest.java:48 test path SSLContext context = SSLContext.getInstance("TLSv1.2");
12. common/src/test/java/org/conscrypt/javax/net/ssl/SSLServerSocketTest.java:103 test path SSLContext context = SSLContext.getInstance("TLSv1.3");
13. common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketTest.java:391 test path SSLContext context = SSLContext.getInstance("TLSv1.2");
14. common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketTest.java:412 test path SSLContext context = SSLContext.getInstance("TLSv1.3");
15. common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketVersionCompatibilityTest.java:700 test path SSLContext clientContext = SSLContext.getInstance("TLS");
16. common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketVersionCompatibilityTest.java:771 test path SSLContext clientContext = SSLContext.getInstance("TLS");
17. openjdk/src/test/java/org/conscrypt/ConscryptTest.java:96 test path SSLContext context = SSLContext.getInstance("TLS");
18. openjdk/src/test/java/org/conscrypt/ConscryptTest.java:102 test path context = SSLContext.getInstance("Default");
19. platform/src/test/java/org/conscrypt/SpakeTest.java:88 test path SSLContext contextClient = SSLContext.getInstance("TlsV1.3");
20. platform/src/test/java/org/conscrypt/SpakeTest.java:99 test path SSLContext contextServer = SSLContext.getInstance("TlsV1.3");
21. platform/src/test/java/org/conscrypt/SpakeTest.java:119 test path SSLContext contextClient = SSLContext.getInstance("TlsV1.3");
22. platform/src/test/java/org/conscrypt/SpakeTest.java:138 test path SSLContext contextServer = SSLContext.getInstance("TlsV1.3");
23. platform/src/test/java/org/conscrypt/SpakeTest.java:489 test path SSLContext sslContext = SSLContext.getInstance("TlsV1.3");
24. platform/src/test/java/org/conscrypt/SpakeTest.java:518 test path SSLContext sslContext = SSLContext.getInstance("TlsV1.3");
25. testing/src/main/java/org/conscrypt/TestUtils.java:432 test path return SSLContext.getInstance("TLS", provider);

java.sslcontext · CWE-757

RSA-OAEP Quantum-vulnerable Recorded traffic 20 places See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1617 test path Cipher encryptCipher = Cipher.getInstance("RSA/ECB/NoPadding", provider);
2. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1654 test path Cipher decryptCipher = Cipher.getInstance("RSA/ECB/NoPadding", provider);
3. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2655 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
4. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2684 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
5. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2716 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
6. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2752 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
7. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2788 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
8. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2815 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
9. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2852 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
10. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2882 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
11. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2915 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
12. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2943 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
13. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:2990 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
14. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3022 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
15. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3056 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
16. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3090 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
17. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3115 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
18. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3134 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
19. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3153 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);
20. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3170 test path Cipher c = Cipher.getInstance("RSA/ECB/NoPadding", provider);

java.cipher · CWE-327

RSA2048-bit Quantum-vulnerable 15 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. openjdk/src/test/resources/blocklist_test_chain.pem:1 test path -----BEGIN CERTIFICATE-----
2. openjdk/src/test/resources/blocklist_test_chain.pem:20 test path -----BEGIN CERTIFICATE-----
3. openjdk/src/test/resources/blocklist_test_valid_ca.pem:1 test path -----BEGIN CERTIFICATE-----
4. openjdk/src/test/resources/blocklist_test_valid_chain.pem:1 test path -----BEGIN CERTIFICATE-----
5. openjdk/src/test/resources/blocklist_test_valid_chain.pem:20 test path -----BEGIN CERTIFICATE-----
6. openjdk/src/test/resources/blocklist_test_valid_chain.pem:39 test path -----BEGIN CERTIFICATE-----
7. openjdk/src/test/resources/blocklist_test_valid_chain.pem:58 test path -----BEGIN CERTIFICATE-----
8. openjdk/src/test/resources/blocklist_test_valid_chain.pem:77 test path -----BEGIN CERTIFICATE-----
9. openjdk/src/test/resources/test_blocklist_ca.pem:1 test path -----BEGIN CERTIFICATE-----
10. openjdk/src/test/resources/test_blocklist_ca2.pem:1 test path -----BEGIN CERTIFICATE-----
11. openjdk/src/test/resources/test_intermediate_blockedroot.pem:1 test path -----BEGIN CERTIFICATE-----
12. openjdk/src/test/resources/test_intermediate_nonblockedroot.pem:1 test path -----BEGIN CERTIFICATE-----
13. openjdk/src/test/resources/test_leaf_blockedroot.pem:1 test path -----BEGIN CERTIFICATE-----
14. openjdk/src/test/resources/test_leaf_intermediate.pem:1 test path -----BEGIN CERTIFICATE-----
15. openjdk/src/test/resources/test_nonblocklist_ca.pem:1 test path -----BEGIN CERTIFICATE-----

pem.certificate

X25519255-bitother/Curve25519 Quantum-vulnerable Recorded traffic 15 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/HpkeFixture.java:88 test path final KeyFactory factory = KeyFactory.getInstance("XDH");
2. common/src/test/java/org/conscrypt/HpkeFixture.java:98 test path final KeyFactory factory = KeyFactory.getInstance("XDH");
3. common/src/test/java/org/conscrypt/X25519Test.java:102 test path KeyFactory keyFactory = KeyFactory.getInstance("X25519", conscryptProvider);
4. common/src/test/java/org/conscrypt/X25519Test.java:116 test path KeyFactory keyFactory = KeyFactory.getInstance("X25519", conscryptProvider);
5. common/src/test/java/org/conscrypt/X25519Test.java:142 test path KeyFactory keyFactory = KeyFactory.getInstance("X25519", conscryptProvider);
6. common/src/test/java/org/conscrypt/X25519Test.java:157 test path KeyFactory keyFactory = KeyFactory.getInstance("X25519", conscryptProvider);
7. common/src/test/java/org/conscrypt/X25519Test.java:204 test path KeyFactory keyFactory = KeyFactory.getInstance("X25519", conscryptProvider);
8. common/src/test/java/org/conscrypt/X25519Test.java:229 test path KeyFactory keyFactory = KeyFactory.getInstance("X25519", conscryptProvider);
9. common/src/test/java/org/conscrypt/X25519Test.java:254 test path KeyFactory keyFactory = KeyFactory.getInstance("X25519", conscryptProvider);
10. common/src/test/java/org/conscrypt/X25519Test.java:285 test path KeyFactory keyFactory = KeyFactory.getInstance("X25519", conscryptProvider);
11. common/src/test/java/org/conscrypt/javax/crypto/XDHKeyAgreementTest.java:69 test path KeyFactory kf = KeyFactory.getInstance("XDH", p);
12. common/src/test/java/org/conscrypt/javax/crypto/XDHKeyAgreementTest.java:95 test path KeyFactory kf = KeyFactory.getInstance("X25519", p);
13. common/src/test/java/org/conscrypt/javax/crypto/XdhKeyFactoryTest.java:62 test path KeyFactory.getInstance("XDH", TestUtils.getConscryptProvider());
14. common/src/test/java/org/conscrypt/javax/crypto/XdhKeyFactoryTest.java:188 test path KeyFactory sunKf = KeyFactory.getInstance("XDH", "SunEC");
15. common/src/test/java/org/conscrypt/javax/crypto/XdhKeyFactoryTest.java:239 test path KeyFactory sunKf = KeyFactory.getInstance("XDH", "SunEC");

java.keyfactory · CWE-327

ECDSA Quantum-vulnerable 10 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:36 test path Signature signature = Signature.getInstance("SHA256withECDSA", conscryptProvider);
2. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:51 test path Signature signature = Signature.getInstance("NONEwithECDSA", conscryptProvider);
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1856 test path Signature sig = Signature.getInstance("NONEwithECDSA");
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1873 test path Signature sig = Signature.getInstance("NONEwithECDSA");
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1885 test path Signature sig = Signature.getInstance("NONEwithECDSA");
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1899 test path Signature sig = Signature.getInstance("NONEwithECDSA");
7. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1926 test path Signature.getInstance("NONEwithECDSA", TestUtils.getConscryptProvider());
8. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1954 test path Signature.getInstance("NONEwithECDSA", TestUtils.getConscryptProvider());
9. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2179 test path Signature ecdsaVerify = Signature.getInstance("SHA1withECDSA");
10. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2185 test path ecdsaVerify = Signature.getInstance("SHA1withECDSA");

java.signature · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable 10 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/EdDsaTest.java:76 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
2. common/src/test/java/org/conscrypt/EdDsaTest.java:95 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
3. common/src/test/java/org/conscrypt/EdDsaTest.java:124 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
4. common/src/test/java/org/conscrypt/EdDsaTest.java:144 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
5. common/src/test/java/org/conscrypt/EdDsaTest.java:177 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
6. common/src/test/java/org/conscrypt/EdDsaTest.java:183 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519");
7. common/src/test/java/org/conscrypt/EdDsaTest.java:344 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
8. common/src/test/java/org/conscrypt/EdDsaTest.java:480 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
9. common/src/test/java/org/conscrypt/EdDsaTest.java:507 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);
10. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:136 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("Ed25519", conscryptProvider);

java.keypairgenerator · CWE-327

RSA Quantum-vulnerable Recorded traffic 10 places See details

Cipher transformation named away from the call

A JCA transformation string - `algorithm/mode/padding` - written somewhere other than a `getInstance()` argument, which is how a codebase that centralises its cryptography passes the choice to a helper. The string is unambiguous wherever it appears: nothing but a transformation is spelled that way.

This names an encryption method as text, and passes it to code elsewhere that does the work. It is the same choice, made in a different place.

What to do. The same migration applies as to the call that consumes it. Move the constant and the call together, so the inventory keeps naming the algorithm after the change.

1. common/src/main/java/org/conscrypt/OpenSSLProvider.java:587 putRSACipherImplClass("RSA/ECB/NoPadding", "OpenSSLCipherRSA$Raw");
2. common/src/main/java/org/conscrypt/OpenSSLProvider.java:588 put("Alg.Alias.Cipher.RSA/None/NoPadding", "RSA/ECB/NoPadding");
3. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:461 test path setExpectedBlockSize("RSA/ECB/NoPadding", "SunJCE", 0);
4. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:471 test path setExpectedBlockSize("RSA/ECB/NoPadding", Cipher.ENCRYPT_MODE, 256);
5. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:476 test path setExpectedBlockSize("RSA/ECB/NoPadding", Cipher.ENCRYPT_MODE, "BC", 255);
6. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:479 test path setExpectedBlockSize("RSA/ECB/NoPadding", Cipher.DECRYPT_MODE, 256);
7. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:752 test path setExpectedOutputSize("RSA/ECB/NoPadding", Cipher.ENCRYPT_MODE, 256);
8. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:756 test path setExpectedOutputSize("RSA/ECB/NoPadding", Cipher.DECRYPT_MODE, 256);
9. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:765 test path setExpectedOutputSize("RSA/ECB/NoPadding", Cipher.DECRYPT_MODE, "BC", 255);
10. testing/src/main/java/org/conscrypt/testing/OpaqueProvider.java:153 test path super("RSA/ECB/NoPadding");

java.transformation · CWE-327

RSA-OAEP Quantum-vulnerable Recorded traffic 10 places See details

Cipher transformation named away from the call

A JCA transformation string - `algorithm/mode/padding` - written somewhere other than a `getInstance()` argument, which is how a codebase that centralises its cryptography passes the choice to a helper. The string is unambiguous wherever it appears: nothing but a transformation is spelled that way.

This names an encryption method as text, and passes it to code elsewhere that does the work. It is the same choice, made in a different place.

What to do. The same migration applies as to the call that consumes it. Move the constant and the call together, so the inventory keeps naming the algorithm after the change.

1. common/src/main/java/org/conscrypt/OpenSSLProvider.java:592 putRSACipherImplClass("RSA/ECB/OAEPPadding", "OpenSSLCipherRSA$OAEP$SHA1");
2. common/src/main/java/org/conscrypt/OpenSSLProvider.java:593 put("Alg.Alias.Cipher.RSA/None/OAEPPadding", "RSA/ECB/OAEPPadding");
3. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:134 test path super("OAEP", new AlgorithmParameterAsymmetricHelper("RSA/ECB/OAEPPadding"),
4. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:463 test path setExpectedBlockSize("RSA/ECB/OAEPPadding", "SunJCE", 0);
5. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:483 test path setExpectedBlockSize("RSA/ECB/OAEPPadding", Cipher.ENCRYPT_MODE, 214);
6. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:490 test path setExpectedBlockSize("RSA/ECB/OAEPPadding", Cipher.DECRYPT_MODE, 256);
7. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:758 test path setExpectedOutputSize("RSA/ECB/OAEPPadding", Cipher.DECRYPT_MODE, 256);
8. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:768 test path setExpectedOutputSize("RSA/ECB/OAEPPadding", Cipher.DECRYPT_MODE, 214);
9. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:775 test path setExpectedOutputSize("RSA/ECB/OAEPPadding", Cipher.ENCRYPT_MODE, 256);
10. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3818 test path "RSA/ECB/OAEPPadding", new OAEPParameterSpec(digest, "MGF1", mgf1Spec, pSource),

java.transformation · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable 9 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. common/src/test/java/org/conscrypt/EdDsaTest.java:81 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
2. common/src/test/java/org/conscrypt/EdDsaTest.java:99 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
3. common/src/test/java/org/conscrypt/EdDsaTest.java:128 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
4. common/src/test/java/org/conscrypt/EdDsaTest.java:148 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
5. common/src/test/java/org/conscrypt/EdDsaTest.java:187 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
6. common/src/test/java/org/conscrypt/EdDsaTest.java:221 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);
7. common/src/test/java/org/conscrypt/EdDsaTest.java:329 test path Signature signer = Signature.getInstance("Ed25519", conscryptProvider);
8. common/src/test/java/org/conscrypt/EdDsaTest.java:335 test path Signature verifier = Signature.getInstance("Ed25519", conscryptProvider);
9. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:139 test path Signature signature = Signature.getInstance("Ed25519", conscryptProvider);

java.signature · CWE-327

DSA Quantum-vulnerable Renamed import 8 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:710 test path assertNotNull(Signature.getInstance("SHA1withDSA"));
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2043 test path Signature sig = Signature.getInstance("SHA1withDSA");
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2063 test path Signature sig = Signature.getInstance("SHA1withDSA");
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2076 test path Signature sig = Signature.getInstance("SHA224withDSA");
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2097 test path Signature sig = Signature.getInstance("SHA224withDSA");
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2110 test path Signature sig = Signature.getInstance("SHA256withDSA");
7. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2131 test path Signature sig = Signature.getInstance("SHA256withDSA");
8. testing/src/main/java/org/conscrypt/TestUtils.java:231 test path Signature.getInstance("SHA256withDSA");

java.signature · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable 7 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/EdDsaTest.java:215 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
2. common/src/test/java/org/conscrypt/EdDsaTest.java:237 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
3. common/src/test/java/org/conscrypt/EdDsaTest.java:270 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
4. common/src/test/java/org/conscrypt/EdDsaTest.java:302 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
5. common/src/test/java/org/conscrypt/EdDsaTest.java:327 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
6. common/src/test/java/org/conscrypt/EdDsaTest.java:369 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);
7. common/src/test/java/org/conscrypt/EdDsaTest.java:428 test path KeyFactory keyFactory = KeyFactory.getInstance("Ed25519", conscryptProvider);

java.keyfactory · CWE-327

DSA Quantum-vulnerable 6 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2039 test path KeyFactory kf = KeyFactory.getInstance("DSA");
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2059 test path KeyFactory kf = KeyFactory.getInstance("DSA");
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2072 test path KeyFactory kf = KeyFactory.getInstance("DSA");
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2093 test path KeyFactory kf = KeyFactory.getInstance("DSA");
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2106 test path KeyFactory kf = KeyFactory.getInstance("DSA");
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2127 test path KeyFactory kf = KeyFactory.getInstance("DSA");

java.keyfactory · CWE-327

X25519255-bitother/Curve25519 Quantum-vulnerable Recorded traffic 6 places See details

Classical key agreement through the JCA

`KeyAgreement.getInstance()` with ECDH, DH or XDH. Key agreement is the highest-priority class of finding: traffic recorded today is decrypted once the key exchange is broken.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 (FIPS 203), or a hybrid X25519+ML-KEM-768 construction that keeps the classical guarantee while adding the quantum one.

1. common/src/test/java/org/conscrypt/X25519Test.java:75 test path KeyAgreement ka1 = KeyAgreement.getInstance("X25519", conscryptProvider);
2. common/src/test/java/org/conscrypt/X25519Test.java:79 test path KeyAgreement ka2 = KeyAgreement.getInstance("X25519", conscryptProvider);
3. common/src/test/java/org/conscrypt/X25519Test.java:106 test path KeyAgreement ka = KeyAgreement.getInstance("X25519", conscryptProvider);
4. common/src/test/java/org/conscrypt/javax/crypto/XDHKeyAgreementTest.java:75 test path KeyAgreement ka = KeyAgreement.getInstance("XDH", p);
5. common/src/test/java/org/conscrypt/javax/crypto/XDHKeyAgreementTest.java:101 test path KeyAgreement ka = KeyAgreement.getInstance("X25519", p);
6. common/src/test/java/org/conscrypt/javax/crypto/XdhKeyTest.java:182 test path KeyAgreement ka = KeyAgreement.getInstance("XDH");

java.keyagreement · CWE-327

ECDSA256-bit Quantum-vulnerable 4 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:32 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("EC", conscryptProvider);
2. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:47 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("EC", conscryptProvider);
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1917 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1944 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");

java.keypairgenerator · CWE-327

RSA Quantum-vulnerable Recorded traffic 4 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/java/security/cert/CertificateFactoryTest.java:809 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
2. common/src/test/java/org/conscrypt/javax/crypto/XdhKeyFactoryTest.java:167 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
3. common/src/test/java/org/conscrypt/javax/crypto/XdhKeyFactoryTest.java:279 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
4. common/src/test/java/org/conscrypt/javax/crypto/XdhKeyTest.java:165 test path KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");

java.keypairgenerator · CWE-327

RSA2048-bit Quantum-vulnerable Recorded traffic 4 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. openjdk/src/test/resources/test_blocklist_ca2_key.pem:1 test path -----BEGIN PRIVATE KEY-----
2. openjdk/src/test/resources/test_blocklist_ca_key.pem:1 test path -----BEGIN PRIVATE KEY-----
3. openjdk/src/test/resources/test_intermediate_key.pem:1 test path -----BEGIN PRIVATE KEY-----
4. openjdk/src/test/resources/test_nonblocklist_ca_key.pem:1 test path -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

EC Quantum-vulnerable 3 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:517 test path KeyFactory keyFactory = KeyFactory.getInstance("EC", provider);
2. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:523 test path KeyFactory keyFactory = KeyFactory.getInstance("EC", provider);
3. testing/src/main/java/org/conscrypt/TestUtils.java:306 test path return KeyFactory.getInstance("EC").generatePublic(

java.keyfactory · CWE-327

RSA Quantum-vulnerable Recorded traffic 3 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:299 test path -----BEGIN RSA PRIVATE KEY-----
2. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1774 test path -----BEGIN RSA PRIVATE KEY-----
3. openjdk/src/test/resources/cert-key.pem:1 test path -----BEGIN RSA PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

RSA Quantum-vulnerable Recorded traffic 3 places See details

Algorithm named in a setting

A setting whose name says it holds an algorithm, given a literal that names one: `withOaepPaddingDigestAlgorithm("SHA-512")`, `signatureAlgorithm = "SHA256withRSA"`, `"digestAlgorithm": "SHA-256"`. The algorithm never reaches a `getInstance()` in this file - it is carried to one somewhere else, often through configuration - so a scan that only reads the factories cannot see it at all.

Something here is configured to use a named algorithm. The code that uses it may be somewhere else entirely, but this is the line that decides which algorithm it is.

What to do. Find what consumes the setting. The migration belongs to that operation; this line is where the choice is actually written down, and usually where it is easiest to change.

1. common/src/test/java/org/conscrypt/java/security/cert/CertificateFactoryTest.java:845 test path certGen.setSignatureAlgorithm("SHA1withRSA");
2. testing/src/main/java/org/conscrypt/java/security/TestKeyStore.java:708 test path signatureAlgorithm = "sha256WithRSA";
3. testing/src/main/java/org/conscrypt/java/security/TestKeyStore.java:714 test path signatureAlgorithm = "sha256WithRSA";

config.algorithm-setting · CWE-327

X25519255-bitother/Curve25519 Quantum-vulnerable Recorded traffic 3 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/X25519Test.java:71 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("X25519", conscryptProvider);
2. common/src/test/java/org/conscrypt/X25519Test.java:88 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("X25519", conscryptProvider);
3. common/src/test/java/org/conscrypt/X25519Test.java:182 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("X25519", conscryptProvider);

java.keypairgenerator · CWE-327

EC384-bitsecg/secp384r1 Quantum-vulnerable From a constant 2 places See details

Named elliptic curve requested

`ECGenParameterSpec` names a curve explicitly. Every standardised prime curve is broken by Shor regardless of its size, so a larger curve is not a mitigation.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.

What to do. ML-DSA-65 for signatures, ML-KEM-768 for key establishment.

1. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestEC.java:55 test path new ECGenParameterSpec(CURVE_NAME));
2. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestEC.java:64 test path params.init(new ECGenParameterSpec(CURVE_NAME));

java.eccurve · CWE-327

ECDH Quantum-vulnerable Recorded traffic 2 places See details

Classical key agreement through the JCA

`KeyAgreement.getInstance()` with ECDH, DH or XDH. Key agreement is the highest-priority class of finding: traffic recorded today is decrypted once the key exchange is broken.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 (FIPS 203), or a hybrid X25519+ML-KEM-768 construction that keeps the classical guarantee while adding the quantum one.

1. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:424 test path KeyAgreement kaA = KeyAgreement.getInstance("ECDH", provider);
2. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:539 test path return KeyAgreement.getInstance("ECDH", provider);

java.keyagreement · CWE-327

ECDH Quantum-vulnerable Recorded traffic 2 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:529 test path KeyFactory keyFactory = KeyFactory.getInstance("EC");
2. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:534 test path KeyFactory keyFactory = KeyFactory.getInstance("EC");

java.keyfactory · CWE-327

RSA2048-bit Quantum-vulnerable Recorded traffic 2 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/MacTest.java:188 test path KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
2. openjdk/src/test/java/org/conscrypt/NativeCryptoTest.java:189 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");

java.keypairgenerator · CWE-327

RSA2048-bit Quantum-vulnerable 2 places See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

1. openjdk/src/test/resources/test_intermediate.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----
2. openjdk/src/test/resources/test_leaf.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----

pem.certificate-request

DSA Quantum-vulnerable 1 place See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java:516 test path final KeyPairGenerator kpg = KeyPairGenerator.getInstance("DSA", p);

java.keypairgenerator · CWE-327

DSA Quantum-vulnerable 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1971 test path -----BEGIN DSA PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

DSA Quantum-vulnerable 1 place See details

Algorithm named in a setting

A setting whose name says it holds an algorithm, given a literal that names one: `withOaepPaddingDigestAlgorithm("SHA-512")`, `signatureAlgorithm = "SHA256withRSA"`, `"digestAlgorithm": "SHA-256"`. The algorithm never reaches a `getInstance()` in this file - it is carried to one somewhere else, often through configuration - so a scan that only reads the factories cannot see it at all.

Something here is configured to use a named algorithm. The code that uses it may be somewhere else entirely, but this is the line that decides which algorithm it is.

What to do. Find what consumes the setting. The migration belongs to that operation; this line is where the choice is actually written down, and usually where it is easiest to change.

1. testing/src/main/java/org/conscrypt/java/security/TestKeyStore.java:710 test path signatureAlgorithm = "sha256WithDSA";

config.algorithm-setting · CWE-327

EC256-bitsecg/secp256r1 Quantum-vulnerable 1 place See details

Named elliptic curve requested

`ECGenParameterSpec` names a curve explicitly. Every standardised prime curve is broken by Shor regardless of its size, so a larger curve is not a mitigation.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.

What to do. ML-DSA-65 for signatures, ML-KEM-768 for key establishment.

1. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:211 test path getKeyAgreement(provider).init(KAT_PRIVATE_KEY1, new ECGenParameterSpec("prime256v1"));

java.eccurve · CWE-327

EC Quantum-vulnerable 1 place See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:411 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC", provider);

java.keypairgenerator · CWE-327

ECDH256-bitsecg/secp256r1 Quantum-vulnerable Recorded traffic 1 place See details

Named elliptic curve requested

`ECGenParameterSpec` names a curve explicitly. Every standardised prime curve is broken by Shor regardless of its size, so a larger curve is not a mitigation.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 for signatures, ML-KEM-768 for key establishment.

1. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:412 test path ECGenParameterSpec ecSpec256 = new ECGenParameterSpec("secp256r1");

java.eccurve · CWE-327

ECDH224-bitsecg/secp224r1 Quantum-vulnerable Recorded traffic 1 place See details

Named elliptic curve requested

`ECGenParameterSpec` names a curve explicitly. Every standardised prime curve is broken by Shor regardless of its size, so a larger curve is not a mitigation.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 for signatures, ML-KEM-768 for key establishment.

1. common/src/test/java/org/conscrypt/javax/crypto/ECDHKeyAgreementTest.java:416 test path ECGenParameterSpec ecSpec224 = new ECGenParameterSpec("secp224r1");

java.eccurve · CWE-327

ECDSA Quantum-vulnerable 1 place See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2170 test path final KeyFactory factory = KeyFactory.getInstance("EC");

java.keyfactory · CWE-327

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

1. openjdk/src/test/resources/ct-server-key-public.pem:1 test path -----BEGIN PUBLIC KEY-----

pem.public-key

ECDSA Quantum-vulnerable 1 place See details

Algorithm named in a setting

A setting whose name says it holds an algorithm, given a literal that names one: `withOaepPaddingDigestAlgorithm("SHA-512")`, `signatureAlgorithm = "SHA256withRSA"`, `"digestAlgorithm": "SHA-256"`. The algorithm never reaches a `getInstance()` in this file - it is carried to one somewhere else, often through configuration - so a scan that only reads the factories cannot see it at all.

Something here is configured to use a named algorithm. The code that uses it may be somewhere else entirely, but this is the line that decides which algorithm it is.

What to do. Find what consumes the setting. The migration belongs to that operation; this line is where the choice is actually written down, and usually where it is easiest to change.

1. testing/src/main/java/org/conscrypt/java/security/TestKeyStore.java:712 test path signatureAlgorithm = "sha256WithECDSA";

config.algorithm-setting · CWE-327

EdDSA Quantum-vulnerable 1 place See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:107 test path .skipAlgorithm("Ed448")

jose.algorithm · CWE-327

RSA Quantum-vulnerable Recorded traffic 1 place See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1731 test path Cipher cipher = Cipher.getInstance("RSA");

java.cipher · CWE-327

AES Reduced margin 28 places See details

Cipher transformation named away from the call

A JCA transformation string - `algorithm/mode/padding` - written somewhere other than a `getInstance()` argument, which is how a codebase that centralises its cryptography passes the choice to a helper. The string is unambiguous wherever it appears: nothing but a transformation is spelled that way.

This names an encryption method as text, and passes it to code elsewhere that does the work. It is the same choice, made in a different place.

What to do. The same migration applies as to the call that consumes it. Move the constant and the call together, so the inventory keeps naming the algorithm after the change.

1. common/src/main/java/org/conscrypt/OpenSSLProvider.java:627 putSymmetricCipherImplClass("AES/ECB/NoPadding", "OpenSSLEvpCipherAES$AES$ECB$NoPadding");
2. common/src/main/java/org/conscrypt/OpenSSLProvider.java:628 putSymmetricCipherImplClass("AES/ECB/PKCS5Padding",
3. common/src/main/java/org/conscrypt/OpenSSLProvider.java:630 put("Alg.Alias.Cipher.AES/ECB/PKCS7Padding", "AES/ECB/PKCS5Padding");
4. common/src/main/java/org/conscrypt/OpenSSLProvider.java:631 putSymmetricCipherImplClass("AES/CBC/NoPadding", "OpenSSLEvpCipherAES$AES$CBC$NoPadding");
5. common/src/main/java/org/conscrypt/OpenSSLProvider.java:632 putSymmetricCipherImplClass("AES/CBC/PKCS5Padding",
6. common/src/main/java/org/conscrypt/OpenSSLProvider.java:634 put("Alg.Alias.Cipher.AES/CBC/PKCS7Padding", "AES/CBC/PKCS5Padding");
7. common/src/main/java/org/conscrypt/OpenSSLProvider.java:635 putSymmetricCipherImplClass("AES/CTR/NoPadding", "OpenSSLEvpCipherAES$AES$CTR");
8. common/src/main/java/org/conscrypt/OpenSSLProvider.java:682 putSymmetricCipherImplClass("AES/GCM/NoPadding", "OpenSSLAeadCipherAES$GCM");
9. common/src/main/java/org/conscrypt/OpenSSLProvider.java:683 put("Alg.Alias.Cipher.GCM", "AES/GCM/NoPadding");
10. common/src/main/java/org/conscrypt/OpenSSLProvider.java:684 put("Alg.Alias.Cipher.2.16.840.1.101.3.4.1.6", "AES/GCM/NoPadding");
11. common/src/main/java/org/conscrypt/OpenSSLProvider.java:685 put("Alg.Alias.Cipher.2.16.840.1.101.3.4.1.26", "AES/GCM/NoPadding");
12. common/src/main/java/org/conscrypt/OpenSSLProvider.java:686 put("Alg.Alias.Cipher.2.16.840.1.101.3.4.1.46", "AES/GCM/NoPadding");
13. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:54 test path new CipherParam("AES/GCM/NoPadding", new SecretKeySpec(new byte[16], "AES"),
14. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:59 test path BASIC_CIPHER_TO_TEST_DATA.put("AES/ECB/NoPadding", "crypto/aes-ecb.csv");
15. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:60 test path BASIC_CIPHER_TO_TEST_DATA.put("AES/CBC/NoPadding", "crypto/aes-cbc.csv");
16. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:61 test path BASIC_CIPHER_TO_TEST_DATA.put("AES/CFB8/NoPadding", "crypto/aes-cfb8.csv");
17. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:62 test path BASIC_CIPHER_TO_TEST_DATA.put("AES/CFB128/NoPadding", "crypto/aes-cfb128.csv");
18. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:63 test path BASIC_CIPHER_TO_TEST_DATA.put("AES/OFB/NoPadding", "crypto/aes-ofb.csv");
19. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:74 test path AEAD_CIPHER_TO_TEST_DATA.put("AES/GCM/NoPadding", "crypto/aes-gcm.csv");
20. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:214 test path && transformation.equals("AES/ECB/NoPadding")) {
21. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3736 test path new CipherTestParam("AES/ECB/PKCS5Padding", null, AES_128_KEY, null,
22. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3742 test path new CipherTestParam("AES/ECB/PKCS7Padding", null, AES_128_KEY, null,
23. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3757 test path "AES/CTR/NoPadding", new IvParameterSpec(AES_192_CTR_NoPadding_TestVector_1_IV),
24. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3762 test path "AES/CBC/PKCS5Padding",
25. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3768 test path "AES/CBC/PKCS7Padding",
26. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4577 test path String algorithm = "AES/ECB/NoPadding";
27. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4618 test path String algorithm = "AES/ECB/NoPadding";
28. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4745 test path String testedCipher = "AES/ECB/PKCS7Padding";

java.transformation · CWE-327

SHA-256 Reduced margin Renamed import 20 places See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. common/src/main/java/org/conscrypt/ct/CertificateEntry.java:106 MessageDigest md = MessageDigest.getInstance("SHA-256");
2. common/src/main/java/org/conscrypt/ct/LogInfo.java:84 this.logId = MessageDigest.getInstance("SHA-256").digest(publicKey.getEncoded());
3. common/src/test/java/org/conscrypt/MacTest.java:227 test path final Mac mac = Mac.getInstance("HMACSHA256", conscryptProvider);
4. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:36 test path Signature signature = Signature.getInstance("SHA256withECDSA", conscryptProvider);
5. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:95 test path Signature signature = Signature.getInstance("SHA256withRSA", conscryptProvider);
6. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:110 test path Signature signature = Signature.getInstance("SHA256withRSA/PSS", conscryptProvider);
7. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:290 test path Signature sig = Signature.getInstance("SHA256withRSA");
8. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:705 test path assertNotNull(Signature.getInstance("SHA256withRSA"));
9. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:751 test path Signature sig = Signature.getInstance("SHA256withRSA");
10. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:877 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
11. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:892 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
12. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:906 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
13. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1243 test path Signature sig = Signature.getInstance("SHA256withRSA");
14. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1454 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
15. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1478 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
16. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1506 test path Signature sig = Signature.getInstance("SHA256withRSA/PSS");
17. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1519 test path sig = Signature.getInstance("SHA256withRSA/PSS");
18. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2110 test path Signature sig = Signature.getInstance("SHA256withDSA");
19. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2131 test path Signature sig = Signature.getInstance("SHA256withDSA");
20. testing/src/main/java/org/conscrypt/TestUtils.java:231 test path Signature.getInstance("SHA256withDSA");

java.messagedigest · CWE-328

AES Reduced margin 14 places See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Grover's algorithm halves the effective strength; the parameter, not the design, is the problem. The key size was not visible at this call site, so the weaker case is assumed.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestGCM.java:141 test path Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
2. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:602 test path Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
3. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4189 test path Cipher c = Cipher.getInstance("AES/ECB/NoPadding");
4. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4225 test path Cipher c = Cipher.getInstance("AES/ECB/NoPadding");
5. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4377 test path Cipher c = Cipher.getInstance("AES/ECB/NoPadding");
6. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4482 test path Cipher c = Cipher.getInstance("AES/ECB/PKCS5Padding", provider);
7. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4536 test path Cipher enc = Cipher.getInstance("AES/ECB/PKCS5Padding", provider);
8. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4541 test path Cipher c = Cipher.getInstance("AES/ECB/PKCS5Padding", provider);
9. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4747 test path Cipher encCipher = Cipher.getInstance(testedCipher);
10. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4755 test path Cipher cipher = Cipher.getInstance(testedCipher);
11. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4820 test path Cipher c1 = Cipher.getInstance("AES/GCM/NoPadding");
12. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4821 test path Cipher c2 = Cipher.getInstance("AES/GCM/NoPadding");
13. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4881 test path final Cipher c = Cipher.getInstance("AES/ECB/NoPadding");
14. common/src/test/java/org/conscrypt/javax/crypto/ScryptTest.java:117 test path Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");

java.cipher · CWE-327

AES Reduced margin 11 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestGCM.java:131 test path SecretKeySpec skeySpec = new SecretKeySpec(randomBytes(16), "AES");
2. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:54 test path new CipherParam("AES/GCM/NoPadding", new SecretKeySpec(new byte[16], "AES"),
3. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:56 test path new CipherParam("AES/GCM-SIV/NoPadding", new SecretKeySpec(new byte[16], "AES"),
4. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:600 test path SecretKeySpec key = new SecretKeySpec(new byte[16], "AES");
5. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4226 test path c.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(new byte[128 / 8], "AES"));
6. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4537 test path enc.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(new byte[16], "AES"));
7. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4542 test path c.init(Cipher.DECRYPT_MODE, new SecretKeySpec(new byte[16], "AES"));
8. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4748 test path encCipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(testKey, "AES"));
9. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4756 test path cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(testKey, "AES"));
10. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4816 test path SecretKeySpec key = new SecretKeySpec(new byte[16], "AES");
11. common/src/test/java/org/conscrypt/javax/crypto/ScryptTest.java:112 test path return new SecretKeySpec(bytes, 0, len, "AES");

java.keyspec · CWE-327

AES-128 Reduced margin 7 places See details

Cipher transformation named away from the call

A JCA transformation string - `algorithm/mode/padding` - written somewhere other than a `getInstance()` argument, which is how a codebase that centralises its cryptography passes the choice to a helper. The string is unambiguous wherever it appears: nothing but a transformation is spelled that way.

This names an encryption method as text, and passes it to code elsewhere that does the work. It is the same choice, made in a different place.

What to do. The same migration applies as to the call that consumes it. Move the constant and the call together, so the inventory keeps naming the algorithm after the change.

1. common/src/main/java/org/conscrypt/OpenSSLProvider.java:637 putSymmetricCipherImplClass("AES_128/ECB/NoPadding",
2. common/src/main/java/org/conscrypt/OpenSSLProvider.java:639 putSymmetricCipherImplClass("AES_128/ECB/PKCS5Padding",
3. common/src/main/java/org/conscrypt/OpenSSLProvider.java:641 put("Alg.Alias.Cipher.AES_128/ECB/PKCS7Padding", "AES_128/ECB/PKCS5Padding");
4. common/src/main/java/org/conscrypt/OpenSSLProvider.java:642 putSymmetricCipherImplClass("AES_128/CBC/NoPadding",
5. common/src/main/java/org/conscrypt/OpenSSLProvider.java:644 putSymmetricCipherImplClass("AES_128/CBC/PKCS5Padding",
6. common/src/main/java/org/conscrypt/OpenSSLProvider.java:646 put("Alg.Alias.Cipher.AES_128/CBC/PKCS7Padding", "AES_128/CBC/PKCS5Padding");
7. common/src/main/java/org/conscrypt/OpenSSLProvider.java:687 putSymmetricCipherImplClass("AES_128/GCM/NoPadding", "OpenSSLAeadCipherAES$GCM$AES_128");

java.transformation · CWE-327

SHA-256 Reduced margin 5 places See details

Mask-generation digest named for RSA padding

`MGF1ParameterSpec.SHA256` names the digest inside RSA-OAEP and RSA-PSS padding. It is a separate choice from the digest the signature or the cipher uses, it is frequently left at SHA-1 by default, and a static import of it - `import static java.security.spec.MGF1ParameterSpec.SHA512` - is the only place the choice appears in the file that makes it.

This picks the hash used inside RSA padding. It matters because the default is often SHA-1, which is broken today without any quantum computer.

What to do. The mask-generation digest travels with the RSA key it pads. When that key moves to ML-KEM or ML-DSA the padding goes with it; until then, SHA-256 or better.

1. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersPSSTest.java:49 test path new PSSParameterSpec("SHA-224", "MGF1", MGF1ParameterSpec.SHA256, 32, 1);
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:564 test path new PSSParameterSpec("SHA-256", "MGF1", MGF1ParameterSpec.SHA256, 32, 1);
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:581 test path new PSSParameterSpec("SHA-256", "MGF1", MGF1ParameterSpec.SHA256, 0, 1);
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:598 test path new PSSParameterSpec("SHA-256", "MGF1", MGF1ParameterSpec.SHA256, 222, 1);
5. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3781 test path addRsaOaepTest("SHA-256", MGF1ParameterSpec.SHA256, RSA_Vector2_OAEP_SHA256_MGF1_SHA256);

java.mgf1 · CWE-327

AES-128128-bit Reduced margin 4 places See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Grover's algorithm halves the effective strength; the parameter, not the design, is the problem.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1316 test path KeyGenerator kg = KeyGenerator.getInstance("AES");
2. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4143 test path KeyGenerator kg = KeyGenerator.getInstance("AES");
3. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4406 test path KeyGenerator kg = KeyGenerator.getInstance("AES");
4. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4437 test path KeyGenerator kg = KeyGenerator.getInstance("AES");

java.cipher · CWE-327

SHA-224 Reduced margin 4 places See details

Mask-generation digest named for RSA padding

`MGF1ParameterSpec.SHA256` names the digest inside RSA-OAEP and RSA-PSS padding. It is a separate choice from the digest the signature or the cipher uses, it is frequently left at SHA-1 by default, and a static import of it - `import static java.security.spec.MGF1ParameterSpec.SHA512` - is the only place the choice appears in the file that makes it.

This picks the hash used inside RSA padding. It matters because the default is often SHA-1, which is broken today without any quantum computer.

What to do. The mask-generation digest travels with the RSA key it pads. When that key moves to ML-KEM or ML-DSA the padding goes with it; until then, SHA-256 or better.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:513 test path new PSSParameterSpec("SHA-224", "MGF1", new MGF1ParameterSpec("SHA-224"), 28, 1);
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:530 test path new PSSParameterSpec("SHA-224", "MGF1", new MGF1ParameterSpec("SHA-224"), 0, 1);
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:547 test path new PSSParameterSpec("SHA-224", "MGF1", new MGF1ParameterSpec("SHA-224"), 226, 1);
4. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3780 test path addRsaOaepTest("SHA-224", MGF1ParameterSpec.SHA224, RSA_Vector2_OAEP_SHA224_MGF1_SHA224);

java.mgf1 · CWE-327

PBKDF2 Reduced margin 2 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:338 test path key = skf.generateSecret(new PBEKeySpec("secret".toCharArray()));
2. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4867 test path PBEKeySpec pbeks = new PBEKeySpec("password".toCharArray(),

java.keyspec · CWE-327

SHA-224 Reduced margin 10 places See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Grover's algorithm halves the effective strength; the parameter, not the design, is the problem.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:834 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:849 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:863 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1229 test path Signature sig = Signature.getInstance("SHA224withRSA");
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1375 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1399 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
7. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1427 test path Signature sig = Signature.getInstance("SHA224withRSA/PSS");
8. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1440 test path sig = Signature.getInstance("SHA224withRSA/PSS");
9. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2076 test path Signature sig = Signature.getInstance("SHA224withDSA");
10. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:2097 test path Signature sig = Signature.getInstance("SHA224withDSA");

java.messagedigest · CWE-328

unknown Could not be determined 103 places See details

Key pair algorithm chosen at runtime

`KeyPairGenerator.getInstance(x)` where the argument is an identifier. The algorithm cannot be resolved without running the program, so this is reported as an unknown rather than assumed to be classical.

This code picks its encryption method while it runs, so a scan cannot tell which one it ends up using. Somebody has to check the configuration.

What to do. Trace the value to its configuration source and record the concrete algorithm in the cryptographic inventory by hand.

1. common/src/main/java/org/conscrypt/CryptoUpcalls.java:80 signature = Signature.getInstance(algorithm);
2. common/src/main/java/org/conscrypt/CryptoUpcalls.java:103 signature = Signature.getInstance(algorithm, p);
3. common/src/main/java/org/conscrypt/CryptoUpcalls.java:180 c = Cipher.getInstance(transformation);
4. common/src/main/java/org/conscrypt/CryptoUpcalls.java:201 c = Cipher.getInstance(transformation, p);
5. common/src/main/java/org/conscrypt/OpenSSLCipher.java:362 KeyFactory keyFactory = KeyFactory.getInstance(wrappedKeyAlgorithm);
6. common/src/main/java/org/conscrypt/OpenSSLCipher.java:365 KeyFactory keyFactory = KeyFactory.getInstance(wrappedKeyAlgorithm);
7. common/src/main/java/org/conscrypt/OpenSSLCipherRSA.java:360 KeyFactory keyFactory = KeyFactory.getInstance(wrappedKeyAlgorithm);
8. common/src/main/java/org/conscrypt/OpenSSLCipherRSA.java:363 KeyFactory keyFactory = KeyFactory.getInstance(wrappedKeyAlgorithm);
9. common/src/main/java/org/conscrypt/OpenSSLX509CRL.java:237 sig = Signature.getInstance(sigAlg);
10. common/src/main/java/org/conscrypt/OpenSSLX509CRL.java:239 sig = Signature.getInstance(sigAlg, sigProvider);
11. common/src/main/java/org/conscrypt/OpenSSLX509Certificate.java:476 KeyFactory kf = KeyFactory.getInstance(oid);
12. common/src/main/java/org/conscrypt/ct/LogInfo.java:196 signature = Signature.getInstance(algorithm);
13. common/src/test/java/org/conscrypt/MlDsaTest.java:188 test path Signature ss = Signature.getInstance(signAlgorithm, conscryptProvider);
14. common/src/test/java/org/conscrypt/MlDsaTest.java:195 test path Signature sv = Signature.getInstance(verifyAlgorithm, conscryptProvider);
15. common/src/test/java/org/conscrypt/MlDsaTest.java:221 test path Signature ss = Signature.getInstance(signAlgorithm, conscryptProvider);
16. common/src/test/java/org/conscrypt/MlDsaTest.java:228 test path Signature sv = Signature.getInstance(verifyAlgorithm, conscryptProvider);
17. common/src/test/java/org/conscrypt/MlDsaTest.java:254 test path Signature ss = Signature.getInstance(signAlgorithm, conscryptProvider);
18. common/src/test/java/org/conscrypt/MlDsaTest.java:261 test path Signature sv = Signature.getInstance(verifyAlgorithm, conscryptProvider);
19. common/src/test/java/org/conscrypt/MlDsaTest.java:284 test path Signature ss = Signature.getInstance(signAlgorithm, conscryptProvider);
20. common/src/test/java/org/conscrypt/MlDsaTest.java:291 test path Signature sv = Signature.getInstance(verifyAlgorithm, conscryptProvider);
21. common/src/test/java/org/conscrypt/MlDsaTest.java:314 test path Signature ss = Signature.getInstance(signAlgorithm, conscryptProvider);
22. common/src/test/java/org/conscrypt/MlDsaTest.java:321 test path Signature sv = Signature.getInstance(verifyAlgorithm, conscryptProvider);
23. common/src/test/java/org/conscrypt/MlDsaTest.java:341 test path KeyFactory keyFactory = KeyFactory.getInstance(keyFactoryAlgorithm, conscryptProvider);
24. common/src/test/java/org/conscrypt/MlDsaTest.java:398 test path KeyFactory keyFactory = KeyFactory.getInstance(keyFactoryAlgorithm, conscryptProvider);
25. common/src/test/java/org/conscrypt/MlDsaTest.java:431 test path KeyFactory keyFactory = KeyFactory.getInstance(keyFactoryAlgorithm, conscryptProvider);
26. common/src/test/java/org/conscrypt/MlDsaTest.java:486 test path KeyFactory keyFactory = KeyFactory.getInstance(keyFactoryAlgorithm, conscryptProvider);
27. common/src/test/java/org/conscrypt/MlDsaTest.java:510 test path KeyFactory keyFactory = KeyFactory.getInstance(algorithm, conscryptProvider);
28. common/src/test/java/org/conscrypt/MlDsaTest.java:574 test path KeyFactory keyFactory = KeyFactory.getInstance(algorithm, conscryptProvider);
29. common/src/test/java/org/conscrypt/MlDsaTest.java:638 test path KeyFactory keyFactory = KeyFactory.getInstance(algorithm, conscryptProvider);
30. common/src/test/java/org/conscrypt/MlDsaTest.java:955 test path KeyFactory keyFactory = KeyFactory.getInstance(algorithm, conscryptProvider);
31. common/src/test/java/org/conscrypt/MlDsaTest.java:957 test path Signature signer = Signature.getInstance(algorithm, conscryptProvider);
32. common/src/test/java/org/conscrypt/MlDsaTest.java:964 test path Signature verifier = Signature.getInstance(algorithm, conscryptProvider);
33. common/src/test/java/org/conscrypt/MlKemTest.java:88 test path KeyPairGenerator.getInstance(keyGenAlgorithm, conscryptProvider);
34. common/src/test/java/org/conscrypt/MlKemTest.java:116 test path KeyFactory keyFactory = KeyFactory.getInstance(factoryAlgorithm, conscryptProvider);
35. common/src/test/java/org/conscrypt/MlKemTest.java:225 test path KeyFactory keyFactory = KeyFactory.getInstance(algorithm, conscryptProvider);
36. common/src/test/java/org/conscrypt/MlKemTest.java:291 test path KeyFactory keyFactory = KeyFactory.getInstance(algorithm, conscryptProvider);
37. common/src/test/java/org/conscrypt/MlKemTest.java:703 test path KeyFactory keyFactory = KeyFactory.getInstance(keyAlgorithm, conscryptProvider);
38. common/src/test/java/org/conscrypt/MlKemTest.java:736 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance(algorithm, conscryptProvider);
39. common/src/test/java/org/conscrypt/OpenSslCompositeMlDsaKeyFactoryTest.java:63 test path return KeyFactory.getInstance(algName, PROVIDER);
40. common/src/test/java/org/conscrypt/SlhDsaTest.java:457 test path Signature signer = Signature.getInstance(algorithm, conscryptProvider);
41. common/src/test/java/org/conscrypt/SlhDsaTest.java:462 test path Signature verifier = Signature.getInstance(algorithm, conscryptProvider);
42. common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java:114 test path KeyPairGenerator kpg1 = KeyPairGenerator.getInstance(algorithm);
43. common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java:122 test path KeyPairGenerator kpg2 = KeyPairGenerator.getInstance(algorithm, provider);
44. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:122 test path Signature sig1 = Signature.getInstance(algorithm);
45. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:127 test path Signature sig2 = Signature.getInstance(algorithm, provider);
46. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:133 test path Signature sig3 = Signature.getInstance(algorithm, provider.getName());
47. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:178 test path kpg = KeyPairGenerator.getInstance(kpAlgorithm, "SunEC");
48. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:180 test path kpg = KeyPairGenerator.getInstance(kpAlgorithm);
49. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:74 test path Cipher c = Cipher.getInstance(param.name);
50. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:82 test path Cipher c = Cipher.getInstance(param.name);
51. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:95 test path Cipher c1 = Cipher.getInstance(param.name);
52. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:96 test path Cipher c2 = Cipher.getInstance(param.name);
53. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:133 test path Cipher c1 = Cipher.getInstance(param.name);
54. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:134 test path Cipher c2 = Cipher.getInstance(param.name);
55. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:135 test path Cipher c3 = Cipher.getInstance(param.name);
56. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:191 test path Cipher c1 = Cipher.getInstance(param.name);
57. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:192 test path Cipher c2 = Cipher.getInstance(param.name);
58. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:193 test path Cipher c3 = Cipher.getInstance(param.name);
59. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:256 test path Cipher c1 = Cipher.getInstance(param.name);
60. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:257 test path Cipher c2 = Cipher.getInstance(param.name);
61. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:258 test path Cipher c3 = Cipher.getInstance(param.name);
62. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:324 test path Cipher c1 = Cipher.getInstance(param.name);
63. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:325 test path Cipher c2 = Cipher.getInstance(param.name);
64. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:326 test path Cipher c3 = Cipher.getInstance(param.name);
65. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:373 test path Cipher c1 = Cipher.getInstance(param.name);
66. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:374 test path Cipher c2 = Cipher.getInstance(param.name);
67. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:226 test path cipher = Cipher.getInstance(transformation, p);
68. common/src/test/java/org/conscrypt/javax/crypto/CipherBasicsTest.java:379 test path cipher = Cipher.getInstance(transformation, p);
69. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1033 test path Cipher.getInstance(algorithm).init(getEncryptMode(algorithm),
70. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1169 test path Cipher c1 = Cipher.getInstance(algorithm);
71. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1176 test path Cipher c2 = Cipher.getInstance(algorithm, provider);
72. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:1182 test path Cipher c3 = Cipher.getInstance(algorithm, provider.getName());
73. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3949 test path Cipher c = Cipher.getInstance(p.transformation, provider);
74. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3973 test path c = Cipher.getInstance(p.transformation, provider);
75. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4148 test path c = Cipher.getInstance(p.transformation, provider);
76. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4581 test path Cipher c = Cipher.getInstance(algorithm, provider);
77. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4622 test path Cipher c = Cipher.getInstance(algorithm, provider);
78. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:4775 test path Cipher cipher = Cipher.getInstance(c);
79. common/src/test/java/org/conscrypt/javax/crypto/KeyGeneratorTest.java:71 test path KeyGenerator kg1 = KeyGenerator.getInstance(algorithm);
80. common/src/test/java/org/conscrypt/javax/crypto/KeyGeneratorTest.java:76 test path KeyGenerator kg2 = KeyGenerator.getInstance(algorithm, provider);
81. common/src/test/java/org/conscrypt/javax/crypto/KeyGeneratorTest.java:82 test path KeyGenerator kg3 = KeyGenerator.getInstance(algorithm, provider.getName());
82. testing/src/main/java/org/conscrypt/java/security/AbstractKeyFactoryTest.java:60 test path final KeyFactory factory = KeyFactory.getInstance(algorithm, p);
83. testing/src/main/java/org/conscrypt/java/security/AbstractKeyFactoryTest.java:83 test path KeyFactory.getInstance(algorithm, p2);
84. testing/src/main/java/org/conscrypt/java/security/AbstractKeyPairGeneratorTest.java:40 test path generator = KeyPairGenerator.getInstance(algorithmName);
85. testing/src/main/java/org/conscrypt/java/security/AlgorithmParameterAsymmetricHelper.java:47 test path Cipher cipher = Cipher.getInstance(algorithmName);
86. testing/src/main/java/org/conscrypt/java/security/AlgorithmParameterKeyAgreementHelper.java:36 test path KeyPairGenerator generator = KeyPairGenerator.getInstance(algorithmName);
87. testing/src/main/java/org/conscrypt/java/security/AlgorithmParameterKeyAgreementHelper.java:40 test path KeyAgreement keyAgreement = KeyAgreement.getInstance(algorithmName);
88. testing/src/main/java/org/conscrypt/java/security/AlgorithmParameterSignatureHelper.java:50 test path Signature signature = Signature.getInstance(algorithmName);
89. testing/src/main/java/org/conscrypt/java/security/AlgorithmParameterSignatureHelper.java:52 test path KeyPairGenerator generator = KeyPairGenerator.getInstance(keyPairAlgorithmName);
90. testing/src/main/java/org/conscrypt/java/security/AlgorithmParameterSymmetricHelper.java:46 test path KeyGenerator generator = KeyGenerator.getInstance(algorithmName);
91. testing/src/main/java/org/conscrypt/java/security/AlgorithmParameterSymmetricHelper.java:55 test path Cipher cipher = Cipher.getInstance(transformation);
92. testing/src/main/java/org/conscrypt/java/security/CipherHelper.java:40 test path Cipher cipher = Cipher.getInstance(algorithmName);
93. testing/src/main/java/org/conscrypt/java/security/DefaultKeys.java:491 test path KeyFactory factory = KeyFactory.getInstance(algorithmName);
94. testing/src/main/java/org/conscrypt/java/security/DefaultKeys.java:497 test path KeyFactory factory = KeyFactory.getInstance(algorithmName);
95. testing/src/main/java/org/conscrypt/java/security/KeyAgreementHelper.java:40 test path KeyAgreement keyAgreement = KeyAgreement.getInstance(algorithmName);
96. testing/src/main/java/org/conscrypt/java/security/SignatureHelper.java:41 test path Signature signature = Signature.getInstance(algorithmName);
97. testing/src/main/java/org/conscrypt/java/security/TestKeyStore.java:616 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance(keyAlgorithm);
98. testing/src/main/java/org/conscrypt/javax/net/ssl/RandomPrivateKeyX509ExtendedKeyManager.java:51 test path KeyFactory keyFactory = KeyFactory.getInstance(keyAlgorithm);
99. testing/src/main/java/org/conscrypt/javax/net/ssl/RandomPrivateKeyX509ExtendedKeyManager.java:60 test path KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(keyAlgorithm);
100. testing/src/main/java/org/conscrypt/javax/net/ssl/RandomPrivateKeyX509ExtendedKeyManager.java:68 test path KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(keyAlgorithm);
101. testing/src/main/java/org/conscrypt/javax/net/ssl/RandomPrivateKeyX509ExtendedKeyManager.java:73 test path KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(keyAlgorithm);
102. testing/src/main/java/org/conscrypt/testing/OpaqueProvider.java:102 test path delegate = Signature.getInstance(algorithm);
103. testing/src/main/java/org/conscrypt/testing/OpaqueProvider.java:202 test path delegate = Cipher.getInstance(algorithm, StandardNames.JSSE_PROVIDER_NAME);

java.keypairgenerator.variable · CWE-327

unknown Could not be determined Renamed import 11 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. common/src/main/java/org/conscrypt/Hkdf.java:126 mac.init(new SecretKeySpec(key, "RAW"));
2. common/src/test/java/org/conscrypt/MacTest.java:86 test path SecretKeySpec secretKey = new SecretKeySpec(keyBytes, "RawBytes");
3. common/src/test/java/org/conscrypt/MacTest.java:246 test path SecretKeySpec key = new SecretKeySpec(keyBytes, "RawBytes");
4. common/src/test/java/org/conscrypt/MacTest.java:335 test path return new SecretKeySpec(decodeHex(entry[KEY_INDEX]), "RawBytes");
5. common/src/test/java/org/conscrypt/MacTest.java:349 test path SecretKeySpec key = new SecretKeySpec(keyBytes, "RawBytes");
6. common/src/test/java/org/conscrypt/MacTest.java:420 test path SecretKeySpec otherKey = new SecretKeySpec(otherKeyBytes, "RawBytes");
7. common/src/test/java/org/conscrypt/MacTest.java:427 test path SecretKeySpec key = new SecretKeySpec(keyBytes, "RawBytes");
8. common/src/test/java/org/conscrypt/javax/net/ssl/SSLEngineTest.java:153 test path return new SecretKeySpec("Just an arbitrary key".getBytes(UTF_8), "RAW");
9. common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketTest.java:203 test path return new SecretKeySpec("Just an arbitrary key".getBytes(UTF_8), "RAW");
10. common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketVersionCompatibilityTest.java:1919 test path return new SecretKeySpec("Just an arbitrary key".getBytes(UTF_8), "RAW");
11. openjdk/src/test/java/org/conscrypt/DuckTypedPSKKeyManagerTest.java:158 test path SecretKey key = new SecretKeySpec("arbitrary".getBytes(StandardCharsets.UTF_8), "RAW");

java.keyspec · CWE-327

SEED Could not be determined 5 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:137 test path new CipherSuite(0x0096, "TLS_RSA_WITH_SEED_CBC_SHA"),
2. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:138 test path new CipherSuite(0x0097, "TLS_DH_DSS_WITH_SEED_CBC_SHA"),
3. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:139 test path new CipherSuite(0x0098, "TLS_DH_RSA_WITH_SEED_CBC_SHA"),
4. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:140 test path new CipherSuite(0x0099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA"),
5. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:141 test path new CipherSuite(0x009a, "TLS_DHE_RSA_WITH_SEED_CBC_SHA"),

config.cipher-suite · CWE-757

unknown Could not be determined 5 places See details

Non-cryptographic randomness near key material

`new Random()` or `Math.random()` in a file that also imports `java.security`, `javax.crypto` or BouncyCastle. `java.util.Random` is a linear congruential generator and its output is predictable from a handful of samples. The import check is what keeps this from firing on every retry jitter and test fixture in the tree.

Part of this code uses a predictable source of random numbers. If any key comes from it, that key can be guessed today, with no quantum computer needed.

What to do. `java.security.SecureRandom`. This is a classical defect, not a quantum one, and it is worth fixing first.

1. common/src/test/java/org/conscrypt/MacTest.java:66 test path private final Random random = new Random(System.currentTimeMillis());
2. common/src/test/java/org/conscrypt/javax/net/ssl/SSLEngineVersionCompatibilityTest.java:823 test path Random random = new Random(System.currentTimeMillis());
3. openjdk/src/test/java/org/conscrypt/ConscryptSocketTest.java:242 test path private final Random random = new Random(System.currentTimeMillis());
4. platform/src/test/java/org/conscrypt/TrustedCertificateStoreTest.java:71 test path private static final Random tempFileRandom = new Random();
5. testing/src/main/java/org/conscrypt/TestUtils.java:109 test path private static final Random random = new Random(System.currentTimeMillis());

java.random.insecure · CWE-338

RC2 Could not be determined 2 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:33 test path new CipherSuite(0x0006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5"),
2. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:106 test path new CipherSuite(0x0061, "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5"),

config.cipher-suite · CWE-757

unknown Could not be determined 2 places See details

Release signed by the build

`apksigner sign`, `jarsigner`, `codesign` or `signtool` in a build script or a CI workflow. The key it uses signs what customers install, so it outlives every key inside the application and is usually the last one anybody thinks to migrate. The algorithm is deliberately not claimed: a keystore can hold RSA, DSA or EC and the command does not say which.

This is where a release gets signed. The signing key is not in the code, but the code says it exists - and a signing key is usually the hardest one to replace.

What to do. Find the key this command loads and record its algorithm in the inventory. Platform signing formats move on the platform's schedule, not yours, so the useful work now is knowing which key it is and who holds it.

1. gradle/publishing.gradle:81 def command = 'jarsigner -keystore ' + rootProject.signingKeystore +
2. release/README.md:125 gpg --armor --detach-sign "$f"

build.code-signing · CWE-327

IDEA Could not be determined 1 place See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. testing/src/main/java/org/conscrypt/tlswire/handshake/CipherSuite.java:34 test path new CipherSuite(0x0007, "TLS_RSA_WITH_IDEA_CBC_SHA"),

config.cipher-suite · CWE-757

ML-DSA-65 Quantum-safe Renamed import 36 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. common/src/main/java/org/conscrypt/MlDsaAlgorithm.java:22 ML_DSA_65("ML-DSA-65", 1952),
2. common/src/main/java/org/conscrypt/MlDsaAlgorithm.java:46 case "ML-DSA-65":
3. common/src/main/java/org/conscrypt/OidData.java:64 OID_TO_NAME_MAP.put("2.16.840.1.101.3.4.3.18", "ML-DSA-65");
4. common/src/main/java/org/conscrypt/OpenSSLProvider.java:251 put("Alg.Alias.KeyPairGenerator.2.16.840.1.101.3.4.3.18", "ML-DSA-65");
5. common/src/main/java/org/conscrypt/OpenSSLProvider.java:252 put("Alg.Alias.KeyPairGenerator.OID.2.16.840.1.101.3.4.3.18", "ML-DSA-65");
6. common/src/main/java/org/conscrypt/OpenSSLProvider.java:335 put("Alg.Alias.KeyFactory.2.16.840.1.101.3.4.3.18", "ML-DSA-65");
7. common/src/main/java/org/conscrypt/OpenSSLProvider.java:336 put("Alg.Alias.KeyFactory.OID.2.16.840.1.101.3.4.3.18", "ML-DSA-65");
8. common/src/main/java/org/conscrypt/OpenSSLProvider.java:520 putSignatureImplClass("ML-DSA-65", "OpenSslSignatureMlDsa$MlDsa65");
9. common/src/main/java/org/conscrypt/OpenSSLProvider.java:521 put("Alg.Alias.Signature.2.16.840.1.101.3.4.3.18", "ML-DSA-65");
10. common/src/main/java/org/conscrypt/OpenSSLProvider.java:522 put("Alg.Alias.Signature.OID.2.16.840.1.101.3.4.3.18", "ML-DSA-65");
11. common/src/main/java/org/conscrypt/OpenSslMlDsaKeyPairGenerator.java:54 super("ML-DSA-65");
12. common/src/test/java/org/conscrypt/MlDsaTest.java:101 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
13. common/src/test/java/org/conscrypt/MlDsaTest.java:106 test path Signature signature = Signature.getInstance("ML-DSA-65", conscryptProvider);
14. common/src/test/java/org/conscrypt/MlDsaTest.java:204 test path Signature s65 = Signature.getInstance("ML-DSA-65", conscryptProvider);
15. common/src/test/java/org/conscrypt/MlDsaTest.java:211 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
16. common/src/test/java/org/conscrypt/MlDsaTest.java:219 test path for (String signAlgorithm : new String[] {"ML-DSA-65", "ML-DSA", ML_DSA_65_OID}) {
17. common/src/test/java/org/conscrypt/MlDsaTest.java:227 test path for (String verifyAlgorithm : new String[] {"ML-DSA-65", "ML-DSA", ML_DSA_65_OID}) {
18. common/src/test/java/org/conscrypt/MlDsaTest.java:270 test path Signature s65 = Signature.getInstance("ML-DSA-65", conscryptProvider);
19. common/src/test/java/org/conscrypt/MlDsaTest.java:307 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
20. common/src/test/java/org/conscrypt/MlDsaTest.java:312 test path for (String signAlgorithm : new String[] {"ML-DSA-65", "ML-DSA"}) {
21. common/src/test/java/org/conscrypt/MlDsaTest.java:320 test path for (String verifyAlgorithm : new String[] {"ML-DSA-65", "ML-DSA"}) {
22. common/src/test/java/org/conscrypt/MlDsaTest.java:394 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
23. common/src/test/java/org/conscrypt/MlDsaTest.java:397 test path for (String keyFactoryAlgorithm : new String[] {"ML-DSA-65", "ML-DSA", ML_DSA_65_OID}) {
24. common/src/test/java/org/conscrypt/MlDsaTest.java:475 test path KeyFactory keyFactory65 = KeyFactory.getInstance("ML-DSA-65", conscryptProvider);
25. common/src/test/java/org/conscrypt/MlDsaTest.java:485 test path new String[] {"ML-DSA-44", "ML-DSA-65", "ML-DSA-87", "ML-DSA"}) {
26. common/src/test/java/org/conscrypt/MlDsaTest.java:565 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
27. common/src/test/java/org/conscrypt/MlDsaTest.java:573 test path for (String algorithm : new String[] {"ML-DSA-65", "ML-DSA"}) {
28. common/src/test/java/org/conscrypt/MlDsaTest.java:666 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-65", conscryptProvider);
29. common/src/test/java/org/conscrypt/MlDsaTest.java:831 test path Signature signer = Signature.getInstance("ML-DSA-65", conscryptProvider);
30. common/src/test/java/org/conscrypt/MlDsaTest.java:837 test path Signature verifier = Signature.getInstance("ML-DSA-65", conscryptProvider);
31. common/src/test/java/org/conscrypt/MlDsaTest.java:999 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
32. common/src/test/java/org/conscrypt/MlDsaTest.java:1100 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-65", conscryptProvider);
33. common/src/test/java/org/conscrypt/MlDsaTest.java:1267 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-65", conscryptProvider);
34. common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java:171 test path putKeySize("ML-DSA-65", -1);
35. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:112 test path .skipAlgorithm("ML-DSA-65")
36. common/src/test/java/org/conscrypt/java/security/cert/X509CertificateTest.java:970 test path assertEquals("ML-DSA-65", c.getSigAlgName());

jose.algorithm · CWE-327

ML-DSA-87 Quantum-safe Renamed import 35 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. common/src/main/java/org/conscrypt/MlDsaAlgorithm.java:23 ML_DSA_87("ML-DSA-87", 2592);
2. common/src/main/java/org/conscrypt/MlDsaAlgorithm.java:48 case "ML-DSA-87":
3. common/src/main/java/org/conscrypt/OidData.java:65 OID_TO_NAME_MAP.put("2.16.840.1.101.3.4.3.19", "ML-DSA-87");
4. common/src/main/java/org/conscrypt/OpenSSLProvider.java:254 put("Alg.Alias.KeyPairGenerator.2.16.840.1.101.3.4.3.19", "ML-DSA-87");
5. common/src/main/java/org/conscrypt/OpenSSLProvider.java:255 put("Alg.Alias.KeyPairGenerator.OID.2.16.840.1.101.3.4.3.19", "ML-DSA-87");
6. common/src/main/java/org/conscrypt/OpenSSLProvider.java:338 put("Alg.Alias.KeyFactory.2.16.840.1.101.3.4.3.19", "ML-DSA-87");
7. common/src/main/java/org/conscrypt/OpenSSLProvider.java:339 put("Alg.Alias.KeyFactory.OID.2.16.840.1.101.3.4.3.19", "ML-DSA-87");
8. common/src/main/java/org/conscrypt/OpenSSLProvider.java:523 putSignatureImplClass("ML-DSA-87", "OpenSslSignatureMlDsa$MlDsa87");
9. common/src/main/java/org/conscrypt/OpenSSLProvider.java:524 put("Alg.Alias.Signature.2.16.840.1.101.3.4.3.19", "ML-DSA-87");
10. common/src/main/java/org/conscrypt/OpenSSLProvider.java:525 put("Alg.Alias.Signature.OID.2.16.840.1.101.3.4.3.19", "ML-DSA-87");
11. common/src/main/java/org/conscrypt/OpenSslMlDsaKeyPairGenerator.java:82 super("ML-DSA-87");
12. common/src/test/java/org/conscrypt/MlDsaTest.java:237 test path Signature s87 = Signature.getInstance("ML-DSA-87", conscryptProvider);
13. common/src/test/java/org/conscrypt/MlDsaTest.java:244 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-87", conscryptProvider);
14. common/src/test/java/org/conscrypt/MlDsaTest.java:252 test path for (String signAlgorithm : new String[] {"ML-DSA-87", "ML-DSA", ML_DSA_87_OID}) {
15. common/src/test/java/org/conscrypt/MlDsaTest.java:260 test path for (String verifyAlgorithm : new String[] {"ML-DSA-87", "ML-DSA", ML_DSA_87_OID}) {
16. common/src/test/java/org/conscrypt/MlDsaTest.java:300 test path Signature s87 = Signature.getInstance("ML-DSA-87", conscryptProvider);
17. common/src/test/java/org/conscrypt/MlDsaTest.java:330 test path Signature s87 = Signature.getInstance("ML-DSA-87", conscryptProvider);
18. common/src/test/java/org/conscrypt/MlDsaTest.java:385 test path KeyFactory keyFactory87 = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
19. common/src/test/java/org/conscrypt/MlDsaTest.java:418 test path KeyFactory keyFactory87 = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
20. common/src/test/java/org/conscrypt/MlDsaTest.java:427 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-87", conscryptProvider);
21. common/src/test/java/org/conscrypt/MlDsaTest.java:430 test path for (String keyFactoryAlgorithm : new String[] {"ML-DSA-87", ML_DSA_87_OID}) {
22. common/src/test/java/org/conscrypt/MlDsaTest.java:485 test path new String[] {"ML-DSA-44", "ML-DSA-65", "ML-DSA-87", "ML-DSA"}) {
23. common/src/test/java/org/conscrypt/MlDsaTest.java:538 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
24. common/src/test/java/org/conscrypt/MlDsaTest.java:602 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
25. common/src/test/java/org/conscrypt/MlDsaTest.java:629 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-87", conscryptProvider);
26. common/src/test/java/org/conscrypt/MlDsaTest.java:637 test path for (String algorithm : new String[] {"ML-DSA-87", "ML-DSA"}) {
27. common/src/test/java/org/conscrypt/MlDsaTest.java:1019 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-87", conscryptProvider);
28. common/src/test/java/org/conscrypt/MlDsaTest.java:1156 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
29. common/src/test/java/org/conscrypt/MlDsaTest.java:1319 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
30. common/src/test/java/org/conscrypt/MlDsaTest.java:1374 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
31. common/src/test/java/org/conscrypt/MlDsaTest.java:1407 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
32. common/src/test/java/org/conscrypt/MlDsaTest.java:1440 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
33. common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java:172 test path putKeySize("ML-DSA-87", -1);
34. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:113 test path .skipAlgorithm("ML-DSA-87")
35. common/src/test/java/org/conscrypt/java/security/cert/X509CertificateTest.java:987 test path assertEquals("ML-DSA-87", c.getSigAlgName());

jose.algorithm · CWE-327

ML-DSA-44 Quantum-safe Renamed import 32 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. common/src/main/java/org/conscrypt/MlDsaAlgorithm.java:21 ML_DSA_44("ML-DSA-44", 1312),
2. common/src/main/java/org/conscrypt/MlDsaAlgorithm.java:44 case "ML-DSA-44":
3. common/src/main/java/org/conscrypt/OidData.java:63 OID_TO_NAME_MAP.put("2.16.840.1.101.3.4.3.17", "ML-DSA-44");
4. common/src/main/java/org/conscrypt/OpenSSLProvider.java:248 put("Alg.Alias.KeyPairGenerator.2.16.840.1.101.3.4.3.17", "ML-DSA-44");
5. common/src/main/java/org/conscrypt/OpenSSLProvider.java:249 put("Alg.Alias.KeyPairGenerator.OID.2.16.840.1.101.3.4.3.17", "ML-DSA-44");
6. common/src/main/java/org/conscrypt/OpenSSLProvider.java:332 put("Alg.Alias.KeyFactory.2.16.840.1.101.3.4.3.17", "ML-DSA-44");
7. common/src/main/java/org/conscrypt/OpenSSLProvider.java:333 put("Alg.Alias.KeyFactory.OID.2.16.840.1.101.3.4.3.17", "ML-DSA-44");
8. common/src/main/java/org/conscrypt/OpenSSLProvider.java:517 putSignatureImplClass("ML-DSA-44", "OpenSslSignatureMlDsa$MlDsa44");
9. common/src/main/java/org/conscrypt/OpenSSLProvider.java:518 put("Alg.Alias.Signature.2.16.840.1.101.3.4.3.17", "ML-DSA-44");
10. common/src/main/java/org/conscrypt/OpenSSLProvider.java:519 put("Alg.Alias.Signature.OID.2.16.840.1.101.3.4.3.17", "ML-DSA-44");
11. common/src/main/java/org/conscrypt/OpenSslMlDsaKeyPairGenerator.java:37 super("ML-DSA-44");
12. common/src/test/java/org/conscrypt/MlDsaTest.java:178 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
13. common/src/test/java/org/conscrypt/MlDsaTest.java:186 test path for (String signAlgorithm : new String[] {"ML-DSA-44", "ML-DSA", ML_DSA_44_OID}) {
14. common/src/test/java/org/conscrypt/MlDsaTest.java:194 test path for (String verifyAlgorithm : new String[] {"ML-DSA-44", "ML-DSA", ML_DSA_44_OID}) {
15. common/src/test/java/org/conscrypt/MlDsaTest.java:277 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
16. common/src/test/java/org/conscrypt/MlDsaTest.java:282 test path for (String signAlgorithm : new String[] {"ML-DSA-44", "ML-DSA"}) {
17. common/src/test/java/org/conscrypt/MlDsaTest.java:290 test path for (String verifyAlgorithm : new String[] {"ML-DSA-44", "ML-DSA"}) {
18. common/src/test/java/org/conscrypt/MlDsaTest.java:337 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
19. common/src/test/java/org/conscrypt/MlDsaTest.java:340 test path for (String keyFactoryAlgorithm : new String[] {"ML-DSA-44", ML_DSA_44_OID}) {
20. common/src/test/java/org/conscrypt/MlDsaTest.java:485 test path new String[] {"ML-DSA-44", "ML-DSA-65", "ML-DSA-87", "ML-DSA"}) {
21. common/src/test/java/org/conscrypt/MlDsaTest.java:501 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
22. common/src/test/java/org/conscrypt/MlDsaTest.java:509 test path for (String algorithm : new String[] {"ML-DSA-44", "ML-DSA"}) {
23. common/src/test/java/org/conscrypt/MlDsaTest.java:748 test path Signature signer = Signature.getInstance("ML-DSA-44", conscryptProvider);
24. common/src/test/java/org/conscrypt/MlDsaTest.java:754 test path Signature verifier = Signature.getInstance("ML-DSA-44", conscryptProvider);
25. common/src/test/java/org/conscrypt/MlDsaTest.java:979 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
26. common/src/test/java/org/conscrypt/MlDsaTest.java:1042 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-44", conscryptProvider);
27. common/src/test/java/org/conscrypt/MlDsaTest.java:1213 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-44", conscryptProvider);
28. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:150 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
29. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:153 test path Signature signature = Signature.getInstance("ML-DSA-44", conscryptProvider);
30. common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java:170 test path putKeySize("ML-DSA-44", -1);
31. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:111 test path .skipAlgorithm("ML-DSA-44")
32. common/src/test/java/org/conscrypt/java/security/cert/X509CertificateTest.java:953 test path assertEquals("ML-DSA-44", c.getSigAlgName());

jose.algorithm · CWE-327

ChaCha20-Poly1305 Quantum-safe 22 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:53 test path SecretKeySpec key = new SecretKeySpec(new byte[32], "ChaCha20");
2. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:69 test path SecretKeySpec key = new SecretKeySpec(new byte[32], "ChaCha20");
3. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:78 test path SecretKeySpec differentKey = new SecretKeySpec(differentKeyBytes, "ChaCha20");
4. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:87 test path SecretKeySpec key = new SecretKeySpec(new byte[32], "ChaCha20");
5. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:103 test path SecretKeySpec key = new SecretKeySpec(new byte[32], "XChaCha20");
6. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:119 test path SecretKeySpec key = new SecretKeySpec(new byte[32], "XChaCha20");
7. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:128 test path SecretKeySpec differentKey = new SecretKeySpec(differentKeyBytes, "XChaCha20");
8. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:137 test path SecretKeySpec key = new SecretKeySpec(new byte[32], "XChaCha20");
9. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:153 test path SecretKeySpec key = new SecretKeySpec(new byte[32], "XChaCha20");
10. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:169 test path SecretKeySpec key = new SecretKeySpec(new byte[32], "ChaCha20");
11. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:180 test path SecretKeySpec key = new SecretKeySpec(new byte[32], "XChaCha20");
12. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:191 test path SecretKeySpec key = new SecretKeySpec(new byte[32], "ChaCha20");
13. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:201 test path SecretKeySpec key = new SecretKeySpec(new byte[32], "XChaCha20");
14. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:212 test path SecretKeySpec shortKey = new SecretKeySpec(new byte[16], "ChaCha20");
15. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:222 test path SecretKeySpec shortKey = new SecretKeySpec(new byte[16], "XChaCha20");
16. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:233 test path SecretKeySpec chaCha20Key = new SecretKeySpec(keyBytes, "ChaCha20");
17. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:234 test path SecretKeySpec xChaCha20Key = new SecretKeySpec(keyBytes, "XChaCha20");
18. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:253 test path SecretKeySpec xChaCha20Key = new SecretKeySpec(keyBytes, "XChaCha20");
19. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:254 test path SecretKeySpec chaCha20Key = new SecretKeySpec(keyBytes, "ChaCha20");
20. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:297 test path SecretKeySpec key = new SecretKeySpec(keyBytes, "XChaCha20");
21. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:59 test path new SecretKeySpec(new byte[32], "ChaCha20"),
22. common/src/test/java/org/conscrypt/javax/crypto/AeadCipherTest.java:62 test path new SecretKeySpec(new byte[32], "XChaCha20"),

java.keyspec · CWE-327

ChaCha20-Poly1305 Quantum-safe 17 places See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:52 test path Cipher c = Cipher.getInstance("ChaCha20/Poly1305/NoPadding", conscryptProvider);
2. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:68 test path Cipher c = Cipher.getInstance("ChaCha20/Poly1305/NoPadding", conscryptProvider);
3. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:86 test path Cipher c = Cipher.getInstance("ChaCha20/Poly1305/NoPadding", conscryptProvider);
4. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:102 test path Cipher c = Cipher.getInstance("XChaCha20/Poly1305/NoPadding", conscryptProvider);
5. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:118 test path Cipher c = Cipher.getInstance("XChaCha20/Poly1305/NoPadding", conscryptProvider);
6. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:136 test path Cipher c = Cipher.getInstance("XChaCha20/Poly1305/NoPadding", conscryptProvider);
7. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:168 test path Cipher c = Cipher.getInstance("ChaCha20/Poly1305/NoPadding", conscryptProvider);
8. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:179 test path Cipher c = Cipher.getInstance("XChaCha20/Poly1305/NoPadding", conscryptProvider);
9. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:190 test path Cipher c = Cipher.getInstance("ChaCha20/Poly1305/NoPadding", conscryptProvider);
10. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:200 test path Cipher c = Cipher.getInstance("XChaCha20/Poly1305/NoPadding", conscryptProvider);
11. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:210 test path Cipher c = Cipher.getInstance("ChaCha20/Poly1305/NoPadding", conscryptProvider);
12. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:220 test path Cipher c = Cipher.getInstance("XChaCha20/Poly1305/NoPadding", conscryptProvider);
13. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:230 test path Cipher c = Cipher.getInstance("XChaCha20/Poly1305/NoPadding", conscryptProvider);
14. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:250 test path Cipher c = Cipher.getInstance("ChaCha20/Poly1305/NoPadding", conscryptProvider);
15. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:270 test path KeyGenerator kg = KeyGenerator.getInstance("ChaCha20", conscryptProvider);
16. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:278 test path KeyGenerator kg = KeyGenerator.getInstance("XChaCha20", conscryptProvider);
17. common/src/test/java/org/conscrypt/ChaCha20Poly1305Test.java:300 test path Cipher c = Cipher.getInstance("XChaCha20/Poly1305/NoPadding", conscryptProvider);

java.cipher · CWE-327

SLH-DSA Quantum-safe 12 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. common/src/test/java/org/conscrypt/SlhDsaTest.java:81 test path Signature ss = Signature.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
2. common/src/test/java/org/conscrypt/SlhDsaTest.java:87 test path Signature sv = Signature.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
3. common/src/test/java/org/conscrypt/SlhDsaTest.java:102 test path Signature signature = Signature.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
4. common/src/test/java/org/conscrypt/SlhDsaTest.java:133 test path Signature ss = Signature.getInstance("SLH-DSA-SHA2-128S-WITH-SHA384", conscryptProvider);
5. common/src/test/java/org/conscrypt/SlhDsaTest.java:139 test path Signature sv = Signature.getInstance("SLH-DSA-SHA2-128S-WITH-SHA384", conscryptProvider);
6. common/src/test/java/org/conscrypt/SlhDsaTest.java:166 test path Signature rawSigner = Signature.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
7. common/src/test/java/org/conscrypt/SlhDsaTest.java:175 test path Signature rawVerifier = Signature.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
8. common/src/test/java/org/conscrypt/SlhDsaTest.java:190 test path Signature.getInstance("SLH-DSA-SHA2-128S-WITH-SHA384", conscryptProvider);
9. common/src/test/java/org/conscrypt/SlhDsaTest.java:225 test path Signature.getInstance("SLH-DSA-SHA2-128S-WITH-SHA384", conscryptProvider);
10. common/src/test/java/org/conscrypt/SlhDsaTest.java:232 test path Signature.getInstance("SLH-DSA-SHA2-128S-WITH-SHA384", conscryptProvider);
11. common/src/test/java/org/conscrypt/SlhDsaTest.java:241 test path Signature.getInstance("SLH-DSA-SHA2-128S-WITH-SHA384", conscryptProvider);
12. common/src/test/java/org/conscrypt/SlhDsaTest.java:257 test path () -> Signature.getInstance("SLH-DSA", conscryptProvider));

java.signature · CWE-327

SHA-384 Quantum-safe Renamed import 11 places See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:706 test path assertNotNull(Signature.getInstance("SHA384withRSA"));
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:761 test path Signature sig = Signature.getInstance("SHA384withRSA");
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:920 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:935 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:949 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1257 test path Signature sig = Signature.getInstance("SHA384withRSA");
7. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1533 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
8. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1557 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
9. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1585 test path Signature sig = Signature.getInstance("SHA384withRSA/PSS");
10. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1598 test path sig = Signature.getInstance("SHA384withRSA/PSS");
11. openjdk/src/test/java/org/conscrypt/NativeCryptoTest.java:4956 test path MessageDigest md = MessageDigest.getInstance("SHA-384");

java.messagedigest · CWE-328

SLH-DSA Quantum-safe 11 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/SlhDsaTest.java:259 test path () -> KeyFactory.getInstance("SLH-DSA", conscryptProvider));
2. common/src/test/java/org/conscrypt/SlhDsaTest.java:268 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
3. common/src/test/java/org/conscrypt/SlhDsaTest.java:290 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
4. common/src/test/java/org/conscrypt/SlhDsaTest.java:301 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
5. common/src/test/java/org/conscrypt/SlhDsaTest.java:372 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
6. common/src/test/java/org/conscrypt/SlhDsaTest.java:420 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
7. common/src/test/java/org/conscrypt/SlhDsaTest.java:455 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
8. common/src/test/java/org/conscrypt/SlhDsaTest.java:497 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
9. common/src/test/java/org/conscrypt/SlhDsaTest.java:524 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
10. common/src/test/java/org/conscrypt/SlhDsaTest.java:549 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
11. common/src/test/java/org/conscrypt/SlhDsaTest.java:575 test path KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);

java.keyfactory · CWE-327

SHA-512 Quantum-safe Renamed import 10 places See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:707 test path assertNotNull(Signature.getInstance("SHA512withRSA"));
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:771 test path Signature sig = Signature.getInstance("SHA512withRSA");
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:963 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:978 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:992 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1271 test path Signature sig = Signature.getInstance("SHA512withRSA");
7. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1612 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
8. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1636 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
9. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1664 test path Signature sig = Signature.getInstance("SHA512withRSA/PSS");
10. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:1677 test path sig = Signature.getInstance("SHA512withRSA/PSS");

java.messagedigest · CWE-328

ML-DSA-65 Quantum-safe 9 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. common/src/test/java/org/conscrypt/MlDsaTest.java:87 test path Signature ss = Signature.getInstance("ML-DSA", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlDsaTest.java:92 test path Signature sv = Signature.getInstance("ML-DSA", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlDsaTest.java:106 test path Signature signature = Signature.getInstance("ML-DSA-65", conscryptProvider);
4. common/src/test/java/org/conscrypt/MlDsaTest.java:204 test path Signature s65 = Signature.getInstance("ML-DSA-65", conscryptProvider);
5. common/src/test/java/org/conscrypt/MlDsaTest.java:270 test path Signature s65 = Signature.getInstance("ML-DSA-65", conscryptProvider);
6. common/src/test/java/org/conscrypt/MlDsaTest.java:831 test path Signature signer = Signature.getInstance("ML-DSA-65", conscryptProvider);
7. common/src/test/java/org/conscrypt/MlDsaTest.java:837 test path Signature verifier = Signature.getInstance("ML-DSA-65", conscryptProvider);
8. common/src/test/java/org/conscrypt/MlDsaTest.java:927 test path Signature signer = Signature.getInstance("ML-DSA", conscryptProvider);
9. common/src/test/java/org/conscrypt/MlDsaTest.java:933 test path Signature verifier = Signature.getInstance("ML-DSA", conscryptProvider);

java.signature · CWE-327

ML-DSA-65 Quantum-safe 9 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/MlDsaTest.java:362 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlDsaTest.java:452 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlDsaTest.java:475 test path KeyFactory keyFactory65 = KeyFactory.getInstance("ML-DSA-65", conscryptProvider);
4. common/src/test/java/org/conscrypt/MlDsaTest.java:666 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-65", conscryptProvider);
5. common/src/test/java/org/conscrypt/MlDsaTest.java:693 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA", conscryptProvider);
6. common/src/test/java/org/conscrypt/MlDsaTest.java:762 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA", conscryptProvider);
7. common/src/test/java/org/conscrypt/MlDsaTest.java:845 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA", conscryptProvider);
8. common/src/test/java/org/conscrypt/MlDsaTest.java:1100 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-65", conscryptProvider);
9. common/src/test/java/org/conscrypt/MlDsaTest.java:1267 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-65", conscryptProvider);

java.keyfactory · CWE-327

ML-DSA-87 Quantum-safe 9 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/MlDsaTest.java:385 test path KeyFactory keyFactory87 = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlDsaTest.java:418 test path KeyFactory keyFactory87 = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlDsaTest.java:538 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
4. common/src/test/java/org/conscrypt/MlDsaTest.java:602 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
5. common/src/test/java/org/conscrypt/MlDsaTest.java:1156 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
6. common/src/test/java/org/conscrypt/MlDsaTest.java:1319 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
7. common/src/test/java/org/conscrypt/MlDsaTest.java:1374 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
8. common/src/test/java/org/conscrypt/MlDsaTest.java:1407 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);
9. common/src/test/java/org/conscrypt/MlDsaTest.java:1440 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-87", conscryptProvider);

java.keyfactory · CWE-327

SLH-DSA Quantum-safe 9 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/SlhDsaTest.java:75 test path KeyPairGenerator.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
2. common/src/test/java/org/conscrypt/SlhDsaTest.java:97 test path KeyPairGenerator.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
3. common/src/test/java/org/conscrypt/SlhDsaTest.java:127 test path KeyPairGenerator.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
4. common/src/test/java/org/conscrypt/SlhDsaTest.java:184 test path KeyPairGenerator.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
5. common/src/test/java/org/conscrypt/SlhDsaTest.java:215 test path KeyPairGenerator.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
6. common/src/test/java/org/conscrypt/SlhDsaTest.java:255 test path () -> KeyPairGenerator.getInstance("SLH-DSA", conscryptProvider));
7. common/src/test/java/org/conscrypt/SlhDsaTest.java:265 test path KeyPairGenerator.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
8. common/src/test/java/org/conscrypt/SlhDsaTest.java:361 test path KeyPairGenerator.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
9. common/src/test/java/org/conscrypt/SlhDsaTest.java:476 test path KeyPairGenerator.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);

java.keypairgenerator · CWE-327

CSPRNG Quantum-safe 8 places See details

Random number generation

`SecureRandom`. A platform CSPRNG is not a quantum exposure; it is recorded because an inventory that omits the randomness source is incomplete. `SHA1PRNG` is named explicitly where it appears, since it is a legacy algorithm even though its output is adequate.

This is where the software gets its random numbers. Quantum computers do not weaken it.

What to do. No action. Prefer the platform default over naming an algorithm.

1. common/src/main/java/org/conscrypt/KeyGeneratorImpl.java:81 secureRandom = new SecureRandom();
2. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestGCM.java:113 test path new SecureRandom().nextBytes(bytes);
3. common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java:239 test path kpg.initialize(keySize, new SecureRandom());
4. common/src/test/java/org/conscrypt/java/security/SecureRandomTest.java:50 test path final SecureRandom random = SecureRandom.getInstance("SHA1PRNG", provider);
5. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:947 test path new SecureRandom().nextBytes(salt);
6. common/src/test/java/org/conscrypt/javax/crypto/KeyGeneratorTest.java:149 test path kg.init(new SecureRandom());
7. testing/src/main/java/org/conscrypt/java/security/TestKeyStore.java:721 test path new SecureRandom().nextBytes(serialBytes);
8. testing/src/main/java/org/conscrypt/javax/net/ssl/TestSSLContext.java:395 test path context.init(keyManagers, trustManagers, new SecureRandom());

java.rng

SHA-512 Quantum-safe Renamed import 8 places See details

Mask-generation digest named for RSA padding

`MGF1ParameterSpec.SHA256` names the digest inside RSA-OAEP and RSA-PSS padding. It is a separate choice from the digest the signature or the cipher uses, it is frequently left at SHA-1 by default, and a static import of it - `import static java.security.spec.MGF1ParameterSpec.SHA512` - is the only place the choice appears in the file that makes it.

This picks the hash used inside RSA padding. It matters because the default is often SHA-1, which is broken today without any quantum computer.

What to do. The mask-generation digest travels with the RSA key it pads. When that key moves to ML-KEM or ML-DSA the padding goes with it; until then, SHA-256 or better.

1. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:171 test path spec = new OAEPParameterSpec("SHA-1", "MGF1", MGF1ParameterSpec.SHA512,
2. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:227 test path assertEquals(MGF1ParameterSpec.SHA512.getDigestAlgorithm(),
3. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:239 test path assertEquals(MGF1ParameterSpec.SHA512.getDigestAlgorithm(),
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:666 test path new PSSParameterSpec("SHA-512", "MGF1", MGF1ParameterSpec.SHA512, 64, 1);
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:683 test path new PSSParameterSpec("SHA-512", "MGF1", MGF1ParameterSpec.SHA512, 0, 1);
6. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:700 test path new PSSParameterSpec("SHA-512", "MGF1", MGF1ParameterSpec.SHA512, 190, 1);
7. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3783 test path addRsaOaepTest("SHA-512", MGF1ParameterSpec.SHA512, RSA_Vector2_OAEP_SHA512_MGF1_SHA512);
8. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3786 test path addRsaOaepTest("SHA-512", MGF1ParameterSpec.SHA512,

java.mgf1 · CWE-327

AES-256 Quantum-safe 7 places See details

Cipher transformation named away from the call

A JCA transformation string - `algorithm/mode/padding` - written somewhere other than a `getInstance()` argument, which is how a codebase that centralises its cryptography passes the choice to a helper. The string is unambiguous wherever it appears: nothing but a transformation is spelled that way.

This names an encryption method as text, and passes it to code elsewhere that does the work. It is the same choice, made in a different place.

What to do. The same migration applies as to the call that consumes it. Move the constant and the call together, so the inventory keeps naming the algorithm after the change.

1. common/src/main/java/org/conscrypt/OpenSSLProvider.java:654 putSymmetricCipherImplClass("AES_256/ECB/NoPadding",
2. common/src/main/java/org/conscrypt/OpenSSLProvider.java:656 putSymmetricCipherImplClass("AES_256/ECB/PKCS5Padding",
3. common/src/main/java/org/conscrypt/OpenSSLProvider.java:658 put("Alg.Alias.Cipher.AES_256/ECB/PKCS7Padding", "AES_256/ECB/PKCS5Padding");
4. common/src/main/java/org/conscrypt/OpenSSLProvider.java:659 putSymmetricCipherImplClass("AES_256/CBC/NoPadding",
5. common/src/main/java/org/conscrypt/OpenSSLProvider.java:661 putSymmetricCipherImplClass("AES_256/CBC/PKCS5Padding",
6. common/src/main/java/org/conscrypt/OpenSSLProvider.java:663 put("Alg.Alias.Cipher.AES_256/CBC/PKCS7Padding", "AES_256/CBC/PKCS5Padding");
7. common/src/main/java/org/conscrypt/OpenSSLProvider.java:688 putSymmetricCipherImplClass("AES_256/GCM/NoPadding", "OpenSSLAeadCipherAES$GCM$AES_256");

java.transformation · CWE-327

ML-DSA-65 Quantum-safe 7 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/MlDsaTest.java:81 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlDsaTest.java:101 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlDsaTest.java:211 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
4. common/src/test/java/org/conscrypt/MlDsaTest.java:307 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
5. common/src/test/java/org/conscrypt/MlDsaTest.java:394 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
6. common/src/test/java/org/conscrypt/MlDsaTest.java:565 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);
7. common/src/test/java/org/conscrypt/MlDsaTest.java:999 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-65", conscryptProvider);

java.keypairgenerator · CWE-327

ML-DSA-44 Quantum-safe 6 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/MlDsaTest.java:178 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlDsaTest.java:277 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlDsaTest.java:337 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
4. common/src/test/java/org/conscrypt/MlDsaTest.java:501 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
5. common/src/test/java/org/conscrypt/MlDsaTest.java:979 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);
6. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:150 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("ML-DSA-44", conscryptProvider);

java.keypairgenerator · CWE-327

SHA-384 Quantum-safe Renamed import 6 places See details

Mask-generation digest named for RSA padding

`MGF1ParameterSpec.SHA256` names the digest inside RSA-OAEP and RSA-PSS padding. It is a separate choice from the digest the signature or the cipher uses, it is frequently left at SHA-1 by default, and a static import of it - `import static java.security.spec.MGF1ParameterSpec.SHA512` - is the only place the choice appears in the file that makes it.

This picks the hash used inside RSA padding. It matters because the default is often SHA-1, which is broken today without any quantum computer.

What to do. The mask-generation digest travels with the RSA key it pads. When that key moves to ML-KEM or ML-DSA the padding goes with it; until then, SHA-256 or better.

1. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:164 test path "SHA-256", "MGF1", MGF1ParameterSpec.SHA384,
2. common/src/test/java/org/conscrypt/java/security/AlgorithmParametersTestOAEP.java:215 test path assertEquals(MGF1ParameterSpec.SHA384.getDigestAlgorithm(),
3. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:615 test path new PSSParameterSpec("SHA-384", "MGF1", MGF1ParameterSpec.SHA384, 48, 1);
4. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:632 test path new PSSParameterSpec("SHA-384", "MGF1", MGF1ParameterSpec.SHA384, 0, 1);
5. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:649 test path new PSSParameterSpec("SHA-384", "MGF1", MGF1ParameterSpec.SHA384, 206, 1);
6. common/src/test/java/org/conscrypt/javax/crypto/CipherTest.java:3782 test path addRsaOaepTest("SHA-384", MGF1ParameterSpec.SHA384, RSA_Vector2_OAEP_SHA384_MGF1_SHA384);

java.mgf1 · CWE-327

ML-DSA-87 Quantum-safe 4 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/MlDsaTest.java:244 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-87", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlDsaTest.java:427 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-87", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlDsaTest.java:629 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-87", conscryptProvider);
4. common/src/test/java/org/conscrypt/MlDsaTest.java:1019 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-DSA-87", conscryptProvider);

java.keypairgenerator · CWE-327

ML-DSA-44 Quantum-safe 3 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. common/src/test/java/org/conscrypt/MlDsaTest.java:748 test path Signature signer = Signature.getInstance("ML-DSA-44", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlDsaTest.java:754 test path Signature verifier = Signature.getInstance("ML-DSA-44", conscryptProvider);
3. common/src/test/java/org/conscrypt/SignatureThreadMisuseTest.java:153 test path Signature signature = Signature.getInstance("ML-DSA-44", conscryptProvider);

java.signature · CWE-327

ML-DSA-87 Quantum-safe 3 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. common/src/test/java/org/conscrypt/MlDsaTest.java:237 test path Signature s87 = Signature.getInstance("ML-DSA-87", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlDsaTest.java:300 test path Signature s87 = Signature.getInstance("ML-DSA-87", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlDsaTest.java:330 test path Signature s87 = Signature.getInstance("ML-DSA-87", conscryptProvider);

java.signature · CWE-327

ML-KEM-1024 Quantum-safe 3 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/MlKemTest.java:253 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-KEM-1024", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlKemTest.java:375 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-KEM-1024", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlKemTest.java:491 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-KEM-1024", conscryptProvider);

java.keyfactory · CWE-327

ML-KEM-768 Quantum-safe 3 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/MlKemTest.java:214 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-KEM-768", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlKemTest.java:602 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-KEM-768", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlKemTest.java:657 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-KEM-768", conscryptProvider);

java.keypairgenerator · CWE-327

ML-KEM-768 Quantum-safe 3 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/MlKemTest.java:319 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-KEM-768", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlKemTest.java:346 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-KEM-768", conscryptProvider);
3. common/src/test/java/org/conscrypt/MlKemTest.java:404 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-KEM-768", conscryptProvider);

java.keyfactory · CWE-327

ML-DSA-44 Quantum-safe 2 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. common/src/test/java/org/conscrypt/MlDsaTest.java:1042 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-44", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlDsaTest.java:1213 test path KeyFactory keyFactory = KeyFactory.getInstance("ML-DSA-44", conscryptProvider);

java.keyfactory · CWE-327

ML-DSA-65 Quantum-safe 2 places See details

Post-quantum algorithm through BouncyCastle

A `org.bouncycastle.pqc` class. This is migration work already in progress and is recorded so the inventory shows what has been done, not only what is outstanding.

This is already a quantum-safe algorithm. It is listed so the report shows the work that has been completed.

What to do. None. Confirm the parameter set matches the required NIST category.

1. common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java:312 test path if (expectedAlgorithm.equals("ML-DSA") || expectedAlgorithm.startsWith("MLDSA")) {
2. common/src/test/java/org/conscrypt/java/security/SignatureTest.java:165 test path } else if (sigAlgorithmUpperCase.startsWith("MLDSA")) {

java.bouncycastle.pqc

ML-KEM-1024 Quantum-safe 2 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/test/java/org/conscrypt/MlKemTest.java:280 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-KEM-1024", conscryptProvider);
2. common/src/test/java/org/conscrypt/MlKemTest.java:630 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ML-KEM-1024", conscryptProvider);

java.keypairgenerator · CWE-327

HMAC Quantum-safe 1 place See details

Message authentication code through the JCA

`Mac.getInstance()`. HMAC is not broken by Shor and is only marginally affected by Grover; it is inventoried, not flagged, unless the underlying digest is broken.

This is a fingerprint used to prove a message was not altered. Quantum computers do not break it.

What to do. No action beyond avoiding HmacMD5 and HmacSHA1.

1. common/src/test/java/org/conscrypt/MacTest.java:227 test path final Mac mac = Mac.getInstance("HMACSHA256", conscryptProvider);

java.mac