NixOS/nixpkgs

RSA2048-bit Quantum-vulnerable Recorded traffic 8 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. nixos/tests/common/acme/server/acme.test.cert.pem:1 test path -----BEGIN CERTIFICATE-----
2. nixos/tests/common/acme/server/ca.cert.pem:1 test path -----BEGIN CERTIFICATE-----
3. nixos/tests/hitch/example.pem:1 test path -----BEGIN CERTIFICATE-----
4. nixos/tests/nginx-proxyprotocol/_.test.nix.cert.pem:1 test path -----BEGIN CERTIFICATE-----
5. nixos/tests/nginx-proxyprotocol/ca.cert.pem:1 test path -----BEGIN CERTIFICATE-----
6. nixos/tests/rkvm/cert.pem:1 test path -----BEGIN CERTIFICATE-----
7. nixos/tests/tpm-ek/ca.crt:1 test path -----BEGIN CERTIFICATE-----
8. pkgs/by-name/dn/dn42-cacert/root-ca.crt:66 -----BEGIN CERTIFICATE-----

pem.certificate

Ed25519ed25519 Quantum-vulnerable 6 places See details

SSH public key

An `ssh-rsa`, `ecdsa-sha2-*`, `ssh-ed25519` or `ssh-dss` key. `ssh-dss` is disabled by default in current OpenSSH and is reported as broken.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Replace `ssh-dss` now. For the rest, enable the `sntrup761x25519-sha512` key exchange, which protects recorded sessions even while host keys stay classical.

1. nixos/doc/manual/configuration/ssh.section.md:18 users.users.alice.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAB3NzaC1kc3MAA
2. nixos/modules/profiles/keys/ssh_host_ed25519_key.pub:1 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJBWcxb/Blaqt1auOtE+F8QUWrUotiC5qBJ+UuEWdVCb
3. nixos/modules/services/backup/borgbackup.md:60 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID78zmOyA+5uPG4Ot0hfAy+sLDPU1L4AiIoRYEIVbbQ/
4. nixos/modules/services/backup/borgbackup.md:69 "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID78zmOyA+5uPG4Ot0hfAy+sLDPU1L4AiIoRYEIVbbQ
5. nixos/tests/initrd-network-ssh/id_ed25519.pub:1 test path ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBVxf7fZiqKDblHFEDxt6X9/rTjBXSn/re6b46S7/e9/
6. nixos/tests/initrd-network-ssh/ssh_host_ed25519_key.pub:1 test path ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM/0zPqqXF1CoDiiauBs6VWzFIY40Imy2Nb3Oqq5qOUg

ssh.public-key · CWE-327

ECDSAsecg/secp384r1 Quantum-vulnerable 5 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. nixos/tests/ente/acme.test.cert.pem:1 test path -----BEGIN CERTIFICATE-----
2. nixos/tests/ente/ca.cert.pem:1 test path -----BEGIN CERTIFICATE-----
3. nixos/tests/redlib/ca.cert.pem:1 test path -----BEGIN CERTIFICATE-----
4. nixos/tests/redlib/www.reddit.com.cert.pem:1 test path -----BEGIN CERTIFICATE-----
5. pkgs/by-name/ca/cacert/test-cert-file.crt:1 test path -----BEGIN CERTIFICATE-----

pem.certificate

ECDSAsecg/secp384r1 Quantum-vulnerable 4 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. nixos/tests/ente/acme.test.key.pem:1 test path -----BEGIN PRIVATE KEY-----
2. nixos/tests/ente/ca.key.pem:1 test path -----BEGIN PRIVATE KEY-----
3. nixos/tests/redlib/ca.key.pem:1 test path -----BEGIN PRIVATE KEY-----
4. nixos/tests/redlib/www.reddit.com.key.pem:1 test path -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

RSA Quantum-vulnerable Recorded traffic 4 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. nixos/tests/common/acme/server/acme.test.key.pem:1 test path -----BEGIN RSA PRIVATE KEY-----
2. nixos/tests/common/acme/server/ca.key.pem:1 test path -----BEGIN RSA PRIVATE KEY-----
3. nixos/tests/nginx-proxyprotocol/_.test.nix.key.pem:1 test path -----BEGIN RSA PRIVATE KEY-----
4. nixos/tests/nginx-proxyprotocol/ca.key.pem:1 test path -----BEGIN RSA PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

RSA2048-bit Quantum-vulnerable Recorded traffic 3 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. nixos/tests/hitch/example.pem:26 test path -----BEGIN PRIVATE KEY-----
2. nixos/tests/rkvm/key.pem:1 test path -----BEGIN PRIVATE KEY-----
3. pkgs/by-name/li/libcamera/ipa-priv-key.pem:1 -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

RSA4096-bit Quantum-vulnerable Recorded traffic 1 place See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. pkgs/by-name/gn/gnutls/dummy.crt:2 -----BEGIN CERTIFICATE-----

pem.certificate

SHA-256 Reduced margin 13 places See details

Hash function in use

`hashlib.sha256()` and friends. The digest is read from the call, so SHA-384 and above are inventory while the broken ones are reported separately.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something long-lived.

1. maintainers/scripts/kde/generate-sources.py:121 hasher = hashlib.sha256()
2. nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py:192 combined_hash = hashlib.sha256(combined.encode("utf-8")).hexdigest()
3. nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py:204 contents_hash = hashlib.sha256(contents).hexdigest()
4. nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py:213 if hashlib.sha256(Path(e.path).read_bytes()).hexdigest() != contents_hash:
5. nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py:132 hashed = hashlib.sha256(host_intf_name.encode()).hexdigest()[:6]
6. nixos/tests/google-oslogin/server.py:25 test path return hashlib.sha256(decoded_key).hexdigest()
7. nixos/tests/google-oslogin/server.py:30 test path return str(int(hashlib.sha256(username.encode()).hexdigest(), 16))[0:21]
8. pkgs/build-support/docker/stream_layered_image.py:118 self._digest = hashlib.sha256()
9. pkgs/build-support/docker/stream_layered_image.py:415 image_json_checksum = hashlib.sha256(image_json).hexdigest()
10. pkgs/build-support/rust/fetch-cargo-vendor-util.py:50 sha256_hash = hashlib.sha256()
11. pkgs/by-name/nd/ndi-6/update.py:64 sha256 = hashlib.sha256(tarball).hexdigest()
12. pkgs/by-name/nd/ndi/update.py:64 sha256 = hashlib.sha256(tarball).hexdigest()
13. pkgs/games/papermc/update.py:128 sha256_hash = hashlib.sha256()

py.hashlib

SHA3-256 Reduced margin 1 place See details

Hash function in use

`hashlib.sha256()` and friends. The digest is read from the call, so SHA-384 and above are inventory while the broken ones are reported separately.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Grover's algorithm halves the effective strength; the parameter, not the design, is the problem.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something long-lived.

1. pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py:300 content_hash = hashlib.sha3_256(content).hexdigest()

py.hashlib

unknown Could not be determined 1 place See details

Cryptographic library in the dependency manifest

A dependency known to implement classical asymmetric cryptography. Its presence is inventory, not a finding about this codebase: the library may never be called with a quantum-vulnerable algorithm.

The project depends on a cryptography library. Listed so the inventory is complete; it is not by itself a problem.

What to do. Check the version. Several of these libraries have shipped ML-KEM and ML-DSA support since 2024, so the migration may need an upgrade rather than a replacement.

1. pkgs/by-name/pa/pam_ussh/go.mod:7 golang.org/x/crypto v0.0.0-20220313003712-b769efc7c000

dep.crypto-library

BLAKE2 Quantum-safe 2 places See details

Hash function in use

`hashlib.sha256()` and friends. The digest is read from the call, so SHA-384 and above are inventory while the broken ones are reported separately.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something long-lived.

1. nixos/modules/system/boot/loader/limine/limine-install.py:147 b2sum = hashlib.blake2b()
2. nixos/modules/system/boot/loader/limine/limine-install.py:661 b2sum = hashlib.blake2b()

py.hashlib

SHA-512 Quantum-safe 1 place See details

Hash function in use

`hashlib.sha256()` and friends. The digest is read from the call, so SHA-384 and above are inventory while the broken ones are reported separately.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something long-lived.

1. pkgs/by-name/se/session-desktop/generate_pnpm_patch.py:25 integrity = base64.b64encode(hashlib.sha512(data).digest()).decode()

py.hashlib