Crypto-View

To address	895
Key establishment	233
Inventory only	1
Total findings	1275

Branch	`master`
Commit	`fa946c527a6c0564a6ec2a5f5c5b9ae1feeb657a` Merge pull request #2794 from smallstep/josh/webhook-content-type
Committed	2026-09-08 20:07 UTC
Scanned	2026-09-10 22:16 UTC 3 hours ago
Coverage	456 files, 338 go

Scanned	Commit	To address
3 hours ago this scan	`fa946c527a6c` master	895
3 hours ago	`fa946c527a6c` master	444	Compare
17 hours ago	`b4518162981a`	448	Compare
17 hours ago	`fa946c527a6c` master	444	Compare
19 hours ago	`fa946c527a6c` master	444	Compare
23 hours ago	`fa946c527a6c` master	444	Compare
23 hours ago	`fa946c527a6c` master	444	Compare
23 hours ago	`fa946c527a6c` master	444	Compare
1 day ago	`fa946c527a6c` master	444	Compare
3 days ago	`bb481fbf670c` master	458	Compare
3 days ago	`bb481fbf670c` master	458	Compare
4 days ago	`bb481fbf670c` master	458	Compare
10 days ago	`3f006a5d3288` master	458	Compare
11 days ago	`b4518162981a`	462	Compare

RSA-10241024-bit Already broken 37 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

authority/provisioner/aws_certificates.pem:6 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:27 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:48 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:69 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:90 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:106 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:123 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:139 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:161 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:182 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:203 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:224 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:240 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:261 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:277 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:298 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:319 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:335 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:351 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:367 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:383 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:399 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:420 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:441 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:457 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:478 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:499 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:515 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:536 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:557 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:578 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:599 -----BEGIN CERTIFICATE-----
authority/provisioner/aws_certificates.pem:620 -----BEGIN CERTIFICATE-----
authority/provisioner/testdata/certs/aws-test.crt:1 test path -----BEGIN CERTIFICATE-----
authority/provisioner/testdata/certs/aws-test.crt:20 test path -----BEGIN CERTIFICATE-----
authority/provisioner/testdata/certs/aws.crt:1 test path -----BEGIN CERTIFICATE-----
authority/provisioner/utils_test.go:58 test path -----BEGIN CERTIFICATE-----

pem.certificate

RSAES-PKCS1v15 Already broken Recorded traffic 21 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

authority/config/tls_options.go:121 "TLS_RSA_WITH_RC4_128_SHA": tls.TLS_RSA_WITH_RC4_128_SHA, // lgtm[go/insecure-tls]
authority/config/tls_options.go:122 "TLS_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
authority/config/tls_options.go:123 "TLS_RSA_WITH_AES_128_CBC_SHA": tls.TLS_RSA_WITH_AES_128_CBC_SHA,
authority/config/tls_options.go:124 "TLS_RSA_WITH_AES_256_CBC_SHA": tls.TLS_RSA_WITH_AES_256_CBC_SHA,
authority/config/tls_options.go:125 "TLS_RSA_WITH_AES_128_CBC_SHA256": tls.TLS_RSA_WITH_AES_128_CBC_SHA256, // lgtm[go/insecure-tls]
authority/config/tls_options.go:126 "TLS_RSA_WITH_AES_128_GCM_SHA256": tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
authority/config/tls_options.go:127 "TLS_RSA_WITH_AES_256_GCM_SHA384": tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
authority/config/tls_options_test.go:59 test path {"TLS_RSA_WITH_RC4_128_SHA", CipherSuites{"TLS_RSA_WITH_RC4_128_SHA"}, false},
authority/config/tls_options_test.go:60 test path {"TLS_RSA_WITH_3DES_EDE_CBC_SHA", CipherSuites{"TLS_RSA_WITH_3DES_EDE_CBC_SHA"}, false},
authority/config/tls_options_test.go:61 test path {"TLS_RSA_WITH_AES_128_CBC_SHA", CipherSuites{"TLS_RSA_WITH_AES_128_CBC_SHA"}, false},
authority/config/tls_options_test.go:62 test path {"TLS_RSA_WITH_AES_256_CBC_SHA", CipherSuites{"TLS_RSA_WITH_AES_256_CBC_SHA"}, false},
authority/config/tls_options_test.go:63 test path {"TLS_RSA_WITH_AES_128_CBC_SHA256", CipherSuites{"TLS_RSA_WITH_AES_128_CBC_SHA256"}, false},
authority/config/tls_options_test.go:64 test path {"TLS_RSA_WITH_AES_128_GCM_SHA256", CipherSuites{"TLS_RSA_WITH_AES_128_GCM_SHA256"}, false},
authority/config/tls_options_test.go:65 test path {"TLS_RSA_WITH_AES_256_GCM_SHA384", CipherSuites{"TLS_RSA_WITH_AES_256_GCM_SHA384"}, false},
authority/config/tls_options_test.go:98 test path {"TLS_RSA_WITH_RC4_128_SHA", CipherSuites{"TLS_RSA_WITH_RC4_128_SHA"}, []uint16{tls.TLS_RSA_WITH_RC4_128_SHA}},
authority/config/tls_options_test.go:99 test path {"TLS_RSA_WITH_3DES_EDE_CBC_SHA", CipherSuites{"TLS_RSA_WITH_3DES_EDE_CBC_SHA"}, []uint16{tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA}},
authority/config/tls_options_test.go:100 test path {"TLS_RSA_WITH_AES_128_CBC_SHA", CipherSuites{"TLS_RSA_WITH_AES_128_CBC_SHA"}, []uint16{tls.TLS_RSA_WITH_AES_128_CBC_SHA}},
authority/config/tls_options_test.go:101 test path {"TLS_RSA_WITH_AES_256_CBC_SHA", CipherSuites{"TLS_RSA_WITH_AES_256_CBC_SHA"}, []uint16{tls.TLS_RSA_WITH_AES_256_CBC_SHA}},
authority/config/tls_options_test.go:102 test path {"TLS_RSA_WITH_AES_128_CBC_SHA256", CipherSuites{"TLS_RSA_WITH_AES_128_CBC_SHA256"}, []uint16{tls.TLS_RSA_WITH_AES_128_CBC_SHA256}},
authority/config/tls_options_test.go:103 test path {"TLS_RSA_WITH_AES_128_GCM_SHA256", CipherSuites{"TLS_RSA_WITH_AES_128_GCM_SHA256"}, []uint16{tls.TLS_RSA_WITH_AES_128_GCM_SHA256}},
authority/config/tls_options_test.go:104 test path {"TLS_RSA_WITH_AES_256_GCM_SHA384", CipherSuites{"TLS_RSA_WITH_AES_256_GCM_SHA384"}, []uint16{tls.TLS_RSA_WITH_AES_256_GCM_SHA384}},

config.cipher-suite · CWE-757

RC4 Already broken 7 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

authority/config/tls_options.go:121 "TLS_RSA_WITH_RC4_128_SHA": tls.TLS_RSA_WITH_RC4_128_SHA, // lgtm[go/insecure-tls]
authority/config/tls_options.go:128 "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA": tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, // lgtm[go/insecure-tls]
authority/config/tls_options.go:131 "TLS_ECDHE_RSA_WITH_RC4_128_SHA": tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, // lgtm[go/insecure-tls]
authority/config/tls_options_test.go:59 test path {"TLS_RSA_WITH_RC4_128_SHA", CipherSuites{"TLS_RSA_WITH_RC4_128_SHA"}, false},
authority/config/tls_options_test.go:66 test path {"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", CipherSuites{"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"}, false},
authority/config/tls_options_test.go:98 test path {"TLS_RSA_WITH_RC4_128_SHA", CipherSuites{"TLS_RSA_WITH_RC4_128_SHA"}, []uint16{tls.TLS_RSA_WITH_RC4_128_SHA}},
authority/config/tls_options_test.go:105 test path {"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", CipherSuites{"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA}},

config.cipher-suite · CWE-757

3DES Already broken 6 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

authority/config/tls_options.go:122 "TLS_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
authority/config/tls_options.go:132 "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
authority/config/tls_options_test.go:60 test path {"TLS_RSA_WITH_3DES_EDE_CBC_SHA", CipherSuites{"TLS_RSA_WITH_3DES_EDE_CBC_SHA"}, false},
authority/config/tls_options_test.go:73 test path {"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", CipherSuites{"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"}, false},
authority/config/tls_options_test.go:99 test path {"TLS_RSA_WITH_3DES_EDE_CBC_SHA", CipherSuites{"TLS_RSA_WITH_3DES_EDE_CBC_SHA"}, []uint16{tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA}},
authority/config/tls_options_test.go:112 test path {"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", CipherSuites{"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"}, []uint16{tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA}},

config.cipher-suite · CWE-757

RSA-10241024-bit Already broken Recorded traffic 5 places See details

RSA in the Go standard library

`rsa.GenerateKey()`, `rsa.SignPKCS1v15()`, `rsa.EncryptOAEP()` or an import of `crypto/rsa`.

This is already unsafe today, with no quantum computer involved. A modulus of 1024 bits or less is below the NIST SP 800-57 floor and is within reach of classical factorisation. Shor is not the nearest problem here.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Go 1.24 ships ML-KEM as `crypto/mlkem`.

authority/provisioner/aws_test.go:755 test path rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)
authority/provisioner/azure_test.go:667 test path rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)
authority/provisioner/gcp_test.go:649 test path rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)
authority/provisioner/jwk_test.go:423 test path rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)
authority/provisioner/oidc_test.go:559 test path rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)

go.rsa · CWE-327

SHA-1 Already broken 4 places See details

Broken hash function

An import of `crypto/md5` or `crypto/sha1`, or a call to `New()` on either.

This is already unsafe today, with no quantum computer involved. SHAttered and subsequent work produced practical collisions; NIST withdrew SHA-1 in 2030 guidance and it is already unacceptable for signatures.

What to do. `crypto/sha256`, or `crypto/sha512` for long-lived signatures.

authority/provisioner/collection.go:325 sum := sha1.Sum([]byte(p.GetID()))
authority/tls_test.go:224 test path hash := sha1.Sum(info.SubjectPublicKey.Bytes)
ca/ca_test.go:70 test path hash := sha1.Sum(info.SubjectPublicKey.Bytes)
test/integration/scep/common_test.go:456 test path h := sha1.Sum(publicKeyBytes)

go.hash.weak · CWE-328

RSA-10241048-bit Already broken 1 place See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

authority/provisioner/testdata/certs/short-rsa.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----

pem.certificate-request

RSA-10241024-bit Already broken 1 place See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

authority/tls_test.go:372 test path -----BEGIN CERTIFICATE REQUEST-----

pem.certificate-request

ECDSA Quantum-vulnerable 303 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

acme/account_test.go:23 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/account_test.go:32 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/account_test.go:521 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/account_test.go:541 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/account_test.go:560 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/account_test.go:585 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/account_test.go:660 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/account_test.go:691 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/account_test.go:710 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/account_test.go:750 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:20 test path jwkX, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:22 test path jwkY, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:24 test path wrongJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:92 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:115 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:177 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:201 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:226 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:272 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:319 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:368 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:417 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:466 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:523 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:570 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:629 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:684 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:686 test path differentJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:741 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:795 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:907 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:919 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:931 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:943 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:955 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:967 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:980 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:1018 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:1055 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/eab_test.go:1093 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/handler_test.go:661 test path _jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/handler_test.go:701 test path _jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/middleware_test.go:364 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/middleware_test.go:421 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/middleware_test.go:476 test path _jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/middleware_test.go:500 test path _jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/middleware_test.go:614 test path "alg": "ES256",
acme/api/middleware_test.go:680 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/middleware_test.go:979 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/middleware_test.go:1263 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/middleware_test.go:1379 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/middleware_test.go:1459 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/middleware_test.go:1551 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/middleware_test.go:1627 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/middleware_test.go:1665 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/middleware_test.go:1820 test path "alg": "ES256",
acme/api/middleware_test.go:1835 test path "alg": "ES256",
acme/api/middleware_test.go:1850 test path "alg": "ES256",
acme/api/order_test.go:568 test path Algorithms: []string{"ES256"},
acme/api/order_test.go:572 test path SignatureAlgorithms: []string{"ES256"},
acme/api/order_test.go:2012 test path Algorithms: []string{"ES256"},
acme/api/order_test.go:2016 test path SignatureAlgorithms: []string{"ES256"},
acme/api/revoke_test.go:151 test path return "ES256", crypto.SHA256
acme/api/revoke_test.go:153 test path return "ES384", crypto.SHA384
acme/api/revoke_test.go:155 test path return "ES512", crypto.SHA512
acme/api/wire_integration_test.go:132 test path accessTokenSignerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/wire_integration_test.go:145 test path oidcTokenSignerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/api/wire_integration_test.go:173 test path Algorithms: []string{"ES256"},
acme/api/wire_integration_test.go:177 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_test.go:132 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:515 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:526 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:839 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:885 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:1029 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:1083 test path Algorithms: []string{"ES256"},
acme/challenge_test.go:1087 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_test.go:1138 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:1192 test path Algorithms: []string{"ES256"},
acme/challenge_test.go:1196 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_test.go:1238 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:1328 test path Algorithms: []string{"ES256"},
acme/challenge_test.go:1332 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_test.go:1389 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:1479 test path Algorithms: []string{"ES256"},
acme/challenge_test.go:1483 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_test.go:1568 test path "id_token_signing_alg_values_supported": ["ES256"]
acme/challenge_test.go:1778 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:1802 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:1845 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:1889 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:1932 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:2079 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:2102 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:2145 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:2187 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:2231 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:2568 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:2606 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:2645 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:2689 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:2734 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:2778 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:2822 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:2849 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:2889 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:2930 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:2974 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:3019 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:3059 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:3100 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:3147 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:3195 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:3240 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:3286 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:3324 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:3691 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:3933 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:4686 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_test.go:4821 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_tpmsimulator_test.go:485 test path jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:57 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:61 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:88 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:92 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:130 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:134 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:172 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:176 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:226 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:230 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:301 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:392 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:396 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:449 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:540 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:544 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:601 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:692 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:696 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:753 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:844 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:848 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:911 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:1001 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:1005 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:1056 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:1146 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:1150 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:1201 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:1291 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:1295 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:1341 test path maliciousJwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:1348 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:1438 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:1442 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:1489 test path maliciousJwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:1496 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:1586 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:1590 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:1642 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:1732 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:1736 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:1787 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:1877 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:1881 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:1932 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:2022 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:2026 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:2077 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:2167 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:2171 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:2222 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:2224 test path maliciousSignerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:2314 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:2318 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:2369 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:2459 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:2463 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:2515 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:2605 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:2609 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:2714 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:2718 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:2745 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:2749 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:2794 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:2798 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:2832 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:2839 test path anotherSignerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:2888 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:2892 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:2942 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:2996 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:3000 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:3050 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:3104 test path Algorithms: []string{"ES256"},
acme/challenge_wire_test.go:3108 test path SignatureAlgorithms: []string{"ES256"},
acme/challenge_wire_test.go:3153 test path signerJWK, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
acme/challenge_wire_test.go:3207 test path Algorithms: []string{"ES256"},

Showing the first 200. The CBOM has every one.

jose.algorithm · CWE-327

ECDH Quantum-vulnerable Recorded traffic 117 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

authority/config/config_test.go:168 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
authority/config/config_test.go:177 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
authority/config/config_test.go:197 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
authority/config/tls_options.go:20 "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
authority/config/tls_options.go:21 "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
authority/config/tls_options.go:26 "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
authority/config/tls_options.go:27 "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
authority/config/tls_options.go:28 "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
authority/config/tls_options.go:29 "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
authority/config/tls_options.go:30 "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
authority/config/tls_options.go:31 "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
authority/config/tls_options.go:34 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
authority/config/tls_options.go:35 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
authority/config/tls_options.go:36 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
authority/config/tls_options.go:37 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
authority/config/tls_options.go:128 "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA": tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, // lgtm[go/insecure-tls]
authority/config/tls_options.go:129 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
authority/config/tls_options.go:130 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
authority/config/tls_options.go:131 "TLS_ECDHE_RSA_WITH_RC4_128_SHA": tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, // lgtm[go/insecure-tls]
authority/config/tls_options.go:132 "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
authority/config/tls_options.go:133 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
authority/config/tls_options.go:134 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
authority/config/tls_options.go:135 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, // lgtm[go/insecure-tls]
authority/config/tls_options.go:136 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, // lgtm[go/insecure-tls]
authority/config/tls_options.go:137 "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
authority/config/tls_options.go:138 "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
authority/config/tls_options.go:139 "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
authority/config/tls_options.go:140 "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
authority/config/tls_options.go:141 "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256": tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
authority/config/tls_options.go:142 "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
authority/config/tls_options.go:150 "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305": tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
authority/config/tls_options.go:151 "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
authority/config/tls_options_test.go:66 test path {"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", CipherSuites{"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"}, false},
authority/config/tls_options_test.go:67 test path {"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA"}, false},
authority/config/tls_options_test.go:68 test path {"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"}, false},
authority/config/tls_options_test.go:69 test path {"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"}, false},
authority/config/tls_options_test.go:70 test path {"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"}, false},
authority/config/tls_options_test.go:71 test path {"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"}, false},
authority/config/tls_options_test.go:72 test path {"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", CipherSuites{"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305"}, false},
authority/config/tls_options_test.go:73 test path {"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", CipherSuites{"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"}, false},
authority/config/tls_options_test.go:74 test path {"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"}, false},
authority/config/tls_options_test.go:75 test path {"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"}, false},
authority/config/tls_options_test.go:76 test path {"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"}, false},
authority/config/tls_options_test.go:77 test path {"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"}, false},
authority/config/tls_options_test.go:78 test path {"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"}, false},
authority/config/tls_options_test.go:79 test path {"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", CipherSuites{"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"}, false},
authority/config/tls_options_test.go:80 test path {"multiple", CipherSuites{"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"}, false},
authority/config/tls_options_test.go:81 test path {"fail", CipherSuites{"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", "TLS_BAD_CIPHERSUITE"}, true},
authority/config/tls_options_test.go:105 test path {"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", CipherSuites{"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA}},
authority/config/tls_options_test.go:106 test path {"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA}},
authority/config/tls_options_test.go:107 test path {"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256}},
authority/config/tls_options_test.go:108 test path {"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256}},
authority/config/tls_options_test.go:109 test path {"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA}},
authority/config/tls_options_test.go:110 test path {"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", CipherSuites{"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384}},
authority/config/tls_options_test.go:111 test path {"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", CipherSuites{"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305}},
authority/config/tls_options_test.go:112 test path {"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", CipherSuites{"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"}, []uint16{tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA}},
authority/config/tls_options_test.go:113 test path {"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"}, []uint16{tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA}},
authority/config/tls_options_test.go:114 test path {"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"}, []uint16{tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256}},
authority/config/tls_options_test.go:115 test path {"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"}, []uint16{tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256}},
authority/config/tls_options_test.go:116 test path {"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"}, []uint16{tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA}},
authority/config/tls_options_test.go:117 test path {"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", CipherSuites{"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"}, []uint16{tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384}},
authority/config/tls_options_test.go:118 test path {"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", CipherSuites{"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"}, []uint16{tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305}},
authority/config/tls_options_test.go:119 test path {"multiple", CipherSuites{"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256}},
authority/config/tls_options_test.go:120 test path {"fail", CipherSuites{"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", "TLS_BAD_CIPHERSUITE"}, []uint16{tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, 0}},
authority/config/tls_options_test.go:144 test path CipherSuites: []uint16{tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
authority/config/tls_options_test.go:150 test path CipherSuites: []uint16{tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
authority/tls_test.go:1482 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
authority/tls_test.go:1483 test path "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
ca/identity/testdata/config/ca.json:34 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
ca/identity/testdata/config/ca.json:35 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
ca/testdata/ca.json:15 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
ca/testdata/ca.json:16 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
ca/testdata/federated-ca.json:15 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
ca/testdata/federated-ca.json:16 test path "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
ca/testdata/federated-ca.json:17 test path "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
ca/testdata/rotate-ca-0.json:14 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
ca/testdata/rotate-ca-0.json:15 test path "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
ca/testdata/rotate-ca-0.json:16 test path "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
ca/testdata/rotate-ca-1.json:14 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
ca/testdata/rotate-ca-1.json:15 test path "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
ca/testdata/rotate-ca-1.json:16 test path "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
ca/testdata/rotate-ca-2.json:14 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
ca/testdata/rotate-ca-2.json:15 test path "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
ca/testdata/rotate-ca-2.json:16 test path "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
ca/testdata/rotate-ca-3.json:14 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
ca/testdata/rotate-ca-3.json:15 test path "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
ca/testdata/rotate-ca-3.json:16 test path "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
ca/testdata/rsaca.json:15 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
ca/testdata/rsaca.json:16 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
examples/basic-federation/pki/cloud/config/ca.federated.json:33 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
examples/basic-federation/pki/cloud/config/ca.federated.json:34 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
examples/basic-federation/pki/cloud/config/ca.json:33 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
examples/basic-federation/pki/cloud/config/ca.json:34 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
examples/basic-federation/pki/kubernetes/config/ca.federated.json:33 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
examples/basic-federation/pki/kubernetes/config/ca.federated.json:34 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
examples/basic-federation/pki/kubernetes/config/ca.json:33 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
examples/basic-federation/pki/kubernetes/config/ca.json:34 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
examples/docker/ca/pki/config/ca.json:51 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
examples/docker/ca/pki/config/ca.json:52 test path "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
examples/pki/config/ca.json:87 test path "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
examples/pki/config/ca.json:88 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
pki/testdata/helm/simple.yml:26 test path - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
pki/testdata/helm/simple.yml:27 test path - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:27 test path - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:28 test path - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
pki/testdata/helm/with-acme.yml:27 test path - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
pki/testdata/helm/with-acme.yml:28 test path - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
pki/testdata/helm/with-admin.yml:26 test path - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
pki/testdata/helm/with-admin.yml:27 test path - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
pki/testdata/helm/with-provisioner.yml:26 test path - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
pki/testdata/helm/with-provisioner.yml:27 test path - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
pki/testdata/helm/with-ssh-and-acme.yml:31 test path - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
pki/testdata/helm/with-ssh-and-acme.yml:32 test path - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:30 test path - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:31 test path - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
pki/testdata/helm/with-ssh.yml:30 test path - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
pki/testdata/helm/with-ssh.yml:31 test path - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

config.cipher-suite · CWE-757

TLS Quantum-vulnerable Recorded traffic 65 places See details

TLS configuration in code

A `tls.Config` field pinning versions, cipher suites or curve preferences. Every available suite negotiates a classical key exchange.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Every TLS cipher suite in general use negotiates a classical key exchange, so a recorded session is decryptable once that exchange falls.

What to do. Set `MinVersion: tls.VersionTLS13`. Go 1.24 enables the hybrid X25519MLKEM768 group by default, which is the single highest-value change available today.

acme/challenge.go:242 config := &tls.Config{
acme/challenge_test.go:2304 test path srv.TLS = &tls.Config{
acme/client.go:59 TLSClientConfig: &tls.Config{
authority/config/config_test.go:167 test path CipherSuites: CipherSuites{
authority/config/config_test.go:176 test path CipherSuites: CipherSuites{
authority/config/config_test.go:196 test path CipherSuites: CipherSuites{
authority/config/tls_options.go:42 CipherSuites: DefaultTLSCipherSuites,
authority/config/tls_options.go:164 func (t *TLSOptions) TLSConfig() *tls.Config {
authority/config/tls_options.go:172 return &tls.Config{
authority/config/tls_options.go:173 CipherSuites: t.CipherSuites.Value(),
authority/config/tls_options_test.go:143 test path {"default", fields{DefaultTLSCipherSuites, DefaultTLSMinVersion, DefaultTLSMaxVersion, DefaultTLSRenegotiation}, &tls.Config{
authority/config/tls_options_test.go:144 test path CipherSuites: []uint16{tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
authority/config/tls_options_test.go:149 test path {"renegotation", fields{DefaultTLSCipherSuites, DefaultTLSMinVersion, DefaultTLSMaxVersion, true}, &tls.Config{
authority/config/tls_options_test.go:150 test path CipherSuites: []uint16{tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
authority/config/tls_options_test.go:159 test path CipherSuites: tt.fields.CipherSuites,
authority/http_client.go:47 tr.TLSClientConfig = &tls.Config{
authority/http_client_test.go:84 test path srv.TLS = &tls.Config{
authority/linkedca.go:482 conn, err := grpc.NewClient(endpoint, grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{
authority/linkedca.go:532 conn, err := grpc.NewClient(endpoint, grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{
authority/linkedca.go:609 return cert, &tls.Config{
authority/provisioner/webhook_test.go:654 test path transport.TLSClientConfig = &tls.Config{
authority/tls_test.go:1481 test path CipherSuites: CipherSuites{
ca/bootstrap_test.go:232 test path {"fail with TLSConfig", args{context.Background(), token(), &http.Server{TLSConfig: &tls.Config{}}}, true},
ca/bootstrap_test.go:290 test path {"fail with TLSConfig", args{context.Background(), token(), &http.Server{TLSConfig: &tls.Config{}}}, true},
ca/ca.go:634 serverTLSConfig = &tls.Config{
ca/client.go:70 Transport: getDefaultTransport(&tls.Config{InsecureSkipVerify: true}),
ca/client.go:257 tr.TLSClientConfig = &tls.Config{
ca/client.go:267 tr.TLSClientConfig = &tls.Config{
ca/client.go:311 TLSClientConfig: &tls.Config{
ca/client.go:433 return getDefaultTransport(&tls.Config{
ca/client.go:451 return getDefaultTransport(&tls.Config{
ca/client.go:462 return getDefaultTransport(&tls.Config{
ca/identity/client.go:65 tr.TLSClientConfig = &tls.Config{
ca/identity/client_test.go:59 test path okServer.TLS = &tls.Config{
ca/identity/client_test.go:135 test path tr.TLSClientConfig = &tls.Config{
ca/identity/identity.go:300 tr.TLSClientConfig = &tls.Config{
ca/tls.go:66 Config: &tls.Config{
ca/tls.go:294 func getDefaultTLSConfig(sign *api.SignResponse) *tls.Config {
ca/tls.go:298 return &tls.Config{
ca/tls_options_test.go:35 test path {"ok", args{client, &tls.Config{}, &api.SignResponse{}}, &TLSOptionCtx{Client: client, Config: &tls.Config{}, Sign: &api.SignResponse{}, mutableConfig: newMutableTLSConfig()}},
ca/tls_options_test.go:66 test path {"ok", fields{&tls.Config{}}, args{[]TLSOption{RequireAndVerifyClientCert()}}, false},
ca/tls_options_test.go:67 test path {"ok", fields{&tls.Config{}}, args{[]TLSOption{VerifyClientCertIfGiven()}}, false},
ca/tls_options_test.go:68 test path {"fail", fields{&tls.Config{}}, args{[]TLSOption{VerifyClientCertIfGiven(), fail()}}, true},
ca/tls_options_test.go:89 test path {"ok", &tls.Config{ClientAuth: tls.RequireAndVerifyClientCert}},
ca/tls_options_test.go:94 test path Config: &tls.Config{},
ca/tls_options_test.go:114 test path {"ok", &tls.Config{ClientAuth: tls.VerifyClientCertIfGiven}},
ca/tls_options_test.go:119 test path Config: &tls.Config{},
ca/tls_options_test.go:147 test path {"ok", args{cert}, &tls.Config{RootCAs: pool}},
ca/tls_options_test.go:152 test path Config: &tls.Config{},
ca/tls_options_test.go:180 test path {"ok", args{cert}, &tls.Config{ClientCAs: pool}},
ca/tls_options_test.go:185 test path Config: &tls.Config{},
ca/tls_options_test.go:227 test path {"ok", args{client, &tls.Config{}}, &tls.Config{RootCAs: pool}, false},
ca/tls_options_test.go:228 test path {"fail", args{clientFail, &tls.Config{}}, &tls.Config{}, true},
ca/tls_options_test.go:276 test path {"ok", args{client, &tls.Config{}}, &tls.Config{ClientCAs: pool}, false},
ca/tls_options_test.go:277 test path {"fail", args{clientFail, &tls.Config{}}, &tls.Config{}, true},
ca/tls_options_test.go:330 test path {"ok", args{client, &tls.Config{}}, &tls.Config{RootCAs: pool}, false},
ca/tls_options_test.go:331 test path {"fail", args{clientFail, &tls.Config{}}, &tls.Config{}, true},
ca/tls_options_test.go:387 test path {"ok", args{client, &tls.Config{}}, &tls.Config{ClientCAs: pool}, false},
ca/tls_options_test.go:388 test path {"fail", args{clientFail, &tls.Config{}}, &tls.Config{}, true},
ca/tls_options_test.go:439 test path {"ok", args{client, &tls.Config{}}, &tls.Config{ClientCAs: pool, RootCAs: pool}, false},
ca/tls_options_test.go:440 test path {"fail", args{clientFail, &tls.Config{}}, &tls.Config{}, true},
ca/tls_options_test.go:493 test path {"ok", args{client, &tls.Config{}}, &tls.Config{ClientCAs: pool, RootCAs: pool}, false},
ca/tls_options_test.go:494 test path {"fail", args{clientFail, &tls.Config{}}, &tls.Config{}, true},
test/integration/requestid_test.go:280 test path srv.TLS = &tls.Config{
test/integration/scep/common_test.go:178 test path transport.TLSClientConfig = &tls.Config{

go.tls.config · CWE-757

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 56 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

api/api_test.go:71 test path -----BEGIN CERTIFICATE-----
api/api_test.go:121 test path -----BEGIN CERTIFICATE-----
authority/provisioner/testdata/certs/bad-extension.crt:1 test path -----BEGIN CERTIFICATE-----
authority/provisioner/testdata/certs/foo.crt:1 test path -----BEGIN CERTIFICATE-----
authority/provisioner/testdata/certs/good-extension.crt:1 test path -----BEGIN CERTIFICATE-----
authority/provisioner/testdata/certs/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
authority/provisioner/testdata/certs/x5c-leaf.crt:1 test path -----BEGIN CERTIFICATE-----
authority/provisioner/testdata/certs/x5c-leaf.crt:13 test path -----BEGIN CERTIFICATE-----
authority/provisioner/utils_test.go:269 test path -----BEGIN CERTIFICATE-----
authority/provisioner/x5c_test.go:105 test path -----BEGIN CERTIFICATE-----
authority/provisioner/x5c_test.go:117 test path -----BEGIN CERTIFICATE-----
authority/provisioner/x5c_test.go:192 test path -----BEGIN CERTIFICATE-----
authority/provisioner/x5c_test.go:220 test path -----BEGIN CERTIFICATE-----
authority/provisioner/x5c_test.go:231 test path -----BEGIN CERTIFICATE-----
authority/provisioner/x5c_test.go:259 test path -----BEGIN CERTIFICATE-----
authority/provisioner/x5c_test.go:271 test path -----BEGIN CERTIFICATE-----
authority/provisioner/x5c_test.go:301 test path -----BEGIN CERTIFICATE-----
authority/provisioner/x5c_test.go:313 test path -----BEGIN CERTIFICATE-----
authority/testdata/certs/foo.crt:1 test path -----BEGIN CERTIFICATE-----
authority/testdata/certs/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
authority/testdata/certs/provisioner-not-found.crt:1 test path -----BEGIN CERTIFICATE-----
authority/testdata/certs/renew-disabled.crt:1 test path -----BEGIN CERTIFICATE-----
authority/testdata/certs/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
authority/testdata/scep/root.crt:1 test path -----BEGIN CERTIFICATE-----
ca/client_test.go:60 test path -----BEGIN CERTIFICATE-----
ca/identity/testdata/certs/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
ca/identity/testdata/certs/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
ca/identity/testdata/certs/server.crt:1 test path -----BEGIN CERTIFICATE-----
ca/identity/testdata/certs/server.crt:15 test path -----BEGIN CERTIFICATE-----
ca/identity/testdata/identity/expired.crt:1 test path -----BEGIN CERTIFICATE-----
ca/identity/testdata/identity/expired.crt:15 test path -----BEGIN CERTIFICATE-----
ca/identity/testdata/identity/identity.crt:1 test path -----BEGIN CERTIFICATE-----
ca/identity/testdata/identity/identity.crt:15 test path -----BEGIN CERTIFICATE-----
ca/identity/testdata/identity/not_before.crt:1 test path -----BEGIN CERTIFICATE-----
ca/identity/testdata/identity/not_before.crt:15 test path -----BEGIN CERTIFICATE-----
ca/testdata/rotated/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
ca/testdata/rotated/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
ca/testdata/secrets/federated_ca.crt:1 test path -----BEGIN CERTIFICATE-----
ca/testdata/secrets/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
ca/testdata/secrets/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
cas/cloudcas/cloudcas_test.go:54 test path -----BEGIN CERTIFICATE-----
cas/cloudcas/cloudcas_test.go:64 test path -----BEGIN CERTIFICATE-----
cas/cloudcas/cloudcas_test.go:75 test path -----BEGIN CERTIFICATE-----
cas/cloudcas/cloudcas_test.go:87 test path -----BEGIN CERTIFICATE-----
cas/vaultcas/vaultcas_test.go:22 test path -----BEGIN CERTIFICATE-----
cas/vaultcas/vaultcas_test.go:64 test path -----BEGIN CERTIFICATE-----
examples/basic-federation/pki/cloud/certs/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
examples/basic-federation/pki/cloud/certs/kubernetes_root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
examples/basic-federation/pki/cloud/certs/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
examples/basic-federation/pki/kubernetes/certs/cloud_root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
examples/basic-federation/pki/kubernetes/certs/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
examples/basic-federation/pki/kubernetes/certs/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
examples/docker/ca/pki/secrets/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
examples/docker/ca/pki/secrets/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
examples/pki/secrets/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
examples/pki/secrets/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----

pem.certificate

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 40 places See details

ECDSA in the Go standard library

`ecdsa.GenerateKey()` or `ecdsa.Sign*()`. The curve is read from the `elliptic.P###()` argument.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

acme/challenge_test.go:146 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
acme/challenge_test.go:203 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
acme/challenge_test.go:248 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
acme/challenge_test.go:302 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
acme/challenge_test.go:3530 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
acme/challenge_test.go:3679 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
acme/challenge_test.go:3704 test path otherSigner, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
acme/challenge_test.go:3923 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
acme/challenge_test.go:4684 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
acme/challenge_test.go:4819 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
acme/challenge_test.go:5116 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
acme/challenge_test.go:5201 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
acme/challenge_test.go:5283 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
api/api_test.go:1469 test path p256, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
api/ssh_test.go:39 test path priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
authority/provisioner/nebula_test.go:83 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
authority/provisioner/nebula_test.go:135 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
authority/ssh_test.go:139 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
authority/ssh_test.go:143 test path signKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
authority/ssh_test.go:321 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
authority/ssh_test.go:325 test path signKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
authority/ssh_test.go:413 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
authority/ssh_test.go:418 test path key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
authority/ssh_test.go:455 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
authority/ssh_test.go:460 test path key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
authority/ssh_test.go:497 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
authority/ssh_test.go:505 test path key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
authority/ssh_test.go:883 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
authority/ssh_test.go:887 test path signKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
authority/tls_test.go:86 test path priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
authority/tls_test.go:114 test path priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
authority/tls_test.go:132 test path priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
ca/client.go:1461 pk, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
ca/client_test.go:113 test path priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
cas/softcas/softcas_test.go:475 test path rootSigner, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
cas/stepcas/x5c_issuer_test.go:246 test path p256 := mustSigner(ecdsa.GenerateKey(elliptic.P256(), rand.Reader))
templates/templates_test.go:220 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
templates/templates_test.go:226 test path key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
templates/templates_test.go:291 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
templates/templates_test.go:297 test path key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

go.ecdsa · CWE-327

ECDSA Quantum-vulnerable 31 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

authority/provisioner/testdata/secrets/ecdsa.key:1 test path -----BEGIN EC PRIVATE KEY-----
authority/provisioner/testdata/secrets/foo.key:1 test path -----BEGIN EC PRIVATE KEY-----
authority/provisioner/testdata/secrets/x5c-leaf.key:1 test path -----BEGIN EC PRIVATE KEY-----
authority/testdata/scep/root.key:1 test path -----BEGIN EC PRIVATE KEY-----
authority/testdata/secrets/foo.key:1 test path -----BEGIN EC PRIVATE KEY-----
authority/testdata/secrets/provisioner-not-found.key:1 test path -----BEGIN EC PRIVATE KEY-----
authority/testdata/secrets/renew-disabled.key:1 test path -----BEGIN EC PRIVATE KEY-----
cas/cloudcas/cloudcas_test.go:107 test path -----BEGIN EC PRIVATE KEY-----
cas/cloudcas/cloudcas_test.go:113 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/simple.yml:67 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/simple.yml:78 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:68 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:79 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-acme.yml:68 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-acme.yml:79 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-admin.yml:67 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-admin.yml:78 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-provisioner.yml:67 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-provisioner.yml:78 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-ssh-and-acme.yml:77 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-ssh-and-acme.yml:88 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-ssh-and-acme.yml:95 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-ssh-and-acme.yml:102 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:76 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:87 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:94 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:101 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-ssh.yml:76 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-ssh.yml:87 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-ssh.yml:94 test path -----BEGIN EC PRIVATE KEY-----
pki/testdata/helm/with-ssh.yml:101 test path -----BEGIN EC PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 30 places See details

Public key declared as a JSON Web Key

A `kty` field, with the curve read from the sibling `crv` where the family needs one. A JWKS document declares a key without naming an algorithm anywhere, so it is invisible to a scan that only looks for `alg`.

This file publishes the public keys other systems use to check this system's signatures. Everyone who trusts these keys has to accept the new kind of key before the old ones can be retired.

What to do. A published JWKS is what relying parties trust. It has to accept a post-quantum key type before the keys behind it can change, so put it early in the migration order.

ca/identity/testdata/config/ca.json:21 test path "kty": "EC",
ca/testdata/ca.json:28 test path "kty": "EC",
ca/testdata/ca.json:41 test path "kty": "EC",
ca/testdata/ca.json:54 test path "kty": "EC",
ca/testdata/ca.json:67 test path "kty": "EC",
ca/testdata/ca.json:83 test path "kty": "EC",
ca/testdata/federated-ca.json:28 test path "kty": "EC",
ca/testdata/rotate-ca-0.json:27 test path "kty": "EC",
ca/testdata/rotate-ca-1.json:27 test path "kty": "EC",
ca/testdata/rotate-ca-2.json:27 test path "kty": "EC",
ca/testdata/rotate-ca-3.json:27 test path "kty": "EC",
ca/testdata/rsaca.json:32 test path "kty": "EC",
examples/basic-federation/pki/cloud/config/ca.federated.json:20 test path "kty": "EC",
examples/basic-federation/pki/cloud/config/ca.json:20 test path "kty": "EC",
examples/basic-federation/pki/kubernetes/config/ca.federated.json:20 test path "kty": "EC",
examples/basic-federation/pki/kubernetes/config/ca.json:20 test path "kty": "EC",
examples/docker/ca/pki/config/ca.json:20 test path "kty": "EC",
examples/docker/ca/pki/config/ca.json:34 test path "kty": "EC",
examples/pki/config/ca.json:20 test path "kty": "EC",
examples/pki/config/ca.json:34 test path "kty": "EC",
examples/pki/config/ca.json:52 test path "kty": "EC",
examples/pki/config/ca.json:70 test path "kty": "EC",
pki/testdata/helm/simple.yml:23 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD
pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:23 test path - {"type":"JWK","name":"acme","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFDOI"}
pki/testdata/helm/with-acme.yml:23 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD
pki/testdata/helm/with-admin.yml:23 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD
pki/testdata/helm/with-provisioner.yml:23 test path - {"type":"JWK","name":"a-provisioner","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvr
pki/testdata/helm/with-ssh-and-acme.yml:26 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD
pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:26 test path - {"type":"JWK","name":"sshpop","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFDOI
pki/testdata/helm/with-ssh.yml:26 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD

jose.jwk · CWE-327

RSA2048-bit Quantum-vulnerable Recorded traffic 19 places See details

RSA in the Go standard library

`rsa.GenerateKey()`, `rsa.SignPKCS1v15()`, `rsa.EncryptOAEP()` or an import of `crypto/rsa`.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Go 1.24 ships ML-KEM as `crypto/mlkem`.

acme/challenge_test.go:2343 test path privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
api/api_test.go:1473 test path rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
authority/provisioner/aws_test.go:319 test path badKey, err := rsa.GenerateKey(rand.Reader, 2048)
authority/provisioner/aws_test.go:582 test path badKey, err := rsa.GenerateKey(rand.Reader, 2048)
authority/provisioner/aws_test.go:752 test path rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
authority/provisioner/azure_test.go:664 test path rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
authority/provisioner/gcp_test.go:646 test path rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
authority/provisioner/jwk_test.go:420 test path rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
authority/provisioner/oidc_test.go:556 test path rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
authority/provisioner/scep_test.go:35 test path key, err := rsa.GenerateKey(rand.Reader, 2048)
authority/provisioner/scep_test.go:522 test path key, err := rsa.GenerateKey(rand.Reader, 2048)
authority/provisioner/scep_test.go:524 test path badKey, err := rsa.GenerateKey(rand.Reader, 2048)
cas/softcas/softcas_test.go:414 test path signer, err := rsa.GenerateKey(rand.Reader, 2048)
cas/softcas/softcas_test.go:480 test path intSigner, err := rsa.GenerateKey(rand.Reader, 2048)
cas/stepcas/x5c_issuer_test.go:250 test path rsaKey := mustSigner(rsa.GenerateKey(rand.Reader, 2048))
scep/authority_test.go:140 test path return rsa.GenerateKey(rand.Reader, 2048)
test/integration/scep/common_test.go:305 test path signer, err = rsa.GenerateKey(rand.Reader, 2048)
test/integration/scep/windows_go1.23_test.go:47 test path signer, err := rsa.GenerateKey(rand.Reader, 2048)
test/integration/scep/windows_test.go:33 test path signer, err := rsa.GenerateKey(rand.Reader, 2048)

go.rsa · CWE-327

ECDSA Quantum-vulnerable 16 places See details

SSH algorithms pinned in configuration

A `KexAlgorithms`, `HostKeyAlgorithms` or `Ciphers` directive in an SSH configuration. `KexAlgorithms` is the line that decides whether recorded sessions stay confidential.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Put `sntrup761x25519-sha512@openssh.com` first in `KexAlgorithms`. It is a hybrid, so it is no weaker than the classical exchange it replaces.

api/api_test.go:1655 test path fixtureECDSACertificate = `ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgLnkvSk4odlo3b1R+RDw+LmorL3RkN354IilCIVFVen4AAAAIbmlzdHAyNTYAAABBBHjKHss8WM2ffMYlavisoLXR0I6UEIU+cidV1ogEH1U6
api/api_test.go:1675 test path assert.Equal(t, "ecdsa-sha2-nistp256-cert-v01@openssh.com user certificate", fields["certificate-type"])
api/ssh_test.go:469 test path {Name: "known_host.tpl", Type: templates.File, Comment: "#", Path: "ssh/known_host", Content: []byte("@cert-authority * ecdsa-sha2-nistp256 AAAA...=")},
api/ssh_test.go:473 test path {Name: "ca.tpl", Type: templates.File, Comment: "#", Path: "/etc/ssh/ca.pub", Content: []byte("ecdsa-sha2-nistp256 AAAA...=")},
authority/provisioner/testdata/certs/ssh_host_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJj80EJXJR9vxefhdqOLSdzRzBw24t9YKPxb+eCYLf7BU50pJQnB/jK2ZM3qLFbieLaYjngZ86T4DzHxlPAnlAY=
authority/provisioner/testdata/certs/ssh_user_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ8einS88ZaWpcTZG27D5N9JDKfGv0rzjDByLGsZzMsLYl3XcsN9IWKXB6b+5GJ3UaoZf/pFxzRzIdDIh7Ypw3Y=
authority/testdata/certs/ssh_host_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJj80EJXJR9vxefhdqOLSdzRzBw24t9YKPxb+eCYLf7BU50pJQnB/jK2ZM3qLFbieLaYjngZ86T4DzHxlPAnlAY=
authority/testdata/certs/ssh_user_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ8einS88ZaWpcTZG27D5N9JDKfGv0rzjDByLGsZzMsLYl3XcsN9IWKXB6b+5GJ3UaoZf/pFxzRzIdDIh7Ypw3Y=
pki/helm_test.go:239 test path p.Files[p.Ssh.HostPublicKey] = []byte("ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ0IdS5sZm6KITBMZLEJD6b5ROVraYHcAOr3feFel8r1Wp4DRPR1oU0W00J/zjNBRBbANlJoYN4x/8WNNVZ49Ms=")
pki/helm_test.go:244 test path p.Files[p.Ssh.UserPublicKey] = []byte("ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEWA1qUxaGwVNErsvEOGe2d6TvLMF+aiVpuOiIEvpMJ3JeJmecLQctjWqeIbpSvy6/gRa7c82Ge5rLlapYmOChs=")
pki/testdata/helm/with-ssh-and-acme.yml:61 test path ssh_host_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ0IdS5sZm6KITBMZLEJD6b5ROVraYHcAOr3feFel8r1Wp4DRPR1oU0W00J/zjNBRBbANlJoYN4x/8WNNVZ49Ms=
pki/testdata/helm/with-ssh-and-acme.yml:64 test path ssh_user_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEWA1qUxaGwVNErsvEOGe2d6TvLMF+aiVpuOiIEvpMJ3JeJmecLQctjWqeIbpSvy6/gRa7c82Ge5rLlapYmOChs=
pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:60 test path ssh_host_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ0IdS5sZm6KITBMZLEJD6b5ROVraYHcAOr3feFel8r1Wp4DRPR1oU0W00J/zjNBRBbANlJoYN4x/8WNNVZ49Ms=
pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:63 test path ssh_user_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEWA1qUxaGwVNErsvEOGe2d6TvLMF+aiVpuOiIEvpMJ3JeJmecLQctjWqeIbpSvy6/gRa7c82Ge5rLlapYmOChs=
pki/testdata/helm/with-ssh.yml:60 test path ssh_host_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ0IdS5sZm6KITBMZLEJD6b5ROVraYHcAOr3feFel8r1Wp4DRPR1oU0W00J/zjNBRBbANlJoYN4x/8WNNVZ49Ms=
pki/testdata/helm/with-ssh.yml:63 test path ssh_user_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEWA1qUxaGwVNErsvEOGe2d6TvLMF+aiVpuOiIEvpMJ3JeJmecLQctjWqeIbpSvy6/gRa7c82Ge5rLlapYmOChs=

config.ssh-algorithms · CWE-757

Ed25519255-bitother/Ed25519 Quantum-vulnerable 14 places See details

Ed25519 in the Go standard library

`ed25519.GenerateKey()` or `ed25519.Sign()`.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204). Go 1.24 ships ML-DSA as `crypto/mldsa`.

acme/api/wire_integration_test.go:600 test path _, priv, err := ed25519.GenerateKey(rand.Reader)
acme/challenge.go:1628 if !ed25519.Verify(pub, []byte(keyAuth), sig) {
acme/challenge.go:1808 if !ed25519.Verify(pub, []byte(keyAuth), sig) {
api/api_test.go:977 test path rootPub, rootPriv, err := ed25519.GenerateKey(rand.Reader)
api/api_test.go:981 test path leafPub, leafPriv, err := ed25519.GenerateKey(rand.Reader)
api/api_test.go:1477 test path edPub, edPriv, err := ed25519.GenerateKey(rand.Reader)
authority/authorize_test.go:1435 test path _, signer, err := ed25519.GenerateKey(rand.Reader)
authority/authorize_test.go:1443 test path _, otherSigner, err := ed25519.GenerateKey(rand.Reader)
authority/provisioner/nebula_test.go:38 test path pub, priv, err := ed25519.GenerateKey(rand.Reader)
authority/provisioner/nebula_test.go:60 test path pub, priv, err := ed25519.GenerateKey(rand.Reader)
cas/cloudcas/certificate_test.go:110 test path edpub, _, err := ed25519.GenerateKey(rand.Reader)
cas/cloudcas/cloudcas_test.go:228 test path pub, _, err := ed25519.GenerateKey(rand.Reader)
cas/stepcas/stepcas_test.go:56 test path pub, priv, err := ed25519.GenerateKey(rand.Reader)
cas/stepcas/x5c_issuer_test.go:249 test path edKey := mustSigner(ed25519.GenerateKey(rand.Reader))

go.ed25519 · CWE-327

ECDSAsecp256r1 Quantum-vulnerable 12 places See details

SSH public key

An `ssh-rsa`, `ecdsa-sha2-*`, `ssh-ed25519` or `ssh-dss` key. `ssh-dss` is disabled by default in current OpenSSH and is reported as broken.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Replace `ssh-dss` now. For the rest, enable the `sntrup761x25519-sha512` key exchange, which protects recorded sessions even while host keys stay classical.

authority/provisioner/testdata/certs/ssh_host_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJj80EJX
authority/provisioner/testdata/certs/ssh_user_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ8einS8
authority/testdata/certs/ssh_host_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJj80EJX
authority/testdata/certs/ssh_user_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ8einS8
pki/helm_test.go:239 test path p.Files[p.Ssh.HostPublicKey] = []byte("ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItb
pki/helm_test.go:244 test path p.Files[p.Ssh.UserPublicKey] = []byte("ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItb
pki/testdata/helm/with-ssh-and-acme.yml:61 test path ssh_host_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY
pki/testdata/helm/with-ssh-and-acme.yml:64 test path ssh_user_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY
pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:60 test path ssh_host_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY
pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:63 test path ssh_user_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY
pki/testdata/helm/with-ssh.yml:60 test path ssh_host_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY
pki/testdata/helm/with-ssh.yml:63 test path ssh_user_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY

ssh.public-key · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable 10 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

acme/api/order_test.go:560 test path -----BEGIN PUBLIC KEY-----
acme/api/order_test.go:1067 test path -----BEGIN PUBLIC KEY-----
acme/challenge_test.go:563 test path -----BEGIN PUBLIC KEY-----
acme/challenge_wire_test.go:27 test path -----BEGIN PUBLIC KEY-----
acme/challenge_wire_test.go:2683 test path -----BEGIN PUBLIC KEY-----
acme/challenge_wire_test.go:3940 test path -----BEGIN PUBLIC KEY-----
acme/challenge_wire_test.go:4011 test path -----BEGIN PUBLIC KEY-----
acme/challenge_wire_test.go:4062 test path -----BEGIN PUBLIC KEY-----
authority/provisioner/acme_test.go:103 test path -----BEGIN PUBLIC KEY-----
authority/provisioner/wire/wire_options_test.go:11 test path -----BEGIN PUBLIC KEY-----

pem.public-key

Ed25519255-bitother/Ed25519 Quantum-vulnerable 7 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

acme/api/wire_integration_test.go:218 test path jwk, err := jose.GenerateJWK("OKP", "", "EdDSA", "sig", "", 0)
acme/challenge_test.go:3865 test path "x5c": []interface{}{makeLeaf(mustSigner("OKP", "Ed25519", 0), serialNumber).Raw, ca.Intermediate.Raw},
acme/challenge_wire_test.go:3963 test path jwkBytes := []byte(`{"crv": "Ed25519", "kty": "OKP", "x": "1L1eH2a6AgVvzTp5ZalKRfq6pVPOtEjI7h8TPzBYFgM"}`)
api/api_test.go:1500 test path {"ed25519", args{edPub, edPriv, nil}, "Ed25519"},
cas/stepcas/x5c_issuer_test.go:265 test path {"ed25519", args{edKey, nil}, []jose.Header{{Algorithm: "EdDSA"}}, false},
test/integration/scep/internal/x509/x509.go:95 test path Ed25519: "Ed25519",
test/integration/scep/internal/x509/x509.go:204 test path {PureEd25519, "Ed25519", oidSignatureEd25519, emptyRawValue, Ed25519, crypto.Hash(0) /* no pre-hashing */, false},

jose.algorithm · CWE-327

RSA2048-bit Quantum-vulnerable 7 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

acme/challenge.go:1664 -----BEGIN CERTIFICATE-----
acme/challenge.go:1686 -----BEGIN CERTIFICATE-----
api/api_test.go:46 test path -----BEGIN CERTIFICATE-----
authority/provisioner/testdata/certs/yubico-piv-ca.crt:1 test path -----BEGIN CERTIFICATE-----
authority/testdata/scep/intermediate.crt:1 test path -----BEGIN CERTIFICATE-----
ca/client_test.go:35 test path -----BEGIN CERTIFICATE-----
cas/cloudcas/certificate_test.go:27 test path -----BEGIN CERTIFICATE-----

pem.certificate

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 5 places See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

authority/provisioner/testdata/certs/ecdsa.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----
authority/testdata/certs/badsig.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----
authority/testdata/certs/foo.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----
cas/cloudcas/cloudcas_test.go:100 test path -----BEGIN CERTIFICATE REQUEST-----
cas/vaultcas/vaultcas_test.go:35 test path -----BEGIN CERTIFICATE REQUEST-----

pem.certificate-request

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 4 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

authority/provisioner/testdata/certs/bar.pub:1 test path -----BEGIN PUBLIC KEY-----
authority/provisioner/testdata/certs/foo.pub:1 test path -----BEGIN PUBLIC KEY-----
cas/cloudcas/certificate_test.go:22 test path -----BEGIN PUBLIC KEY-----
cosign.pub:1 -----BEGIN PUBLIC KEY-----

pem.public-key

ECDSA Quantum-vulnerable 3 places See details

ECDSA in the Go standard library

`ecdsa.GenerateKey()` or `ecdsa.Sign*()`. The curve is read from the `elliptic.P###()` argument.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

acme/api/revoke_test.go:174 test path r, s, err := ecdsa.Sign(rand.Reader, key, digest)
acme/challenge.go:1619 if !ecdsa.VerifyASN1(pub, sum[:], sig) {
acme/challenge.go:1799 if !ecdsa.VerifyASN1(pub, sum[:], sig) {

go.ecdsa · CWE-327

ECDSA384-bitsecg/secp384r1 Quantum-vulnerable 3 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

acme/challenge.go:1300 -----BEGIN CERTIFICATE-----
acme/challenge.go:1438 -----BEGIN CERTIFICATE-----
authority/provisioner/testdata/certs/apple-att-ca.crt:1 test path -----BEGIN CERTIFICATE-----

pem.certificate

RSA4096-bit Quantum-vulnerable 3 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

acme/challenge.go:1406 -----BEGIN CERTIFICATE-----
ca/testdata/secrets/rsa_intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
ca/testdata/secrets/rsa_root_ca.crt:1 test path -----BEGIN CERTIFICATE-----

pem.certificate

RSA2048-bit Quantum-vulnerable 3 places See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

authority/provisioner/testdata/certs/rsa.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----
ca/ca_test.go:125 test path -----BEGIN CERTIFICATE REQUEST-----
cas/vaultcas/vaultcas_test.go:42 test path -----BEGIN CERTIFICATE REQUEST-----

pem.certificate-request

RSA Quantum-vulnerable Recorded traffic 3 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

authority/provisioner/testdata/secrets/rsa.key:1 test path -----BEGIN RSA PRIVATE KEY-----
authority/provisioner/utils_test.go:73 test path -----BEGIN RSA PRIVATE KEY-----
authority/testdata/scep/intermediate.key:1 test path -----BEGIN RSA PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

RSASSA-PKCS1v15 Quantum-vulnerable 3 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

acme/api/revoke_test.go:147 test path return "RS256", crypto.SHA256
acme/challenge_wire_test.go:4022 test path SignatureAlgorithms: []string{"RS256"},
cas/stepcas/x5c_issuer_test.go:266 test path {"rsa", args{rsaKey, nil}, []jose.Header{{Algorithm: "RS256"}}, false},

jose.algorithm · CWE-327

DSA Quantum-vulnerable 2 places See details

DSA in the Go standard library

`crypto/dsa`, which the Go team deprecated in 1.16 and froze.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65.

api/api_test.go:1482 test path if err := dsa.GenerateParameters(&dsa2048.Parameters, rand.Reader, dsa.L2048N256); err != nil {
api/api_test.go:1485 test path if err := dsa.GenerateKey(&dsa2048, rand.Reader); err != nil {

go.dsa · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable 2 places See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

authority/provisioner/testdata/certs/ed25519.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----
cas/vaultcas/vaultcas_test.go:58 test path -----BEGIN CERTIFICATE REQUEST-----

pem.certificate-request

RSA Quantum-vulnerable Recorded traffic 2 places See details

RSA in the Go standard library

`rsa.GenerateKey()`, `rsa.SignPKCS1v15()`, `rsa.EncryptOAEP()` or an import of `crypto/rsa`.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Go 1.24 ships ML-KEM as `crypto/mlkem`.

acme/challenge.go:1624 if err := rsa.VerifyPKCS1v15(pub, crypto.SHA256, sum[:], sig); err != nil {
acme/challenge.go:1804 if err := rsa.VerifyPKCS1v15(pub, crypto.SHA256, sum[:], sig); err != nil {

go.rsa · CWE-327

RSA4096-bit Quantum-vulnerable 2 places See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

api/api_test.go:94 test path -----BEGIN CERTIFICATE REQUEST-----
ca/client_test.go:83 test path -----BEGIN CERTIFICATE REQUEST-----

pem.certificate-request

EC Quantum-vulnerable 1 place See details

X.509 certificate handling

`x509.CreateCertificate()` or a PKCS#1/PKCS#8/EC key parser. Certificates are the longest-lived cryptographic artefacts most systems own, and their validity periods often outrun the migration.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.

What to do. Shorten certificate lifetimes now so the eventual re-issue with a post-quantum key is routine rather than an incident.

cas/cloudcas/cloudcas_test.go:297 test path key, err := x509.ParseECPrivateKey(block.Bytes)

go.x509

ECDH256-bitsecg/secp256r1 Quantum-vulnerable Recorded traffic 1 place See details

Key agreement in Go

`ecdh.P256()`, `ecdh.X25519()` or `curve25519.X25519()`. Key agreement is the highest priority: recorded traffic is decrypted retrospectively.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 (`crypto/mlkem` in Go 1.24), or a hybrid construction.

authority/provisioner/nebula.go:346 ecdhPub, err := ecdh.P256().NewPublicKey(c.PublicKey())

go.ecdh · CWE-327

ECDSA224-bitsecg/secp224r1 Quantum-vulnerable 1 place See details

ECDSA in the Go standard library

`ecdsa.GenerateKey()` or `ecdsa.Sign*()`. The curve is read from the `elliptic.P###()` argument.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

cas/stepcas/x5c_issuer_test.go:245 test path p224 := mustSigner(ecdsa.GenerateKey(elliptic.P224(), rand.Reader))

go.ecdsa · CWE-327

ECDSA384-bitsecg/secp384r1 Quantum-vulnerable 1 place See details

ECDSA in the Go standard library

`ecdsa.GenerateKey()` or `ecdsa.Sign*()`. The curve is read from the `elliptic.P###()` argument.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

cas/stepcas/x5c_issuer_test.go:247 test path p384 := mustSigner(ecdsa.GenerateKey(elliptic.P384(), rand.Reader))

go.ecdsa · CWE-327

ECDSA521-bitsecg/secp521r1 Quantum-vulnerable 1 place See details

ECDSA in the Go standard library

`ecdsa.GenerateKey()` or `ecdsa.Sign*()`. The curve is read from the `elliptic.P###()` argument.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

cas/stepcas/x5c_issuer_test.go:248 test path p521 := mustSigner(ecdsa.GenerateKey(elliptic.P521(), rand.Reader))

go.ecdsa · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable 1 place See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

cas/softcas/softcas_test.go:32 test path -----BEGIN CERTIFICATE-----

pem.certificate

Ed25519255-bitother/Ed25519 Quantum-vulnerable 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

cas/softcas/softcas_test.go:42 test path -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

RSA Quantum-vulnerable 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

cas/cloudcas/certificate_test.go:44 test path -----BEGIN RSA PUBLIC KEY-----

pem.public-key

RSASSA-PKCS1v15 Quantum-vulnerable 1 place See details

SSH algorithms pinned in configuration

A `KexAlgorithms`, `HostKeyAlgorithms` or `Ciphers` directive in an SSH configuration. `KexAlgorithms` is the line that decides whether recorded sessions stay confidential.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both.

What to do. Put `sntrup761x25519-sha512@openssh.com` first in `KexAlgorithms`. It is a hybrid, so it is no weaker than the classical exchange it replaces.

CHANGELOG.md:623 - Replace hash function with an RSA SSH CA to "rsa-sha2-256".

config.ssh-algorithms · CWE-757

unknown Could not be determined 16 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

pki/testdata/helm/simple.yml:43 test path -----BEGIN CERTIFICATE-----
pki/testdata/helm/simple.yml:51 test path -----BEGIN CERTIFICATE-----
pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:44 test path -----BEGIN CERTIFICATE-----
pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:52 test path -----BEGIN CERTIFICATE-----
pki/testdata/helm/with-acme.yml:44 test path -----BEGIN CERTIFICATE-----
pki/testdata/helm/with-acme.yml:52 test path -----BEGIN CERTIFICATE-----
pki/testdata/helm/with-admin.yml:43 test path -----BEGIN CERTIFICATE-----
pki/testdata/helm/with-admin.yml:51 test path -----BEGIN CERTIFICATE-----
pki/testdata/helm/with-provisioner.yml:43 test path -----BEGIN CERTIFICATE-----
pki/testdata/helm/with-provisioner.yml:51 test path -----BEGIN CERTIFICATE-----
pki/testdata/helm/with-ssh-and-acme.yml:48 test path -----BEGIN CERTIFICATE-----
pki/testdata/helm/with-ssh-and-acme.yml:56 test path -----BEGIN CERTIFICATE-----
pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:47 test path -----BEGIN CERTIFICATE-----
pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:55 test path -----BEGIN CERTIFICATE-----
pki/testdata/helm/with-ssh.yml:47 test path -----BEGIN CERTIFICATE-----
pki/testdata/helm/with-ssh.yml:55 test path -----BEGIN CERTIFICATE-----

pem.certificate

unknown Could not be determined 13 places See details

X.509 certificate handling

`x509.CreateCertificate()` or a PKCS#1/PKCS#8/EC key parser. Certificates are the longest-lived cryptographic artefacts most systems own, and their validity periods often outrun the migration.

The algorithm could not be established from the source. Usually it is selected while the program runs, but it may equally be that the call gives no clue, or that it is decided somewhere this scan does not reach. Somebody has to check.

What to do. Shorten certificate lifetimes now so the eventual re-issue with a post-quantum key is routine rather than an incident.

acme/api/wire_integration_test.go:620 test path csr, err := x509.CreateCertificateRequest(rand.Reader, csrTemplate, priv)
acme/challenge_test.go:2378 test path cert, err := x509.CreateCertificate(rand.Reader, certTemplate, certTemplate, privateKey.Public(), privateKey)
api/api_test.go:1533 test path der, err := x509.CreateCertificate(rand.Reader, &template, &template, pub, priv)
authority/authority_test.go:435 test path cr, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{
authority/provisioner/aws_test.go:317 test path key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
authority/provisioner/aws_test.go:579 test path key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
authority/provisioner/utils_test.go:434 test path key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
authority/provisioner/utils_test.go:542 test path key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
authority/tls_test.go:198 test path csrBytes, err := x509.CreateCertificateRequest(rand.Reader, _csr, priv)
ca/ca_test.go:49 test path csrBytes, err := x509.CreateCertificateRequest(rand.Reader, _csr, priv)
ca/client.go:1482 csr, err := x509.CreateCertificateRequest(rand.Reader, template, pk)
ca/client.go:1548 csr, err := x509.CreateCertificateRequest(rand.Reader, template, key)
test/integration/scep/common_test.go:345 test path selfSigned, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, signer.Public(), signer)

go.x509

unknown Could not be determined 12 places See details

SSH implementation in use

`golang.org/x/crypto/ssh`. Host keys are long-lived and awkward to rotate.

The algorithm could not be established from the source. Usually it is selected while the program runs, but it may equally be that the call gives no clue, or that it is decided somewhere this scan does not reach. Somebody has to check.

What to do. OpenSSH's `sntrup761x25519` hybrid key exchange addresses the recorded-traffic half; the host-key signature has no standardised replacement yet.

api/ssh_test.go:47 test path signerKey, err := ssh.NewPublicKey(sshSignerKey.Public())
authority/authorize_test.go:1020 test path cert.Key, err = ssh.NewPublicKey(jwk.Public().Key)
authority/config/ssh.go:77 key, err := ssh.NewPublicKey(k.Key.Key)
authority/config/ssh_test.go:49 test path pub, err := ssh.NewPublicKey(key.Public().Key)
authority/provisioner/jwk_test.go:427 test path sshPub, err := ssh.NewPublicKey(pub)
authority/provisioner/sign_ssh_options_test.go:233 test path sshPub, err := ssh.NewPublicKey(pub)
authority/provisioner/ssh_test.go:49 test path pub, err := ssh.NewPublicKey(key)
authority/provisioner/sshpop_test.go:49 test path cert.Key, err = ssh.NewPublicKey(jwk.Public().Key)
authority/ssh_test.go:141 test path pub, err := ssh.NewPublicKey(key.Public())
ca/client_test.go:796 test path key, err := ssh.NewPublicKey(mustKey(t).Public())
pki/pki.go:681 sshKey, err := ssh.NewPublicKey(resp.PublicKey)
templates/templates_test.go:222 test path user, err := ssh.NewPublicKey(key.Public())

go.ssh · CWE-327

unknown Could not be determined 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

authority/provisioner/testdata/secrets/ed25519.key:1 test path -----BEGIN ENCRYPTED PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

unknown Could not be determined 1 place See details

Cryptographic library in the dependency manifest

A dependency known to implement classical asymmetric cryptography. Its presence is inventory, not a finding about this codebase: the library may never be called with a quantum-vulnerable algorithm.

The project depends on a cryptography library. Listed so the inventory is complete; it is not by itself a problem.

What to do. Check the version. Several of these libraries have shipped ML-KEM and ML-DSA support since 2024, so the migration may need an upgrade rather than a replacement.

go.mod:43 golang.org/x/crypto v0.55.0

dep.crypto-library

CSPRNG Quantum-safe 2 places See details

Random number generation

`crypto/rand`. Recorded so the inventory names its randomness source. `math/rand` reaching key material would be a present-day defect, and is a different thing entirely.

This is where the software gets its random numbers. Quantum computers do not weaken it.

What to do. No action.

acme/api/revoke_test.go:45 test path return rand.Int(rand.Reader, big.NewInt(1000000000000000000))
acme/db/nosql/eab.go:66 _, err = rand.Read(random)

go.rng

HMAC Quantum-safe 2 places See details

Keyed hash in use

`hmac.New()`. Not broken by Shor and only marginally affected by Grover.

This is a fingerprint proving a message was not altered. Quantum computers do not break it.

What to do. No action, unless the digest is MD5 or SHA-1.

authority/provisioner/webhook.go:240 h := hmac.New(sha256.New, secret)
authority/provisioner/webhook_test.go:582 test path h := hmac.New(sha256.New, secret)

go.hmac

HMAC Quantum-safe 1 place See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. A keyed MAC is not affected by Shor and only marginally by Grover.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

acme/api/account_test.go:119 test path Algorithm: jose.SignatureAlgorithm("HS256"),

jose.algorithm · CWE-327

Library	Files
crypto/sha1 the SHA-1 digest, which has practical collisions	5
crypto/ed25519 Edwards-curve signatures	60
crypto/ecdsa elliptic-curve signatures	24
crypto/tls the TLS client and server	32
crypto/rsa RSA key generation, signing and OAEP encryption	29
crypto/dsa DSA signatures; frozen by the Go team since 1.16	3
crypto/ecdh elliptic-curve key agreement	1
crypto/sha256 the SHA-2 digests	23
crypto/x509 certificate and key parsing	139
crypto/rand the platform random source	35
crypto/hmac keyed message authentication	2
crypto/sha512 the SHA-2 digests	1

Algorithm	Assessment	What it means	Occurrences
`ECDSA`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer.	545
`unknown`	Could not be determined	The algorithm could not be established from the source - chosen at runtime, or decided somewhere this scan does not reach.	181
`ECDH`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer.	119
`Ed25519`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer.	100
`TLS`	Quantum-vulnerable	Every TLS cipher suite in general use negotiates a classical key exchange, so a recorded session is decryptable once that exchange falls.	97
`RSA`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer.	69
`RSA-1024`	Already broken	A modulus of 1024 bits or less is below the NIST SP 800-57 floor and is within reach of classical factorisation. Shor is not the nearest problem here.	44
`CSPRNG`	Quantum-safe	A cryptographically secure random number generator provided by the platform. Not weakened by a quantum computer.	37
`SHA-256`	Reduced margin	Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades.	23
`RSAES-PKCS1v15`	Already broken	PKCS#1 v1.5 encryption padding is vulnerable to Bleichenbacher oracles today, and the underlying RSA is broken by Shor.	21
`SHA-1`	Already broken	SHAttered and subsequent work produced practical collisions; NIST withdrew SHA-1 in 2030 guidance and it is already unacceptable for signatures.	9
`RC4`	Already broken	RC4 keystream biases break it classically; it is prohibited in TLS by RFC 7465.	7
`3DES`	Already broken	Triple DES is withdrawn by NIST and limited by its 64-bit block, independent of quantum.	6
`DSA`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer.	5
`HMAC`	Quantum-safe	A keyed MAC is not affected by Shor and only marginally by Grover.	5
`RSASSA-PKCS1v15`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both.	4
`EC`	Quantum-vulnerable	An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.	1
`SHA-512`	Quantum-safe	No known quantum algorithm changes the security margin.	1

smallstep/certificates

Earlier scans of this repository

List of cryptographic assets

X.509 certificate

TLS cipher suite named in source

TLS cipher suite named in source

TLS cipher suite named in source

RSA in the Go standard library

Broken hash function

Certificate signing request

Certificate signing request

JOSE algorithm declared in configuration

TLS cipher suite named in source

TLS configuration in code

X.509 certificate

ECDSA in the Go standard library

Private key committed to the repository

Public key declared as a JSON Web Key

RSA in the Go standard library

SSH algorithms pinned in configuration

Ed25519 in the Go standard library

SSH public key

Public key file

JOSE algorithm declared in configuration

X.509 certificate

Certificate signing request

Public key file

ECDSA in the Go standard library

X.509 certificate

X.509 certificate

Certificate signing request

Private key committed to the repository

JOSE algorithm declared in configuration

DSA in the Go standard library

Certificate signing request

RSA in the Go standard library

Certificate signing request

X.509 certificate handling

Key agreement in Go

ECDSA in the Go standard library

ECDSA in the Go standard library

ECDSA in the Go standard library

X.509 certificate

Private key committed to the repository

Public key file

SSH algorithms pinned in configuration

X.509 certificate

X.509 certificate handling

SSH implementation in use

Private key committed to the repository

Cryptographic library in the dependency manifest

Random number generation

Keyed hash in use

JOSE algorithm declared in configuration

Cryptographic assets

Imported cryptographic libraries