spring-projects/spring-security

SHA-1 Already broken 2 places See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

This is already unsafe today, with no quantum computer involved. SHAttered and subsequent work produced practical collisions; NIST withdrew SHA-1 in 2030 guidance and it is already unacceptable for signatures.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. web/src/main/java/org/springframework/security/web/authentication/password/HaveIBeenPwnedRestApiPasswordChecker.java:107 return MessageDigest.getInstance("SHA-1");
2. web/src/main/java/org/springframework/security/web/authentication/password/HaveIBeenPwnedRestApiReactivePasswordChecker.java:102 return MessageDigest.getInstance("SHA-1");

java.messagedigest · CWE-328

MD5 Already broken 1 place See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

This is already unsafe today, with no quantum computer involved. Practical chosen-prefix collisions exist; MD5 has no remaining security as a digest.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. web/src/main/java/org/springframework/security/web/authentication/www/DigestAuthUtils.java:183 MessageDigest digest = MessageDigest.getInstance("MD5");

java.messagedigest · CWE-328

RSA-10241024-bit Already broken 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

This is already unsafe today, with no quantum computer involved. A modulus of 1024 bits or less is below the NIST SP 800-57 floor and is within reach of classical factorisation. Shor is not the nearest problem here.

What to do. Inventory only; a public key is not itself a secret.

1. config/src/test/resources/org/springframework/security/config/annotation/web/configuration/simple.pub:1 test path -----BEGIN PUBLIC KEY-----

pem.public-key

RSA-10241024-bit Already broken 1 place See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. config/src/test/resources/org/springframework/security/config/saml2/rp-certificate.crt:1 test path -----BEGIN CERTIFICATE-----

pem.certificate

RSA-10241024-bit Already broken Recorded traffic 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. config/src/test/resources/org/springframework/security/config/saml2/rp-private.key:1 test path -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

RSA-10241024-bit Already broken Recorded traffic 1 place See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

This is already unsafe today, with no quantum computer involved. A modulus of 1024 bits or less is below the NIST SP 800-57 floor and is within reach of classical factorisation. Shor is not the nearest problem here.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. crypto/src/main/java/org/springframework/security/crypto/encrypt/RsaKeyHelper.java:156 final KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");

java.keypairgenerator · CWE-327

RSASSA-PKCS1v15 Quantum-vulnerable Renamed import 26 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. config/src/test/java/org/springframework/security/SerializationSamples.java:650 test path .idTokenSigningAlgorithm("RS256")
2. config/src/test/java/org/springframework/security/config/annotation/web/configuration/OAuth2AuthorizedClientManagerConfigurationTests.java:321 test path Collections.singletonMap(JoseHeaderNames.ALG, "RS256"),
3. config/src/test/java/org/springframework/security/config/annotation/web/reactive/ReactiveOAuth2AuthorizedClientManagerConfigurationTests.java:349 test path Collections.singletonMap(JoseHeaderNames.ALG, "RS256"),
4. config/src/test/java/org/springframework/security/config/http/OAuth2AuthorizedClientManagerRegistrarTests.java:319 test path Collections.singletonMap(JoseHeaderNames.ALG, "RS256"),
5. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/OidcClientRegistrationTests.java:96 test path assertThat(clientRegistration.getIdTokenSignedResponseAlgorithm()).isEqualTo("RS256");
6. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/OidcClientRegistrationTests.java:156 test path assertThat(clientRegistration.getIdTokenSignedResponseAlgorithm()).isEqualTo("RS256");
7. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/OidcProviderConfigurationTests.java:48 test path .idTokenSigningAlgorithm("RS256");
8. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/OidcProviderConfigurationTests.java:62 test path .idTokenSigningAlgorithm("RS256")
9. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/OidcProviderConfigurationTests.java:80 test path assertThat(providerConfiguration.getIdTokenSigningAlgorithms()).containsExactly("RS256");
10. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/OidcProviderConfigurationTests.java:100 test path .idTokenSigningAlgorithm("RS256")
11. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/OidcProviderConfigurationTests.java:112 test path assertThat(providerConfiguration.getIdTokenSigningAlgorithms()).containsExactly("RS256");
12. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/OidcProviderConfigurationTests.java:127 test path Collections.singletonList("RS256"));
13. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/OidcProviderConfigurationTests.java:144 test path assertThat(providerConfiguration.getIdTokenSigningAlgorithms()).containsExactly("RS256");
14. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/OidcProviderConfigurationTests.java:164 test path Collections.singletonList("RS256"));
15. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/OidcProviderConfigurationTests.java:181 test path assertThat(providerConfiguration.getIdTokenSigningAlgorithms()).containsExactly("RS256");
16. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/OidcProviderConfigurationTests.java:360 test path claims.put(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED, "RS256");
17. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/http/converter/OidcClientRegistrationHttpMessageConverterTests.java:143 test path assertThat(clientRegistration.getIdTokenSignedResponseAlgorithm()).isEqualTo("RS256");
18. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/http/converter/OidcProviderConfigurationHttpMessageConverterTests.java:89 test path assertThat(providerConfiguration.getIdTokenSigningAlgorithms()).containsExactly("RS256");
19. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/http/converter/OidcProviderConfigurationHttpMessageConverterTests.java:130 test path assertThat(providerConfiguration.getIdTokenSigningAlgorithms()).containsExactly("RS256");
20. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/http/converter/OidcProviderConfigurationHttpMessageConverterTests.java:177 test path .idTokenSigningAlgorithm("RS256")
21. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/http/converter/OidcProviderConfigurationHttpMessageConverterTests.java:220 test path .idTokenSigningAlgorithm("RS256")
22. oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jose/jws/JwsAlgorithms.java:54 public static final String RS256 = "RS256";
23. oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jose/jws/JwsAlgorithms.java:59 public static final String RS384 = "RS384";
24. oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jose/jws/JwsAlgorithms.java:64 public static final String RS512 = "RS512";
25. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/ReactiveRemoteJWKSourceTests.java:126 test path assertThat(key1.getAlgorithm().getName()).isEqualTo("RS256");
26. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/ReactiveRemoteJWKSourceTests.java:131 test path assertThat(key2.getAlgorithm().getName()).isEqualTo("RS256");

jose.algorithm · CWE-327

RSASSA-PKCS1v15 Quantum-vulnerable Renamed import 13 places See details

XML signature or encryption algorithm

An XML Signature or XML Encryption algorithm URI - SAML, XAdES or WS-Security. The URI names the algorithm exactly, and a signature URI names its digest as well, so `#rsa-sha1` reports both the key and the broken digest.

Federated login and signed XML documents name their cryptography in a web address. Some of those addresses name algorithms that are already broken.

What to do. Move off `#rsa-sha1` first: that signature is forgeable today, with no quantum computer involved. The key algorithm changes with the wider migration.

1. config/src/test/java/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParserTests.java:99 test path " <ds:SignatureMethod Algorithm=\"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256\"/>\n" +
2. config/src/test/java/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParserTests.java:173 test path .containsExactly("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");
3. config/src/test/java/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParserTests.java:207 test path .containsExactly("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");
4. config/src/test/java/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParserTests.java:234 test path .containsExactly("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");
5. config/src/test/java/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParserTests.java:258 test path assertThat(google.getSigningAlgorithms()).containsExactly("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");
6. config/src/test/java/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParserTests.java:273 test path "http://www.w3.org/2001/04/xmldsig-more#rsa-sha224",
7. config/src/test/java/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParserTests.java:274 test path "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
8. config/src/test/java/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParserTests.java:275 test path "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384");
9. config/src/test/resources/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParserTests-MultiRegistration.xml:56 test path signing-algorithms="http://www.w3.org/2001/04/xmldsig-more#rsa-sha224,http://www.w3.org/2001/04/xmldsig-more#rsa-sha256,http://www.w3.org/2001/04/xmldsig-more#rsa-sha384">
10. config/src/test/resources/org/springframework/security/config/saml2/google-custom-registration.xml:55 test path signing-algorithms="http://www.w3.org/2001/04/xmldsig-more#rsa-sha224,http://www.w3.org/2001/04/xmldsig-more#rsa-sha256,http://www.w3.org/2001/04/xmldsig-more#rsa-sha384">
11. saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/registration/RelyingPartyRegistration.java:783 ? Collections.singletonList("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256")
12. saml2/saml2-service-provider/src/opensaml5Test/java/org/springframework/security/saml2/provider/service/metadata/OpenSaml5MetadataResolverTests.java:70 test path .contains("SignatureMethod Algorithm=\"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256")
13. saml2/saml2-service-provider/src/opensaml5Test/java/org/springframework/security/saml2/provider/service/metadata/OpenSaml5MetadataResolverTests.java:176 test path .contains("SignatureMethod Algorithm=\"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256")

xmldsig.algorithm · CWE-327

RSA Quantum-vulnerable Recorded traffic 10 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/OAuth2ResourceServerConfigurerTests.java:2346 test path RSAPublicKey publicKey = (RSAPublicKey) KeyFactory.getInstance("RSA")
2. config/src/test/java/org/springframework/security/config/web/server/OAuth2ResourceServerSpecTests.java:736 test path KeyFactory factory = KeyFactory.getInstance("RSA");
3. core/src/main/java/org/springframework/security/converter/RsaKeyConverters.java:154 return KeyFactory.getInstance("RSA");
4. crypto/src/main/java/org/springframework/security/crypto/encrypt/KeyStoreKeyFactory.java:91 publicKey = KeyFactory.getInstance("RSA").generatePublic(spec);
5. crypto/src/main/java/org/springframework/security/crypto/encrypt/RsaKeyHelper.java:93 KeyFactory fact = KeyFactory.getInstance("RSA");
6. crypto/src/main/java/org/springframework/security/crypto/encrypt/RsaKeyHelper.java:249 return (RSAPublicKey) KeyFactory.getInstance("RSA").generatePublic(new RSAPublicKeySpec(n, e));
7. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jose/TestKeys.java:47 test path kf = KeyFactory.getInstance("RSA");
8. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/NimbusJwtDecoderTests.java:141 test path kf = KeyFactory.getInstance("RSA");
9. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/NimbusReactiveJwtDecoderTests.java:127 test path kf = KeyFactory.getInstance("RSA");
10. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/NimbusReactiveJwtDecoderTests.java:163 test path RSAPublicKey publicKey = (RSAPublicKey) KeyFactory.getInstance("RSA")

java.keyfactory · CWE-327

RSASSA-PKCS1v15 Quantum-vulnerable 6 places See details

COSE algorithm identifier

A COSE algorithm named as an identifier or as its IANA registry number - `COSEAlgorithmIdentifier.ES256`, or `alg: -7` in a WebAuthn `pubKeyCredParams`. The names match JOSE's; the numbers are the registry's.

This is the list of signature algorithms a security key or a passkey is allowed to use. Every one available today is broken by a quantum computer, so the value of writing it down now is knowing where to look later.

What to do. No post-quantum COSE algorithm is registered for WebAuthn yet. Record the exposure and keep the list short, so there is less to change when one is.

1. config/src/test/java/org/springframework/security/SerializationSamples.java:989 test path generatorByClassName.put(COSEAlgorithmIdentifier.class, ((r) -> COSEAlgorithmIdentifier.RS256));
2. javascript/test/webauthn-core.test.js:396 test path alg: -257,
3. javascript/test/webauthn-core.test.js:522 test path alg: -257,
4. webauthn/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialParameters.java:49 COSEAlgorithmIdentifier.RS256);
5. webauthn/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialParameters.java:52 COSEAlgorithmIdentifier.RS384);
6. webauthn/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialParameters.java:55 COSEAlgorithmIdentifier.RS512);

cose.algorithm

ECDSA Quantum-vulnerable 5 places See details

COSE algorithm identifier

A COSE algorithm named as an identifier or as its IANA registry number - `COSEAlgorithmIdentifier.ES256`, or `alg: -7` in a WebAuthn `pubKeyCredParams`. The names match JOSE's; the numbers are the registry's.

This is the list of signature algorithms a security key or a passkey is allowed to use. Every one available today is broken by a quantum computer, so the value of writing it down now is knowing where to look later.

What to do. No post-quantum COSE algorithm is registered for WebAuthn yet. Record the exposure and keep the list short, so there is less to change when one is.

1. javascript/test/webauthn-core.test.js:392 test path alg: -7,
2. javascript/test/webauthn-core.test.js:518 test path alg: -7,
3. webauthn/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialParameters.java:40 COSEAlgorithmIdentifier.ES256);
4. webauthn/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialParameters.java:43 COSEAlgorithmIdentifier.ES384);
5. webauthn/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialParameters.java:46 COSEAlgorithmIdentifier.ES512);

cose.algorithm

ECDSA Quantum-vulnerable Renamed import 5 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/OidcProviderConfigurationTests.java:445 test path signingAlgorithms.add("ES256");
2. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/OidcProviderConfigurationTests.java:449 test path assertThat(configuration.getIdTokenSigningAlgorithms()).containsExactly("ES256");
3. oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jose/jws/JwsAlgorithms.java:69 public static final String ES256 = "ES256";
4. oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jose/jws/JwsAlgorithms.java:74 public static final String ES384 = "ES384";
5. oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jose/jws/JwsAlgorithms.java:79 public static final String ES512 = "ES512";

jose.algorithm · CWE-327

RSA2048-bit Quantum-vulnerable Recorded traffic From a constant 5 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/util/X509CertificateUtils.java:75 test path KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA", BC_PROVIDER);
2. oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/endpoint/NimbusJwtClientAuthenticationParametersConverterTests.java:266 test path KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
3. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jose/TestJwks.java:42 test path rsaKeyPairGenerator = KeyPairGenerator.getInstance("RSA");
4. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jose/X509CertificateUtils.java:76 test path KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA", BC_PROVIDER);
5. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/NimbusJwtEncoderDecoderTests.java:72 test path KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");

java.keypairgenerator · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable 3 places See details

COSE algorithm identifier

A COSE algorithm named as an identifier or as its IANA registry number - `COSEAlgorithmIdentifier.ES256`, or `alg: -7` in a WebAuthn `pubKeyCredParams`. The names match JOSE's; the numbers are the registry's.

This is the list of signature algorithms a security key or a passkey is allowed to use. Every one available today is broken by a quantum computer, so the value of writing it down now is knowing where to look later.

What to do. No post-quantum COSE algorithm is registered for WebAuthn yet. Record the exposure and keep the list short, so there is less to change when one is.

1. javascript/test/webauthn-core.test.js:388 test path alg: -8,
2. javascript/test/webauthn-core.test.js:514 test path alg: -8,
3. webauthn/src/main/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialParameters.java:37 COSEAlgorithmIdentifier.EdDSA);

cose.algorithm

RSA2048-bit Quantum-vulnerable 3 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. config/src/test/resources/org/springframework/security/config/http/MiscHttpConfigTests-certificate.pem:1 test path -----BEGIN CERTIFICATE-----
2. config/src/test/resources/org/springframework/security/config/saml2/idp-certificate.crt:1 test path -----BEGIN CERTIFICATE-----
3. saml2/saml2-service-provider/src/test/resources/rsa.crt:1 test path -----BEGIN CERTIFICATE-----

pem.certificate

RSA-PSS Quantum-vulnerable 3 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jose/jws/JwsAlgorithms.java:84 public static final String PS256 = "PS256";
2. oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jose/jws/JwsAlgorithms.java:89 public static final String PS384 = "PS384";
3. oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jose/jws/JwsAlgorithms.java:94 public static final String PS512 = "PS512";

jose.algorithm · CWE-327

EC Quantum-vulnerable 2 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jose/TestKeys.java:137 test path KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");
2. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/NimbusJwtEncoderDecoderTests.java:90 test path KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");

java.keypairgenerator · CWE-327

RSA Quantum-vulnerable Recorded traffic 2 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OidcLogoutConfigurerTests.java:603 test path KeyPair pair = KeyPairGenerator.getInstance("RSA").generateKeyPair();
2. config/src/test/java/org/springframework/security/config/web/server/OidcLogoutSpecTests.java:724 test path KeyPair pair = KeyPairGenerator.getInstance("RSA").generateKeyPair();

java.keypairgenerator · CWE-327

RSA2048-bit Quantum-vulnerable 2 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

1. config/src/test/resources/org/springframework/security/config/http/OAuth2ResourceServerBeanDefinitionParserTests-SingleKey.pub:1 test path -----BEGIN PUBLIC KEY-----
2. config/src/test/resources/org/springframework/security/config/web/server/OAuth2ResourceServerSpecTests-simple.pub:1 test path -----BEGIN PUBLIC KEY-----

pem.public-key

RSA Quantum-vulnerable Recorded traffic 2 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. crypto/src/test/resources/fake.pem:1 test path -----BEGIN RSA PRIVATE KEY-----
2. crypto/src/test/resources/spacey.pem:1 test path -----BEGIN RSA PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 1 place See details

Named elliptic curve requested

`ECGenParameterSpec` names a curve explicitly. Every standardised prime curve is broken by Shor regardless of its size, so a larger curve is not a mitigation.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 for signatures, ML-KEM-768 for key establishment.

1. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/NimbusJwtEncoderDecoderTests.java:91 test path keyPairGenerator.initialize(new ECGenParameterSpec("secp256r1"));

java.eccurve · CWE-327

RSA2048-bit Quantum-vulnerable Recorded traffic 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. config/src/test/resources/org/springframework/security/config/http/key.pem:1 test path -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

RSA-OAEP Quantum-vulnerable Recorded traffic 1 place See details

Cipher transformation named away from the call

A JCA transformation string - `algorithm/mode/padding` - written somewhere other than a `getInstance()` argument, which is how a codebase that centralises its cryptography passes the choice to a helper. The string is unambiguous wherever it appears: nothing but a transformation is spelled that way.

This names an encryption method as text, and passes it to code elsewhere that does the work. It is the same choice, made in a different place.

What to do. The same migration applies as to the call that consumes it. Move the constant and the call together, so the inventory keeps naming the algorithm after the change.

1. crypto/src/main/java/org/springframework/security/crypto/encrypt/RsaAlgorithm.java:27 DEFAULT("RSA", 117), OAEP("RSA/ECB/OAEPPadding", 86);

java.transformation · CWE-327

RSA-OAEP Quantum-vulnerable Recorded traffic 1 place See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/NimbusJweEncoderTests.java:175 test path RSA_OAEP_256("RSA-OAEP-256");

jose.algorithm · CWE-327

RSASSA-PKCS1v15 Quantum-vulnerable 1 place See details

SSH algorithms pinned in configuration

A `KexAlgorithms`, `HostKeyAlgorithms` or `Ciphers` directive in an SSH configuration. `KexAlgorithms` is the line that decides whether recorded sessions stay confidential.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both.

What to do. Put `sntrup761x25519-sha512@openssh.com` first in `KexAlgorithms`. It is a hybrid, so it is no weaker than the classical exchange it replaces.

1. crypto/src/main/java/org/springframework/security/crypto/encrypt/RsaKeyHelper.java:212 output.append("ssh-rsa ");

config.ssh-algorithms · CWE-757

SHA-256 Reduced margin 18 places See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/DefaultOAuth2TokenCustomizers.java:146 MessageDigest md = MessageDigest.getInstance("SHA-256");
2. config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2RefreshTokenGrantTests.java:433 test path MessageDigest md = MessageDigest.getInstance("SHA-256");
3. config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/DPoPAuthenticationTests.java:260 test path MessageDigest md = MessageDigest.getInstance("SHA-256");
4. oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/CodeVerifierAuthenticator.java:162 MessageDigest md = MessageDigest.getInstance("SHA-256");
5. oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationProvider.java:361 MessageDigest md = MessageDigest.getInstance("SHA-256");
6. oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcLogoutAuthenticationProvider.java:235 MessageDigest md = MessageDigest.getInstance("SHA-256");
7. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationProviderTests.java:814 test path MessageDigest md = MessageDigest.getInstance("SHA-256");
8. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcLogoutAuthenticationProviderTests.java:585 test path MessageDigest md = MessageDigest.getInstance("SHA-256");
9. oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/authentication/OidcAuthorizationCodeAuthenticationProvider.java:263 MessageDigest md = MessageDigest.getInstance("SHA-256");
10. oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/authentication/OidcAuthorizationCodeReactiveAuthenticationManager.java:255 MessageDigest md = MessageDigest.getInstance("SHA-256");
11. oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/DefaultOAuth2AuthorizationRequestResolver.java:297 MessageDigest md = MessageDigest.getInstance("SHA-256");
12. oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/OAuth2AuthorizationRequestCustomizers.java:106 MessageDigest md = MessageDigest.getInstance("SHA-256");
13. oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/server/DefaultServerOAuth2AuthorizationRequestResolver.java:291 MessageDigest md = MessageDigest.getInstance("SHA-256");
14. oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/DPoPProofJwtDecoderFactory.java:249 MessageDigest md = MessageDigest.getInstance("SHA-256");
15. oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/DPoPProofReplayValidator.java:168 MessageDigest md = MessageDigest.getInstance("SHA-256");
16. oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/X509CertificateThumbprintValidator.java:114 MessageDigest md = MessageDigest.getInstance("SHA-256");
17. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/NimbusJwtEncoderDecoderTests.java:57 test path KeyGenerator keyGenerator = KeyGenerator.getInstance("HmacSHA256");
18. oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/authentication/DPoPAuthenticationProviderTests.java:319 test path MessageDigest md = MessageDigest.getInstance("SHA-256");

java.messagedigest · CWE-328

PBKDF2 Reduced margin 12 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. crypto/src/main/java/org/springframework/security/crypto/encrypt/AesBytesEncryptor.java:105 new PBEKeySpec(password.toCharArray(), Hex.decode(salt), 1024, 256)), ivGenerator, alg);
2. crypto/src/main/java/org/springframework/security/crypto/encrypt/AesCbcBytesEncryptor.java:122 new PBEKeySpec(password.toCharArray(), Hex.decode(salt), DEFAULT_PBKDF2_ITERATIONS, 256));
3. crypto/src/main/java/org/springframework/security/crypto/encrypt/AesGcmBytesEncryptor.java:129 new PBEKeySpec(password.toCharArray(), Hex.decode(salt), DEFAULT_PBKDF2_ITERATIONS, 256));
4. crypto/src/main/java/org/springframework/security/crypto/encrypt/CipherUtils.java:51 return newSecretKey(algorithm, new PBEKeySpec(password.toCharArray()));
5. crypto/src/main/java/org/springframework/security/crypto/password/Pbkdf2PasswordEncoder.java:226 PBEKeySpec spec = new PBEKeySpec(rawPassword.toString().toCharArray(),
6. crypto/src/test/java/org/springframework/security/crypto/encrypt/AesBytesEncryptorTests.java:89 test path PBEKeySpec keySpec = new PBEKeySpec(this.password.toCharArray(), Hex.decode(this.hexSalt), 1024, 256);
7. crypto/src/test/java/org/springframework/security/crypto/encrypt/AesCbcBytesEncryptorTests.java:59 test path PBEKeySpec keySpec = new PBEKeySpec(this.password.toCharArray(), Hex.decode(this.hexSalt), 1024, 256);
8. crypto/src/test/java/org/springframework/security/crypto/encrypt/AesCbcBytesEncryptorTests.java:115 test path PBEKeySpec keySpec = new PBEKeySpec(this.password.toCharArray(), Hex.decode(this.hexSalt), 1024, 256);
9. crypto/src/test/java/org/springframework/security/crypto/encrypt/AesCbcBytesEncryptorTests.java:128 test path PBEKeySpec keySpec = new PBEKeySpec(this.password.toCharArray(), Hex.decode(this.hexSalt), 1024, 256);
10. crypto/src/test/java/org/springframework/security/crypto/encrypt/AesGcmBytesEncryptorTests.java:56 test path PBEKeySpec keySpec = new PBEKeySpec(this.password.toCharArray(), Hex.decode(this.hexSalt), 1024, 256);
11. crypto/src/test/java/org/springframework/security/crypto/encrypt/AesGcmBytesEncryptorTests.java:92 test path PBEKeySpec keySpec = new PBEKeySpec(this.password.toCharArray(), Hex.decode(this.hexSalt), 1024, 256);
12. crypto/src/test/java/org/springframework/security/crypto/encrypt/AesGcmBytesEncryptorTests.java:105 test path PBEKeySpec keySpec = new PBEKeySpec(this.password.toCharArray(), Hex.decode(this.hexSalt), 1024, 256);

java.keyspec · CWE-327

SHA-256 Reduced margin Renamed import 11 places See details

XML signature or encryption algorithm

An XML Signature or XML Encryption algorithm URI - SAML, XAdES or WS-Security. The URI names the algorithm exactly, and a signature URI names its digest as well, so `#rsa-sha1` reports both the key and the broken digest.

Federated login and signed XML documents name their cryptography in a web address. Some of those addresses name algorithms that are already broken.

What to do. Move off `#rsa-sha1` first: that signature is forgeable today, with no quantum computer involved. The key algorithm changes with the wider migration.

1. config/src/test/java/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParserTests.java:99 test path " <ds:SignatureMethod Algorithm=\"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256\"/>\n" +
2. config/src/test/java/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParserTests.java:173 test path .containsExactly("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");
3. config/src/test/java/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParserTests.java:207 test path .containsExactly("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");
4. config/src/test/java/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParserTests.java:234 test path .containsExactly("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");
5. config/src/test/java/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParserTests.java:258 test path assertThat(google.getSigningAlgorithms()).containsExactly("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");
6. config/src/test/java/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParserTests.java:274 test path "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
7. saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/registration/RelyingPartyRegistration.java:783 ? Collections.singletonList("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256")
8. saml2/saml2-service-provider/src/opensaml5Test/java/org/springframework/security/saml2/provider/service/metadata/OpenSaml5MetadataResolverTests.java:70 test path .contains("SignatureMethod Algorithm=\"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256")
9. saml2/saml2-service-provider/src/opensaml5Test/java/org/springframework/security/saml2/provider/service/metadata/OpenSaml5MetadataResolverTests.java:74 test path .contains("DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"")
10. saml2/saml2-service-provider/src/opensaml5Test/java/org/springframework/security/saml2/provider/service/metadata/OpenSaml5MetadataResolverTests.java:176 test path .contains("SignatureMethod Algorithm=\"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256")
11. saml2/saml2-service-provider/src/opensaml5Test/java/org/springframework/security/saml2/provider/service/metadata/OpenSaml5MetadataResolverTests.java:180 test path .contains("DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"")

xmldsig.algorithm · CWE-327

AES Reduced margin 10 places See details

Cipher transformation named away from the call

A JCA transformation string - `algorithm/mode/padding` - written somewhere other than a `getInstance()` argument, which is how a codebase that centralises its cryptography passes the choice to a helper. The string is unambiguous wherever it appears: nothing but a transformation is spelled that way.

This names an encryption method as text, and passes it to code elsewhere that does the work. It is the same choice, made in a different place.

What to do. The same migration applies as to the call that consumes it. Move the constant and the call together, so the inventory keeps naming the algorithm after the change.

1. crypto/src/main/java/org/springframework/security/crypto/encrypt/AesBytesEncryptor.java:55 private static final String AES_CBC_ALGORITHM = "AES/CBC/PKCS5Padding";
2. crypto/src/main/java/org/springframework/security/crypto/encrypt/AesBytesEncryptor.java:57 private static final String AES_GCM_ALGORITHM = "AES/GCM/NoPadding";
3. crypto/src/main/java/org/springframework/security/crypto/encrypt/AesBytesEncryptor.java:172 CBC(AES_CBC_ALGORITHM, NULL_IV_GENERATOR),
4. crypto/src/main/java/org/springframework/security/crypto/encrypt/AesBytesEncryptor.java:174 GCM(AES_GCM_ALGORITHM, KeyGenerators.secureRandom(16));
5. crypto/src/main/java/org/springframework/security/crypto/encrypt/AesCbcBytesEncryptor.java:60 private static final String ALGORITHM = "AES/CBC/PKCS5Padding";
6. crypto/src/main/java/org/springframework/security/crypto/encrypt/AesCbcBytesEncryptor.java:76 this.encryptor = CipherUtils.newCipher(ALGORITHM);
7. crypto/src/main/java/org/springframework/security/crypto/encrypt/AesCbcBytesEncryptor.java:77 this.decryptor = CipherUtils.newCipher(ALGORITHM);
8. crypto/src/main/java/org/springframework/security/crypto/encrypt/AesGcmBytesEncryptor.java:63 private static final String ALGORITHM = "AES/GCM/NoPadding";
9. crypto/src/main/java/org/springframework/security/crypto/encrypt/AesGcmBytesEncryptor.java:81 this.encryptor = CipherUtils.newCipher(ALGORITHM);
10. crypto/src/main/java/org/springframework/security/crypto/encrypt/AesGcmBytesEncryptor.java:82 this.decryptor = CipherUtils.newCipher(ALGORITHM);

java.transformation · CWE-327

Kerberos Reduced margin Renamed import 7 places See details

Kerberos or SPNEGO authentication

`javax.security.auth.kerberos` or a GSS-API call. Kerberos itself is symmetric and survives Shor; its PKINIT certificate flow is public-key and does not. The encryption types configured for the realm decide whether it is also a present-day concern.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Kerberos is symmetric at its core, so Shor does not break it. The surrounding PKINIT certificate flow is public-key and does fall.

What to do. Restrict the realm to AES encryption types, and treat PKINIT certificates as part of the public-key migration.

1. kerberos/kerberos-client/src/main/java/org/springframework/security/kerberos/client/KerberosRestTemplate.java:224 princ.add(new KerberosPrincipal(this.userPrincipal));
2. kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosMultiTier.java:85 GSSManager manager = GSSManager.getInstance();
3. kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosServiceRequestToken.java:196 final GSSContext context = validation.getGssContext();
4. kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosTicketValidation.java:39 private final @Nullable GSSContext gssContext;
5. kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/sun/SunJaasKerberosTicketValidator.java:123 princ.add(new KerberosPrincipal(this.servicePrincipal));
6. kerberos/kerberos-core/src/test/java/org/springframework/security/kerberos/authentication/KerberosTicketValidationTests.java:36 test path private GSSContext gssContext = mock(GSSContext.class);
7. kerberos/kerberos-test/src/test/java/org/springframework/security/kerberos/test/TestMiniKdc.java:69 test path principals.add(new KerberosPrincipal(principal));

java.kerberos

AES Reduced margin 6 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. crypto/src/main/java/org/springframework/security/crypto/encrypt/AesBytesEncryptor.java:117 this.secretKey = new SecretKeySpec(secretKey.getEncoded(), "AES");
2. crypto/src/main/java/org/springframework/security/crypto/encrypt/AesCbcBytesEncryptor.java:75 this.secretKey = new SecretKeySpec(secretKey.getEncoded(), "AES");
3. crypto/src/main/java/org/springframework/security/crypto/encrypt/AesGcmBytesEncryptor.java:80 this.secretKey = new SecretKeySpec(secretKey.getEncoded(), "AES");
4. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/NimbusJwtEncoderTests.java:423 test path SecretKey Key = new SecretKeySpec(keyStr.getBytes(), "AES");
5. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/NimbusJwtEncoderTests.java:435 test path SecretKey Key = new SecretKeySpec(keyStr.getBytes(), "AES");
6. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/NimbusJwtEncoderTests.java:442 test path SecretKey Key = new SecretKeySpec("key".getBytes(), "AES");

java.keyspec · CWE-327

PBKDF2 Reduced margin 20 places See details

Password hashing or key derivation

A `SecretKeyFactory` for PBKDF2, or a BouncyCastle password KDF. Not a quantum exposure, and part of a complete inventory.

This is how passwords are stored. Quantum computers do not meaningfully weaken it.

What to do. PBKDF2 needs a high iteration count. Argon2 through BouncyCastle is stronger.

1. crypto/src/main/java/org/springframework/security/crypto/encrypt/AesBytesEncryptor.java:104 this(CipherUtils.newSecretKey("PBKDF2WithHmacSHA1",
2. crypto/src/main/java/org/springframework/security/crypto/encrypt/AesCbcBytesEncryptor.java:121 return CipherUtils.newSecretKey("PBKDF2WithHmacSHA256",
3. crypto/src/main/java/org/springframework/security/crypto/encrypt/AesGcmBytesEncryptor.java:128 return CipherUtils.newSecretKey("PBKDF2WithHmacSHA256",
4. crypto/src/main/java/org/springframework/security/crypto/encrypt/BouncyCastleAesBytesEncryptor.java:48 PBEParametersGenerator keyGenerator = new PKCS5S2ParametersGenerator();
5. crypto/src/main/java/org/springframework/security/crypto/password/Pbkdf2PasswordEncoder.java:53 private static final SecretKeyFactoryAlgorithm DEFAULT_ALGORITHM = SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA256;
6. crypto/src/main/java/org/springframework/security/crypto/password/Pbkdf2PasswordEncoder.java:107 this.algorithm = SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1.name();
7. crypto/src/main/java/org/springframework/security/crypto/password/Pbkdf2PasswordEncoder.java:181 this.hashWidth = SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1.equals(secretKeyFactoryAlgorithm) ? 160
8. crypto/src/main/java/org/springframework/security/crypto/password/Pbkdf2PasswordEncoder.java:182 : SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA256.equals(secretKeyFactoryAlgorithm) ? 256 : 512;
9. crypto/src/main/java/org/springframework/security/crypto/password/Pbkdf2PasswordEncoder.java:243 PBKDF2WithHmacSHA1, PBKDF2WithHmacSHA256, PBKDF2WithHmacSHA512
10. crypto/src/test/java/org/springframework/security/crypto/encrypt/AesBytesEncryptorTests.java:90 test path SecretKey secretKey = CipherUtils.newSecretKey(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1.name(), keySpec);
11. crypto/src/test/java/org/springframework/security/crypto/encrypt/AesCbcBytesEncryptorTests.java:60 test path SecretKey secretKey = CipherUtils.newSecretKey(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1.name(), keySpec);
12. crypto/src/test/java/org/springframework/security/crypto/encrypt/AesCbcBytesEncryptorTests.java:116 test path SecretKey key = CipherUtils.newSecretKey(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1.name(), keySpec);
13. crypto/src/test/java/org/springframework/security/crypto/encrypt/AesCbcBytesEncryptorTests.java:129 test path SecretKey key = CipherUtils.newSecretKey(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1.name(), keySpec);
14. crypto/src/test/java/org/springframework/security/crypto/encrypt/AesGcmBytesEncryptorTests.java:57 test path SecretKey secretKey = CipherUtils.newSecretKey(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1.name(), keySpec);
15. crypto/src/test/java/org/springframework/security/crypto/encrypt/AesGcmBytesEncryptorTests.java:93 test path SecretKey key = CipherUtils.newSecretKey(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1.name(), keySpec);
16. crypto/src/test/java/org/springframework/security/crypto/encrypt/AesGcmBytesEncryptorTests.java:106 test path SecretKey key = CipherUtils.newSecretKey(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1.name(), keySpec);
17. crypto/src/test/java/org/springframework/security/crypto/password/Pbkdf2PasswordEncoderTests.java:171 test path this.encoder.setAlgorithm(Pbkdf2PasswordEncoder.SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA256);
18. crypto/src/test/java/org/springframework/security/crypto/password/Pbkdf2PasswordEncoderTests.java:179 test path this.encoderSalt16.setAlgorithm(Pbkdf2PasswordEncoder.SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA256);
19. crypto/src/test/java/org/springframework/security/crypto/password/Pbkdf2PasswordEncoderTests.java:187 test path this.encoder.setAlgorithm(Pbkdf2PasswordEncoder.SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA256);
20. crypto/src/test/java/org/springframework/security/crypto/password/Pbkdf2PasswordEncoderTests.java:195 test path this.encoderSalt16.setAlgorithm(Pbkdf2PasswordEncoder.SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA256);

java.kdf

AES Reduced margin 4 places See details

Symmetric cipher through BouncyCastle

A BouncyCastle symmetric engine or mode. Symmetric encryption is not broken by a quantum computer, so these are inventoried rather than flagged - but a complete cryptographic inventory has to contain them, and the mode is where AES-256 or a 64-bit block shows up.

This is the kind of encryption that quantum computers do not break. It is listed so the inventory is complete.

What to do. Use a 256-bit key. No change of algorithm is required unless the engine is DES, RC4 or Blowfish.

1. crypto/src/main/java/org/springframework/security/crypto/encrypt/BouncyCastleAesCbcBytesEncryptor.java:52 CBCModeCipher cbcModeCipher = CBCBlockCipher.newInstance(AESEngine.newInstance());
2. crypto/src/main/java/org/springframework/security/crypto/encrypt/BouncyCastleAesCbcBytesEncryptor.java:61 CBCModeCipher cbcModeCipher = CBCBlockCipher.newInstance(AESEngine.newInstance());
3. crypto/src/main/java/org/springframework/security/crypto/encrypt/BouncyCastleAesGcmBytesEncryptor.java:50 AEADBlockCipher blockCipher = GCMBlockCipher.newInstance(AESEngine.newInstance());
4. crypto/src/main/java/org/springframework/security/crypto/encrypt/BouncyCastleAesGcmBytesEncryptor.java:60 AEADBlockCipher blockCipher = GCMBlockCipher.newInstance(AESEngine.newInstance());

java.bouncycastle.symmetric

SHA-224 Reduced margin 3 places See details

XML signature or encryption algorithm

An XML Signature or XML Encryption algorithm URI - SAML, XAdES or WS-Security. The URI names the algorithm exactly, and a signature URI names its digest as well, so `#rsa-sha1` reports both the key and the broken digest.

Federated login and signed XML documents name their cryptography in a web address. Some of those addresses name algorithms that are already broken.

What to do. Move off `#rsa-sha1` first: that signature is forgeable today, with no quantum computer involved. The key algorithm changes with the wider migration.

1. config/src/test/java/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParserTests.java:273 test path "http://www.w3.org/2001/04/xmldsig-more#rsa-sha224",
2. config/src/test/resources/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParserTests-MultiRegistration.xml:56 test path signing-algorithms="http://www.w3.org/2001/04/xmldsig-more#rsa-sha224,http://www.w3.org/2001/04/xmldsig-more#rsa-sha256,http://www.w3.org/2001/04/xmldsig-more#rsa-sha384">
3. config/src/test/resources/org/springframework/security/config/saml2/google-custom-registration.xml:55 test path signing-algorithms="http://www.w3.org/2001/04/xmldsig-more#rsa-sha224,http://www.w3.org/2001/04/xmldsig-more#rsa-sha256,http://www.w3.org/2001/04/xmldsig-more#rsa-sha384">

xmldsig.algorithm · CWE-327

unknown Could not be determined 2 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OidcClientRegistrationTests.java:461 test path TestJwks.jwk(new SecretKeySpec(clientRegistrationResponse.getClientSecret().getBytes(), "HS256"))
2. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/NimbusJwtEncoderTests.java:482 test path SecretKey key = new SecretKeySpec(keyStr.getBytes(), "HS256");

java.keyspec · CWE-327

unknown Could not be determined 2 places See details

Key pair algorithm chosen at runtime

`KeyPairGenerator.getInstance(x)` where the argument is an identifier. The algorithm cannot be resolved without running the program, so this is reported as an unknown rather than assumed to be classical.

This code picks its encryption method while it runs, so a scan cannot tell which one it ends up using. Somebody has to check the configuration.

What to do. Trace the value to its configuration source and record the concrete algorithm in the cryptographic inventory by hand.

1. crypto/src/main/java/org/springframework/security/crypto/encrypt/CipherUtils.java:75 return Cipher.getInstance(algorithm);
2. crypto/src/test/java/org/springframework/security/crypto/encrypt/CryptoAssumptions.java:43 test path Cipher.getInstance(cipherAlgorithm);

java.keypairgenerator.variable · CWE-327

unknown Could not be determined 1 place See details

Non-cryptographic randomness near key material

`new Random()` or `Math.random()` in a file that also imports `java.security`, `javax.crypto` or BouncyCastle. `java.util.Random` is a linear congruential generator and its output is predictable from a handful of samples. The import check is what keeps this from firing on every retry jitter and test fixture in the tree.

Part of this code uses a predictable source of random numbers. If any key comes from it, that key can be guessed today, with no quantum computer needed.

What to do. `java.security.SecureRandom`. This is a classical defect, not a quantum one, and it is worth fixing first.

1. crypto/src/test/java/org/springframework/security/crypto/encrypt/BouncyCastleAesBytesEncryptorEquivalencyTests.java:154 test path this.random = new Random(1);

java.random.insecure · CWE-338

bcrypt Quantum-safe Renamed import 62 places See details

Password hashing or key derivation

A `SecretKeyFactory` for PBKDF2, or a BouncyCastle password KDF. Not a quantum exposure, and part of a complete inventory.

This is how passwords are stored. Quantum computers do not meaningfully weaken it.

What to do. PBKDF2 needs a high iteration count. Argon2 through BouncyCastle is stronger.

1. crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCrypt.java:62 public class BCrypt {
2. crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCrypt.java:607 BCrypt B;
3. crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCrypt.java:659 B = new BCrypt();
4. crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.java:105 if (strength != -1 && (strength < BCrypt.MIN_LOG_ROUNDS || strength > BCrypt.MAX_LOG_ROUNDS)) {
5. crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.java:116 return BCrypt.hashpw(rawPassword.toString(), salt);
6. crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.java:120 return BCrypt.gensalt(this.version.getVersion(), this.strength, this.random.get());
7. crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.java:126 this.logger.warn("Encoded password does not look like BCrypt");
8. crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.java:129 return BCrypt.checkpw(rawPassword.toString(), encodedPassword);
9. crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.java:136 throw new IllegalArgumentException("Encoded password does not look like BCrypt: " + encodedPassword);
10. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:200 test path print("BCrypt.hashpw(): ");
11. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:202 test path String hashed = BCrypt.hashpw(test.password, test.salt);
12. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:215 test path String hashed = BCrypt.hashpw(test.password, test.salt);
13. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:225 test path print("BCrypt.gensalt(log_rounds):");
14. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:230 test path String salt = BCrypt.gensalt(i);
15. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:231 test path String hashed1 = BCrypt.hashpw(plain, salt);
16. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:232 test path String hashed2 = BCrypt.hashpw(plain, hashed1);
17. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:245 test path print("BCrypt.gensalt(): ");
18. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:248 test path String salt = BCrypt.gensalt();
19. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:249 test path String hashed1 = BCrypt.hashpw(plain, salt);
20. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:250 test path String hashed2 = BCrypt.hashpw(plain, hashed1);
21. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:262 test path print("BCrypt.checkpw w/ good passwords: ");
22. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:264 test path assertThat(BCrypt.checkpw(test.password, test.expected)).isTrue();
23. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:276 test path assertThat(BCrypt.checkpw(test.password, test.expected)).isTrue();
24. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:285 test path print("BCrypt.checkpw w/ bad passwords: ");
25. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:290 test path assertThat(BCrypt.checkpw(plain, expected)).isFalse();
26. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:305 test path assertThat(BCrypt.checkpw(plain, expected)).isFalse();
27. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:314 test path print("BCrypt.hashpw w/ international chars: ");
28. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:317 test path String h1 = BCrypt.hashpw(pw1, BCrypt.gensalt());
29. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:318 test path assertThat(BCrypt.checkpw(pw2, h1)).isFalse();
30. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:320 test path String h2 = BCrypt.hashpw(pw2, BCrypt.gensalt());
31. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:321 test path assertThat(BCrypt.checkpw(pw1, h2)).isFalse();
32. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:328 test path assertThat(BCrypt.roundsForLogRounds(10)).isEqualTo(1024);
33. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:329 test path assertThat(BCrypt.roundsForLogRounds(31)).isEqualTo(0x80000000L);
34. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:335 test path .isThrownBy(() -> BCrypt.encode_base64(new byte[0], 0, new StringBuilder()));
35. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:341 test path .isThrownBy(() -> BCrypt.encode_base64(new byte[1], 2, new StringBuilder()));
36. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:346 test path assertThatIllegalArgumentException().isThrownBy(() -> BCrypt.decode_base64("", 0));
37. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:351 test path BCrypt.encode_base64(d, len, rs);
38. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:364 test path byte[] ba = BCrypt.decode_base64("ππππππππ", 1);
39. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:370 test path assertThat(BCrypt.decode_base64("....", 1)).hasSize(1);
40. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:371 test path assertThat(BCrypt.decode_base64(" ....", 1)).isEmpty();
41. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:376 test path assertThat(BCrypt.decode_base64("", 1)).isEmpty();
42. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:377 test path assertThat(BCrypt.decode_base64("......", 3)).hasSize(3);
43. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:378 test path assertThat(BCrypt.decode_base64("......", 4)).hasSize(4);
44. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:379 test path assertThat(BCrypt.decode_base64("......", 5)).hasSize(4);
45. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:394 test path byte[] decoded = BCrypt.decode_base64(s, 3);
46. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:402 test path assertThatIllegalArgumentException().isThrownBy(() -> BCrypt.gensalt(3));
47. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:407 test path assertThatIllegalArgumentException().isThrownBy(() -> BCrypt.gensalt(32));
48. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:412 test path assertThat(BCrypt.gensalt(4)).startsWith("$2a$04$");
49. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:413 test path assertThat(BCrypt.gensalt(31)).startsWith("$2a$31$");
50. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:418 test path assertThatIllegalArgumentException().isThrownBy(() -> BCrypt.hashpw("password", null));
51. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:424 test path .isThrownBy(() -> BCrypt.hashpw("password", "$2a$03$......................"));
52. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:430 test path .isThrownBy(() -> BCrypt.hashpw("password", "$2a$32$......................"));
53. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:435 test path assertThatIllegalArgumentException().isThrownBy(() -> BCrypt.hashpw("", ""));
54. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:440 test path assertThat(BCrypt.hashpw("password", "$2$05$......................"))
55. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:447 test path .isThrownBy(() -> BCrypt.hashpw("password", "$2a$10$123456789012345678901"));
56. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:452 test path assertThat(BCrypt.equalsNoEarlyReturn("", "")).isTrue();
57. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:453 test path assertThat(BCrypt.equalsNoEarlyReturn("test", "test")).isTrue();
58. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:454 test path assertThat(BCrypt.equalsNoEarlyReturn("test", "")).isFalse();
59. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:455 test path assertThat(BCrypt.equalsNoEarlyReturn("", "test")).isFalse();
60. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:456 test path assertThat(BCrypt.equalsNoEarlyReturn("test", "pass")).isFalse();
61. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:462 test path assertThat(BCrypt.checkpw("password", password)).isTrue();
62. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java:463 test path assertThat(BCrypt.checkpw("wrong", password)).isFalse();

java.kdf

CSPRNG Quantum-safe 18 places See details

Random number generation

`SecureRandom`. A platform CSPRNG is not a quantum exposure; it is recorded because an inventory that omits the randomness source is incomplete. `SHA1PRNG` is named explicitly where it appears, since it is a legacy algorithm even though its output is adequate.

This is where the software gets its random numbers. Quantum computers do not weaken it.

What to do. No action. Prefer the platform default over naming an algorithm.

1. config/src/main/java/org/springframework/security/config/authentication/UserServiceBeanDefinitionParser.java:110 this.random = SecureRandom.getInstance("SHA1PRNG");
2. config/src/main/java/org/springframework/security/config/http/AuthenticationConfigBuilder.java:762 SecureRandom random = new SecureRandom();
3. core/src/main/java/org/springframework/security/core/token/SecureRandomFactoryBean.java:43 SecureRandom random = SecureRandom.getInstance(this.algorithm);
4. core/src/test/java/org/springframework/security/authentication/dao/DaoAuthenticationProviderTests.java:436 test path PasswordEncoder encoder = new BCryptPasswordEncoder(10, new SecureRandom());
5. crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCrypt.java:721 return gensalt(prefix, log_rounds, new SecureRandom());
6. crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.java:169 private static final SecureRandom INSTANCE = new SecureRandom();
7. crypto/src/main/java/org/springframework/security/crypto/keygen/SecureRandomBytesKeyGenerator.java:48 this.random = new SecureRandom();
8. crypto/src/main/java/org/springframework/security/crypto/password4j/BalloonHashingPassword4jPasswordEncoder.java:113 this.secureRandom = new SecureRandom();
9. crypto/src/main/java/org/springframework/security/crypto/password4j/Pbkdf2Password4jPasswordEncoder.java:111 this.secureRandom = new SecureRandom();
10. crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoderTests.java:150 test path setEncoder(new BCryptPasswordEncoder(8, new SecureRandom()));
11. crypto/src/test/java/org/springframework/security/crypto/encrypt/BouncyCastleAesBytesEncryptorEquivalencyTests.java:43 test path private SecureRandom secureRandom = new SecureRandom();
12. crypto/src/test/java/org/springframework/security/crypto/encrypt/BouncyCastleAesBytesEncryptorTests.java:43 test path SecureRandom secureRandom = new SecureRandom();
13. oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/util/X509CertificateUtils.java:88 test path BigInteger serialNum = new BigInteger(Long.toString(new SecureRandom().nextLong()));
14. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jose/X509CertificateUtils.java:88 test path BigInteger serialNum = new BigInteger(Long.toString(new SecureRandom().nextLong()));
15. web/src/main/java/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServices.java:79 this.random = new SecureRandom();
16. web/src/main/java/org/springframework/security/web/csrf/XorCsrfTokenRequestAttributeHandler.java:46 private SecureRandom secureRandom = new SecureRandom();
17. web/src/main/java/org/springframework/security/web/server/csrf/XorServerCsrfTokenRequestAttributeHandler.java:46 private SecureRandom secureRandom = new SecureRandom();
18. webauthn/src/main/java/org/springframework/security/web/webauthn/api/Bytes.java:40 private static final SecureRandom RANDOM = new SecureRandom();

java.rng

HMAC Quantum-safe 5 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. A keyed MAC is not affected by Shor and only marginally by Grover.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OidcClientRegistrationTests.java:461 test path TestJwks.jwk(new SecretKeySpec(clientRegistrationResponse.getClientSecret().getBytes(), "HS256"))
2. oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jose/jws/JwsAlgorithms.java:39 public static final String HS256 = "HS256";
3. oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jose/jws/JwsAlgorithms.java:44 public static final String HS384 = "HS384";
4. oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jose/jws/JwsAlgorithms.java:49 public static final String HS512 = "HS512";
5. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/NimbusJwtEncoderTests.java:482 test path SecretKey key = new SecretKeySpec(keyStr.getBytes(), "HS256");

jose.algorithm · CWE-327

scrypt Quantum-safe 3 places See details

Password hashing or key derivation

A `SecretKeyFactory` for PBKDF2, or a BouncyCastle password KDF. Not a quantum exposure, and part of a complete inventory.

This is how passwords are stored. Quantum computers do not meaningfully weaken it.

What to do. PBKDF2 needs a high iteration count. Argon2 through BouncyCastle is stronger.

1. crypto/src/main/java/org/springframework/security/crypto/scrypt/SCryptPasswordEncoder.java:162 throw new IllegalArgumentException("Encoded password does not look like SCrypt: " + encodedPassword);
2. crypto/src/main/java/org/springframework/security/crypto/scrypt/SCryptPasswordEncoder.java:182 byte[] generated = SCrypt.generate(Utf8.encode(rawPassword), salt, cpuCost, memoryCost, parallelization,
3. crypto/src/main/java/org/springframework/security/crypto/scrypt/SCryptPasswordEncoder.java:188 byte[] derived = SCrypt.generate(Utf8.encode(rawPassword), salt, this.cpuCost, this.memoryCost,

java.kdf

Argon2 Quantum-safe 2 places See details

Password hashing or key derivation

A `SecretKeyFactory` for PBKDF2, or a BouncyCastle password KDF. Not a quantum exposure, and part of a complete inventory.

This is how passwords are stored. Quantum computers do not meaningfully weaken it.

What to do. PBKDF2 needs a high iteration count. Argon2 through BouncyCastle is stronger.

1. crypto/src/main/java/org/springframework/security/crypto/argon2/Argon2PasswordEncoder.java:123 Argon2BytesGenerator generator = new Argon2BytesGenerator();
2. crypto/src/main/java/org/springframework/security/crypto/argon2/Argon2PasswordEncoder.java:140 Argon2BytesGenerator generator = new Argon2BytesGenerator();

java.kdf

HMAC Quantum-safe 1 place See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

No known quantum attack changes how strong this is. A keyed MAC is not affected by Shor and only marginally by Grover.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/NimbusJwtEncoderDecoderTests.java:57 test path KeyGenerator keyGenerator = KeyGenerator.getInstance("HmacSHA256");

java.cipher · CWE-327

SHA-384 Quantum-safe 1 place See details

XML signature or encryption algorithm

An XML Signature or XML Encryption algorithm URI - SAML, XAdES or WS-Security. The URI names the algorithm exactly, and a signature URI names its digest as well, so `#rsa-sha1` reports both the key and the broken digest.

Federated login and signed XML documents name their cryptography in a web address. Some of those addresses name algorithms that are already broken.

What to do. Move off `#rsa-sha1` first: that signature is forgeable today, with no quantum computer involved. The key algorithm changes with the wider migration.

1. config/src/test/java/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParserTests.java:275 test path "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384");

xmldsig.algorithm · CWE-327

SHA-512 Quantum-safe 1 place See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. core/src/main/java/org/springframework/security/core/token/Sha512DigestUtils.java:45 return MessageDigest.getInstance("SHA-512");

java.messagedigest · CWE-328