Crypto-View

To address	1203
Key establishment	544
Inventory only	1
Total findings	1619

Branch	`main`
Commit	`ed4a5e564bca79a3da4e601ad3ff9ea4436d1ad3` Bump BoringSSL, OpenSSL, AWS-LC in CI (#15670)
Committed	2026-09-19 11:36 UTC
Scanned	2026-09-21 10:57 UTC 9 hours ago
Coverage	853 files, 5 go, 1 java, 269 python

RSAES-PKCS1v15 Already broken Recorded traffic Renamed import 80 places See details

PKCS#1 v1.5 padding

`padding.PKCS1v15()`. For encryption this is vulnerable to Bleichenbacher-style padding oracles today; for signatures it is acceptable but the key is still RSA.

This is already unsafe today, with no quantum computer involved. PKCS#1 v1.5 encryption padding is vulnerable to Bleichenbacher oracles today, and the underlying RSA is broken by Shor.

What to do. For encryption, OAEP immediately and ML-KEM-768 as the destination.

src/cryptography/hazmat/primitives/serialization/pkcs7.py:202 if not ossl.rsa_encryption_supported(padding=padding.PKCS1v15()):
src/cryptography/hazmat/primitives/serialization/ssh.py:1014 padding.PKCS1v15(),
src/cryptography/hazmat/primitives/serialization/ssh.py:1608 f.tobytes(), padding.PKCS1v15(), hashes.SHA512()
tests/hazmat/backends/test_openssl.py:127 test path assert backend.rsa_padding_supported(padding.PKCS1v15()) is True
tests/hazmat/primitives/test_pkcs7.py:680 test path padding.PKCS1v15(),
tests/hazmat/primitives/test_pkcs7.py:746 test path cert, key, hashes.SHA512(), rsa_padding=padding.PKCS1v15()
tests/hazmat/primitives/test_pkcs7.py:916 test path padding.PKCS1v15()
tests/hazmat/primitives/test_pkcs7.py:1148 test path padding.PKCS1v15()
tests/hazmat/primitives/test_pkcs7.py:1467 test path public_key.encrypt(b"A" * 15, padding.PKCS1v15()),
tests/hazmat/primitives/test_pkcs7.py:1468 test path public_key.encrypt(b"A" * 17, padding.PKCS1v15()),
tests/hazmat/primitives/test_pkcs7.py:1469 test path public_key.encrypt(b"A" * 32, padding.PKCS1v15()),
tests/hazmat/primitives/test_pkcs7.py:1471 test path public_key.encrypt(b"A" * 16, padding.PKCS1v15()),
tests/hazmat/primitives/test_pkcs7.py:1574 test path not backend.rsa_encryption_supported(padding.PKCS1v15())
tests/hazmat/primitives/test_pkcs7.py:1586 test path not backend.rsa_encryption_supported(padding.PKCS1v15())
tests/hazmat/primitives/test_rsa.py:270 test path signature = key.sign(b"whatever", padding.PKCS1v15(), hashes.SHA224())
tests/hazmat/primitives/test_rsa.py:272 test path signature, b"whatever", padding.PKCS1v15(), hashes.SHA224()
tests/hazmat/primitives/test_rsa.py:288 test path b"badsig", b"whatever", padding.PKCS1v15(), hashes.SHA256()
tests/hazmat/primitives/test_rsa.py:398 test path padding.PKCS1v15(),
tests/hazmat/primitives/test_rsa.py:440 test path padding.PKCS1v15(),
tests/hazmat/primitives/test_rsa.py:712 test path b"failure coming", padding.PKCS1v15(), hashes.SHA512()
tests/hazmat/primitives/test_rsa.py:720 test path private_key.sign(b"no failure", padding.PKCS1v15(), hashes.SHA512())
tests/hazmat/primitives/test_rsa.py:731 test path pkcs = padding.PKCS1v15()
tests/hazmat/primitives/test_rsa.py:827 test path b"sign me", padding.PKCS1v15(), hashes.SHA256()
tests/hazmat/primitives/test_rsa.py:833 test path padding.PKCS1v15(),
tests/hazmat/primitives/test_rsa.py:866 test path signature, message, padding.PKCS1v15(), hashes.SHA1()
tests/hazmat/primitives/test_rsa.py:874 test path signature, padding.PKCS1v15(), hashes.SHA1()
tests/hazmat/primitives/test_rsa.py:881 test path signature, padding.PKCS1v15(), asym_utils.NoDigestInfo()
tests/hazmat/primitives/test_rsa.py:892 test path b"sign me", padding.PKCS1v15(), hashes.SHA256()
tests/hazmat/primitives/test_rsa.py:898 test path padding.PKCS1v15(),
tests/hazmat/primitives/test_rsa.py:908 test path b"sign me", padding.PKCS1v15(), hashes.SHA256()
tests/hazmat/primitives/test_rsa.py:912 test path signature, padding.PKCS1v15(), hashes.SHA512()
tests/hazmat/primitives/test_rsa.py:947 test path padding.PKCS1v15(),
tests/hazmat/primitives/test_rsa.py:960 test path signature = private_key.sign(msg, padding.PKCS1v15(), hashes.SHA256())
tests/hazmat/primitives/test_rsa.py:963 test path signature, msg, padding.PKCS1v15(), hashes.SHA256()
tests/hazmat/primitives/test_rsa.py:1278 test path pkcs = padding.PKCS1v15()
tests/hazmat/primitives/test_rsa.py:1291 test path pkcs = padding.PKCS1v15()
tests/hazmat/primitives/test_rsa.py:1303 test path pkcs = padding.PKCS1v15()
tests/hazmat/primitives/test_rsa.py:1454 test path and backend.rsa_padding_supported(padding.PKCS1v15())
tests/hazmat/primitives/test_rsa.py:1467 test path lambda params, hash_alg: padding.PKCS1v15(),
tests/hazmat/primitives/test_rsa.py:1481 test path lambda params, hash_alg: padding.PKCS1v15(),
tests/hazmat/primitives/test_rsa.py:1494 test path lambda params, hash_alg: padding.PKCS1v15(),
tests/hazmat/primitives/test_rsa.py:1506 test path lambda params, hash_alg: padding.PKCS1v15(),
tests/hazmat/primitives/test_rsa.py:1518 test path lambda params, hash_alg: padding.PKCS1v15(),
tests/hazmat/primitives/test_rsa.py:1530 test path lambda params, hash_alg: padding.PKCS1v15(),
tests/hazmat/primitives/test_rsa.py:1536 test path assert padding.PKCS1v15() == padding.PKCS1v15()
tests/hazmat/primitives/test_rsa.py:1537 test path assert padding.PKCS1v15() != padding.PSS(
tests/hazmat/primitives/test_rsa.py:1540 test path assert padding.PKCS1v15() != object()
tests/hazmat/primitives/test_rsa.py:1737 test path assert oaep != padding.PKCS1v15()
tests/hazmat/primitives/test_rsa.py:1744 test path padding.PKCS1v15()
tests/hazmat/primitives/test_rsa.py:1770 test path message = skey.decrypt(ciphertext, padding.PKCS1v15())
tests/hazmat/primitives/test_rsa.py:1780 test path backend.rsa_encryption_supported(padding.PKCS1v15())
tests/hazmat/primitives/test_rsa.py:1788 test path private_key.decrypt(b"\x00" * 256, padding.PKCS1v15())
tests/hazmat/primitives/test_rsa.py:1792 test path padding.PKCS1v15()
tests/hazmat/primitives/test_rsa.py:1801 test path private_key.decrypt(b"\x00" * 257, padding.PKCS1v15())
tests/hazmat/primitives/test_rsa.py:1805 test path padding.PKCS1v15()
tests/hazmat/primitives/test_rsa.py:1818 test path private_key.decrypt(ct, padding.PKCS1v15())
tests/hazmat/primitives/test_rsa.py:2076 test path padding.PKCS1v15()
tests/hazmat/primitives/test_rsa.py:2096 test path [padding.PKCS1v15()],
tests/hazmat/primitives/test_rsa.py:2133 test path padding.PKCS1v15(),
tests/hazmat/primitives/test_rsa.py:2160 test path rsa_key_512.sign(b"somedata", padding.PKCS1v15(), hashes.SHA512())
tests/test_doubles.py:56 test path key.decrypt(b"ciphertext", padding.PKCS1v15())
tests/test_doubles.py:71 test path key.sign(b"data", padding.PKCS1v15(), hashes.SHA256())
tests/wycheproof/test_rsa.py:88 test path padding.PKCS1v15(),
tests/wycheproof/test_rsa.py:96 test path padding.PKCS1v15(),
tests/wycheproof/test_rsa.py:132 test path padding.PKCS1v15(),
tests/wycheproof/test_rsa.py:268 test path padding.PKCS1v15()
tests/wycheproof/test_rsa.py:290 test path binascii.unhexlify(wycheproof.testcase["ct"]), padding.PKCS1v15()
tests/wycheproof/test_rsa.py:297 test path padding.PKCS1v15(),
tests/wycheproof/test_rsa.py:306 test path padding.PKCS1v15(),
tests/x509/test_ocsp.py:1332 test path PKCS1v15(),
tests/x509/test_x509.py:492 test path padding.PKCS1v15(),
tests/x509/test_x509.py:1173 test path padding.PKCS1v15(),
tests/x509/test_x509.py:2303 test path padding.PKCS1v15(),
tests/x509/test_x509.py:2957 test path eckey, hashes.SHA256(), rsa_padding=padding.PKCS1v15()
tests/x509/test_x509.py:3918 test path padding.PKCS1v15(),
tests/x509/test_x509.py:4023 test path padding.PKCS1v15(),
tests/x509/test_x509.py:4232 test path padding.PKCS1v15(),
tests/x509/test_x509.py:4294 test path padding.PKCS1v15(),
tests/x509/test_x509.py:5878 test path eckey, hashes.SHA256(), rsa_padding=padding.PKCS1v15()
tests/x509/test_x509_crlbuilder.py:245 test path eckey, hashes.SHA256(), rsa_padding=padding.PKCS1v15()

py.cryptography.pkcs1v15 · CWE-327

3DES Already broken Renamed import 23 places See details

Withdrawn symmetric cipher

`algorithms.TripleDES`, `Blowfish` or `ARC4`. These are withdrawn or broken classically; quantum computing is not the reason to remove them.

This is already unsafe today, with no quantum computer involved. Triple DES is withdrawn by NIST and limited by its 64-bit block, independent of quantum.

What to do. AES-256-GCM or ChaCha20-Poly1305.

docs/development/custom-vectors/cast5/generate_cast5.py:12 algorithms.CAST5(binascii.unhexlify(key)),
docs/development/custom-vectors/idea/generate_idea.py:8 algorithms.IDEA(binascii.unhexlify(key)),
docs/development/custom-vectors/seed/generate_seed.py:8 algorithms.SEED(binascii.unhexlify(key)),
src/cryptography/hazmat/primitives/ciphers/algorithms.py:98 "cryptography.hazmat.decrepit.ciphers.algorithms.TripleDES and "
tests/hazmat/primitives/decrepit/test_3des.py:24 test path algorithms.TripleDES(b"\x00" * 24), modes.CBC(b"\x00" * 8)
tests/hazmat/primitives/decrepit/test_3des.py:39 test path lambda keys, **kwargs: algorithms.TripleDES(
tests/hazmat/primitives/decrepit/test_3des.py:49 test path lambda key1, key2, key3, **kwargs: algorithms.TripleDES(
tests/hazmat/primitives/decrepit/test_3des.py:58 test path algorithms.TripleDES(b"\x00" * 24), OFB(b"\x00" * 8)
tests/hazmat/primitives/decrepit/test_3des.py:73 test path lambda keys, **kwargs: algorithms.TripleDES(
tests/hazmat/primitives/decrepit/test_3des.py:83 test path lambda key1, key2, key3, **kwargs: algorithms.TripleDES(
tests/hazmat/primitives/decrepit/test_3des.py:92 test path algorithms.TripleDES(b"\x00" * 24), CFB(b"\x00" * 8)
tests/hazmat/primitives/decrepit/test_3des.py:107 test path lambda keys, **kwargs: algorithms.TripleDES(
tests/hazmat/primitives/decrepit/test_3des.py:117 test path lambda key1, key2, key3, **kwargs: algorithms.TripleDES(
tests/hazmat/primitives/decrepit/test_3des.py:126 test path algorithms.TripleDES(b"\x00" * 24), CFB8(b"\x00" * 8)
tests/hazmat/primitives/decrepit/test_3des.py:141 test path lambda keys, **kwargs: algorithms.TripleDES(
tests/hazmat/primitives/decrepit/test_3des.py:151 test path lambda key1, key2, key3, **kwargs: algorithms.TripleDES(
tests/hazmat/primitives/decrepit/test_3des.py:160 test path algorithms.TripleDES(b"\x00" * 24), modes.ECB()
tests/hazmat/primitives/decrepit/test_3des.py:175 test path lambda keys, **kwargs: algorithms.TripleDES(
tests/hazmat/primitives/decrepit/test_3des.py:185 test path lambda key1, key2, key3, **kwargs: algorithms.TripleDES(
tests/hazmat/primitives/test_cmac.py:73 test path TripleDES(b"\x00" * 24)
tests/hazmat/primitives/test_cmac.py:88 test path cmac = CMAC(TripleDES(binascii.unhexlify(key)))
tests/hazmat/primitives/test_cmac.py:94 test path TripleDES(b"\x00" * 24)
tests/hazmat/primitives/test_cmac.py:109 test path cmac = CMAC(TripleDES(binascii.unhexlify(key)))

py.cryptography.legacy-cipher · CWE-327

RSA-10241024-bit Already broken 9 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

vectors/cryptography_vectors/x509/badasn1time.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/cdp_all_reasons.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/cdp_crl_issuer.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/cdp_fullname_reasons_crl_issuer.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/cdp_reason_aa_compromise.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/malformed-ian.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/malformed-san.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/san_registered_id.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/verisign_md2_root.pem:1 -----BEGIN CERTIFICATE-----

pem.certificate

RC4 Already broken Renamed import 7 places See details

Withdrawn symmetric cipher

`algorithms.TripleDES`, `Blowfish` or `ARC4`. These are withdrawn or broken classically; quantum computing is not the reason to remove them.

This is already unsafe today, with no quantum computer involved. RC4 keystream biases break it classically; it is prohibited in TLS by RFC 7465.

What to do. AES-256-GCM or ChaCha20-Poly1305.

docs/development/custom-vectors/arc4/generate_arc4.py:64 algorithms.ARC4(binascii.unhexlify(key)),
src/cryptography/hazmat/primitives/ciphers/algorithms.py:86 "cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and "
tests/hazmat/primitives/decrepit/test_arc4.py:19 test path algorithms.ARC4(b"\x00" * 16), None
tests/hazmat/primitives/decrepit/test_arc4.py:37 test path lambda key, **kwargs: algorithms.ARC4(binascii.unhexlify(key)),
tests/hazmat/primitives/test_cmac.py:122 test path only_if=lambda backend: backend.cipher_supported(ARC4(fake_key), None),
tests/hazmat/primitives/test_cmac.py:128 test path CMAC(typing.cast(typing.Any, ARC4(key)))
tests/hazmat/primitives/test_serialization.py:730 test path ARC4(b"\x00" * 16), None

py.cryptography.legacy-cipher · CWE-327

RC4 Already broken 1 place See details

Withdrawn symmetric cipher

An import of `crypto/des` or `crypto/rc4`. Both fail classically.

This is already unsafe today, with no quantum computer involved. RC4 keystream biases break it classically; it is prohibited in TLS by RFC 7465.

What to do. `crypto/aes` with GCM, or ChaCha20-Poly1305.

docs/development/custom-vectors/arc4/verify_arc4.go:43 stream, err := rc4.NewCipher(key)

go.cipher.legacy · CWE-327

RSA-10241024-bit Already broken Recorded traffic 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

vectors/cryptography_vectors/asymmetric/PKCS8/unenc-rsa-pkcs8.pem:63 -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

RSA-10241024-bit Already broken 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

This is already unsafe today, with no quantum computer involved. A modulus of 1024 bits or less is below the NIST SP 800-57 floor and is within reach of classical factorisation. Shor is not the nearest problem here.

What to do. Inventory only; a public key is not itself a secret.

vectors/cryptography_vectors/asymmetric/PKCS8/unenc-rsa-pkcs8.pub.pem:1 -----BEGIN PUBLIC KEY-----

pem.public-key

RSA-10241024-bit Already broken 1 place See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

vectors/cryptography_vectors/x509/requests/invalid_signature.pem:1 -----BEGIN CERTIFICATE REQUEST-----

pem.certificate-request

RSA-1024512-bit Already broken 1 place See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

vectors/cryptography_vectors/x509/v1_cert.pem:1 -----BEGIN CERTIFICATE-----

pem.certificate

SHA-1 Already broken 1 place See details

Mask-generation digest named for RSA padding

`MGF1ParameterSpec.SHA256` names the digest inside RSA-OAEP and RSA-PSS padding. It is a separate choice from the digest the signature or the cipher uses, it is frequently left at SHA-1 by default, and a static import of it - `import static java.security.spec.MGF1ParameterSpec.SHA512` - is the only place the choice appears in the file that makes it.

This picks the hash used inside RSA padding. It matters because the default is often SHA-1, which is broken today without any quantum computer.

What to do. The mask-generation digest travels with the RSA key it pads. When that key moves to ML-KEM or ML-DSA the padding goes with it; until then, SHA-256 or better.

docs/development/custom-vectors/rsa-oaep-sha2/VerifyRSAOAEPSHA2.java:294 mgf1 = MGF1ParameterSpec.SHA1;

java.mgf1 · CWE-327

SHA-1 Already broken 1 place See details

Broken hash function

`hashlib.md5()` or `hashlib.sha1()`. Both have practical collisions. Where the call is annotated `usedforsecurity=False` the finding is recorded as inventory instead.

This is already unsafe today, with no quantum computer involved. SHAttered and subsequent work produced practical collisions; NIST withdrew SHA-1 in 2030 guidance and it is already unacceptable for signatures.

What to do. SHA-256, or SHA-384 for long-lived signatures.

src/cryptography/x509/extensions.py:72 return hashlib.sha1(data).digest()

py.hashlib.weak · CWE-328

RSA Quantum-vulnerable Recorded traffic Renamed import 292 places See details

RSA key generated with pyca/cryptography

`rsa.generate_private_key()`. The `key_size` argument is read where it is a literal and reported on the finding; it does not change the classification, because Shor is polynomial in the modulus size.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption and ML-DSA-65 for signatures.

docs/development/custom-vectors/rsa-oaep-sha2/generate_rsa_oaep_sha2.py:25 skey = rsa.generate_private_key(65537, 2048)
src/cryptography/hazmat/bindings/_rust/openssl/rsa.pyi:9 class RSAPrivateKey: ...
src/cryptography/hazmat/bindings/_rust/openssl/rsa.pyi:10 class RSAPublicKey: ...
src/cryptography/hazmat/bindings/_rust/openssl/rsa.pyi:42 ) -> rsa.RSAPrivateKey: ...
src/cryptography/hazmat/bindings/_rust/openssl/rsa.pyi:50 def public_key(self, backend: typing.Any = None) -> rsa.RSAPublicKey: ...
src/cryptography/hazmat/bindings/_rust/openssl/rsa.pyi:55 ) -> rsa.RSAPrivateKey: ...
src/cryptography/hazmat/bindings/_rust/pkcs7.pyi:30 private_key: rsa.RSAPrivateKey,
src/cryptography/hazmat/bindings/_rust/pkcs7.pyi:36 private_key: rsa.RSAPrivateKey,
src/cryptography/hazmat/bindings/_rust/pkcs7.pyi:42 private_key: rsa.RSAPrivateKey,
src/cryptography/hazmat/primitives/asymmetric/padding.py:132 key: rsa.RSAPrivateKey | rsa.RSAPublicKey,
src/cryptography/hazmat/primitives/asymmetric/padding.py:135 if not isinstance(key, (rsa.RSAPrivateKey, rsa.RSAPublicKey)):
src/cryptography/hazmat/primitives/asymmetric/rsa.py:18 class RSAPrivateKey(metaclass=abc.ABCMeta):
src/cryptography/hazmat/primitives/asymmetric/rsa.py:33 def public_key(self) -> RSAPublicKey:
src/cryptography/hazmat/primitives/asymmetric/rsa.py:35 The RSAPublicKey associated with this private key.
src/cryptography/hazmat/primitives/asymmetric/rsa.py:69 def __copy__(self) -> RSAPrivateKey:
src/cryptography/hazmat/primitives/asymmetric/rsa.py:75 def __deepcopy__(self, memo: dict) -> RSAPrivateKey:
src/cryptography/hazmat/primitives/asymmetric/rsa.py:81 RSAPrivateKeyWithSerialization = RSAPrivateKey
src/cryptography/hazmat/primitives/asymmetric/rsa.py:82 RSAPrivateKey.register(rust_openssl.rsa.RSAPrivateKey)
src/cryptography/hazmat/primitives/asymmetric/rsa.py:85 class RSAPublicKey(metaclass=abc.ABCMeta):
src/cryptography/hazmat/primitives/asymmetric/rsa.py:145 def __copy__(self) -> RSAPublicKey:
src/cryptography/hazmat/primitives/asymmetric/rsa.py:151 def __deepcopy__(self, memo: dict) -> RSAPublicKey:
src/cryptography/hazmat/primitives/asymmetric/rsa.py:157 RSAPublicKeyWithSerialization = RSAPublicKey
src/cryptography/hazmat/primitives/asymmetric/rsa.py:158 RSAPublicKey.register(rust_openssl.rsa.RSAPublicKey)
src/cryptography/hazmat/primitives/asymmetric/rsa.py:168 ) -> RSAPrivateKey:
src/cryptography/hazmat/primitives/asymmetric/rsa.py:170 return rust_openssl.rsa.generate_private_key(public_exponent, key_size)
src/cryptography/hazmat/primitives/asymmetric/types.py:27 rsa.RSAPublicKey,
src/cryptography/hazmat/primitives/asymmetric/types.py:49 rsa.RSAPrivateKey,
src/cryptography/hazmat/primitives/asymmetric/types.py:60 rsa.RSAPrivateKey,
src/cryptography/hazmat/primitives/asymmetric/types.py:71 rsa.RSAPublicKey,
src/cryptography/hazmat/primitives/asymmetric/types.py:83 rsa.RSAPublicKey,
src/cryptography/hazmat/primitives/serialization/pkcs12.py:35 rsa.RSAPrivateKey,
src/cryptography/hazmat/primitives/serialization/pkcs12.py:56 rsa.RSAPrivateKey,
src/cryptography/hazmat/primitives/serialization/pkcs12.py:151 rsa.RSAPrivateKey,
src/cryptography/hazmat/primitives/serialization/pkcs7.py:39 rsa.RSAPrivateKey, ec.EllipticCurvePrivateKey
src/cryptography/hazmat/primitives/serialization/pkcs7.py:106 private_key, (rsa.RSAPrivateKey, ec.EllipticCurvePrivateKey)
src/cryptography/hazmat/primitives/serialization/pkcs7.py:113 if not isinstance(private_key, rsa.RSAPrivateKey):
src/cryptography/hazmat/primitives/serialization/pkcs7.py:230 if not isinstance(certificate.public_key(), rsa.RSAPublicKey):
src/cryptography/hazmat/primitives/serialization/ssh.py:143 elif isinstance(key, (rsa.RSAPrivateKey, rsa.RSAPublicKey)):
src/cryptography/hazmat/primitives/serialization/ssh.py:314 ) -> tuple[rsa.RSAPublicKey, memoryview]:
src/cryptography/hazmat/primitives/serialization/ssh.py:323 ) -> tuple[rsa.RSAPrivateKey, memoryview]:
src/cryptography/hazmat/primitives/serialization/ssh.py:346 self, public_key: rsa.RSAPublicKey, f_pub: _FragList
src/cryptography/hazmat/primitives/serialization/ssh.py:354 self, private_key: rsa.RSAPrivateKey, f_priv: _FragList
src/cryptography/hazmat/primitives/serialization/ssh.py:666 rsa.RSAPrivateKey,
src/cryptography/hazmat/primitives/serialization/ssh.py:873 rsa.RSAPublicKey,
src/cryptography/hazmat/primitives/serialization/ssh.py:880 rsa.RSAPublicKey,
src/cryptography/hazmat/primitives/serialization/ssh.py:1003 assert isinstance(signature_key, rsa.RSAPublicKey)
src/cryptography/hazmat/primitives/serialization/ssh.py:1217 rsa.RSAPrivateKey,
src/cryptography/hazmat/primitives/serialization/ssh.py:1259 rsa.RSAPublicKey,
src/cryptography/hazmat/primitives/serialization/ssh.py:1490 rsa.RSAPrivateKey,
src/cryptography/hazmat/primitives/serialization/ssh.py:1600 assert isinstance(private_key, rsa.RSAPrivateKey)
src/cryptography/x509/base.py:276 if not isinstance(private_key, rsa.RSAPrivateKey):
src/cryptography/x509/base.py:369 rsa.RSAPublicKey,
src/cryptography/x509/base.py:383 "Expecting one of DSAPublicKey, RSAPublicKey,"
src/cryptography/x509/base.py:394 if not isinstance(key, rsa.RSAPublicKey):
src/cryptography/x509/base.py:560 if not isinstance(private_key, rsa.RSAPrivateKey):
src/cryptography/x509/base.py:746 if not isinstance(private_key, rsa.RSAPrivateKey):
src/cryptography/x509/extensions.py:54 if isinstance(public_key, RSAPublicKey):
tests/doubles.py:93 test path class DummyRSAPrivateKey(rsa.RSAPrivateKey):
tests/doubles.py:95 test path A fake RSAPrivateKey whose decrypt() raises a non-ValueError. Used for
tests/doubles.py:109 test path def public_key(self) -> rsa.RSAPublicKey:
tests/doubles.py:133 test path def __copy__(self) -> rsa.RSAPrivateKey:
tests/doubles.py:136 test path def __deepcopy__(self, memo: dict) -> rsa.RSAPrivateKey:
tests/hazmat/primitives/test_pkcs12.py:331 test path (rsa.generate_private_key, rsa.RSAPrivateKey, [65537, 1024]),
tests/hazmat/primitives/test_pkcs7.py:697 test path assert isinstance(rsa_key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_pkcs7.py:757 test path assert isinstance(rsa_key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_pkcs7.py:783 test path assert isinstance(rsa_key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_pkcs7.py:826 test path assert isinstance(rsa_key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_pkcs7.py:1163 test path def fixture_private_key(self) -> rsa.RSAPrivateKey:
tests/hazmat/primitives/test_pkcs7.py:1364 test path self, data, certificate, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_pkcs7.py:1454 test path assert isinstance(public_key, rsa.RSAPublicKey)
tests/hazmat/primitives/test_pkcs7.py:1496 test path enveloped, certificate, DummyRSAPrivateKey(), []
tests/hazmat/primitives/test_rsa.py:63 test path def rsa_key_512() -> rsa.RSAPrivateKey:
tests/hazmat/primitives/test_rsa.py:68 test path def rsa_key_2048() -> rsa.RSAPrivateKey:
tests/hazmat/primitives/test_rsa.py:184 test path skey = rsa.generate_private_key(public_exponent, key_size, backend)
tests/hazmat/primitives/test_rsa.py:203 test path rsa.generate_private_key(public_exponent=65537, key_size=511)
tests/hazmat/primitives/test_rsa.py:206 test path rsa.generate_private_key(public_exponent=65537, key_size=256)
tests/hazmat/primitives/test_rsa.py:269 test path assert isinstance(key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_rsa.py:285 test path assert isinstance(key, rsa.RSAPublicKey)
tests/hazmat/primitives/test_rsa.py:304 test path assert isinstance(private_key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_rsa.py:617 test path self, rsa_key_512: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:640 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:652 test path def test_unsupported_padding(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:657 test path def test_padding_incorrect_type(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:672 test path def test_unsupported_pss_mgf(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:693 test path def test_pss_sign_unsupported_auto(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:729 test path def test_sign(self, rsa_key_2048: rsa.RSAPrivateKey, message):
tests/hazmat/primitives/test_rsa.py:743 test path def test_prehashed_sign(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:755 test path def test_prehashed_digest_length(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:782 test path def test_unsupported_hash(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:795 test path def test_unsupported_hash_pss_mgf1(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:810 test path def test_prehashed_digest_mismatch(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:822 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:887 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:903 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:942 test path assert isinstance(public_key, rsa.RSAPublicKey)
tests/hazmat/primitives/test_rsa.py:952 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:1011 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:1142 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:1164 test path def test_unsupported_padding(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:1172 test path def test_padding_incorrect_type(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:1189 test path def test_unsupported_pss_mgf(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:1213 test path self, rsa_key_512: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:1276 test path def test_verify(self, rsa_key_2048: rsa.RSAPrivateKey, message):
tests/hazmat/primitives/test_rsa.py:1284 test path def test_prehashed_verify(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:1296 test path def test_prehashed_digest_mismatch(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:1773 test path def test_unsupported_padding(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:1785 test path def test_decrypt_invalid_decrypt(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:1797 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:1810 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:1892 test path def test_invalid_oaep_decryption(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:1959 test path def test_unsupported_oaep_hash(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:1980 test path def test_unsupported_oaep_mgf(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:2053 test path self, rsa_key_2048: rsa.RSAPrivateKey, mgf1hash, oaephash, backend
tests/hazmat/primitives/test_rsa.py:2156 test path def test_rsa_fips_small_key(self, rsa_key_512: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:2162 test path def test_unsupported_padding(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:2174 test path def test_unsupported_oaep_mgf(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:2455 test path class TestRSAPrivateKeySerialization:
tests/hazmat/primitives/test_rsa.py:2474 test path self, rsa_key_2048: rsa.RSAPrivateKey, backend, fmt, password
tests/hazmat/primitives/test_rsa.py:2486 test path assert isinstance(loaded_key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_rsa.py:2496 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:2516 test path self, rsa_key_2048: rsa.RSAPrivateKey, encoding, fmt
tests/hazmat/primitives/test_rsa.py:2532 test path self, rsa_key_2048: rsa.RSAPrivateKey, fmt, password
tests/hazmat/primitives/test_rsa.py:2543 test path assert isinstance(loaded_key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_rsa.py:2574 test path self, rsa_key_2048: rsa.RSAPrivateKey, encoding, fmt, loader_func
tests/hazmat/primitives/test_rsa.py:2624 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:2635 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:2646 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:2657 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:2668 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:2759 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:2769 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:2802 test path self, rsa_key_2048: rsa.RSAPrivateKey, encoding, fmt
tests/hazmat/primitives/test_rsa.py:2808 test path def test_public_key_equality(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:2822 test path def test_public_key_copy(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:2828 test path def test_private_key_copy(self, rsa_key_2048: rsa.RSAPrivateKey):
tests/hazmat/primitives/test_rsa.py:2835 test path self, rsa_key_2048: rsa.RSAPrivateKey, rsa_key_512: rsa.RSAPrivateKey
tests/hazmat/primitives/test_rsa.py:2847 test path self, rsa_key_2048: rsa.RSAPrivateKey, rsa_key_512: rsa.RSAPrivateKey
tests/hazmat/primitives/test_serialization.py:98 test path assert isinstance(key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_serialization.py:128 test path assert isinstance(key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_serialization.py:152 test path assert isinstance(key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_serialization.py:349 test path assert isinstance(key, rsa.RSAPublicKey)
tests/hazmat/primitives/test_serialization.py:492 test path ("rsa", rsa.RSAPrivateKey, lambda backend: True, None),
tests/hazmat/primitives/test_serialization.py:598 test path assert isinstance(key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_serialization.py:649 test path assert isinstance(key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_serialization.py:668 test path assert isinstance(key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_serialization.py:687 test path assert isinstance(key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_serialization.py:708 test path assert isinstance(key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_serialization.py:749 test path assert isinstance(key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_serialization.py:777 test path assert isinstance(key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_serialization.py:820 test path assert isinstance(key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_serialization.py:895 test path assert isinstance(key, rsa.RSAPublicKey)
tests/hazmat/primitives/test_serialization.py:975 test path assert isinstance(pkey, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_serialization.py:1304 test path assert isinstance(pkey, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_ssh.py:654 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_ssh.py:707 test path self, password, kdf_rounds, rsa_key_2048: rsa.RSAPrivateKey
tests/hazmat/primitives/test_ssh.py:714 test path original_key, (ec.EllipticCurvePrivateKey, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_ssh.py:862 test path assert isinstance(key, rsa.RSAPublicKey)
tests/hazmat/primitives/test_ssh.py:893 test path assert isinstance(key, rsa.RSAPrivateKey)
tests/hazmat/primitives/test_ssh.py:1313 test path assert isinstance(key, rsa.RSAPublicKey)
tests/hazmat/primitives/test_ssh.py:1772 test path assert isinstance(sig_key, rsa.RSAPublicKey)
tests/hazmat/primitives/test_ssh.py:1795 test path assert isinstance(sig_key, rsa.RSAPublicKey)
tests/test_doubles.py:52 test path class TestDummyRSAPrivateKey:
tests/test_doubles.py:54 test path key = DummyRSAPrivateKey()
tests/test_doubles.py:59 test path key = DummyRSAPrivateKey()
tests/test_doubles.py:64 test path key = DummyRSAPrivateKey()
tests/test_doubles.py:69 test path key = DummyRSAPrivateKey()
tests/test_doubles.py:74 test path key = DummyRSAPrivateKey()
tests/test_doubles.py:79 test path key = DummyRSAPrivateKey()
tests/test_doubles.py:88 test path key = DummyRSAPrivateKey()
tests/test_doubles.py:93 test path key = DummyRSAPrivateKey()
tests/wycheproof/test_rsa.py:76 test path assert isinstance(key, rsa.RSAPublicKey)
tests/wycheproof/test_rsa.py:117 test path assert isinstance(key, rsa.RSAPrivateKey)
tests/wycheproof/test_rsa.py:175 test path assert isinstance(key, rsa.RSAPublicKey)
tests/wycheproof/test_rsa.py:244 test path assert isinstance(key, rsa.RSAPrivateKey)
tests/wycheproof/test_rsa.py:286 test path assert isinstance(key, rsa.RSAPrivateKey)
tests/x509/test_ocsp.py:1328 test path assert isinstance(public_key, rsa.RSAPublicKey)
tests/x509/test_x509.py:487 test path assert isinstance(public_key, rsa.RSAPublicKey)
tests/x509/test_x509.py:579 test path assert isinstance(public_key, rsa.RSAPublicKey)
tests/x509/test_x509.py:602 test path assert isinstance(public_key, rsa.RSAPublicKey)
tests/x509/test_x509.py:794 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/x509/test_x509.py:845 test path assert isinstance(expected_pub_key, rsa.RSAPublicKey)
tests/x509/test_x509.py:847 test path assert isinstance(pub_key, rsa.RSAPublicKey)
tests/x509/test_x509.py:878 test path assert isinstance(expected_pub_key, rsa.RSAPublicKey)
tests/x509/test_x509.py:880 test path assert isinstance(pub_key, rsa.RSAPublicKey)
tests/x509/test_x509.py:922 test path assert isinstance(pub_key, rsa.RSAPublicKey)
tests/x509/test_x509.py:976 test path assert isinstance(cert.public_key(), rsa.RSAPublicKey)
tests/x509/test_x509.py:992 test path assert isinstance(pk, rsa.RSAPublicKey)
tests/x509/test_x509.py:1080 test path assert isinstance(cert.public_key(), rsa.RSAPublicKey)
tests/x509/test_x509.py:1127 test path assert isinstance(public_key, rsa.RSAPublicKey)
tests/x509/test_x509.py:1168 test path assert isinstance(public_key, rsa.RSAPublicKey)
tests/x509/test_x509.py:1438 test path assert isinstance(public_key, rsa.RSAPublicKey)
tests/x509/test_x509.py:1665 test path assert isinstance(public_key, rsa.RSAPublicKey)
tests/x509/test_x509.py:1692 test path assert isinstance(public_key, rsa.RSAPublicKey)
tests/x509/test_x509.py:1752 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/x509/test_x509.py:1796 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/x509/test_x509.py:1808 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/x509/test_x509.py:1849 test path self, rsa_key_2048: rsa.RSAPrivateKey
tests/x509/test_x509.py:2062 test path assert isinstance(public_key, rsa.RSAPublicKey)
tests/x509/test_x509.py:2216 test path assert isinstance(public_key, rsa.RSAPublicKey)
tests/x509/test_x509.py:2244 test path assert isinstance(public_key, rsa.RSAPublicKey)

Showing the first 200. The CBOM has every one.

py.cryptography.rsa · CWE-327

RSA2048-bit Quantum-vulnerable 77 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

vectors/cryptography_vectors/pkcs7/ascii-san.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/pkcs7/non-ascii-san.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/badssl-sct.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/belgian-eid-invalid-visiblestring.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/bigoid.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/cryptography-scts.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/cryptography.io.chain.pem:34 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/cryptography.io.chain_with_garbage.pem:39 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/cryptography.io.precert.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/aia_ca_issuers.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/aia_ocsp.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/aia_ocsp_ca_issuers.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/all_key_usages.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/all_supported_names.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/authority_key_identifier.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/authority_key_identifier_no_keyid.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/bad_country.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/basic_constraints_not_critical.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/bc_path_length_zero.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/cp_cps_uri.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/cp_invalid.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/cp_user_notice_no_explicit_text.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/cp_user_notice_with_explicit_text.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/cp_user_notice_with_notice_reference.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/ekucrit-testuser-cert.pem:1 test path -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/extended_key_usage.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/freshestcrl.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/ian_uri.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/inhibit_any_policy_5.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/inhibit_any_policy_negative.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/invalid_signature_cert.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/invalid_utf8_common_name.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/invalid_version.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/nc_excluded.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/nc_invalid_ip_netmask.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/nc_ip_invalid_length.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/nc_permitted.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/nc_permitted_2.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/nc_permitted_excluded.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/nc_permitted_excluded_2.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/nc_single_ip_netmask.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/negative_serial.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/no_sans.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/ocsp_nocheck.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/pc_inhibit.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/pc_inhibit_require.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/pc_require.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/policy_constraints_explicit.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/post2000utctime.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/private_key_usage_period_both_dates.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/private_key_usage_period_only_not_after.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/private_key_usage_period_only_not_before.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/rsa_pss_sha256_no_null.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/san_dirname.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/san_email_dns_ip_dirname_uri.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/san_idna2003_dnsname.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/san_idna_names.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/san_ipaddr.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/san_other_name.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/san_rfc822_idna.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/san_rfc822_names.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/san_uri_with_port.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/san_wildcard_idna.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/sia.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/two_basic_constraints.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/unsupported_extension.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/unsupported_extension_critical.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/unsupported_subject_name.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/utf8_common_name.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/valid_signature_cert.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/department-of-state-root.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/ee-pss-sha1-cert.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/letsencryptx3.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/rapidssl_sha256_ca_g3.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/tls-feature-ocsp-staple.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/utf8-dnsname.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/wosign-bc-invalid.pem:1 -----BEGIN CERTIFICATE-----

pem.certificate

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 67 places See details

Elliptic-curve key generated with pyca/cryptography

`ec.generate_private_key()`. The curve is read from the argument and normalised onto the CycloneDX 1.7 curve registry.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 for signatures. If the key feeds ECDH, treat it as key establishment and prioritise it above signatures.

tests/hazmat/primitives/test_ec.py:643 test path private_key = ec.generate_private_key(ec.SECP256R1(), backend)
tests/hazmat/primitives/test_ec.py:652 test path private_key = ec.generate_private_key(ec.SECP256R1(), backend)
tests/hazmat/primitives/test_ec.py:664 test path private_key = ec.generate_private_key(ec.SECP256R1(), backend)
tests/hazmat/primitives/test_ec.py:676 test path private_key = ec.generate_private_key(ec.SECP256R1(), backend)
tests/hazmat/primitives/test_ec.py:684 test path private_key = ec.generate_private_key(ec.SECP256R1(), backend)
tests/hazmat/primitives/test_ec.py:693 test path private_key = ec.generate_private_key(ec.SECP256R1(), backend)
tests/hazmat/primitives/test_ec.py:706 test path private_key = ec.generate_private_key(ec.SECP256R1(), backend)
tests/hazmat/primitives/test_ec.py:761 test path key3 = ec.generate_private_key(ec.SECP256R1()).public_key()
tests/hazmat/primitives/test_ec.py:882 test path key = ec.generate_private_key(ec.SECP256R1(), backend)
tests/hazmat/primitives/test_ec.py:1366 test path key = ec.generate_private_key(ec.SECP256R1(), backend).public_key()
tests/hazmat/primitives/test_hpke.py:172 test path sk_r = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_hpke.py:237 test path sk_r = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_hpke.py:275 test path ec_pk = ec.generate_private_key(ec.SECP256R1()).public_key()
tests/hazmat/primitives/test_hpke.py:280 test path ec_sk = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_hpke.py:286 test path sk_r = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_hpke.py:291 test path sk_wrong = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_hpke.py:337 test path secp256r1_pk = ec.generate_private_key(ec.SECP256R1()).public_key()
tests/hazmat/primitives/test_hpke.py:342 test path secp256r1_sk = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_hpke.py:378 test path secp256r1_pk = ec.generate_private_key(ec.SECP256R1()).public_key()
tests/hazmat/primitives/test_hpke.py:383 test path secp256r1_sk = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_hpke.py:437 test path sk_r = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_hpke.py:784 test path p256_sk = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_hpke.py:914 test path sk_r = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_pkcs12.py:661 test path key = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_pkcs12.py:700 test path key = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_pkcs12.py:940 test path key = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_ssh.py:320 test path private_key = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_ssh.py:388 test path private_key = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_ssh.py:657 test path private_key = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_ssh.py:671 test path private_key = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_ssh.py:710 test path ec.generate_private_key(ec.SECP256R1()),
tests/hazmat/primitives/test_ssh.py:1435 test path private_key = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_ssh.py:1436 test path public_key = ec.generate_private_key(ec.SECP256R1()).public_key()
tests/hazmat/primitives/test_ssh.py:1481 test path public_key = ec.generate_private_key(ec.SECP256R1()).public_key()
tests/hazmat/primitives/test_ssh.py:1610 test path private_key = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_ssh.py:1622 test path private_key = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_ssh.py:1634 test path private_key = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_ssh.py:1646 test path private_key = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_ssh.py:1658 test path private_key = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_ssh.py:1670 test path private_key = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_ssh.py:1683 test path private_key = ec.generate_private_key(ec.SECP256R1())
tests/hazmat/primitives/test_ssh.py:1697 test path private_key = ec.generate_private_key(ec.SECP256R1())
tests/x509/test_ocsp.py:918 test path diff_key = ec.generate_private_key(ec.SECP256R1(), backend)
tests/x509/test_x509.py:1859 test path secondary_issuer_key = ec.generate_private_key(ec.SECP256R1())
tests/x509/test_x509.py:2954 test path eckey = ec.generate_private_key(ec.SECP256R1())
tests/x509/test_x509.py:3216 test path private_key = ec.generate_private_key(ec.SECP256R1())
tests/x509/test_x509.py:3672 test path issuer_private_key = ec.generate_private_key(ec.SECP256R1(), backend)
tests/x509/test_x509.py:3673 test path subject_private_key = ec.generate_private_key(ec.SECP256R1(), backend)
tests/x509/test_x509.py:3736 test path private_key = ec.generate_private_key(ec.SECP256R1())
tests/x509/test_x509.py:5187 test path private_key = ec.generate_private_key(ec.SECP256R1(), backend)
tests/x509/test_x509.py:5225 test path private_key = ec.generate_private_key(ec.SECP256R1())
tests/x509/test_x509.py:5516 test path private_key = ec.generate_private_key(ec.SECP256R1(), backend)
tests/x509/test_x509.py:5574 test path private_key = ec.generate_private_key(ec.SECP256R1(), backend)
tests/x509/test_x509.py:5610 test path private_key = ec.generate_private_key(ec.SECP256R1())
tests/x509/test_x509.py:5875 test path eckey = ec.generate_private_key(ec.SECP256R1())
tests/x509/test_x509.py:6316 test path issuer_private_key = ec.generate_private_key(ec.SECP256R1())
tests/x509/test_x509.py:6317 test path subject_private_key = ec.generate_private_key(ec.SECP256R1())
tests/x509/test_x509.py:6324 test path issuer_private_key = ec.generate_private_key(ec.SECP256R1())
tests/x509/test_x509.py:6325 test path subject_private_key = ec.generate_private_key(ec.SECP256R1())
tests/x509/test_x509_crlbuilder.py:242 test path eckey = ec.generate_private_key(ec.SECP256R1())
tests/x509/test_x509_crlbuilder.py:636 test path private_key = ec.generate_private_key(ec.SECP256R1(), backend)
tests/x509/test_x509_crlbuilder.py:986 test path private_key = ec.generate_private_key(ec.SECP256R1())
tests/x509/test_x509_ext.py:2049 test path private_key = ec.generate_private_key(ec.SECP256R1())
tests/x509/verification/test_verification.py:341 test path ca_key = ec.generate_private_key(ec.SECP256R1())
tests/x509/verification/test_verification.py:342 test path leaf_key = ec.generate_private_key(ec.SECP256R1())
tests/x509/verification/test_verification.py:878 test path ca_key = ec.generate_private_key(ec.SECP256R1())
tests/x509/verification/test_verification.py:879 test path leaf_key = ec.generate_private_key(ec.SECP256R1())

py.cryptography.ec · CWE-327

X25519255-bitother/Curve25519 Quantum-vulnerable Recorded traffic 53 places See details

X25519 key agreement

`X25519PrivateKey.generate()`. X25519 is the best classical key exchange available and is still a discrete-logarithm problem, so Shor solves it.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Hybrid X25519+ML-KEM-768 keeps this exact code as the classical half.

tests/hazmat/primitives/test_hpke.py:170 test path sk_r = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:184 test path x25519.X25519PrivateKey.generate(),
tests/hazmat/primitives/test_hpke.py:235 test path sk_r = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:249 test path x25519.X25519PrivateKey.generate(),
tests/hazmat/primitives/test_hpke.py:265 test path sk_r = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:270 test path sk_wrong = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:296 test path x25519_pk = x25519.X25519PrivateKey.generate().public_key()
tests/hazmat/primitives/test_hpke.py:301 test path x25519_sk = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:327 test path x25519_pk = x25519.X25519PrivateKey.generate().public_key()
tests/hazmat/primitives/test_hpke.py:332 test path x25519_sk = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:368 test path x25519_pk = x25519.X25519PrivateKey.generate().public_key()
tests/hazmat/primitives/test_hpke.py:373 test path x25519_sk = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:400 test path sk_r = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:415 test path sk_r = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:426 test path sk_r = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:498 test path x25519_pk = x25519.X25519PrivateKey.generate().public_key()
tests/hazmat/primitives/test_hpke.py:503 test path x25519_sk = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:549 test path x25519_pk = x25519.X25519PrivateKey.generate().public_key()
tests/hazmat/primitives/test_hpke.py:554 test path x25519_sk = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:589 test path x25519_sk = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:609 test path x25519_sk = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:621 test path x25519.X25519PrivateKey.generate(),
tests/hazmat/primitives/test_hpke.py:627 test path stray_x25519_pk = x25519.X25519PrivateKey.generate().public_key()
tests/hazmat/primitives/test_hpke.py:632 test path stray_x25519_sk = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:653 test path x25519_sk = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:667 test path x25519_sk = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:812 test path sk_r = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:823 test path sk_r = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:836 test path sk_r = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:854 test path sk_r = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:903 test path sk_r = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_hpke.py:926 test path pk_r = x25519.X25519PrivateKey.generate().public_key()
tests/hazmat/primitives/test_hpke.py:935 test path pk_r = x25519.X25519PrivateKey.generate().public_key()
tests/hazmat/primitives/test_serialization.py:1705 test path key = x448.X448PrivateKey.generate()
tests/hazmat/primitives/test_serialization.py:1720 test path key = x448.X448PrivateKey.generate()
tests/hazmat/primitives/test_serialization.py:1796 test path key = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_serialization.py:1811 test path key = x25519.X25519PrivateKey.generate()
tests/hazmat/primitives/test_x25519.py:42 test path X25519PrivateKey.generate()
tests/hazmat/primitives/test_x25519.py:101 test path key = X25519PrivateKey.generate().public_key()
tests/hazmat/primitives/test_x25519.py:177 test path key = X25519PrivateKey.generate()
tests/hazmat/primitives/test_x25519.py:182 test path key = X25519PrivateKey.generate()
tests/hazmat/primitives/test_x25519.py:201 test path key = X25519PrivateKey.generate()
tests/hazmat/primitives/test_x25519.py:272 test path key = X25519PrivateKey.generate().public_key()
tests/hazmat/primitives/test_x25519.py:325 test path key = X25519PrivateKey.generate()
tests/hazmat/primitives/test_x25519.py:364 test path key3 = X25519PrivateKey.generate().public_key()
tests/hazmat/primitives/test_x448.py:41 test path X448PrivateKey.generate()
tests/hazmat/primitives/test_x448.py:176 test path key = X448PrivateKey.generate()
tests/hazmat/primitives/test_x448.py:182 test path key = X448PrivateKey.generate()
tests/hazmat/primitives/test_x448.py:187 test path key = X448PrivateKey.generate()
tests/hazmat/primitives/test_x448.py:206 test path key = X448PrivateKey.generate()
tests/hazmat/primitives/test_x448.py:235 test path key = X448PrivateKey.generate().public_key()
tests/hazmat/primitives/test_x448.py:289 test path key3 = X448PrivateKey.generate().public_key()
tests/x509/test_x509.py:1872 test path x25519_public = x25519.X25519PrivateKey.generate().public_key()

py.cryptography.x25519 · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable 50 places See details

Ed25519 signing key

`Ed25519PrivateKey.generate()`. Signatures are not exposed to harvest-now-decrypt-later, but a quantum attacker can forge them once the curve falls.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

tests/hazmat/primitives/test_ed25519.py:93 test path key = Ed25519PrivateKey.generate()
tests/hazmat/primitives/test_ed25519.py:102 test path key = Ed25519PrivateKey.generate()
tests/hazmat/primitives/test_ed25519.py:108 test path key = Ed25519PrivateKey.generate()
tests/hazmat/primitives/test_ed25519.py:113 test path public_key = Ed25519PrivateKey.generate().public_key()
tests/hazmat/primitives/test_ed25519.py:147 test path key = Ed25519PrivateKey.generate()
tests/hazmat/primitives/test_ed25519.py:183 test path key = Ed25519PrivateKey.generate().public_key()
tests/hazmat/primitives/test_ed25519.py:248 test path key = Ed25519PrivateKey.generate()
tests/hazmat/primitives/test_ed25519.py:283 test path key3 = Ed25519PrivateKey.generate().public_key()
tests/hazmat/primitives/test_ed448.py:47 test path Ed448PrivateKey.generate()
tests/hazmat/primitives/test_ed448.py:83 test path key = Ed448PrivateKey.generate()
tests/hazmat/primitives/test_ed448.py:92 test path key = Ed448PrivateKey.generate()
tests/hazmat/primitives/test_ed448.py:98 test path key = Ed448PrivateKey.generate()
tests/hazmat/primitives/test_ed448.py:174 test path key = Ed448PrivateKey.generate()
tests/hazmat/primitives/test_ed448.py:202 test path key = Ed448PrivateKey.generate()
tests/hazmat/primitives/test_ed448.py:231 test path key = Ed448PrivateKey.generate().public_key()
tests/hazmat/primitives/test_ed448.py:300 test path key3 = Ed448PrivateKey.generate().public_key()
tests/hazmat/primitives/test_mldsa.py:417 test path typing.cast(typing.Any, ed25519.Ed25519PrivateKey.generate())
tests/hazmat/primitives/test_pkcs7.py:233 test path key = ed25519.Ed25519PrivateKey.generate()
tests/hazmat/primitives/test_serialization.py:1625 test path key = ed25519.Ed25519PrivateKey.generate()
tests/hazmat/primitives/test_serialization.py:1887 test path key = ed448.Ed448PrivateKey.generate()
tests/hazmat/primitives/test_serialization.py:1902 test path key = ed448.Ed448PrivateKey.generate()
tests/hazmat/primitives/test_ssh.py:1728 test path private_key = ed25519.Ed25519PrivateKey.generate()
tests/x509/test_ocsp.py:1659 test path private_key = ed25519.Ed25519PrivateKey.generate()
tests/x509/test_ocsp.py:1687 test path private_key = ed25519.Ed25519PrivateKey.generate()
tests/x509/test_ocsp.py:1733 test path private_key = ed448.Ed448PrivateKey.generate()
tests/x509/test_x509.py:1871 test path private_key = ed25519.Ed25519PrivateKey.generate()
tests/x509/test_x509.py:3446 test path private_key = ed25519.Ed25519PrivateKey.generate()
tests/x509/test_x509.py:3469 test path private_key = ed448.Ed448PrivateKey.generate()
tests/x509/test_x509.py:3832 test path issuer_private_key = ed25519.Ed25519PrivateKey.generate()
tests/x509/test_x509.py:3833 test path subject_private_key = ed25519.Ed25519PrivateKey.generate()
tests/x509/test_x509.py:3894 test path subject_private_key = ed25519.Ed25519PrivateKey.generate()
tests/x509/test_x509.py:3933 test path issuer_private_key = ed448.Ed448PrivateKey.generate()
tests/x509/test_x509.py:3934 test path subject_private_key = ed448.Ed448PrivateKey.generate()
tests/x509/test_x509.py:3999 test path subject_private_key = ed448.Ed448PrivateKey.generate()
tests/x509/test_x509.py:4974 test path private_key = ed25519.Ed25519PrivateKey.generate()
tests/x509/test_x509.py:4987 test path private_key = ed448.Ed448PrivateKey.generate()
tests/x509/test_x509.py:5274 test path private_key = ed25519.Ed25519PrivateKey.generate()
tests/x509/test_x509.py:5312 test path private_key = ed448.Ed448PrivateKey.generate()
tests/x509/test_x509.py:7005 test path issuer_private_key = ed25519.Ed25519PrivateKey.generate()
tests/x509/test_x509.py:7006 test path subject_private_key = ed25519.Ed25519PrivateKey.generate()
tests/x509/test_x509.py:7013 test path issuer_private_key = ed25519.Ed25519PrivateKey.generate()
tests/x509/test_x509.py:7014 test path subject_private_key = ed25519.Ed25519PrivateKey.generate()
tests/x509/test_x509.py:7045 test path issuer_private_key = ed448.Ed448PrivateKey.generate()
tests/x509/test_x509.py:7046 test path subject_private_key = ed448.Ed448PrivateKey.generate()
tests/x509/test_x509.py:7053 test path issuer_private_key = ed448.Ed448PrivateKey.generate()
tests/x509/test_x509.py:7054 test path subject_private_key = ed448.Ed448PrivateKey.generate()
tests/x509/test_x509_crlbuilder.py:529 test path private_key = ed25519.Ed25519PrivateKey.generate()
tests/x509/test_x509_crlbuilder.py:557 test path private_key = ed448.Ed448PrivateKey.generate()
tests/x509/test_x509_crlbuilder.py:686 test path private_key = ed25519.Ed25519PrivateKey.generate()
tests/x509/test_x509_crlbuilder.py:742 test path private_key = ed448.Ed448PrivateKey.generate()

py.cryptography.ed25519 · CWE-327

ECDSA Quantum-vulnerable 41 places See details

SSH algorithms pinned in configuration

A `KexAlgorithms`, `HostKeyAlgorithms` or `Ciphers` directive in an SSH configuration. `KexAlgorithms` is the line that decides whether recorded sessions stay confidential.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Put `sntrup761x25519-sha512@openssh.com` first in `KexAlgorithms`. It is a hybrid, so it is no weaker than the classical exchange it replaces.

src/cryptography/hazmat/primitives/serialization/ssh.py:61 _ECDSA_NISTP256 = b"ecdsa-sha2-nistp256"
src/cryptography/hazmat/primitives/serialization/ssh.py:62 _ECDSA_NISTP384 = b"ecdsa-sha2-nistp384"
src/cryptography/hazmat/primitives/serialization/ssh.py:63 _ECDSA_NISTP521 = b"ecdsa-sha2-nistp521"
src/cryptography/hazmat/primitives/serialization/ssh.py:68 _SK_SSH_ECDSA_NISTP256 = b"sk-ecdsa-sha2-nistp256@openssh.com"
src/cryptography/hazmat/primitives/serialization/ssh.py:619 The format of a sk-ecdsa-sha2-nistp256@openssh.com public key is:
src/cryptography/hazmat/primitives/serialization/ssh.py:621 string "sk-ecdsa-sha2-nistp256@openssh.com"
src/cryptography/hazmat/primitives/serialization/ssh.py:639 "sk-ecdsa-sha2-nistp256 private keys cannot be loaded"
tests/hazmat/primitives/test_ec.py:1311 test path b"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy"
tests/hazmat/primitives/test_ssh.py:411 test path pub_type=b"ecdsa-sha2-nistp256",
tests/hazmat/primitives/test_ssh.py:520 test path data = self.make_file(priv_type=b"ecdsa-sha2-nistp384")
tests/hazmat/primitives/test_ssh.py:1018 test path b"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy"
tests/hazmat/primitives/test_ssh.py:1044 test path b"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy"
tests/hazmat/primitives/test_ssh.py:1055 test path b"ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAz"
tests/hazmat/primitives/test_ssh.py:1081 test path b"ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1"
tests/hazmat/primitives/test_ssh.py:1109 test path b"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy"
tests/hazmat/primitives/test_ssh.py:1118 test path b"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy"
tests/hazmat/primitives/test_ssh.py:1129 test path b"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy"
tests/hazmat/primitives/test_ssh.py:1140 test path b"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy"
tests/hazmat/primitives/test_ssh.py:1149 test path b"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy"
tests/hazmat/primitives/test_ssh.py:1202 test path b"ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbm"
tests/hazmat/primitives/test_ssh.py:1384 test path b"ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAK0VjZHNhLXNoYTI"
vectors/cryptography_vectors/asymmetric/OpenSSH/certs/p256-dsa.pub:1 ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgqlL0IDRu6PBXcHrEqr66w+nW4TWpgWcqB9/SiSVsHk0AAAAIbmlzdHAyNTYAAABBBKxrpV0taLLnqbE08WQoMGmopbPBTC1Vj3GLi4/+n9BINlKBskAjhVfQdfLzse4REtYbNH2
vectors/cryptography_vectors/asymmetric/OpenSSH/certs/p256-ed25519-non-singular-crit-opt-val.pub:1 ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIbmlzdHAyNTYAAABBBCZWRs4GYIHGJpyXuqvfFGWN49dnJRkZJLDkFrHf6mNHhIMI3vtrLfCZwxPSfnCYWK6Yofs
vectors/cryptography_vectors/asymmetric/OpenSSH/certs/p256-ed25519-non-singular-ext-val.pub:1 ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIbmlzdHAyNTYAAABBBCZWRs4GYIHGJpyXuqvfFGWN49dnJRkZJLDkFrHf6mNHhIMI3vtrLfCZwxPSfnCYWK6Yofs
vectors/cryptography_vectors/asymmetric/OpenSSH/certs/p256-p256-broken-signature-key-type.pub:1 ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAg5F1PDG/y2CzJp73derFFtoa/OJjJQZ1jaQKqf2nKciQAAAAIbmlzdHAyNTYAAABBBL4QG3yEahvircH4Px+aVHip40dqWot+JJB3TuyFGN5rCDP4eZmM5gmTIDJw+Y3uJk/8oP4
vectors/cryptography_vectors/asymmetric/OpenSSH/certs/p256-p256-duplicate-crit-opts.pub:1 ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgLhqcBHfeQKtL85NO1EYeTF6EWUPuCswcuhsj4jN8+9gAAAAIbmlzdHAyNTYAAABBBMnYLqlS1l6aEf5MAzEnTd2rfYYAdaesNxUsSW+2/QyIE0KiR1OOqnth+V+8JDTWBf78Ecq
vectors/cryptography_vectors/asymmetric/OpenSSH/certs/p256-p256-duplicate-extension.pub:1 ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgN6rRGEpLjA1BohPwr8SEa33Vn4+H+94Jifl6hg6n5IIAAAAIbmlzdHAyNTYAAABBBFQDtz1+0wnP2wLnHZhES+XJVxImzusYhXd3G2cWCZL4HKZHRMIWj1x6oU9JdoEOMHppb6D
vectors/cryptography_vectors/asymmetric/OpenSSH/certs/p256-p256-empty-principals.pub:1 ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgBXWXwDzsP++5IxnXmRrXXXP5wyJzMXW1nnQh7DPYZx8AAAAIbmlzdHAyNTYAAABBBCuO1AQsw/HmbXrjAHBJ7YA1ydYJeNbZ6LSArnxvrTX9kXDWF4bfOTSpUsC6OBKfzOiryc2
vectors/cryptography_vectors/asymmetric/OpenSSH/certs/p256-p256-invalid-cert-type.pub:1 ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgSgPwfPbsfbii+9RAUJYav6zJ0oU54htu+vOuTdctY88AAAAIbmlzdHAyNTYAAABBBCARilffhR67GJ6CjUyP78jhu8eGCJ6bb68l86BnJIudjlYAQ/sgiFsQjmrMmDVqNrKGFud
vectors/cryptography_vectors/asymmetric/OpenSSH/certs/p256-p256-non-lexical-crit-opts.pub:1 ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAghD4Bg5C3PR6Yjo0Onv9jTmMJL/ysWxOWM3lvbjkwSbgAAAAIbmlzdHAyNTYAAABBBMXF33sjujlcCsz5pnR7SXXO34s49Ofqw6wIoqNe2zJy2MxaBTQzMi+WXLTpv1+c5fKW1+j
vectors/cryptography_vectors/asymmetric/OpenSSH/certs/p256-p256-non-lexical-extensions.pub:1 ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgTbZxg0yj7wdJdgLZWEmyQ27GJzA6hm0qmproBqnoGc0AAAAIbmlzdHAyNTYAAABBBKGL/tGE87lFxV86H/xeWCOc5EOwjojk5Mju0yM/z37Jgg1UJT0RYbZQdPEuFHlXrUsxNCg
vectors/cryptography_vectors/asymmetric/OpenSSH/certs/p256-p384.pub:1 ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAghNd9jFDm9sueG2QuKV7fTRhKPKB0pprZqRP44dYXSZwAAAAIbmlzdHAyNTYAAABBBIdWgz67U4Fg01DzNm9UmX9EdFEqrfSyWj0ay2JLiCj8I+GHUoSTxOSrj0XkWvVdVpTAkmO
vectors/cryptography_vectors/asymmetric/OpenSSH/certs/p256-p521.pub:1 ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAga9pP3iYGmmVlFMM97Lb2Nuj7LCi4fVeLN++/xsyHLOoAAAAIbmlzdHAyNTYAAABBBD42p7j3tjDcn1YoNjKgDgec+9Czi+6KNZM9EV51kpSq1ZZz1D5H+iqWByjmT5EtWCPq+2E
vectors/cryptography_vectors/asymmetric/OpenSSH/certs/p256-rsa-sha1.pub:1 ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgUvBup0dKwDazWqFmuY+CX0+O9SvgYe6XXwZdGSsCFoAAAAAIbmlzdHAyNTYAAABBBCRtIgvrukZwrNM62pkYACgJjoL0ViIzOZTvyuoaPRxbKTpVUQVeLt+H6kZDnrsloOzfH0P
vectors/cryptography_vectors/asymmetric/OpenSSH/certs/p256-rsa-sha256.pub:1 ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgEZ5t7LyaprT8g277kTvOMv/kgHECdpguBplHoRgAYpoAAAAIbmlzdHAyNTYAAABBBLQNIj2s2PZDa7LFPocsNN6ORF1ZsPmXqII23UPlpvFcUa8vDIccoO2shfUrFAMoudRiiyE
vectors/cryptography_vectors/asymmetric/OpenSSH/certs/p256-rsa-sha512.pub:1 ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgIOnlOEWH3RJ+U/Yr/pGEU2ig0h5qeLO9XgwIzocUxgUAAAAIbmlzdHAyNTYAAABBBAR7IuTauq/eQ9DgGVuv9qJ1jmI89k/9VIpKD/edK/mI9Rhz7RprmXC2Heopinwt9vyzvrN
vectors/cryptography_vectors/asymmetric/OpenSSH/ecdsa-nopsw.key-cert.pub:1 ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAg7ohu2h3ZSjGNlNGn5wmDHarKBT8q+6Yl23V+s3MNjzEAAAAIbmlzdHAyNTYAAABBBCZWRs4GYIHGJpyXuqvfFGWN49dnJRkZJLDkFrHf6mNHhIMI3vtrLfCZwxPSfnCYWK6Yofs
vectors/cryptography_vectors/asymmetric/OpenSSH/ecdsa-nopsw.key.pub:1 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCZWRs4GYIHGJpyXuqvfFGWN49dnJRkZJLDkFrHf6mNHhIMI3vtrLfCZwxPSfnCYWK6YofssZ1FYA6TkVJq8Xi8= ecdsa-nopsw.key
vectors/cryptography_vectors/asymmetric/OpenSSH/ecdsa-psw.key.pub:1 ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBKoqSCpmO6pLIjBokwga14onc/XOkRZ9WPKfFf/d0Aq6HOjL5Vm4ZxxRP3mjyLI/flOjrx5aMVAed5xkX6shh+zN4mb2xajuPTwqbvsVvIyglrFbKKQO3DQnkbbeqBHLPA== ecdsa-psw.key
vectors/cryptography_vectors/asymmetric/OpenSSH/sk-ecdsa-nopsw.key.pub:1 sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBDte6cjxBF+bJPQ8pYle1oTSUDr4fLkdN8gN8d7GxlXrwAYCPSdjJ/b6YAr+8+nojJUEAsmp3N0liLJ5en/ed4sAAAAac3NoOnRoZS1hcHBsaWNhdGlvbi1zdHJpbmc= sk-e
vectors/cryptography_vectors/asymmetric/OpenSSH/sk-ecdsa-psw.key.pub:1 sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBACdJuKxgDLk+a1NeeCtRqCropd0hXume/cTdOvV/B4lmupr9viNQsUT09wbKRflnOc9jxPAiQOzZbXTkmnV8kkAAAAac3NoOnRoZS1hcHBsaWNhdGlvbi1zdHJpbmc= sk-e

config.ssh-algorithms · CWE-757

RSA-OAEP Quantum-vulnerable Recorded traffic 38 places See details

RSA-OAEP encryption padding

`padding.OAEP(...)`. OAEP is the correct RSA padding and remains fully exposed to Shor.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768.

docs/development/custom-vectors/rsa-oaep-sha2/generate_rsa_oaep_sha2.py:69 padding.OAEP(
docs/development/custom-vectors/rsa-oaep-sha2/generate_rsa_oaep_sha2.py:78 padding.OAEP(
tests/hazmat/backends/test_openssl.py:143 test path padding.OAEP(
tests/hazmat/backends/test_openssl.py:169 test path padding.OAEP(
tests/hazmat/backends/test_openssl.py:181 test path padding.OAEP(
tests/hazmat/backends/test_openssl.py:201 test path padding.OAEP(
tests/hazmat/primitives/test_rsa.py:308 test path padding.OAEP(
tests/hazmat/primitives/test_rsa.py:327 test path padding.OAEP(
tests/hazmat/primitives/test_rsa.py:335 test path padding.OAEP(
tests/hazmat/primitives/test_rsa.py:352 test path padding.OAEP(
tests/hazmat/primitives/test_rsa.py:361 test path padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1664 test path padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1673 test path oaep = padding.OAEP(mgf=mgf, algorithm=algorithm, label=None)
tests/hazmat/primitives/test_rsa.py:1680 test path oaep = padding.OAEP(mgf=mgf, algorithm=algorithm, label=None)
tests/hazmat/primitives/test_rsa.py:1686 test path oaep1 = padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1691 test path oaep2 = padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1699 test path assert padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1703 test path ) != padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1710 test path assert padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1714 test path ) != padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1721 test path assert padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1725 test path ) != padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1732 test path oaep = padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1822 test path padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1853 test path padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1865 test path pad = padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1900 test path padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1914 test path padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1923 test path padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1952 test path padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1964 test path padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1973 test path padding.OAEP(
tests/hazmat/primitives/test_rsa.py:1985 test path padding.OAEP(
tests/hazmat/primitives/test_rsa.py:2011 test path padding.OAEP(
tests/hazmat/primitives/test_rsa.py:2055 test path pad = padding.OAEP(
tests/hazmat/primitives/test_rsa.py:2128 test path padding.OAEP(
tests/hazmat/primitives/test_rsa.py:2181 test path padding.OAEP(
tests/wycheproof/test_rsa.py:225 test path padding_algo = padding.OAEP(

py.cryptography.oaep · CWE-327

DH Quantum-vulnerable Recorded traffic 37 places See details

Finite-field Diffie-Hellman

`dh.generate_parameters()`. Finite-field DH is both slower and no safer than the elliptic-curve variant against a quantum attacker.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768.

tests/hazmat/primitives/fixtures_dh.py:15 test path FFDH3072_P = dh.DHParameterNumbers(
tests/hazmat/primitives/test_dh.py:53 test path params = dh.DHParameterNumbers(P_1536, 2)
tests/hazmat/primitives/test_dh.py:59 test path dh.DHParameterNumbers(typing.cast(typing.Any, None), 2)
tests/hazmat/primitives/test_dh.py:62 test path dh.DHParameterNumbers(P_1536, typing.cast(typing.Any, None))
tests/hazmat/primitives/test_dh.py:65 test path dh.DHParameterNumbers(
tests/hazmat/primitives/test_dh.py:70 test path dh.DHParameterNumbers(P_1536, 1)
tests/hazmat/primitives/test_dh.py:74 test path dh.DHParameterNumbers(65537, 2)
tests/hazmat/primitives/test_dh.py:76 test path params = dh.DHParameterNumbers(P_1536, 7, 1245)
tests/hazmat/primitives/test_dh.py:83 test path dh.DHParameterNumbers(P_1536, 2, typing.cast(typing.Any, "hello"))
tests/hazmat/primitives/test_dh.py:89 test path params = dh.DHParameterNumbers(P_1536, 2, 12345)
tests/hazmat/primitives/test_dh.py:95 test path params = dh.DHParameterNumbers(P_1536, 2)
tests/hazmat/primitives/test_dh.py:121 test path assert dh.DHParameterNumbers(P_1536, 2) == dh.DHParameterNumbers(P_1536, 2)
tests/hazmat/primitives/test_dh.py:122 test path assert dh.DHParameterNumbers(P_1536, 7, 12345) == dh.DHParameterNumbers(
tests/hazmat/primitives/test_dh.py:125 test path assert dh.DHParameterNumbers(P_1536 + 2, 2) != dh.DHParameterNumbers(
tests/hazmat/primitives/test_dh.py:128 test path assert dh.DHParameterNumbers(P_1536, 2, 123) != dh.DHParameterNumbers(
tests/hazmat/primitives/test_dh.py:131 test path assert dh.DHParameterNumbers(P_1536, 2, 123) != dh.DHParameterNumbers(
tests/hazmat/primitives/test_dh.py:134 test path assert dh.DHParameterNumbers(P_1536, 5) != dh.DHParameterNumbers(P_1536, 2)
tests/hazmat/primitives/test_dh.py:135 test path assert dh.DHParameterNumbers(P_1536, 2) != object()
tests/hazmat/primitives/test_dh.py:139 test path params = dh.DHParameterNumbers(P_1536, 2)
tests/hazmat/primitives/test_dh.py:147 test path 2, dh.DHPublicNumbers(1, dh.DHParameterNumbers(P_1536, 5))
tests/hazmat/primitives/test_dh.py:153 test path params = dh.DHParameterNumbers(P_1536, 2)
tests/hazmat/primitives/test_dh.py:158 test path assert public != dh.DHPublicNumbers(1, dh.DHParameterNumbers(P_1536, 5))
tests/hazmat/primitives/test_dh.py:169 test path dh.generate_parameters(2, 511)
tests/hazmat/primitives/test_dh.py:173 test path dh.generate_parameters(7, 512)
tests/hazmat/primitives/test_dh.py:177 test path dh.generate_parameters(2, 1 << 30)
tests/hazmat/primitives/test_dh.py:200 test path params = dh.DHParameterNumbers(p, int(vector["g"]))
tests/hazmat/primitives/test_dh.py:233 test path parameters = dh.generate_parameters(2, 512).generate_private_key()
tests/hazmat/primitives/test_dh.py:241 test path params = dh.DHParameterNumbers(p, g, q)
tests/hazmat/primitives/test_dh.py:259 test path params = dh.DHParameterNumbers(P_1536 + 1, 2)
tests/hazmat/primitives/test_dh.py:277 test path parameters = dh.DHParameterNumbers(p, g, q).parameters()
tests/hazmat/primitives/test_dh.py:283 test path parameters = dh.generate_parameters(generator, key_size)
tests/hazmat/primitives/test_dh.py:366 test path parameters = dh.DHParameterNumbers(p, g)
tests/hazmat/primitives/test_dh.py:387 test path parameters1 = dh.DHParameterNumbers(
tests/hazmat/primitives/test_dh.py:395 test path parameters2 = dh.DHParameterNumbers(
tests/hazmat/primitives/test_dh.py:449 test path parameters = dh.DHParameterNumbers(int(vector["p"]), int(vector["g"]))
tests/hazmat/primitives/test_dh.py:465 test path parameters = dh.DHParameterNumbers(
tests/x509/test_x509.py:7128 test path params = dh.DHParameterNumbers(p, int(vector["g"]))

py.cryptography.dh · CWE-327

ECDSA Quantum-vulnerable 28 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

vectors/cryptography_vectors/asymmetric/EC/ec-missing-curve.pem:1 -----BEGIN EC PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/EC/explicit_parameters_private_key.pem:1 -----BEGIN EC PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/EC/explicit_parameters_wap_wsg_idm_ecid_wtls11_private_key.pem:1 -----BEGIN EC PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/EC/high-bit-set.pem:1 -----BEGIN EC PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/EC/secp128r1_private_key.pem:1 -----BEGIN EC PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/EC/secp256k1-explicit-no-seed.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/EC/secp256r1-explicit-no-seed.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/EC/secp256r1-explicit-seed.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/EC/secp384r1-explicit-no-seed.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/EC/secp384r1-explicit-seed.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/EC/secp521r1-explicit-no-seed.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/EC/secp521r1-explicit-seed.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:1053 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:1269 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:1469 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:1669 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:1870 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:2072 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:2287 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:2486 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:2686 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:2887 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PEM_Serialization/ec_private_key.pem:1 -----BEGIN EC PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PEM_Serialization/ec_private_key_encrypted.pem:1 -----BEGIN EC PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/ec_oid_not_in_reg_private_2.pkcs8.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/nodompar_private.pkcs8.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/private.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/withdompar_private.pkcs8.pem:1 -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

ECDSA Quantum-vulnerable 21 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

vectors/cryptography_vectors/asymmetric/EC/secp256k1-pub-explicit-no-seed.pem:1 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/EC/secp256r1-pub-explicit-no-seed.pem:1 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/EC/secp256r1-pub-explicit-seed.pem:1 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/EC/secp384r1-pub-explicit-no-seed.pem:1 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/EC/secp384r1-pub-explicit-seed.pem:1 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/EC/secp521r1-pub-explicit-no-seed.pem:1 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/EC/secp521r1-pub-explicit-seed.pem:1 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/EC/sect163k1-spki.pem:1 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/EC/sect163r2-spki.pem:1 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/EC/sect233k1-spki.pem:1 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/EC/sect233r1-spki.pem:1 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:1059 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:1275 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:1475 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:1675 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:1877 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:2077 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:2292 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:2492 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:2692 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:2894 -----BEGIN PUBLIC KEY-----

pem.public-key

RSASSA-PKCS1v15 Quantum-vulnerable 21 places See details

SSH algorithms pinned in configuration

A `KexAlgorithms`, `HostKeyAlgorithms` or `Ciphers` directive in an SSH configuration. `KexAlgorithms` is the line that decides whether recorded sessions stay confidential.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both.

What to do. Put `sntrup761x25519-sha512@openssh.com` first in `KexAlgorithms`. It is a hybrid, so it is no weaker than the classical exchange it replaces.

src/cryptography/hazmat/primitives/serialization/ssh.py:59 _SSH_RSA = b"ssh-rsa"
src/cryptography/hazmat/primitives/serialization/ssh.py:72 _SSH_RSA_SHA256 = b"rsa-sha2-256"
src/cryptography/hazmat/primitives/serialization/ssh.py:73 _SSH_RSA_SHA512 = b"rsa-sha2-512"
tests/hazmat/primitives/test_rsa.py:2733 test path b"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC7JHoJfg6yNzLMOWet8Z49a4KD"
tests/hazmat/primitives/test_ssh.py:544 test path pub_type=b"ssh-rsa",
tests/hazmat/primitives/test_ssh.py:782 test path ssh_key = b"ssh-rsa not-a-real-key"
tests/hazmat/primitives/test_ssh.py:788 test path ssh_key = b"ssh-rsa"
tests/hazmat/primitives/test_ssh.py:794 test path ssh_key = b"ssh-rsa AAAAB3NzaC1yc2EAAAA="
tests/hazmat/primitives/test_ssh.py:799 test path ssh_key = b"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAACKr+IHXo"
tests/hazmat/primitives/test_ssh.py:806 test path b"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDu/XRP1kyK6Cgt36gts9XAk"
tests/hazmat/primitives/test_ssh.py:820 test path b"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDu/XRP1kyK6Cgt36gts9XAk"
tests/hazmat/primitives/test_ssh.py:837 test path b"ssh-rsa AAAAB3NzAC1yc2EAAAADAQABAAABAQDDu/XRP1kyK6Cgt36gts9XAk"
tests/hazmat/primitives/test_ssh.py:850 test path b"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDu/XRP1kyK6Cgt36gts9XAk"
tests/hazmat/primitives/test_ssh.py:1266 test path if backend._fips_enabled and bytes(cert._inner_sig_type) == b"ssh-rsa":
tests/hazmat/primitives/test_ssh.py:1293 test path if backend._fips_enabled and bytes(cert._inner_sig_type) == b"ssh-rsa":
tests/hazmat/primitives/test_ssh.py:1379 test path load_ssh_public_identity(b"ssh-rsa-cert-v01@openssh.com invalid")
tests/hazmat/primitives/test_ssh.py:1798 test path b"ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3Blbn"
vectors/cryptography_vectors/asymmetric/OpenSSH/gen.sh:58 -z 2 -n user1,user2 -t rsa-sha2-512 \
vectors/cryptography_vectors/asymmetric/OpenSSH/rsa-nopsw.key-cert.pub:1 ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgtL8iJdlD7w2obBZdlxyqu06uLR78fvDASlnR3RRk/eMAAAADAQABAAABAQCrZB1KbbZASyb4a2kDA3iqTR7EMjHDFRvyMnossujX0olH3JJDD50COn1YhS6ZczY49iLSqq03okoywOtVJHztGgrtXZbiUdiWNkE4MZg
vectors/cryptography_vectors/asymmetric/OpenSSH/rsa-nopsw.key.pub:1 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrZB1KbbZASyb4a2kDA3iqTR7EMjHDFRvyMnossujX0olH3JJDD50COn1YhS6ZczY49iLSqq03okoywOtVJHztGgrtXZbiUdiWNkE4MZgDxt+mpou3kcy+QmmyQwQGomRm3A7wb8ndAM4UHKIY7F54vj/a+czlfA399/pIoAHF9TrSAOaWh8WVmoIP17FY7nZ2DkFD+A3m
vectors/cryptography_vectors/asymmetric/OpenSSH/rsa-psw.key.pub:1 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCek3p8wNo15l7Ihy4yaGjWScJpjh/Lq7WS7f64KxXKodBe35fLl8lu9Ds4Y06XWeHZdGxC+qp4QoxGYIFt2Awm8sz2wRbPY7d322tG9VnT59bQlvKtq77y9ZYefsdVwh2Uf7otdUZOEz6KuKc1CXXbFfBFY6YB1lZ4YkQ2YHsYau22RHDjaHi55VoFokyk7cVnuhaIXCrp

config.ssh-algorithms · CWE-757

ECDSA384-bitsecg/secp384r1 Quantum-vulnerable 18 places See details

Elliptic-curve key generated with pyca/cryptography

`ec.generate_private_key()`. The curve is read from the argument and normalised onto the CycloneDX 1.7 curve registry.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 for signatures. If the key feeds ECDH, treat it as key establishment and prioritise it above signatures.

tests/hazmat/primitives/test_hpke.py:174 test path sk_r = ec.generate_private_key(ec.SECP384R1())
tests/hazmat/primitives/test_hpke.py:189 test path ec.generate_private_key(ec.SECP384R1()),
tests/hazmat/primitives/test_hpke.py:239 test path sk_r = ec.generate_private_key(ec.SECP384R1())
tests/hazmat/primitives/test_hpke.py:254 test path ec.generate_private_key(ec.SECP384R1()),
tests/hazmat/primitives/test_hpke.py:306 test path secp384r1_pk = ec.generate_private_key(ec.SECP384R1()).public_key()
tests/hazmat/primitives/test_hpke.py:311 test path secp384r1_sk = ec.generate_private_key(ec.SECP384R1())
tests/hazmat/primitives/test_hpke.py:317 test path sk_r = ec.generate_private_key(ec.SECP384R1())
tests/hazmat/primitives/test_hpke.py:322 test path sk_wrong = ec.generate_private_key(ec.SECP384R1())
tests/hazmat/primitives/test_hpke.py:388 test path secp384r1_pk = ec.generate_private_key(ec.SECP384R1()).public_key()
tests/hazmat/primitives/test_hpke.py:393 test path secp384r1_sk = ec.generate_private_key(ec.SECP384R1())
tests/hazmat/primitives/test_hpke.py:448 test path sk_r = ec.generate_private_key(ec.SECP384R1())
tests/hazmat/primitives/test_hpke.py:703 test path p384_sk = ec.generate_private_key(ec.SECP384R1())
tests/hazmat/primitives/test_hpke.py:723 test path p384_sk = ec.generate_private_key(ec.SECP384R1())
tests/hazmat/primitives/test_hpke.py:735 test path ec.generate_private_key(ec.SECP384R1()),
tests/hazmat/primitives/test_hpke.py:741 test path stray_p384_pk = ec.generate_private_key(ec.SECP384R1()).public_key()
tests/hazmat/primitives/test_hpke.py:746 test path stray_p384_sk = ec.generate_private_key(ec.SECP384R1())
tests/hazmat/primitives/test_hpke.py:767 test path p384_sk = ec.generate_private_key(ec.SECP384R1())
tests/hazmat/primitives/test_hpke.py:781 test path p384_sk = ec.generate_private_key(ec.SECP384R1())

py.cryptography.ec · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable 18 places See details

SSH algorithms pinned in configuration

A `KexAlgorithms`, `HostKeyAlgorithms` or `Ciphers` directive in an SSH configuration. `KexAlgorithms` is the line that decides whether recorded sessions stay confidential.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Put `sntrup761x25519-sha512@openssh.com` first in `KexAlgorithms`. It is a hybrid, so it is no weaker than the classical exchange it replaces.

src/cryptography/hazmat/primitives/serialization/ssh.py:58 _SSH_ED25519 = b"ssh-ed25519"
src/cryptography/hazmat/primitives/serialization/ssh.py:67 _SK_SSH_ED25519 = b"sk-ssh-ed25519@openssh.com"
src/cryptography/hazmat/primitives/serialization/ssh.py:594 The format of a sk-ssh-ed25519@openssh.com public key is:
src/cryptography/hazmat/primitives/serialization/ssh.py:596 string "sk-ssh-ed25519@openssh.com"
src/cryptography/hazmat/primitives/serialization/ssh.py:613 "sk-ssh-ed25519 private keys cannot be loaded"
tests/hazmat/primitives/test_ssh.py:565 test path pub_type=b"ssh-ed25519",
tests/hazmat/primitives/test_ssh.py:575 test path pub_type=b"ssh-ed25519",
tests/hazmat/primitives/test_ssh.py:1160 test path b"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG2fgpmpYO61qeAxGd0wgRaN/E4"
tests/hazmat/primitives/test_ssh.py:1172 test path b"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG2fgpmpYO61qeAxGd0wgRaN/E4"
tests/hazmat/primitives/test_ssh.py:1183 test path b"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI22fgpmpYO61qeAxGd0wgRaN/E4"
tests/hazmat/primitives/test_ssh.py:1191 test path b"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG2fgpmpYO61qeAxGd0wgRa"
tests/hazmat/primitives/test_ssh.py:1851 test path b"ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdj"
vectors/cryptography_vectors/asymmetric/OpenSSH/ed25519-aesgcm-psw.key.pub:1 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICuPdFT6OORNyXh9rMfOx3LUCm9yANYovOfNlGd2hg01
vectors/cryptography_vectors/asymmetric/OpenSSH/ed25519-nopsw.key-cert.pub:1 ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIJjE7jTtIuJ68m5zBEtn0bCWKUXcMdAOau0hO3FTMpeAAAAAIN1mDO2AAUULtPk+J+tTL+Qy7Q+fCrVq7e9K0od7sUUwAAAAAAAAAAAAAAABAAAABG5hbWUAAAAAAAAAAAAAAAD//////////wAAAAAAAAB
vectors/cryptography_vectors/asymmetric/OpenSSH/ed25519-nopsw.key.pub:1 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN1mDO2AAUULtPk+J+tTL+Qy7Q+fCrVq7e9K0od7sUUw ed25519-nopsw.key
vectors/cryptography_vectors/asymmetric/OpenSSH/ed25519-psw.key.pub:1 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFpz5PWWlJVx/imAhJjv57fg4eTGFVHf4WcFfbXPNo+/ ed25519-psw.key
vectors/cryptography_vectors/asymmetric/OpenSSH/sk-ed25519-nopsw.key.pub:1 sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHpq5GvsHBU6pNrCAM7FSlpQVw3xJntJbOhHZWy5tuTfAAAAGnNzaDp0aGUtYXBwbGljYXRpb24tc3RyaW5n sk-ed25519-nopsw.key
vectors/cryptography_vectors/asymmetric/OpenSSH/sk-ed25519-psw.key.pub:1 sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHf0iiNQTiR7NNAbeAwY+READVx9G0mP6idSAZ7bPTrMAAAAGnNzaDp0aGUtYXBwbGljYXRpb24tc3RyaW5n sk-ed25519-psw.key

config.ssh-algorithms · CWE-757

RSA Quantum-vulnerable Recorded traffic 17 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

tests/hazmat/primitives/fixtures_rsa.py:713 test path -----BEGIN RSA PRIVATE KEY-----
tests/hazmat/primitives/test_serialization.py:1167 test path -----BEGIN RSA PRIVATE KEY-----
tests/hazmat/primitives/test_serialization.py:1188 test path -----BEGIN RSA PRIVATE KEY-----
tests/hazmat/primitives/test_serialization.py:1214 test path -----BEGIN RSA PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PEM_Serialization/rsa-bad-1025-q-is-2.pem:1 -----BEGIN RSA PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PEM_Serialization/rsa_private_key.pem:1 -----BEGIN RSA PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/wrong-pem-delimiter-rsa.pem:1 -----BEGIN RSA PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/Traditional_OpenSSL_Serialization/key1-malformed-dek-info.pem:1 -----BEGIN RSA PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/Traditional_OpenSSL_Serialization/key1-malformed-iv.pem:1 -----BEGIN RSA PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/Traditional_OpenSSL_Serialization/key1-no-dek-info.pem:1 -----BEGIN RSA PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/Traditional_OpenSSL_Serialization/key1-short-iv.pem:1 -----BEGIN RSA PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/Traditional_OpenSSL_Serialization/key1.pem:1 -----BEGIN RSA PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/Traditional_OpenSSL_Serialization/key2.pem:1 -----BEGIN RSA PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/Traditional_OpenSSL_Serialization/rsa-wrong-version.pem:1 -----BEGIN RSA PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/Traditional_OpenSSL_Serialization/testrsa-encrypted.pem:1 test path -----BEGIN RSA PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/Traditional_OpenSSL_Serialization/testrsa.pem:1 test path -----BEGIN RSA PRIVATE KEY-----
vectors/cryptography_vectors/x509/cryptography.io.with_headers.pem:34 -----BEGIN RSA PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

DSA Quantum-vulnerable 15 places See details

DSA signing key

`dsa.generate_private_key()`. DSA is deprecated for new work by NIST SP 800-186 independently of quantum considerations.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65.

tests/hazmat/primitives/test_dsa.py:113 test path skey = dsa.generate_private_key(2048)
tests/hazmat/primitives/test_dsa.py:292 test path dsa.DSAPrivateNumbers(
tests/hazmat/primitives/test_dsa.py:384 test path dsa.DSAPrivateNumbers(
tests/hazmat/primitives/test_dsa.py:558 test path private_key = dsa.DSAPrivateNumbers(
tests/hazmat/primitives/test_dsa.py:677 test path private_numbers = dsa.DSAPrivateNumbers(
tests/hazmat/primitives/test_dsa.py:689 test path dsa.DSAPrivateNumbers(
tests/hazmat/primitives/test_dsa.py:695 test path dsa.DSAPrivateNumbers(
tests/hazmat/primitives/test_dsa.py:741 test path priv = dsa.DSAPrivateNumbers(1, pub)
tests/hazmat/primitives/test_dsa.py:742 test path assert priv == dsa.DSAPrivateNumbers(
tests/hazmat/primitives/test_dsa.py:748 test path priv = dsa.DSAPrivateNumbers(1, pub)
tests/hazmat/primitives/test_dsa.py:749 test path assert priv != dsa.DSAPrivateNumbers(
tests/hazmat/primitives/test_dsa.py:752 test path assert priv != dsa.DSAPrivateNumbers(
tests/hazmat/primitives/test_dsa.py:755 test path assert priv != dsa.DSAPrivateNumbers(
tests/hazmat/primitives/test_dsa.py:758 test path assert priv != dsa.DSAPrivateNumbers(
tests/hazmat/primitives/test_dsa.py:761 test path assert priv != dsa.DSAPrivateNumbers(

py.cryptography.dsa · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable 15 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

tests/hazmat/primitives/test_ed25519.py:56 test path os.path.join("asymmetric", "Ed25519", "sign.input"),
tests/hazmat/primitives/test_ed25519.py:80 test path os.path.join("asymmetric", "Ed25519", "sign.input"),
tests/hazmat/primitives/test_ed25519.py:277 test path os.path.join("asymmetric", "Ed25519", "ed25519-pkcs8.der"),
tests/hazmat/primitives/test_ed25519.py:294 test path os.path.join("asymmetric", "Ed25519", "ed25519-pkcs8.der"),
tests/hazmat/primitives/test_ed25519.py:306 test path os.path.join("asymmetric", "Ed25519", "ed25519-pkcs8.der"),
tests/hazmat/primitives/test_ed25519.py:318 test path os.path.join("asymmetric", "Ed25519", "ed25519-pkcs8.der"),
tests/hazmat/primitives/test_ed25519.py:330 test path os.path.join("asymmetric", "Ed25519", "ed25519-pkcs8.der"),
tests/hazmat/primitives/test_serialization.py:363 test path "asymmetric", "Ed25519", "ed25519-pub-non-zero-unused-bits.der"
tests/hazmat/primitives/test_serialization.py:1559 test path os.path.join("asymmetric", "Ed25519", "ed25519-pkcs8-enc.der"),
tests/hazmat/primitives/test_serialization.py:1564 test path os.path.join("asymmetric", "Ed25519", "ed25519-pkcs8.der"),
tests/hazmat/primitives/test_serialization.py:1578 test path os.path.join("asymmetric", "Ed25519", "ed25519-pkcs8-enc.pem"),
tests/hazmat/primitives/test_serialization.py:1583 test path os.path.join("asymmetric", "Ed25519", "ed25519-pkcs8.pem"),
tests/hazmat/primitives/test_serialization.py:1599 test path ["Ed25519", "ed25519-pub.pem"],
tests/hazmat/primitives/test_serialization.py:1604 test path ["Ed25519", "ed25519-pub.der"],
tests/hazmat/primitives/test_ssh.py:1828 test path os.path.join("asymmetric", "Ed25519", "ed25519-pkcs8.pem"),

jose.algorithm · CWE-327

EdDSA Quantum-vulnerable 13 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

tests/hazmat/primitives/test_ed448.py:58 test path os.path.join("asymmetric", "Ed448", "rfc8032.txt"),
tests/hazmat/primitives/test_ed448.py:105 test path os.path.join("asymmetric", "Ed448", "rfc8032.txt"),
tests/hazmat/primitives/test_ed448.py:294 test path os.path.join("asymmetric", "Ed448", "ed448-pkcs8.der"),
tests/hazmat/primitives/test_ed448.py:315 test path os.path.join("asymmetric", "Ed448", "ed448-pkcs8.der"),
tests/hazmat/primitives/test_ed448.py:331 test path os.path.join("asymmetric", "Ed448", "ed448-pkcs8.der"),
tests/hazmat/primitives/test_ed448.py:347 test path os.path.join("asymmetric", "Ed448", "ed448-pkcs8.der"),
tests/hazmat/primitives/test_ed448.py:363 test path os.path.join("asymmetric", "Ed448", "ed448-pkcs8.der"),
tests/hazmat/primitives/test_serialization.py:1829 test path os.path.join("asymmetric", "Ed448", "ed448-pkcs8-enc.der"),
tests/hazmat/primitives/test_serialization.py:1834 test path os.path.join("asymmetric", "Ed448", "ed448-pkcs8.der"),
tests/hazmat/primitives/test_serialization.py:1848 test path os.path.join("asymmetric", "Ed448", "ed448-pkcs8-enc.pem"),
tests/hazmat/primitives/test_serialization.py:1853 test path os.path.join("asymmetric", "Ed448", "ed448-pkcs8.pem"),
tests/hazmat/primitives/test_serialization.py:1868 test path (["Ed448", "ed448-pub.pem"], Encoding.PEM, load_pem_public_key),
tests/hazmat/primitives/test_serialization.py:1869 test path (["Ed448", "ed448-pub.der"], Encoding.DER, load_der_public_key),

jose.algorithm · CWE-327

RSA4096-bit Quantum-vulnerable 13 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

vectors/cryptography_vectors/x509/accvraiz1.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/cryptography.io.chain.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/cryptography.io.chain_with_garbage.pem:3 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/cryptography.io.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/cryptography.io.with_garbage.pem:9 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/cryptography.io.with_headers.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/admissions_extension_authority_not_provided.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/admissions_extension_optional_data_not_provided.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/ca/rsa_ca.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/ca/rsae_ca.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/cdp_empty_hostname.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/san_empty_hostname.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/wildcard_san.pem:1 -----BEGIN CERTIFICATE-----

pem.certificate

RSA2048-bit Quantum-vulnerable 13 places See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

vectors/cryptography_vectors/x509/requests/basic_constraints.pem:48 -----BEGIN CERTIFICATE REQUEST-----
vectors/cryptography_vectors/x509/requests/challenge-unstructured.pem:1 -----BEGIN CERTIFICATE REQUEST-----
vectors/cryptography_vectors/x509/requests/challenge.pem:1 -----BEGIN CERTIFICATE REQUEST-----
vectors/cryptography_vectors/x509/requests/freeipa-bad-critical.pem:1 -----BEGIN CERTIFICATE REQUEST-----
vectors/cryptography_vectors/x509/requests/long-form-attribute.pem:1 -----BEGIN CERTIFICATE REQUEST-----
vectors/cryptography_vectors/x509/requests/rsa_md4.pem:1 -----BEGIN CERTIFICATE REQUEST-----
vectors/cryptography_vectors/x509/requests/rsa_sha1.pem:1 -----BEGIN CERTIFICATE REQUEST-----
vectors/cryptography_vectors/x509/requests/rsa_sha256.pem:1 -----BEGIN CERTIFICATE REQUEST-----
vectors/cryptography_vectors/x509/requests/san_rsa_sha1.pem:1 -----BEGIN CERTIFICATE REQUEST-----
vectors/cryptography_vectors/x509/requests/two_basic_constraints.pem:50 -----BEGIN CERTIFICATE REQUEST-----
vectors/cryptography_vectors/x509/requests/unsupported_extension.pem:48 -----BEGIN CERTIFICATE REQUEST-----
vectors/cryptography_vectors/x509/requests/unsupported_extension_critical.pem:48 -----BEGIN CERTIFICATE REQUEST-----
vectors/cryptography_vectors/x509/requests/zero-element-attribute.pem:1 -----BEGIN CERTIFICATE REQUEST-----

pem.certificate-request

DSA Quantum-vulnerable 12 places See details

SSH algorithms pinned in configuration

A `KexAlgorithms`, `HostKeyAlgorithms` or `Ciphers` directive in an SSH configuration. `KexAlgorithms` is the line that decides whether recorded sessions stay confidential.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Put `sntrup761x25519-sha512@openssh.com` first in `KexAlgorithms`. It is a hybrid, so it is no weaker than the classical exchange it replaces.

src/cryptography/hazmat/primitives/serialization/ssh.py:60 _SSH_DSA = b"ssh-dss"
tests/hazmat/primitives/test_dsa.py:1056 test path b"ssh-dss AAAAB3NzaC1kc3MAAACBAKoJMMwUWCUiHK/6KKwolBlqJ4M95ewhJweR"
tests/hazmat/primitives/test_ssh.py:553 test path pub_type=b"ssh-dss",
tests/hazmat/primitives/test_ssh.py:898 test path ssh_key = b"ssh-dss"
tests/hazmat/primitives/test_ssh.py:905 test path b"ssh-dss AAAAB3NzaC1kc3MAAACBALmwUtfwdjAUjU2Dixd5DvT0NDcjjr69UD"
tests/hazmat/primitives/test_ssh.py:922 test path b"ssh-dss AAAAB3NzaC1kc3MAAACBALmwUtfwdjAUjU2Dixd5DvT0NDcjjr69UD"
tests/hazmat/primitives/test_ssh.py:942 test path b"ssh-dss AAAAB3NzAC1kc3MAAACBALmwUtfwdjAUjU2Dixd5DvT0NDcjjr69UD"
tests/hazmat/primitives/test_ssh.py:958 test path b"ssh-dss AAAAB3NzaC1kc3MAAACBALmwUtfwdjAUjU2Dixd5DvT0NDcjjr69UD"
vectors/cryptography_vectors/asymmetric/OpenSSH/certs/dsa-p256.pub:1 ssh-dss-cert-v01@openssh.com AAAAHHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgIE0DERxEocGf8SILUWuT5wakv34qIiz0+1/fQVf0PYQAAACBAPloKFUpz5YJF4doiftzBT3wlM37PvuklYVczyOr8HCn4srUK4Zwe13Ce/Ee+Ibpy3nECDI9AICjYycWOVVbpDAy4nFDpsWal/nxL1wFIocSVD3eiDK
vectors/cryptography_vectors/asymmetric/OpenSSH/dsa-nopsw.key-cert.pub:1 ssh-dss-cert-v01@openssh.com AAAAHHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgT/srHasDLk3rB8bDZK7rP6miircgVvnVrTghYfkmZsEAAACBANGqIFBXxBjpr/l9S8UKzmSh4mBePW/YPp2VKoQEQS7xpED+wlBmZLHpfOiL2CWe/KtLT9KN/RjgnmJTUPSBiw3MGHFkUXKuDosTHBJ+oxxZYHDyl1w
vectors/cryptography_vectors/asymmetric/OpenSSH/dsa-nopsw.key.pub:1 ssh-dss AAAAB3NzaC1kc3MAAACBANGqIFBXxBjpr/l9S8UKzmSh4mBePW/YPp2VKoQEQS7xpED+wlBmZLHpfOiL2CWe/KtLT9KN/RjgnmJTUPSBiw3MGHFkUXKuDosTHBJ+oxxZYHDyl1wxw6NV+txaiG+oX81rYSfNNmBI5fdZtcDyKTDUitqTky8PuW40MtfZkqLvAAAAFQD3Hz77495ou42M1S9toNeG+bCNtwAAAIEA
vectors/cryptography_vectors/asymmetric/OpenSSH/dsa-psw.key.pub:1 ssh-dss AAAAB3NzaC1kc3MAAACBAMHOI6HG+xy8RLV6C1JSk3dldozdE3SJjK1n0UTdBFo/r1ZMnnH/IZOk5+TkRXplfkVAcmmH++Zm4yb4SzxiDMY8XBTn0COzgPOfJJUV6TKLgAF8QsvlhDrbRgLk1ANPQRY3YIPrVGcF4oUZcyUkIcjl4kycGwMyE8wm0FckDKitAAAAFQC5WH7VkaACexO69dQapzGy05mb0QAAAIAS

config.ssh-algorithms · CWE-757

ECDH Quantum-vulnerable Recorded traffic 12 places See details

ECDH key agreement

`ec.ECDH()` passed to `exchange()`. Any traffic protected by this exchange and recorded now is readable once the curve is broken.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768, or hybrid X25519+ML-KEM-768.

tests/hazmat/primitives/test_ec.py:107 test path _skip_exchange_algorithm_unsupported(backend, ec.ECDH(), DummyCurve())
tests/hazmat/primitives/test_ec.py:1530 test path backend, ec.ECDH(), ec._CURVE_TYPES[vector["curve"]]
tests/hazmat/primitives/test_ec.py:1566 test path z = private_key.exchange(ec.ECDH(), peer_pubkey)
tests/hazmat/primitives/test_ec.py:1586 test path _skip_exchange_algorithm_unsupported(backend, ec.ECDH(), curve)
tests/hazmat/primitives/test_ec.py:1599 test path shared_secret = key.exchange(ec.ECDH(), peer.public_key())
tests/hazmat/primitives/test_ec.py:1601 test path shared_secret_2 = peer.exchange(ec.ECDH(), key.public_key())
tests/hazmat/primitives/test_ec.py:1634 test path key.exchange(ec.ECDH(), public_key)
tests/wycheproof/test_ecdh.py:56 test path _skip_exchange_algorithm_unsupported(backend, ec.ECDH(), curve)
tests/wycheproof/test_ecdh.py:77 test path computed_shared = private_key.exchange(ec.ECDH(), public_key)
tests/wycheproof/test_ecdh.py:82 test path private_key.exchange(ec.ECDH(), public_key)
tests/wycheproof/test_ecdh.py:94 test path _skip_exchange_algorithm_unsupported(backend, ec.ECDH(), curve)
tests/wycheproof/test_ecdh.py:115 test path computed_shared = private_key.exchange(ec.ECDH(), public_key)

py.cryptography.ecdh · CWE-327

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 10 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

tests/hazmat/primitives/test_ec.py:478 test path -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:450 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/ec-consistent-curve.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/ec-inconsistent-curve.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/ec-invalid-private-scalar.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/ec-invalid-version.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/ec_private_key.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/ecc_private_with_rfc5915_ext.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/pkcs12/ca/ca_key.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/x509/custom/ca/ca_key.pem:1 -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

ECDSAsecp256r1 Quantum-vulnerable 9 places See details

SSH public key

An `ssh-rsa`, `ecdsa-sha2-*`, `ssh-ed25519` or `ssh-dss` key. `ssh-dss` is disabled by default in current OpenSSH and is reported as broken.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Replace `ssh-dss` now. For the rest, enable the `sntrup761x25519-sha512` key exchange, which protects recorded sessions even while host keys stay classical.

tests/hazmat/primitives/test_ec.py:1311 test path b"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy"
tests/hazmat/primitives/test_ssh.py:1018 test path b"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy"
tests/hazmat/primitives/test_ssh.py:1044 test path b"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy"
tests/hazmat/primitives/test_ssh.py:1109 test path b"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy"
tests/hazmat/primitives/test_ssh.py:1118 test path b"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy"
tests/hazmat/primitives/test_ssh.py:1129 test path b"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy"
tests/hazmat/primitives/test_ssh.py:1140 test path b"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy"
tests/hazmat/primitives/test_ssh.py:1149 test path b"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy"
vectors/cryptography_vectors/asymmetric/OpenSSH/ecdsa-nopsw.key.pub:1 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCZWRs4G

ssh.public-key · CWE-327

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 9 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

vectors/cryptography_vectors/pkcs12/ca/ca.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/ca/ca.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/ecdsa_null_alg.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/empty-eku.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/ms-certificate-template.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/name_attribute_unsupported_tag.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/unsupported_extension_2.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/scottishpower-bitstring-dn.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/unique_identifier.pem:1 -----BEGIN CERTIFICATE-----

pem.certificate

Ed25519ed25519 Quantum-vulnerable 9 places See details

SSH public key

An `ssh-rsa`, `ecdsa-sha2-*`, `ssh-ed25519` or `ssh-dss` key. `ssh-dss` is disabled by default in current OpenSSH and is reported as broken.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Replace `ssh-dss` now. For the rest, enable the `sntrup761x25519-sha512` key exchange, which protects recorded sessions even while host keys stay classical.

tests/hazmat/primitives/test_ssh.py:1160 test path b"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG2fgpmpYO61qeAxGd0wgRaN/E4"
tests/hazmat/primitives/test_ssh.py:1172 test path b"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG2fgpmpYO61qeAxGd0wgRaN/E4"
tests/hazmat/primitives/test_ssh.py:1183 test path b"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI22fgpmpYO61qeAxGd0wgRaN/E4"
tests/hazmat/primitives/test_ssh.py:1191 test path b"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG2fgpmpYO61qeAxGd0wgRa"
vectors/cryptography_vectors/asymmetric/OpenSSH/ed25519-aesgcm-psw.key.pub:1 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICuPdFT6OORNyXh9rMfOx3LUCm9yANYovOfNlGd2hg01
vectors/cryptography_vectors/asymmetric/OpenSSH/ed25519-nopsw.key.pub:1 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN1mDO2AAUULtPk+J+tTL+Qy7Q+fCrVq7e9K0od7sUUw
vectors/cryptography_vectors/asymmetric/OpenSSH/ed25519-psw.key.pub:1 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFpz5PWWlJVx/imAhJjv57fg4eTGFVHf4WcFfbXPNo+/
vectors/cryptography_vectors/asymmetric/OpenSSH/sk-ed25519-nopsw.key.pub:1 sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHpq5GvsH
vectors/cryptography_vectors/asymmetric/OpenSSH/sk-ed25519-psw.key.pub:1 sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHf0iiNQT

ssh.public-key · CWE-327

RSA Quantum-vulnerable 9 places See details

SSH public key

An `ssh-rsa`, `ecdsa-sha2-*`, `ssh-ed25519` or `ssh-dss` key. `ssh-dss` is disabled by default in current OpenSSH and is reported as broken.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Replace `ssh-dss` now. For the rest, enable the `sntrup761x25519-sha512` key exchange, which protects recorded sessions even while host keys stay classical.

tests/hazmat/primitives/test_rsa.py:2733 test path b"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC7JHoJfg6yNzLMOWet8Z49a4KD"
tests/hazmat/primitives/test_ssh.py:794 test path ssh_key = b"ssh-rsa AAAAB3NzaC1yc2EAAAA="
tests/hazmat/primitives/test_ssh.py:799 test path ssh_key = b"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAACKr+IHXo"
tests/hazmat/primitives/test_ssh.py:806 test path b"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDu/XRP1kyK6Cgt36gts9XAk"
tests/hazmat/primitives/test_ssh.py:820 test path b"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDu/XRP1kyK6Cgt36gts9XAk"
tests/hazmat/primitives/test_ssh.py:837 test path b"ssh-rsa AAAAB3NzAC1yc2EAAAADAQABAAABAQDDu/XRP1kyK6Cgt36gts9XAk"
tests/hazmat/primitives/test_ssh.py:850 test path b"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDu/XRP1kyK6Cgt36gts9XAk"
vectors/cryptography_vectors/asymmetric/OpenSSH/rsa-nopsw.key.pub:1 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrZB1KbbZASyb4a2kDA3iqTR7EMjHDFRvyMnossujX
vectors/cryptography_vectors/asymmetric/OpenSSH/rsa-psw.key.pub:1 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCek3p8wNo15l7Ihy4yaGjWScJpjh/Lq7WS7f64KxXK

ssh.public-key · CWE-327

DSA Quantum-vulnerable 8 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

vectors/cryptography_vectors/asymmetric/DSA/custom/nilpotent.pem:1 -----BEGIN DSA PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PEM_Serialization/dsa_4096.pem:1 -----BEGIN DSA PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PEM_Serialization/dsa_private_key.pem:1 -----BEGIN DSA PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/unenc-dsa-pkcs8.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/Traditional_OpenSSL_Serialization/dsa-wrong-version.pem:1 -----BEGIN DSA PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/Traditional_OpenSSL_Serialization/dsa.1024.pem:1 -----BEGIN DSA PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/Traditional_OpenSSL_Serialization/dsa.2048.pem:1 -----BEGIN DSA PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/Traditional_OpenSSL_Serialization/dsa.3072.pem:1 -----BEGIN DSA PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

DSA Quantum-vulnerable 7 places See details

SSH public key

An `ssh-rsa`, `ecdsa-sha2-*`, `ssh-ed25519` or `ssh-dss` key. `ssh-dss` is disabled by default in current OpenSSH and is reported as broken.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Replace `ssh-dss` now. For the rest, enable the `sntrup761x25519-sha512` key exchange, which protects recorded sessions even while host keys stay classical.

tests/hazmat/primitives/test_dsa.py:1056 test path b"ssh-dss AAAAB3NzaC1kc3MAAACBAKoJMMwUWCUiHK/6KKwolBlqJ4M95ewhJweR"
tests/hazmat/primitives/test_ssh.py:905 test path b"ssh-dss AAAAB3NzaC1kc3MAAACBALmwUtfwdjAUjU2Dixd5DvT0NDcjjr69UD"
tests/hazmat/primitives/test_ssh.py:922 test path b"ssh-dss AAAAB3NzaC1kc3MAAACBALmwUtfwdjAUjU2Dixd5DvT0NDcjjr69UD"
tests/hazmat/primitives/test_ssh.py:942 test path b"ssh-dss AAAAB3NzAC1kc3MAAACBALmwUtfwdjAUjU2Dixd5DvT0NDcjjr69UD"
tests/hazmat/primitives/test_ssh.py:958 test path b"ssh-dss AAAAB3NzaC1kc3MAAACBALmwUtfwdjAUjU2Dixd5DvT0NDcjjr69UD"
vectors/cryptography_vectors/asymmetric/OpenSSH/dsa-nopsw.key.pub:1 ssh-dss AAAAB3NzaC1kc3MAAACBANGqIFBXxBjpr/l9S8UKzmSh4mBePW/YPp2VKoQEQS7xpED+wlBm
vectors/cryptography_vectors/asymmetric/OpenSSH/dsa-psw.key.pub:1 ssh-dss AAAAB3NzaC1kc3MAAACBAMHOI6HG+xy8RLV6C1JSk3dldozdE3SJjK1n0UTdBFo/r1ZMnnH/

ssh.public-key · CWE-327

ECDSA521-bitsecg/secp521r1 Quantum-vulnerable 7 places See details

Elliptic-curve key generated with pyca/cryptography

`ec.generate_private_key()`. The curve is read from the argument and normalised onto the CycloneDX 1.7 curve registry.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 for signatures. If the key feeds ECDH, treat it as key establishment and prioritise it above signatures.

tests/hazmat/primitives/test_hpke.py:176 test path sk_r = ec.generate_private_key(ec.SECP521R1())
tests/hazmat/primitives/test_hpke.py:241 test path sk_r = ec.generate_private_key(ec.SECP521R1())
tests/hazmat/primitives/test_hpke.py:347 test path secp521r1_pk = ec.generate_private_key(ec.SECP521R1()).public_key()
tests/hazmat/primitives/test_hpke.py:352 test path secp521r1_sk = ec.generate_private_key(ec.SECP521R1())
tests/hazmat/primitives/test_hpke.py:358 test path sk_r = ec.generate_private_key(ec.SECP521R1())
tests/hazmat/primitives/test_hpke.py:363 test path sk_wrong = ec.generate_private_key(ec.SECP521R1())
tests/hazmat/primitives/test_hpke.py:459 test path sk_r = ec.generate_private_key(ec.SECP521R1())

py.cryptography.ec · CWE-327

ECDSA Quantum-vulnerable 6 places See details

Elliptic-curve key generated with pyca/cryptography

`ec.generate_private_key()`. The curve is read from the argument and normalised onto the CycloneDX 1.7 curve registry.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 for signatures. If the key feeds ECDH, treat it as key establishment and prioritise it above signatures.

tests/hazmat/primitives/test_ec.py:119 test path private_numbers = ec.generate_private_key(curve, backend).private_numbers()
tests/hazmat/primitives/test_ec.py:237 test path key = ec.generate_private_key(curve, backend)
tests/hazmat/primitives/test_ec.py:320 test path key = ec.generate_private_key(curve, backend)
tests/hazmat/primitives/test_ec.py:334 test path ec.generate_private_key(DummyCurve(), backend)
tests/hazmat/primitives/test_ec.py:356 test path ec.generate_private_key(curve)
tests/hazmat/primitives/test_ssh.py:1745 test path private_key = ec.generate_private_key(curve)

py.cryptography.ec · CWE-327

RSA-OAEP Quantum-vulnerable Recorded traffic 5 places See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

docs/development/custom-vectors/rsa-oaep-sha2/VerifyRSAOAEPSHA2.java:265 cipher = Cipher.getInstance("RSA/ECB/OAEPwithSHA1andMGF1Padding", "BC");
docs/development/custom-vectors/rsa-oaep-sha2/VerifyRSAOAEPSHA2.java:269 cipher = Cipher.getInstance("RSA/ECB/OAEPwithSHA-224andMGF1Padding", "BC");
docs/development/custom-vectors/rsa-oaep-sha2/VerifyRSAOAEPSHA2.java:273 cipher = Cipher.getInstance("RSA/ECB/OAEPwithSHA-256andMGF1Padding", "BC");
docs/development/custom-vectors/rsa-oaep-sha2/VerifyRSAOAEPSHA2.java:277 cipher = Cipher.getInstance("RSA/ECB/OAEPwithSHA-384andMGF1Padding", "BC");
docs/development/custom-vectors/rsa-oaep-sha2/VerifyRSAOAEPSHA2.java:281 cipher = Cipher.getInstance("RSA/ECB/OAEPwithSHA-512andMGF1Padding", "BC");

java.cipher · CWE-327

RSA-PSS2048-bit Quantum-vulnerable 5 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

vectors/cryptography_vectors/asymmetric/PKCS8/rsa_pss_2048.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/rsa_pss_2048_hash.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/rsa_pss_2048_hash_mask.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/rsa_pss_2048_hash_mask_diff.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/rsa_pss_2048_hash_mask_salt.pem:1 -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

DH Quantum-vulnerable 4 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

vectors/cryptography_vectors/asymmetric/DH/dhp.pem:1 -----BEGIN DH PARAMETERS-----
vectors/cryptography_vectors/asymmetric/DH/dhp_privatevaluelength.pem:1 -----BEGIN DH PARAMETERS-----
vectors/cryptography_vectors/asymmetric/DH/dhpub.pem:1 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/DH/dhpub_cryptography_old.pem:1 -----BEGIN PUBLIC KEY-----

pem.public-key

ECDSA192-bitsecg/secp192r1 Quantum-vulnerable 3 places See details

Elliptic-curve key generated with pyca/cryptography

`ec.generate_private_key()`. The curve is read from the argument and normalised onto the CycloneDX 1.7 curve registry.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 for signatures. If the key feeds ECDH, treat it as key establishment and prioritise it above signatures.

tests/hazmat/primitives/test_ec.py:361 test path key = ec.generate_private_key(ec.SECP192R1(), backend)
tests/hazmat/primitives/test_ec.py:1316 test path key = ec.generate_private_key(ec.SECP192R1(), backend).public_key()
tests/hazmat/primitives/test_ssh.py:647 test path private_key = ec.generate_private_key(ec.SECP192R1())

py.cryptography.ec · CWE-327

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 3 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

tests/hazmat/primitives/test_ec.py:467 test path -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:456 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/PEM_Serialization/ec_public_key.pem:1 -----BEGIN PUBLIC KEY-----

pem.public-key

RSA2048-bit Quantum-vulnerable Recorded traffic 3 places See details

RSA key generated with pyca/cryptography

`rsa.generate_private_key()`. The `key_size` argument is read where it is a literal and reported on the finding; it does not change the classification, because Shor is polynomial in the modulus size.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption and ML-DSA-65 for signatures.

tests/hazmat/primitives/test_rsa.py:193 test path rsa.generate_private_key(public_exponent=1, key_size=2048)
tests/hazmat/primitives/test_rsa.py:196 test path rsa.generate_private_key(public_exponent=4, key_size=2048)
tests/hazmat/primitives/test_rsa.py:199 test path rsa.generate_private_key(public_exponent=65535, key_size=2048)

py.cryptography.rsa · CWE-327

RSA Quantum-vulnerable 3 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

vectors/cryptography_vectors/asymmetric/PEM_Serialization/ec_public_key_rsa_delimiter.pem:1 -----BEGIN RSA PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/PEM_Serialization/rsa_wrong_delimiter_public_key.pem:1 -----BEGIN RSA PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/public/PKCS1/rsa.pub.pem:1 -----BEGIN RSA PUBLIC KEY-----

pem.public-key

DH Quantum-vulnerable Recorded traffic 2 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

vectors/cryptography_vectors/asymmetric/DH/dh_key_256.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/DH/dhkey.pem:1 -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

DSA Quantum-vulnerable 2 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

vectors/cryptography_vectors/asymmetric/PEM_Serialization/dsa_public_key.pem:1 -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/unenc-dsa-pkcs8.pub.pem:1 -----BEGIN PUBLIC KEY-----

pem.public-key

DSA Quantum-vulnerable 2 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

vectors/cryptography_vectors/x509/custom/dsa_null_alg_params.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/dsa_selfsigned_ca.pem:1 -----BEGIN CERTIFICATE-----

pem.certificate

ECDSAsecp384r1 Quantum-vulnerable 2 places See details

SSH public key

An `ssh-rsa`, `ecdsa-sha2-*`, `ssh-ed25519` or `ssh-dss` key. `ssh-dss` is disabled by default in current OpenSSH and is reported as broken.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Replace `ssh-dss` now. For the rest, enable the `sntrup761x25519-sha512` key exchange, which protects recorded sessions even while host keys stay classical.

tests/hazmat/primitives/test_ssh.py:1055 test path b"ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAz"
vectors/cryptography_vectors/asymmetric/OpenSSH/ecdsa-psw.key.pub:1 ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBKoqSCpm

ssh.public-key · CWE-327

ECDSA384-bitsecg/secp384r1 Quantum-vulnerable 2 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:650 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/ec-inconsistent-curve2.pem:1 -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

ECDSA384-bitsecg/secp384r1 Quantum-vulnerable 2 places See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

vectors/cryptography_vectors/x509/requests/ec_sha256.pem:1 -----BEGIN CERTIFICATE REQUEST-----
vectors/cryptography_vectors/x509/requests/ec_sha256_old_header.pem:1 -----BEGIN NEW CERTIFICATE REQUEST-----

pem.certificate-request

Ed25519255-bitother/Ed25519 Quantum-vulnerable 2 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

tests/hazmat/primitives/test_ed25519.py:257 test path -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/Ed25519/ed25519-pub.pem:1 -----BEGIN PUBLIC KEY-----

pem.public-key

Ed25519255-bitother/Ed25519 Quantum-vulnerable 2 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

vectors/cryptography_vectors/x509/ed25519/root-ed25519.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/ed25519/server-ed25519-cert.pem:1 -----BEGIN CERTIFICATE-----

pem.certificate

EdDSA Quantum-vulnerable 2 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

tests/hazmat/primitives/test_ed448.py:252 test path -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/Ed448/ed448-pub.pem:1 -----BEGIN PUBLIC KEY-----

pem.public-key

EdDSA Quantum-vulnerable 2 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

vectors/cryptography_vectors/x509/ed448/root-ed448.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/ed448/server-ed448-cert.pem:1 -----BEGIN CERTIFICATE-----

pem.certificate

RSA-PSS2048-bit Quantum-vulnerable 2 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

vectors/cryptography_vectors/x509/custom/rsa_pss.pem:1 -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/rsa_pss_cert.pem:1 -----BEGIN CERTIFICATE-----

pem.certificate

X25519255-bitother/Curve25519 Quantum-vulnerable 2 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

tests/hazmat/primitives/test_x25519.py:334 test path -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/X25519/x25519-pub.pem:1 -----BEGIN PUBLIC KEY-----

pem.public-key

X448448-bitother/Curve448 Quantum-vulnerable 2 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

tests/hazmat/primitives/test_x448.py:256 test path -----BEGIN PUBLIC KEY-----
vectors/cryptography_vectors/asymmetric/X448/x448-pub.pem:1 -----BEGIN PUBLIC KEY-----

pem.public-key

DSA Quantum-vulnerable 1 place See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

vectors/cryptography_vectors/x509/requests/dsa_sha1.pem:1 -----BEGIN CERTIFICATE REQUEST-----

pem.certificate-request

ECDSAsecp521r1 Quantum-vulnerable 1 place See details

SSH public key

An `ssh-rsa`, `ecdsa-sha2-*`, `ssh-ed25519` or `ssh-dss` key. `ssh-dss` is disabled by default in current OpenSSH and is reported as broken.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Replace `ssh-dss` now. For the rest, enable the `sntrup761x25519-sha512` key exchange, which protects recorded sessions even while host keys stay classical.

tests/hazmat/primitives/test_ssh.py:1081 test path b"ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1"

ssh.public-key · CWE-327

ECDSA192-bitsecg/secp192r1 Quantum-vulnerable 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:18 -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

ECDSA192-bitsecg/secp192r1 Quantum-vulnerable 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:24 -----BEGIN PUBLIC KEY-----

pem.public-key

ECDSA224-bitsecg/secp224r1 Quantum-vulnerable 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:234 -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

ECDSA224-bitsecg/secp224r1 Quantum-vulnerable 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:240 -----BEGIN PUBLIC KEY-----

pem.public-key

ECDSA384-bitsecg/secp384r1 Quantum-vulnerable 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:656 -----BEGIN PUBLIC KEY-----

pem.public-key

ECDSA521-bitsecg/secp521r1 Quantum-vulnerable 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:851 -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

ECDSA521-bitsecg/secp521r1 Quantum-vulnerable 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:858 -----BEGIN PUBLIC KEY-----

pem.public-key

ECDSA Quantum-vulnerable 1 place See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

vectors/cryptography_vectors/x509/custom/ec_no_named_curve.pem:1 -----BEGIN CERTIFICATE-----

pem.certificate

ECDSA384-bitsecg/secp384r1 Quantum-vulnerable 1 place See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

vectors/cryptography_vectors/x509/ecdsa_root.pem:1 -----BEGIN CERTIFICATE-----

pem.certificate

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 1 place See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

vectors/cryptography_vectors/x509/requests/bad-version.pem:1 -----BEGIN CERTIFICATE REQUEST-----

pem.certificate-request

Ed25519255-bitother/Ed25519 Quantum-vulnerable 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

vectors/cryptography_vectors/asymmetric/Ed25519/ed25519-pkcs8.pem:1 -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

EdDSA Quantum-vulnerable 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

vectors/cryptography_vectors/asymmetric/Ed448/ed448-pkcs8.pem:1 -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

RSA Quantum-vulnerable Recorded traffic 1 place See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

docs/development/custom-vectors/rsa-oaep-sha2/VerifyRSAOAEPSHA2.java:347 KeyFactory kf = KeyFactory.getInstance("RSA");

java.keyfactory · CWE-327

RSA2048-bit Quantum-vulnerable 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

vectors/cryptography_vectors/asymmetric/PEM_Serialization/rsa_public_key.pem:1 -----BEGIN PUBLIC KEY-----

pem.public-key

RSA4096-bit Quantum-vulnerable Recorded traffic 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

vectors/cryptography_vectors/x509/custom/ca/rsa_key.pem:1 -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

X25519255-bitother/Curve25519 Quantum-vulnerable Recorded traffic 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

vectors/cryptography_vectors/asymmetric/X25519/x25519-pkcs8.pem:1 -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

X25519255-bitother/Curve25519 Quantum-vulnerable 1 place See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

vectors/cryptography_vectors/x509/ed25519/ed25519-rfc8410.pem:1 -----BEGIN CERTIFICATE-----

pem.certificate

X448448-bitother/Curve448 Quantum-vulnerable Recorded traffic 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

vectors/cryptography_vectors/asymmetric/X448/x448-pkcs8.pem:1 -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

SHA-224 Reduced margin 1 place See details

Mask-generation digest named for RSA padding

`MGF1ParameterSpec.SHA256` names the digest inside RSA-OAEP and RSA-PSS padding. It is a separate choice from the digest the signature or the cipher uses, it is frequently left at SHA-1 by default, and a static import of it - `import static java.security.spec.MGF1ParameterSpec.SHA512` - is the only place the choice appears in the file that makes it.

This picks the hash used inside RSA padding. It matters because the default is often SHA-1, which is broken today without any quantum computer.

What to do. The mask-generation digest travels with the RSA key it pads. When that key moves to ML-KEM or ML-DSA the padding goes with it; until then, SHA-256 or better.

docs/development/custom-vectors/rsa-oaep-sha2/VerifyRSAOAEPSHA2.java:297 mgf1 = MGF1ParameterSpec.SHA224;

java.mgf1 · CWE-327

SHA-256 Reduced margin 1 place See details

Mask-generation digest named for RSA padding

`MGF1ParameterSpec.SHA256` names the digest inside RSA-OAEP and RSA-PSS padding. It is a separate choice from the digest the signature or the cipher uses, it is frequently left at SHA-1 by default, and a static import of it - `import static java.security.spec.MGF1ParameterSpec.SHA512` - is the only place the choice appears in the file that makes it.

This picks the hash used inside RSA padding. It matters because the default is often SHA-1, which is broken today without any quantum computer.

What to do. The mask-generation digest travels with the RSA key it pads. When that key moves to ML-KEM or ML-DSA the padding goes with it; until then, SHA-256 or better.

docs/development/custom-vectors/rsa-oaep-sha2/VerifyRSAOAEPSHA2.java:301 mgf1 = MGF1ParameterSpec.SHA256;

java.mgf1 · CWE-327

AES Reduced margin Renamed import 107 places See details

AES block cipher

`algorithms.AES(key)`. Symmetric encryption is not broken by a quantum computer; the key length is what matters. The key size is reported where it can be read.

This is the kind of encryption that quantum computers do not break. Using a longer key is enough.

What to do. Use a 256-bit key. No change of algorithm is required.

tests/bench/test_aead.py:45 test path aes = AESGCM(b"\x00" * 32)
tests/bench/test_aead.py:50 test path aes = AESGCM(b"\x00" * 32)
tests/bench/test_aead.py:79 test path aes = AESOCB3(b"\x00" * 32)
tests/bench/test_aead.py:88 test path aes = AESOCB3(b"\x00" * 32)
tests/hazmat/primitives/test_aead.py:582 test path aesgcm = AESGCM(key)
tests/hazmat/primitives/test_aead.py:595 test path aesgcm = AESGCM(key)
tests/hazmat/primitives/test_aead.py:619 test path aesgcm = AESGCM(key)
tests/hazmat/primitives/test_aead.py:640 test path aesgcm = AESGCM(key)
tests/hazmat/primitives/test_aead.py:655 test path aesgcm = AESGCM(key)
tests/hazmat/primitives/test_aead.py:669 test path AESGCM(typing.cast(typing.Any, object()))
tests/hazmat/primitives/test_aead.py:672 test path AESGCM(b"0" * 31)
tests/hazmat/primitives/test_aead.py:683 test path aesgcm = AESGCM(key)
tests/hazmat/primitives/test_aead.py:694 test path aesgcm = AESGCM(key)
tests/hazmat/primitives/test_aead.py:701 test path aesgcm2 = AESGCM(bytearray(key))
tests/hazmat/primitives/test_aead.py:709 test path aesgcm3 = AESGCM(memoryview(key))
tests/hazmat/primitives/test_aead.py:721 test path aesgcm = AESGCM(key)
tests/hazmat/primitives/test_aead.py:736 test path aesgcm = AESGCM(key)
tests/hazmat/primitives/test_aead.py:745 test path aesgcm = AESGCM(key)
tests/hazmat/primitives/test_aead.py:760 test path aesgcm = AESGCM(key)
tests/hazmat/primitives/test_aead.py:769 test path aesgcm = AESGCM(key)
tests/hazmat/primitives/test_aead.py:784 test path aesgcm = AESGCM(key)
tests/hazmat/primitives/test_aead.py:813 test path AESOCB3(AESOCB3.generate_key(128))
tests/hazmat/primitives/test_aead.py:827 test path aesocb3 = AESOCB3(key)
tests/hazmat/primitives/test_aead.py:861 test path aesocb3 = AESOCB3(key)
tests/hazmat/primitives/test_aead.py:878 test path aesocb3 = AESOCB3(key)
tests/hazmat/primitives/test_aead.py:880 test path badkey = AESOCB3(AESOCB3.generate_key(128))
tests/hazmat/primitives/test_aead.py:901 test path k = AESOCB3(b"\x00" * ((key_len - 8) // 8) + b"\x80")
tests/hazmat/primitives/test_aead.py:931 test path aesocb3 = AESOCB3(key)
tests/hazmat/primitives/test_aead.py:940 test path aesocb3 = AESOCB3(key)
tests/hazmat/primitives/test_aead.py:967 test path AESOCB3(typing.cast(typing.Any, object()))
tests/hazmat/primitives/test_aead.py:970 test path AESOCB3(b"0" * 31)
tests/hazmat/primitives/test_aead.py:981 test path aesocb3 = AESOCB3(key)
tests/hazmat/primitives/test_aead.py:992 test path aesocb3 = AESOCB3(key)
tests/hazmat/primitives/test_aead.py:999 test path aesocb3_ = AESOCB3(bytearray(key))
tests/hazmat/primitives/test_aead.py:1007 test path aesocb3 = AESOCB3(key)
tests/hazmat/primitives/test_aead.py:1022 test path aesocb3 = AESOCB3(key)
tests/hazmat/primitives/test_aead.py:1031 test path aesocb3 = AESOCB3(key)
tests/hazmat/primitives/test_aead.py:1046 test path aesocb3 = AESOCB3(key)
tests/hazmat/primitives/test_aead.py:1055 test path aesocb3 = AESOCB3(key)
tests/hazmat/primitives/test_aead.py:1069 test path aesocb3 = AESOCB3(key)
tests/hazmat/primitives/test_aes.py:42 test path alg = algorithms.AES(key)
tests/hazmat/primitives/test_aes.py:62 test path alg = algorithms.AES(key)
tests/hazmat/primitives/test_aes.py:80 test path alg = algorithms.AES(key)
tests/hazmat/primitives/test_aes.py:116 test path lambda key, **kwargs: algorithms.AES(binascii.unhexlify(key)),
tests/hazmat/primitives/test_aes.py:142 test path lambda key, **kwargs: algorithms.AES(binascii.unhexlify(key)),
tests/hazmat/primitives/test_aes.py:168 test path lambda key, **kwargs: algorithms.AES(binascii.unhexlify(key)),
tests/hazmat/primitives/test_aes.py:175 test path algorithms.AES(b"\x00" * 16), CFB(b"\x00" * 16)
tests/hazmat/primitives/test_aes.py:200 test path lambda key, **kwargs: algorithms.AES(binascii.unhexlify(key)),
tests/hazmat/primitives/test_aes.py:207 test path algorithms.AES(b"\x00" * 16), CFB8(b"\x00" * 16)
tests/hazmat/primitives/test_aes.py:232 test path lambda key, **kwargs: algorithms.AES(binascii.unhexlify(key)),
tests/hazmat/primitives/test_aes.py:242 test path lambda key, **kwargs: algorithms.AES(binascii.unhexlify(key)),
tests/hazmat/primitives/test_aes.py:262 test path key = algorithms.AES(bytearray(os.urandom(32)))
tests/hazmat/primitives/test_aes.py:303 test path algorithms.AES(b"\x00" * 16),
tests/hazmat/primitives/test_aes.py:307 test path algorithms.AES(b"\x00" * 16),
tests/hazmat/primitives/test_aes.py:345 test path algorithms.AES(b"\x00" * 16),
tests/hazmat/primitives/test_aes_gcm.py:41 test path cipher = base.Cipher(algorithms.AES(key), modes.GCM(iv))
tests/hazmat/primitives/test_aes_gcm.py:54 test path cipher = base.Cipher(algorithms.AES(key), modes.GCM(iv))
tests/hazmat/primitives/test_aes_gcm.py:62 test path algorithms.AES(b"\x00" * 16), modes.GCM(b"\x01" * 16)
tests/hazmat/primitives/test_aes_gcm.py:86 test path algorithms.AES(b"\x00" * 16), modes.GCM(b"\x01" * 16)
tests/hazmat/primitives/test_aes_gcm.py:109 test path encryptor = base.Cipher(algorithms.AES(key), modes.GCM(iv)).encryptor()
tests/hazmat/primitives/test_aes_gcm.py:113 test path decryptor = base.Cipher(algorithms.AES(key), modes.GCM(iv)).decryptor()
tests/hazmat/primitives/test_aes_gcm.py:123 test path encryptor = base.Cipher(algorithms.AES(key), modes.GCM(iv)).encryptor()
tests/hazmat/primitives/test_aes_gcm.py:129 test path algorithms.AES(key), modes.GCM(iv, tag)
tests/hazmat/primitives/test_aes_gcm.py:139 test path encryptor = base.Cipher(algorithms.AES(key), modes.GCM(iv)).encryptor()
tests/hazmat/primitives/test_aes_gcm.py:144 test path decryptor = base.Cipher(algorithms.AES(key), modes.GCM(iv)).decryptor()
tests/hazmat/primitives/test_aes_gcm.py:152 test path algorithms.AES(b"0" * 16), modes.GCM(b"0" * 12)
tests/hazmat/primitives/test_aes_gcm.py:160 test path algorithms.AES(bytearray(b"\x00" * 16)),
tests/hazmat/primitives/test_aes_gcm.py:187 test path encryptor = base.Cipher(algorithms.AES(key), modes.GCM(iv)).encryptor()
tests/hazmat/primitives/test_aes_gcm.py:192 test path decryptor = base.Cipher(algorithms.AES(key), modes.GCM(iv)).decryptor()
tests/hazmat/primitives/test_aes_gcm.py:213 test path algorithms.AES(b"\x00" * 16),
tests/hazmat/primitives/test_block.py:31 test path algorithms.AES(binascii.unhexlify(b"0" * 32)),
tests/hazmat/primitives/test_block.py:38 test path algorithms.AES(binascii.unhexlify(b"0" * 32)),
tests/hazmat/primitives/test_block.py:52 test path algorithms.AES(binascii.unhexlify(b"0" * 32)),
tests/hazmat/primitives/test_block.py:72 test path algorithms.AES(binascii.unhexlify(b"0" * 32)),
tests/hazmat/primitives/test_block.py:84 test path algorithms.AES(binascii.unhexlify(b"0" * 32)), modes.ECB()
tests/hazmat/primitives/test_block.py:110 test path cipher = Cipher(algorithms.AES(b"\x00" * 16), modes.CBC(b"\x00" * 16))
tests/hazmat/primitives/test_block.py:136 test path Cipher(algorithms.AES(b"\x00" * 16), modes.CBC(b"abc"))
tests/hazmat/primitives/test_block.py:140 test path Cipher(algorithms.AES(b"\x00" * 16), OFB(b"abc"))
tests/hazmat/primitives/test_block.py:144 test path Cipher(algorithms.AES(b"\x00" * 16), CFB(b"abc"))
tests/hazmat/primitives/test_block.py:148 test path Cipher(algorithms.AES(b"\x00" * 16), CFB8(b"abc"))
tests/hazmat/primitives/test_block.py:152 test path Cipher(algorithms.AES(b"\x00" * 16), modes.CTR(b"abc"))
tests/hazmat/primitives/test_ciphers.py:46 test path cipher = AES(binascii.unhexlify(key))
tests/hazmat/primitives/test_ciphers.py:51 test path AES(binascii.unhexlify(b"0" * 12))
tests/hazmat/primitives/test_ciphers.py:55 test path AES(typing.cast(typing.Any, "0" * 32))
tests/hazmat/primitives/test_ciphers.py:62 test path ciphers.Cipher(AES(b"0" * 64), mode(b"0" * 16))
tests/hazmat/primitives/test_ciphers.py:74 test path ciphers.Cipher(AES(b"0" * 16), modes.XTS(b"0" * 16))
tests/hazmat/primitives/test_ciphers.py:121 test path c = ciphers.Cipher(AES(key), modes.ECB())
tests/hazmat/primitives/test_ciphers.py:133 test path c = ciphers.Cipher(AES(key), modes.GCM(iv))
tests/hazmat/primitives/test_ciphers.py:140 test path c = ciphers.Cipher(AES(key), modes.GCM(iv, encryptor.tag))
tests/hazmat/primitives/test_ciphers.py:150 test path encryptor = ciphers.Cipher(AES(key), modes.GCM(iv)).encryptor()
tests/hazmat/primitives/test_ciphers.py:154 test path AES(key), modes.GCM(iv, tag=encryptor.tag)
tests/hazmat/primitives/test_ciphers.py:163 test path AES(b"\x00" * 16), modes.GCM(b"\x00" * 12, tag=b"\x00" * 16)
tests/hazmat/primitives/test_ciphers.py:179 test path c = ciphers.Cipher(AES(key), modes.ECB())
tests/hazmat/primitives/test_ciphers.py:194 test path AES(key), typing.cast(modes.ModeWithNonce, mode)
tests/hazmat/primitives/test_ciphers.py:209 test path c = ciphers.Cipher(AES(key), modes.ECB())
tests/hazmat/primitives/test_ciphers.py:217 test path c = ciphers.Cipher(AES(key), modes.ECB())
tests/hazmat/primitives/test_ciphers.py:225 test path c = ciphers.Cipher(AES(key), modes.GCM(b"\x00" * 12))
tests/hazmat/primitives/test_ciphers.py:233 test path c = ciphers.Cipher(AES(key), modes.GCM(b"\x00" * 12))
tests/hazmat/primitives/test_ciphers.py:248 test path c = ciphers.Cipher(AES(key), modes.ECB())
tests/wycheproof/test_aes.py:27 test path cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend)
tests/wycheproof/test_aes.py:63 test path enc = Cipher(algorithms.AES(key), modes.GCM(iv), backend).encryptor()
tests/wycheproof/test_aes.py:70 test path algorithms.AES(key),
tests/wycheproof/test_aes.py:79 test path algorithms.AES(key),
tests/wycheproof/test_aes.py:107 test path aesgcm = AESGCM(key)
tests/wycheproof/test_cmac.py:24 test path ctx = CMAC(AES(key), backend)
tests/wycheproof/test_cmac.py:29 test path CMAC(AES(key), backend)
tests/wycheproof/test_cmac.py:31 test path ctx = CMAC(AES(key), backend)

py.cryptography.aes

PBKDF2 Reduced margin 3 places See details

Password hashing or key derivation

A password hashing or key derivation function. Not a quantum exposure, and part of a complete inventory.

This is how passwords are stored. Quantum computers do not meaningfully weaken it.

What to do. Argon2id for new work. PBKDF2 needs a high iteration count to stay defensible.

tests/hazmat/primitives/test_pbkdf2hmac.py:20 test path kdf = PBKDF2HMAC(hashes.SHA1(), 20, b"salt", 10)
tests/hazmat/primitives/test_pbkdf2hmac_vectors.py:26 test path kdf = PBKDF2HMAC(
tests/wycheproof/test_pbkdf2.py:39 test path p = PBKDF2HMAC(

py.kdf

unknown Could not be determined 54 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

tests/hazmat/primitives/test_serialization.py:1238 test path -----BEGIN PRIVATE KEY-----
tests/hazmat/primitives/test_serialization.py:1266 test path -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/DH/dhkey_rfc5114_2.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/Ed25519/ed25519-pkcs8-enc.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/Ed448/ed448-pkcs8-enc.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/OpenSSH/dsa-nopsw.key:1 -----BEGIN OPENSSH PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/OpenSSH/dsa-psw.key:1 -----BEGIN OPENSSH PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/OpenSSH/ecdsa-nopsw.key:1 -----BEGIN OPENSSH PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/OpenSSH/ecdsa-psw.key:1 -----BEGIN OPENSSH PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/OpenSSH/ed25519-aesgcm-psw.key:1 -----BEGIN OPENSSH PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/OpenSSH/ed25519-nopsw.key:1 -----BEGIN OPENSSH PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/OpenSSH/ed25519-psw.key:1 -----BEGIN OPENSSH PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/OpenSSH/rsa-nopsw.key:1 -----BEGIN OPENSSH PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/OpenSSH/rsa-psw.key:1 -----BEGIN OPENSSH PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/OpenSSH/sk-ecdsa-nopsw.key:1 -----BEGIN OPENSSH PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/OpenSSH/sk-ecdsa-psw.key:1 -----BEGIN OPENSSH PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/OpenSSH/sk-ed25519-nopsw.key:1 -----BEGIN OPENSSH PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/OpenSSH/sk-ed25519-psw.key:1 -----BEGIN OPENSSH PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/bad-encryption-oid.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/bad-oid-dsa-key.pem:1 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/ec_private_key_encrypted.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/ed25519-scrypt.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/enc-ec-sha1-128-rc4.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/enc-rsa-3des.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/enc-rsa-pkcs8-pbkdf2-0iter.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/enc-rsa-pkcs8.pem:22 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/enc-unknown-algorithm.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/enc-unknown-kdf.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/enc-unknown-pbkdf2-prf.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/enc2-rsa-pkcs8.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/pkcs12_s2k_pem-X_9607.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/pkcs12_s2k_pem-X_9671.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/pkcs12_s2k_pem-X_9925.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/pkcs12_s2k_pem-X_9926.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/pkcs12_s2k_pem-X_9927.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/pkcs12_s2k_pem-X_9928.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/pkcs12_s2k_pem-X_9929.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/pkcs12_s2k_pem-X_9930.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/pkcs12_s2k_pem-X_9931.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/pkcs12_s2k_pem-X_9932.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/rsa-40bitrc2.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/rsa-aes-192-cbc.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/rsa-pbe-3des-long-salt.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/rsa-pbewithmd5anddescbc.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/rsa-rc2-cbc-effective-key-length.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/rsa-rc2-cbc.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/rsa_pkcs8_pbes2_pbkdf2_2048_3des_sha224.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/rsa_pkcs8_pbes2_pbkdf2_2048_3des_sha384.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/PKCS8/rsa_pkcs8_pbes2_pbkdf2_2048_3des_sha512.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/X25519/x25519-pkcs8-enc.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/asymmetric/X448/x448-pkcs8-enc.pem:1 -----BEGIN ENCRYPTED PRIVATE KEY-----
vectors/cryptography_vectors/x509/cryptography.io.chain_with_garbage.pem:67 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/x509/cryptography.io.with_garbage.pem:3 -----BEGIN PRIVATE KEY-----
vectors/cryptography_vectors/x509/cryptography.io.with_garbage.pem:45 -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

unknown Could not be determined 2 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

tests/hazmat/primitives/test_pkcs7.py:51 test path -----BEGIN CERTIFICATE-----
vectors/cryptography_vectors/x509/custom/unsupported_subject_public_key_info.pem:1 -----BEGIN CERTIFICATE-----

pem.certificate

unknown Could not be determined 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

The algorithm could not be established from the source. Usually it is selected while the program runs, but it may equally be that the call gives no clue, or that it is decided somewhere this scan does not reach. Somebody has to check.

What to do. Inventory only; a public key is not itself a secret.

vectors/cryptography_vectors/asymmetric/DH/dhpub_rfc5114_2.pem:1 -----BEGIN PUBLIC KEY-----

pem.public-key

unknown Could not be determined 1 place See details

Cryptographic library in the dependency manifest

A dependency known to implement classical asymmetric cryptography. Its presence is inventory, not a finding about this codebase: the library may never be called with a quantum-vulnerable algorithm.

The project depends on a cryptography library. Listed so the inventory is complete; it is not by itself a problem.

What to do. Check the version. Several of these libraries have shipped ML-KEM and ML-DSA support since 2024, so the migration may need an upgrade rather than a replacement.

pyproject.toml:18 name = "cryptography"

dep.crypto-library

ML-KEM-768 Quantum-safe 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

vectors/cryptography_vectors/asymmetric/MLKEM/mlkem768.pem:1 -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

CSPRNG Quantum-safe 14 places See details

Random number generation

`secrets.token_bytes()`, `os.urandom()` or `ssl.RAND_bytes()`. Recorded so the inventory names its randomness source.

This is where the software gets its random numbers. Quantum computers do not weaken it.

What to do. No action. `random.random()` is a separate, present-day defect if it reaches key material.

src/cryptography/hazmat/primitives/serialization/ssh.py:824 salt = os.urandom(16)
src/cryptography/x509/base.py:834 return int.from_bytes(os.urandom(20), "big") >> 1
tests/hazmat/primitives/test_aead.py:137 test path nonce = os.urandom(12)
tests/hazmat/primitives/test_aes.py:262 test path key = algorithms.AES(bytearray(os.urandom(32)))
tests/hazmat/primitives/test_aes_gcm.py:183 test path key = os.urandom(16)
tests/hazmat/primitives/test_chacha20.py:103 test path key = bytearray(os.urandom(32))
tests/hazmat/primitives/test_ed25519.py:263 test path private_bytes = os.urandom(32)
tests/hazmat/primitives/test_ed448.py:258 test path private_bytes = os.urandom(57)
tests/hazmat/primitives/test_keywrap.py:78 test path wrapping_key = os.urandom(32)
tests/hazmat/primitives/test_poly1305.py:58 test path poly = Poly1305(os.urandom(32))
tests/hazmat/primitives/test_x25519.py:340 test path private_bytes = bytearray(os.urandom(32))
tests/hazmat/primitives/twofactor/test_hotp.py:22 test path secret = os.urandom(10)
tests/test_cobblestone.py:69 test path plaintext = os.urandom(length)
tests/x509/test_x509.py:7183 test path sample_data = os.urandom(20)

py.rng

ML-KEM-768 Quantum-safe Renamed import 10 places See details

Post-quantum algorithm in use

`cryptography.hazmat.primitives.asymmetric.mlkem` and its ML-DSA and SLH-DSA siblings, or a call into liboqs, `pqcrypto` or `kyber`/`dilithium` bindings. The class names carry the parameter set - `MLKEM768PrivateKey` is ML-KEM-768 - so the finding names the concrete algorithm rather than the family. Recorded so the inventory shows completed migration work.

This is already a quantum-safe algorithm.

What to do. None. Confirm the parameter set matches the required NIST category.

src/cryptography/hazmat/bindings/_rust/openssl/hpke.pyi:34 mlkem_key: mlkem.MLKEM768PrivateKey,
src/cryptography/hazmat/bindings/_rust/openssl/mlkem.pyi:13 def generate_mlkem768_key() -> mlkem.MLKEM768PrivateKey: ...
src/cryptography/hazmat/primitives/asymmetric/mlkem.py:26 return rust_openssl.mlkem.from_mlkem768_public_bytes(data)
src/cryptography/hazmat/primitives/asymmetric/types.py:34 mlkem.MLKEM768PublicKey,
src/cryptography/x509/base.py:376 mlkem.MLKEM768PublicKey,
tests/hazmat/primitives/test_hpke.py:38 test path mlkem_sk = mlkem.MLKEM768PrivateKey.from_seed_bytes(expanded[:64])
tests/hazmat/primitives/test_mlkem.py:15 test path MLKEM768PrivateKey,
tests/hazmat/primitives/test_serialization.py:538 test path mlkem.MLKEM768PrivateKey,
tests/wycheproof/test_mlkem.py:10 test path MLKEM768PrivateKey,
tests/x509/test_x509.py:4115 test path mlkem.MLKEM768PrivateKey,

py.pqc

ML-DSA-44 Quantum-safe 9 places See details

Post-quantum algorithm in use

`cryptography.hazmat.primitives.asymmetric.mlkem` and its ML-DSA and SLH-DSA siblings, or a call into liboqs, `pqcrypto` or `kyber`/`dilithium` bindings. The class names carry the parameter set - `MLKEM768PrivateKey` is ML-KEM-768 - so the finding names the concrete algorithm rather than the family. Recorded so the inventory shows completed migration work.

This is already a quantum-safe algorithm.

What to do. None. Confirm the parameter set matches the required NIST category.

src/cryptography/hazmat/bindings/_rust/openssl/mldsa.pyi:8 class MLDSA44PrivateKey: ...
src/cryptography/hazmat/primitives/asymmetric/mldsa.py:15 class MLDSA44PublicKey(metaclass=abc.ABCMeta):
src/cryptography/hazmat/primitives/asymmetric/types.py:31 mldsa.MLDSA44PublicKey,
src/cryptography/x509/base.py:373 mldsa.MLDSA44PublicKey,
tests/hazmat/primitives/test_mldsa.py:24 test path MLDSA44PrivateKey,
tests/hazmat/primitives/test_serialization.py:544 test path mldsa.MLDSA44PrivateKey,
tests/wycheproof/test_mldsa.py:14 test path MLDSA44PrivateKey,
tests/x509/test_x509.py:102 test path mldsa.MLDSA44PrivateKey,
tests/x509/test_x509_crlbuilder.py:800 test path (mldsa.MLDSA44PrivateKey, SignatureAlgorithmOID.ML_DSA_44),

py.pqc

ML-DSA-65 Quantum-safe Renamed import 9 places See details

Post-quantum algorithm in use

`cryptography.hazmat.primitives.asymmetric.mlkem` and its ML-DSA and SLH-DSA siblings, or a call into liboqs, `pqcrypto` or `kyber`/`dilithium` bindings. The class names carry the parameter set - `MLKEM768PrivateKey` is ML-KEM-768 - so the finding names the concrete algorithm rather than the family. Recorded so the inventory shows completed migration work.

This is already a quantum-safe algorithm.

What to do. None. Confirm the parameter set matches the required NIST category.

src/cryptography/hazmat/bindings/_rust/openssl/mldsa.pyi:18 public_key: mldsa.MLDSA44PublicKey
src/cryptography/hazmat/primitives/asymmetric/mldsa.py:26 return rust_openssl.mldsa.from_mldsa44_public_bytes(data)
src/cryptography/hazmat/primitives/asymmetric/types.py:31 mldsa.MLDSA44PublicKey,
src/cryptography/x509/base.py:373 mldsa.MLDSA44PublicKey,
tests/hazmat/primitives/test_mldsa.py:347 test path hasher = mldsa.MLDSAMuHasher(pub, ctx)
tests/hazmat/primitives/test_serialization.py:544 test path mldsa.MLDSA44PrivateKey,
tests/wycheproof/test_mldsa.py:16 test path MLDSA65PrivateKey,
tests/x509/test_x509.py:102 test path mldsa.MLDSA44PrivateKey,
tests/x509/test_x509_crlbuilder.py:800 test path (mldsa.MLDSA44PrivateKey, SignatureAlgorithmOID.ML_DSA_44),

py.pqc

ML-KEM-1024 Quantum-safe 9 places See details

Post-quantum algorithm in use

`cryptography.hazmat.primitives.asymmetric.mlkem` and its ML-DSA and SLH-DSA siblings, or a call into liboqs, `pqcrypto` or `kyber`/`dilithium` bindings. The class names carry the parameter set - `MLKEM768PrivateKey` is ML-KEM-768 - so the finding names the concrete algorithm rather than the family. Recorded so the inventory shows completed migration work.

This is already a quantum-safe algorithm.

What to do. None. Confirm the parameter set matches the required NIST category.

src/cryptography/hazmat/bindings/_rust/openssl/hpke.pyi:49 mlkem_key: mlkem.MLKEM1024PrivateKey,
src/cryptography/hazmat/bindings/_rust/openssl/mlkem.pyi:10 class MLKEM1024PrivateKey: ...
src/cryptography/hazmat/primitives/asymmetric/mlkem.py:148 class MLKEM1024PublicKey(metaclass=abc.ABCMeta):
src/cryptography/hazmat/primitives/asymmetric/types.py:35 mlkem.MLKEM1024PublicKey,
src/cryptography/x509/base.py:377 mlkem.MLKEM1024PublicKey,
tests/hazmat/primitives/test_hpke.py:49 test path mlkem_sk = mlkem.MLKEM1024PrivateKey.from_seed_bytes(expanded[:64])
tests/hazmat/primitives/test_mlkem.py:17 test path MLKEM1024PrivateKey,
tests/wycheproof/test_mlkem.py:12 test path MLKEM1024PrivateKey,
tests/x509/test_x509.py:4136 test path mlkem.MLKEM1024PrivateKey,

py.pqc

ML-DSA-87 Quantum-safe 8 places See details

Post-quantum algorithm in use

`cryptography.hazmat.primitives.asymmetric.mlkem` and its ML-DSA and SLH-DSA siblings, or a call into liboqs, `pqcrypto` or `kyber`/`dilithium` bindings. The class names carry the parameter set - `MLKEM768PrivateKey` is ML-KEM-768 - so the finding names the concrete algorithm rather than the family. Recorded so the inventory shows completed migration work.

This is already a quantum-safe algorithm.

What to do. None. Confirm the parameter set matches the required NIST category.

src/cryptography/hazmat/bindings/_rust/openssl/mldsa.pyi:12 class MLDSA87PrivateKey: ...
src/cryptography/hazmat/primitives/asymmetric/mldsa.py:343 class MLDSA87PublicKey(metaclass=abc.ABCMeta):
src/cryptography/hazmat/primitives/asymmetric/types.py:33 mldsa.MLDSA87PublicKey,
src/cryptography/x509/base.py:375 mldsa.MLDSA87PublicKey,
tests/hazmat/primitives/test_mldsa.py:28 test path MLDSA87PrivateKey,
tests/wycheproof/test_mldsa.py:18 test path MLDSA87PrivateKey,
tests/x509/test_x509.py:104 test path mldsa.MLDSA87PrivateKey,
tests/x509/test_x509_crlbuilder.py:802 test path (mldsa.MLDSA87PrivateKey, SignatureAlgorithmOID.ML_DSA_87),

py.pqc

HMAC Quantum-safe 7 places See details

Keyed hash in use

`hmac.new()` or `hmac.digest()`. Not broken by Shor and only marginally affected by Grover. Recorded so the inventory is complete.

This is a fingerprint proving a message was not altered. Quantum computers do not break it.

What to do. No action, unless the digest is MD5 or SHA-1.

src/cryptography/hazmat/bindings/_rust/openssl/hmac.pyi:10 class HMAC(hashes.HashContext):
src/cryptography/hazmat/primitives/twofactor/hotp.py:83 ctx = hmac.HMAC(self._key, self._algorithm)
tests/bench/test_hmac.py:10 test path h = hmac.HMAC(b"my extremely secure key", hashes.SHA256())
tests/hazmat/primitives/test_hmac.py:35 test path h = hmac.HMAC(b"mykey", hashes.SHA1())
tests/hazmat/primitives/test_hmac_vectors.py:82 test path h = hmac.HMAC(b"0" * 64, hashes.BLAKE2b(digest_size=64))
tests/hazmat/primitives/utils.py:239 test path h = hmac.HMAC(binascii.unhexlify(key), algorithm)
tests/wycheproof/test_hmac.py:45 test path h = hmac.HMAC(

py.hmac

ML-DSA-44 Quantum-safe 3 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

src/cryptography/hazmat/_oid.py:293 SignatureAlgorithmOID.ML_DSA_44: "ML-DSA-44",
tests/hazmat/primitives/test_mldsa.py:60 test path id="ML-DSA-44",
tests/wycheproof/test_mldsa.py:178 test path "ML-DSA-44": MLDSA44PublicKey,

jose.algorithm · CWE-327

ML-DSA-65 Quantum-safe 3 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

src/cryptography/hazmat/_oid.py:294 SignatureAlgorithmOID.ML_DSA_65: "ML-DSA-65",
tests/hazmat/primitives/test_mldsa.py:71 test path id="ML-DSA-65",
tests/wycheproof/test_mldsa.py:179 test path "ML-DSA-65": MLDSA65PublicKey,

jose.algorithm · CWE-327

ML-DSA-87 Quantum-safe 3 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

src/cryptography/hazmat/_oid.py:295 SignatureAlgorithmOID.ML_DSA_87: "ML-DSA-87",
tests/hazmat/primitives/test_mldsa.py:82 test path id="ML-DSA-87",
tests/wycheproof/test_mldsa.py:180 test path "ML-DSA-87": MLDSA87PublicKey,

jose.algorithm · CWE-327

Argon2 Quantum-safe 1 place See details

Password hashing or key derivation

A password hashing or key derivation function. Not a quantum exposure, and part of a complete inventory.

This is how passwords are stored. Quantum computers do not meaningfully weaken it.

What to do. Argon2id for new work. PBKDF2 needs a high iteration count to stay defensible.

tests/hazmat/primitives/test_argon2.py:43 test path Argon2id(

py.kdf

HKDF Quantum-safe 1 place See details

Password hashing or key derivation

`golang.org/x/crypto/bcrypt`, `scrypt`, `argon2` or `pbkdf2`. Not a quantum exposure, and part of a complete inventory.

This is how passwords are stored. Quantum computers do not meaningfully weaken it.

What to do. Argon2id for new work.

docs/development/custom-vectors/hkdf/verify_hkdf.go:26 hkdf := hkdf.New(hash, ikm, nil, nil)

go.kdf

SHA-384 Quantum-safe 1 place See details

Mask-generation digest named for RSA padding

`MGF1ParameterSpec.SHA256` names the digest inside RSA-OAEP and RSA-PSS padding. It is a separate choice from the digest the signature or the cipher uses, it is frequently left at SHA-1 by default, and a static import of it - `import static java.security.spec.MGF1ParameterSpec.SHA512` - is the only place the choice appears in the file that makes it.

This picks the hash used inside RSA padding. It matters because the default is often SHA-1, which is broken today without any quantum computer.

What to do. The mask-generation digest travels with the RSA key it pads. When that key moves to ML-KEM or ML-DSA the padding goes with it; until then, SHA-256 or better.

docs/development/custom-vectors/rsa-oaep-sha2/VerifyRSAOAEPSHA2.java:305 mgf1 = MGF1ParameterSpec.SHA384;

java.mgf1 · CWE-327

SHA-512 Quantum-safe 1 place See details

Mask-generation digest named for RSA padding

`MGF1ParameterSpec.SHA256` names the digest inside RSA-OAEP and RSA-PSS padding. It is a separate choice from the digest the signature or the cipher uses, it is frequently left at SHA-1 by default, and a static import of it - `import static java.security.spec.MGF1ParameterSpec.SHA512` - is the only place the choice appears in the file that makes it.

This picks the hash used inside RSA padding. It matters because the default is often SHA-1, which is broken today without any quantum computer.

What to do. The mask-generation digest travels with the RSA key it pads. When that key moves to ML-KEM or ML-DSA the padding goes with it; until then, SHA-256 or better.

docs/development/custom-vectors/rsa-oaep-sha2/VerifyRSAOAEPSHA2.java:309 mgf1 = MGF1ParameterSpec.SHA512;

java.mgf1 · CWE-327

SHA-512 Quantum-safe 1 place See details

Hash function in use

`hashlib.sha256()` and friends. The digest is read from the call, so SHA-384 and above are inventory while the broken ones are reported separately.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something long-lived.

tests/wycheproof/test_cobblestone.py:43 test path hashlib.sha512(msg).hexdigest() == wycheproof.testcase["msgSha512"]

py.hashlib

scrypt Quantum-safe 1 place See details

Password hashing or key derivation

A password hashing or key derivation function. Not a quantum exposure, and part of a complete inventory.

This is how passwords are stored. Quantum computers do not meaningfully weaken it.

What to do. Argon2id for new work. PBKDF2 needs a high iteration count to stay defensible.

tests/hazmat/primitives/test_scrypt.py:60 test path Scrypt(b"NaCl", 64, 1024, 8, 16)

py.kdf

Library	Files
crypto/rc4 RC4, prohibited in TLS by RFC 7465	1
cryptography pyca/cryptography	206
ecdsa pure-Python elliptic-curve signatures	1
org.bouncycastle BouncyCastle, whose low-level API bypasses the JCA algorithm strings. It has shipped ML-KEM and ML-DSA since 1.79	1
hashlib the standard digests, including the broken ones	6
crypto/cipher block-cipher modes	3
crypto/sha256 the SHA-2 digests	1
java.security the JCA	1
golang.org/x/crypto/hkdf key derivation from a shared secret	1
hmac keyed message authentication	1
bcrypt password hashing	1

Algorithm	Assessment	What it means	Occurrences
`RSA`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer.	637
`ECDSA`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer.	240
`AES`	Reduced margin	Grover's algorithm halves the effective strength; the parameter, not the design, is the problem. The key size was not visible at this call site, so the weaker case is assumed.	110
`Ed25519`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer.	97
`RSAES-PKCS1v15`	Already broken	PKCS#1 v1.5 encryption padding is vulnerable to Bleichenbacher oracles today, and the underlying RSA is broken by Shor.	80
`unknown`	Could not be determined	The algorithm could not be established from the source - chosen at runtime, or decided somewhere this scan does not reach.	59
`X25519`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer.	57
`DSA`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer.	47
`DH`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer.	43
`RSA-OAEP`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer.	43
`3DES`	Already broken	Triple DES is withdrawn by NIST and limited by its 64-bit block, independent of quantum.	23
`RSASSA-PKCS1v15`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both.	21
`EdDSA`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer.	18
`CSPRNG`	Quantum-safe	A cryptographically secure random number generator provided by the platform. Not weakened by a quantum computer.	14
`RSA-1024`	Already broken	A modulus of 1024 bits or less is below the NIST SP 800-57 floor and is within reach of classical factorisation. Shor is not the nearest problem here.	13
`ECDH`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer.	12
`ML-DSA-44`	Quantum-safe	No known quantum algorithm changes the security margin.	12
`ML-DSA-65`	Quantum-safe	No known quantum algorithm changes the security margin.	12
`ML-DSA-87`	Quantum-safe	No known quantum algorithm changes the security margin.	11
`ML-KEM-768`	Quantum-safe	No known quantum algorithm changes the security margin.	11
`RC4`	Already broken	RC4 keystream biases break it classically; it is prohibited in TLS by RFC 7465.	9
`ML-KEM-1024`	Quantum-safe	No known quantum algorithm changes the security margin.	9
`HMAC`	Quantum-safe	A keyed MAC is not affected by Shor and only marginally by Grover.	8
`SHA-256`	Reduced margin	Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades.	8
`RSA-PSS`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer.	7
`X448`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer.	3
`PBKDF2`	Reduced margin	Not broken by a quantum computer, but weak against modern GPU cracking at low iteration counts, which is a present-day concern.	3
`HKDF`	Quantum-safe	No known quantum algorithm changes the security margin.	2
`SHA-1`	Already broken	SHAttered and subsequent work produced practical collisions; NIST withdrew SHA-1 in 2030 guidance and it is already unacceptable for signatures.	2
`SHA-512`	Quantum-safe	No known quantum algorithm changes the security margin.	2
`Argon2`	Quantum-safe	The current recommended password hashing function. Not affected by Shor, and memory-hard against Grover.	1
`bcrypt`	Quantum-safe	A password hashing function. Grover offers only a marginal speed-up against a deliberately slow function, so quantum computing is not the concern here.	1
`scrypt`	Quantum-safe	No known quantum algorithm changes the security margin.	1
`SHA-224`	Reduced margin	Grover's algorithm halves the effective strength; the parameter, not the design, is the problem.	1
`SHA-384`	Quantum-safe	No known quantum algorithm changes the security margin.	1

pyca/cryptography

List of cryptographic assets

PKCS#1 v1.5 padding

Withdrawn symmetric cipher

X.509 certificate

Withdrawn symmetric cipher

Withdrawn symmetric cipher

Private key committed to the repository

Public key file

Certificate signing request

X.509 certificate

Mask-generation digest named for RSA padding

Broken hash function

RSA key generated with pyca/cryptography

X.509 certificate

Elliptic-curve key generated with pyca/cryptography

X25519 key agreement

Ed25519 signing key

SSH algorithms pinned in configuration

RSA-OAEP encryption padding

Finite-field Diffie-Hellman

Private key committed to the repository

Public key file

SSH algorithms pinned in configuration

Elliptic-curve key generated with pyca/cryptography

SSH algorithms pinned in configuration

Private key committed to the repository

DSA signing key

JOSE algorithm declared in configuration

JOSE algorithm declared in configuration

X.509 certificate

Certificate signing request

SSH algorithms pinned in configuration

ECDH key agreement

Private key committed to the repository

SSH public key

X.509 certificate

SSH public key

SSH public key

Private key committed to the repository

SSH public key

Elliptic-curve key generated with pyca/cryptography

Elliptic-curve key generated with pyca/cryptography

Classical public-key cipher through the JCA

Private key committed to the repository

Public key file

Elliptic-curve key generated with pyca/cryptography

Public key file

RSA key generated with pyca/cryptography

Public key file

Private key committed to the repository

Public key file

X.509 certificate

SSH public key

Private key committed to the repository

Certificate signing request

Public key file

X.509 certificate

Public key file

X.509 certificate

X.509 certificate

Public key file

Public key file

Certificate signing request

SSH public key

Private key committed to the repository

Public key file

Private key committed to the repository

Public key file

Public key file

Private key committed to the repository

Public key file

X.509 certificate

X.509 certificate

Certificate signing request

Private key committed to the repository

Private key committed to the repository

Classical key material handled through the JCA

Public key file

Private key committed to the repository