Crypto-View

panva/jose

Cryptographic posture

1775 cryptographic locations: 1 already broken, 575 quantum-vulnerable, 457 reduced-margin, 36 undetermined, 706 quantum-safe

196 establish keys, so traffic protected by them and recorded today becomes readable once the algorithm falls. 342 files analysed.

Quantum-vulnerable 575 Already broken 1 Reduced margin 457 Could not be determined 36 Quantum-safe 706
To address602
Key establishment196
Inventory only0
Total findings1775
What was analysed
Branch main
Commit 55c959fd16852462498b0d82c52c4eca07d48f26 ci: use gh run rerun for retries
Committed 2026-09-14 08:22 UTC
Scanned 2026-09-21 10:58 UTC 9 hours ago
Coverage 342 files, 139 javascript

List of cryptographic assets

RSAES-PKCS1v15 Already broken Recorded traffic 1 place See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

This is already unsafe today, with no quantum computer involved. PKCS#1 v1.5 encryption padding is vulnerable to Bleichenbacher oracles today, and the underlying RSA is broken by Shor.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. tap/env.ts:59 case 'RSA1_5':
jose.algorithm · CWE-327
ECDSA Quantum-vulnerable 113 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jws.mjs:158 alg: 'ES512',
  2. cookbook/jws.mjs:162 alg: 'ES512',
  3. src/key/generate_key_pair.ts:29 | 'ES256'
  4. src/key/generate_key_pair.ts:30 | 'ES384'
  5. src/key/generate_key_pair.ts:31 | 'ES512'
  6. src/types.d.ts:18 | 'ES256'
  7. src/types.d.ts:19 | 'ES384'
  8. src/types.d.ts:20 | 'ES512'
  9. tap/general.ts:45 const a = await keys.generateKeyPair('ES256', { extractable: true })
  10. tap/general.ts:50 .setProtectedHeader({ alg: 'ES256' })
  11. tap/generate_options.ts:23 const kp = await lib.generateKeyPair('ES256', { extractable })
  12. tap/jwk.ts:23 ['ES256', KEYS.P256.jwk],
  13. tap/jwk.ts:24 ['ES384', KEYS.P384.jwk],
  14. tap/jwk.ts:25 ['ES512', KEYS.P521.jwk],
  15. tap/jwks.ts:195 await JWKS({ alg: 'ES256' })
  16. tap/jws.ts:17 'ES256',
  17. tap/jws.ts:18 'ES384',
  18. tap/jws.ts:19 'ES512',
  19. tap/keyobject-stub.ts:84 case 'ES256':
  20. tap/keyobject-stub.ts:86 case 'ES384':
  21. tap/keyobject-stub.ts:88 case 'ES512':
  22. tap/pem.ts:20 ['ES256', KEYS.P256.pkcs8],
  23. tap/pem.ts:21 ['ES256', KEYS.P256.spki],
  24. tap/pem.ts:22 ['ES256', KEYS.P256.x509],
  25. tap/pem.ts:23 ['ES384', KEYS.P384.pkcs8],
  26. tap/pem.ts:24 ['ES384', KEYS.P384.spki],
  27. tap/pem.ts:25 ['ES384', KEYS.P384.x509],
  28. tap/pem.ts:26 ['ES512', KEYS.P521.pkcs8],
  29. tap/pem.ts:27 ['ES512', KEYS.P521.spki],
  30. tap/pem.ts:28 ['ES512', KEYS.P521.x509],
  31. test-d/api.ts:101 test path const _toString: string = 'ES256' satisfies jose.JWSAlgorithm
  32. test-d/api.ts:102 test path const _list: jose.JWSAlgorithm[] = [anyString, 'ES256']
  33. test-d/api.ts:103 test path const _opts: jose.VerifyOptions = { algorithms: [anyString, 'ES256'] }
  34. test-d/api.ts:127 test path alg: 'ES256',
  35. test-d/api.ts:131 test path alg: 'ES256',
  36. test-d/api.ts:284 test path const ec = await jose.importJWK({ kty: 'EC', crv: 'P-256', x: 'x', y: 'y' }, 'ES256')
  37. test-d/api.ts:285 test path const parsed = await jose.importJWK(JSON.parse('{}'), 'ES256')
  38. test-d/api.ts:286 test path const unknownKty = await jose.importJWK(typed, 'ES256')
  39. test-d/api.ts:298 test path const _kpLiteral: jose.GenerateKeyPairAlgorithm = 'ES256'
  40. test/jwk/embedded.test.ts:23 test path alg: 'ES256',
  41. test/jwk/embedded.test.ts:35 test path .setProtectedHeader({ alg: 'ES256', jwk: pubjwk(t.context.key) })
  42. test/jwk/embedded.test.ts:40 test path .setProtectedHeader({ alg: 'ES256' })
  43. test/jwk/embedded.test.ts:45 test path .setProtectedHeader({ alg: 'ES256', jwk: null })
  44. test/jwk/embedded.test.ts:50 test path .setProtectedHeader({ alg: 'ES256', jwk: t.context.key })
  45. test/jwk/embedded.test.ts:83 test path await t.throwsAsync(EmbeddedJWK({ alg: 'ES256', jwk }), {
  46. test/jwk/embedded.test.ts:91 test path await t.throwsAsync(EmbeddedJWK({ alg: 'ES256', jwk }), {
  47. test/jwk/embedded.test.ts:99 test path ['alg', 'ES256', 'ECDH-ES'],
  48. test/jwk/embedded.test.ts:110 test path await t.notThrowsAsync(EmbeddedJWK({ alg: 'ES256', jwk }))
  49. test/jwk/embedded.test.ts:117 test path EmbeddedJWK({ alg: 'ES256', jwk: { ...pubjwk(t.context.key), ext: 'false' as never } }),
  50. test/jwk/embedded.test.ts:128 test path for (const alg of [['ES256'], { toString: () => 'ES256' }, undefined]) {
  51. test/jwk/generate_key_pair.test.ts:6 test path await t.throwsAsync(generateKeyPair(['ES256'] as any), {
  52. test/jwk/generate_key_pair.test.ts:30 test path await t.throwsAsync(generateKeyPair('ES256', { extractable: 'false' as never }), {
  53. test/jwk/generate_key_pair.test.ts:40 test path async (options) => (await generateKeyPair('ES256', options)).privateKey,
  54. test/jwk/generate_key_pair.test.ts:59 test path ['ES256', 'P-521', 'P-256'],
  55. test/jwk/generate_key_pair.test.ts:60 test path ['ES384', 'P-256', 'P-384'],
  56. test/jwk/generate_key_pair.test.ts:61 test path ['ES512', 'P-256', 'P-521'],
  57. test/jwk/generate_key_pair.test.ts:74 test path ['ES256', 'P-256'],
  58. test/jwk/generate_key_pair.test.ts:75 test path ['ES384', 'P-384'],
  59. test/jwk/generate_key_pair.test.ts:76 test path ['ES512', 'P-521'],
  60. test/jwk/generate_key_pair.test.ts:86 test path ['ES256', 'P-256'],
  61. test/jwk/generate_key_pair.test.ts:87 test path ['ES512', 'P-521'],
  62. test/jwk/import.test.ts:14 test path const { privateKey, publicKey } = await generateKeyPair('ES256', { extractable: true })
  63. test/jwk/import.test.ts:29 test path const { privateKey } = await generateKeyPair('ES256', { extractable: true })
  64. test/jwk/import.test.ts:33 test path await t.throwsAsync(importPKCS8(pkcs8, 'ES256', { extractable: 'false' as never }), {
  65. test/jwk/import.test.ts:36 test path await t.throwsAsync(importJWK(jwk, 'ES256', { extractable: 'false' as never }), {
  66. test/jwk/import.test.ts:42 test path const { privateKey, publicKey } = await generateKeyPair('ES256', { extractable: true })
  67. test/jwk/import.test.ts:47 test path (options) => importPKCS8(pkcs8, 'ES256', options),
  68. test/jwk/import.test.ts:48 test path (options) => importJWK(jwk, 'ES256', options),
  69. test/jwk/jwk2key.test.ts:31 test path await t.notThrowsAsync(importJWK(nullPrototype, 'ES256'))
  70. test/jwk/jwk2key.test.ts:44 test path alg: ['ES256'],
  71. test/jwk/jwk2key.test.ts:134 test path 'ES256',
  72. test/jwk/jwk2key.test.ts:164 test path 'ES256',
  73. test/jwk/key_input.test.ts:18 test path const { privateKey, publicKey } = await generateKeyPair('ES256', { extractable: true })
  74. test/jwk/key_input.test.ts:45 test path firstPending = new CompactSign(payload).setProtectedHeader({ alg: 'ES256' }).sign(jwk)
  75. test/jwk/key_input.test.ts:55 test path const second = await new CompactSign(payload).setProtectedHeader({ alg: 'ES256' }).sign(jwk)
  76. test/jwk/key_input.test.ts:110 test path const { privateKey, publicKey } = await generateKeyPair('ES256', { extractable: true })
  77. test/jwk/key_input.test.ts:113 test path .setProtectedHeader({ alg: 'ES256' })
  78. test/jwk/key_input.test.ts:310 test path .setProtectedHeader({ alg: 'ES256' })
  79. test/jwks/local.test.ts:68 test path await t.throwsAsync(set({ alg: 'ES256' }), {
  80. test/jwks/local.test.ts:87 test path await t.throwsAsync(set({ alg: 'ES256' }), {
  81. test/jwks/local.test.ts:105 test path await t.throwsAsync(set({ alg: 'ES256', kid: 0 as never }), {
  82. test/jwks/local.test.ts:134 test path await t.throwsAsync(set({ alg: 'ES256' }), {
  83. test/jwks/local.test.ts:155 test path await t.throwsAsync(set({ alg: 'ES256', kid: 'inherited' }), {
  84. test/jwks/local.test.ts:167 test path const first = await exportJWK((await generateKeyPair('ES256')).publicKey)
  85. test/jwks/local.test.ts:168 test path const second = await exportJWK((await generateKeyPair('ES256')).publicKey)
  86. test/jwks/local.test.ts:185 test path const error = await t.throwsAsync(set({ alg: 'ES256' }), {
  87. test/jwks/local.test.ts:193 test path t.is(await set({ alg: 'ES256', kid: 'first' }), keys[0])
  88. test/jwks/local.test.ts:194 test path t.is(await set({ alg: 'ES256', kid: 'second' }), keys[1])
  89. test/jwks/local.test.ts:199 test path const key = await exportJWK((await generateKeyPair('ES256')).publicKey)
  90. test/jwks/local.test.ts:202 test path const keys = await Promise.all(Array.from({ length: 16 }, () => set({ alg: 'ES256' })))
  91. test/jwks/local.test.ts:206 test path t.is(await set({ alg: 'ES256' }), keys[0])
  92. test/jwks/local.test.ts:211 test path const key = await exportJWK((await generateKeyPair('ES256')).publicKey)
  93. test/jwks/local.test.ts:215 test path const results = await Promise.allSettled(Array.from({ length: 16 }, () => set({ alg: 'ES256' })))
  94. test/jwks/local.test.ts:219 test path const keys = await Promise.all(Array.from({ length: 16 }, () => set({ alg: 'ES256' })))
  95. test/jwks/local.test.ts:222 test path t.is(await set({ alg: 'ES256' }), keys[0])
  96. test/jwks/local.test.ts:258 test path await t.throwsAsync(privateKeySet({ alg: 'ES256' }), {
  97. test/jwks/remote.test.ts:196 test path const key = await importJWK({ ...jwk, alg: 'ES256' })
  98. test/jwks/remote.test.ts:197 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'ES256' }).sign(key)
  99. test/jwks/remote.test.ts:228 test path const key = await importJWK({ ...jwk, alg: 'ES256' })
  100. test/jwks/remote.test.ts:230 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'ES256', kid: 'one' }).sign(key)
  101. test/jwks/remote.test.ts:235 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'ES256', kid: 'two' }).sign(key)
  102. test/jwks/remote.test.ts:278 test path const key = await importJWK({ ...jwk, alg: 'ES256' })
  103. test/jwks/remote.test.ts:280 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'ES256', kid: 'two' }).sign(key)
  104. test/jwks/remote.test.ts:393 test path const key = await importJWK({ ...jwk, alg: 'ES256' })
  105. test/jwks/remote.test.ts:395 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'ES256', kid: 'one' }).sign(key)
  106. test/jwks/remote.test.ts:428 test path const key = await importJWK({ ...jwk, alg: 'ES256' })
  107. test/jwks/remote.test.ts:430 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'ES256', kid: 'one' }).sign(key)
  108. test/jws/restrictions.test.ts:121 test path test(testECDSASigEncoding, 'ES256')
  109. test/jws/restrictions.test.ts:122 test path test(testECDSASigEncoding, 'ES384')
  110. test/jws/restrictions.test.ts:123 test path test(testECDSASigEncoding, 'ES512')
  111. test/root_facades.test.ts:48 test path 'ES256',
  112. test/root_facades.test.ts:49 test path 'ES384',
  113. test/root_facades.test.ts:50 test path 'ES512',
jose.algorithm · CWE-327
ECDH Quantum-vulnerable Recorded traffic 90 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jwe.mjs:138 alg: 'ECDH-ES+A128KW',
  2. cookbook/jwe.mjs:156 alg: 'ECDH-ES+A128KW',
  3. cookbook/jwe.mjs:210 alg: 'ECDH-ES',
  4. cookbook/jwe.mjs:228 alg: 'ECDH-ES',
  5. src/key/generate_key_pair.ts:37 | 'ECDH-ES'
  6. src/key/generate_key_pair.ts:38 | 'ECDH-ES+A128KW'
  7. src/key/generate_key_pair.ts:39 | 'ECDH-ES+A192KW'
  8. src/key/generate_key_pair.ts:40 | 'ECDH-ES+A256KW'
  9. src/lib/jwe_algorithms.ts:132 'ECDH-ES': ecdh('direct-key-agreement'),
  10. src/lib/jwe_algorithms.ts:133 'ECDH-ES+A128KW': ecdh('key-agreement-with-key-wrapping'),
  11. src/lib/jwe_algorithms.ts:134 'ECDH-ES+A192KW': ecdh('key-agreement-with-key-wrapping'),
  12. src/lib/jwe_algorithms.ts:135 'ECDH-ES+A256KW': ecdh('key-agreement-with-key-wrapping'),
  13. src/types.d.ts:43 | 'ECDH-ES'
  14. src/types.d.ts:44 | 'ECDH-ES+A128KW'
  15. src/types.d.ts:45 | 'ECDH-ES+A192KW'
  16. src/types.d.ts:46 | 'ECDH-ES+A256KW'
  17. tap/ecdh.ts:18 ['ECDH-ES', { crv: 'P-256' }],
  18. tap/ecdh.ts:19 ['ECDH-ES', { crv: 'P-384' }],
  19. tap/ecdh.ts:20 ['ECDH-ES', { crv: 'P-521' }],
  20. tap/ecdh.ts:21 ['ECDH-ES', { crv: 'X25519' }],
  21. tap/env.ts:105 case 'ECDH-ES+A128KW':
  22. tap/env.ts:106 case 'ECDH-ES+A192KW':
  23. tap/env.ts:107 case 'ECDH-ES+A256KW':
  24. tap/jwk.ts:17 ['ECDH-ES', KEYS.P256.jwk],
  25. tap/jwk.ts:18 ['ECDH-ES', KEYS.P384.jwk],
  26. tap/jwk.ts:19 ['ECDH-ES', KEYS.P521.jwk],
  27. tap/jwk.ts:20 ['ECDH-ES', KEYS.X25519.jwk],
  28. tap/jwk.ts:56 if (alg === 'EdDSA' || alg === 'ECDH-ES') {
  29. tap/keyobject-stub.ts:93 case 'ECDH-ES':
  30. tap/keyobject-stub.ts:94 case 'ECDH-ES+A128KW':
  31. tap/keyobject-stub.ts:95 case 'ECDH-ES+A192KW':
  32. tap/keyobject-stub.ts:96 case 'ECDH-ES+A256KW': {
  33. tap/pem.ts:59 [['ECDH-ES', 'P-256'], KEYS.P256.pkcs8],
  34. tap/pem.ts:60 [['ECDH-ES', 'P-256'], KEYS.P256.spki],
  35. tap/pem.ts:61 [['ECDH-ES', 'P-256'], KEYS.P256.x509],
  36. tap/pem.ts:62 [['ECDH-ES', 'P-384'], KEYS.P384.pkcs8],
  37. tap/pem.ts:63 [['ECDH-ES', 'P-384'], KEYS.P384.spki],
  38. tap/pem.ts:64 [['ECDH-ES', 'P-384'], KEYS.P384.x509],
  39. tap/pem.ts:65 [['ECDH-ES', 'P-521'], KEYS.P521.pkcs8],
  40. tap/pem.ts:66 [['ECDH-ES', 'P-521'], KEYS.P521.spki],
  41. tap/pem.ts:67 [['ECDH-ES', 'P-521'], KEYS.P521.x509],
  42. tap/pem.ts:68 [['ECDH-ES', 'X25519'], KEYS.X25519.pkcs8],
  43. tap/pem.ts:69 [['ECDH-ES', 'X25519'], KEYS.X25519.spki],
  44. test/jwe/compact.encrypt.test.ts:165 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  45. test/jwe/compact.encrypt.test.ts:176 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  46. test/jwe/compact.encrypt.test.ts:194 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  47. test/jwe/flattened.decrypt.test.ts:217 test path const { privateKey } = await generateKeyPair('ECDH-ES', { crv: 'P-256' })
  48. test/jwe/flattened.decrypt.test.ts:219 test path protected: base64url.encode(JSON.stringify({ alg: 'ECDH-ES+A128KW', enc: 'A128GCM' })),
  49. test/jwe/flattened.decrypt.test.ts:232 test path const { privateKey, publicKey } = await generateKeyPair('ECDH-ES', { crv: 'P-256' })
  50. test/jwe/flattened.decrypt.test.ts:234 test path .setProtectedHeader({ alg: 'ECDH-ES+A128KW', enc: 'A128GCM' })
  51. test/jwe/flattened.encrypt.test.ts:398 test path const { publicKey } = await generateKeyPair('ECDH-ES')
  52. test/jwe/flattened.encrypt.test.ts:403 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  53. test/jwe/flattened.encrypt.test.ts:412 test path const { publicKey } = await generateKeyPair('ECDH-ES')
  54. test/jwe/flattened.encrypt.test.ts:415 test path for (const alg of ['ECDH-ES', 'ECDH-ES+A128KW'] as const) {
  55. test/jwe/flattened.encrypt.test.ts:430 test path const { privateKey, publicKey } = await generateKeyPair('ECDH-ES')
  56. test/jwe/flattened.encrypt.test.ts:434 test path for (const alg of ['ECDH-ES', 'ECDH-ES+A128KW'] as const) {
  57. test/jwe/flattened.encrypt.test.ts:463 test path const { publicKey } = await generateKeyPair('ECDH-ES')
  58. test/jwe/flattened.encrypt.test.ts:467 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  59. test/jwe/flattened.encrypt.test.ts:487 test path const { publicKey } = await generateKeyPair('ECDH-ES')
  60. test/jwe/flattened.encrypt.test.ts:492 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  61. test/jwe/flattened.encrypt.test.ts:507 test path const recipient = await generateKeyPair('ECDH-ES', { crv })
  62. test/jwe/flattened.encrypt.test.ts:512 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  63. test/jwe/flattened.encrypt.test.ts:542 test path const { publicKey } = await generateKeyPair('ECDH-ES')
  64. test/jwe/flattened.encrypt.test.ts:549 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  65. test/jwe/general.test.ts:347 test path const kp = await generateKeyPair('ECDH-ES')
  66. test/jwe/general.test.ts:351 test path .setSharedUnprotectedHeader({ alg: 'ECDH-ES' })
  67. test/jwe/general.test.ts:481 test path recipients: [perRecipient.recipients[0], { header: { alg: 'ECDH-ES' } }],
  68. test/jwe/general.test.ts:486 test path message: '"ECDH-ES" alg may only have a single recipient',
  69. test/jwe/general.test.ts:663 test path const { privateKey, publicKey } = await generateKeyPair('ECDH-ES', { extractable: true })
  70. test/jwe/general.test.ts:670 test path .setUnprotectedHeader({ alg: 'ECDH-ES+A256KW' })
  71. test/jwk/embedded.test.ts:89 test path const jwk = { ...pubjwk(t.context.key), alg: 'ECDH-ES' }
  72. test/jwk/embedded.test.ts:99 test path ['alg', 'ES256', 'ECDH-ES'],
  73. test/jwk/generate_key_pair.test.ts:95 test path const { publicKey } = await generateKeyPair('ECDH-ES', { crv: 'P-384', extractable: true })
  74. test/jwk/generate_key_pair.test.ts:98 test path await t.throwsAsync(generateKeyPair('ECDH-ES', { crv: 'Ed25519' }), {
  75. test/jwk/key_input.test.ts:187 test path const ecdh = await generateKeyPair('ECDH-ES')
  76. test/jwk/key_input.test.ts:189 test path new CompactEncrypt(payload).setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' }).encrypt(key)
  77. test/jwk/key_input.test.ts:261 test path const { privateKey, publicKey } = await generateKeyPair('ECDH-ES', { extractable: true })
  78. test/jwk/key_input.test.ts:266 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  79. test/root_facades.test.ts:64 test path 'ECDH-ES',
  80. test/root_facades.test.ts:65 test path 'ECDH-ES+A128KW',
  81. test/root_facades.test.ts:66 test path 'ECDH-ES+A192KW',
  82. test/root_facades.test.ts:67 test path 'ECDH-ES+A256KW',
  83. test/root_facades.test.ts:191 test path const transportsCek = keyManagementAlgorithm !== 'dir' && keyManagementAlgorithm !== 'ECDH-ES'
  84. test/root_facades.test.ts:359 test path for (const algorithm of ['A256KW', 'RSA-OAEP-256', 'ECDH-ES+A256KW'] as const) {
  85. test/root_facades.test.ts:388 test path for (const algorithm of ['dir', 'ECDH-ES', 'A256KW', 'RSA-OAEP-256', 'ECDH-ES+A256KW'] as const) {
  86. test/root_facades.test.ts:394 test path algorithm === 'dir' || algorithm === 'ECDH-ES'
  87. test/root_facades.test.ts:408 test path for (const algorithm of ['A256KW', 'RSA-OAEP-256', 'ECDH-ES+A256KW'] as const) {
  88. test/root_facades.test.ts:440 test path const { publicKey } = await generateKeyPair('ECDH-ES')
  89. test/root_facades.test.ts:443 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A256GCM' })
  90. test/root_facades.test.ts:449 test path message: '"ECDH-ES" alg may only have a single recipient',
jose.algorithm · CWE-327
RSASSA-PKCS1v15 Quantum-vulnerable 67 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jws.mjs:22 alg: 'RS256',
  2. cookbook/jws.mjs:26 alg: 'RS256',
  3. src/key/generate_key_pair.ts:22 | 'RS256'
  4. src/key/generate_key_pair.ts:23 | 'RS384'
  5. src/key/generate_key_pair.ts:24 | 'RS512'
  6. src/types.d.ts:12 | 'RS256'
  7. src/types.d.ts:13 | 'RS384'
  8. src/types.d.ts:14 | 'RS512'
  9. tap/generate_options.ts:32 const { publicKey } = (await lib.generateKeyPair('RS256', {
  10. tap/jwk.ts:29 ['RS256', KEYS.RSA.jwk],
  11. tap/jwk.ts:30 ['RS384', KEYS.RSA.jwk],
  12. tap/jwk.ts:31 ['RS512', KEYS.RSA.jwk],
  13. tap/jwks.ts:19 await t.rejects(jwks({ alg: 'RS256' }), 'multiple matching keys found in the JSON Web Key Set')
  14. tap/jwks.ts:21 jwks({ kid: 'foo', alg: 'RS256' }),
  15. tap/jwks.ts:55 alg: 'RS256',
  16. tap/jwks.ts:78 alg: 'RS256',
  17. tap/jwks.ts:92 alg: 'RS256',
  18. tap/jwks.ts:99 alg: 'RS256',
  19. tap/jwks.ts:162 JWKS({ alg: 'RS256' }),
  20. tap/jwks.ts:167 let error = (await JWKS({ alg: 'RS256' }).catch(
  21. tap/jwks.ts:176 error = (await JWKS({ alg: 'RS256' }).catch(
  22. tap/jws.ts:23 'RS256',
  23. tap/jws.ts:24 'RS384',
  24. tap/jws.ts:25 'RS512',
  25. tap/keyobject-stub.ts:67 case 'RS256':
  26. tap/keyobject-stub.ts:68 case 'RS384':
  27. tap/keyobject-stub.ts:69 case 'RS512':
  28. tap/pem.ts:38 ['RS256', KEYS.RSA.pkcs8],
  29. tap/pem.ts:39 ['RS256', KEYS.RSA.spki],
  30. tap/pem.ts:40 ['RS256', KEYS.RSA.x509],
  31. tap/pem.ts:41 ['RS384', KEYS.RSA.pkcs8],
  32. tap/pem.ts:42 ['RS384', KEYS.RSA.spki],
  33. tap/pem.ts:43 ['RS384', KEYS.RSA.x509],
  34. tap/pem.ts:44 ['RS512', KEYS.RSA.pkcs8],
  35. tap/pem.ts:45 ['RS512', KEYS.RSA.spki],
  36. tap/pem.ts:46 ['RS512', KEYS.RSA.x509],
  37. test/jwk/generate_key_pair.test.ts:22 test path await t.throwsAsync(generateKeyPair('RS256', { modulusLength: 2048.5 }), {
  38. test/jwk/generate_key_pair.test.ts:107 test path await t.notThrowsAsync(generateKeyPair('RS256', { crv: 'P-256' } as any))
  39. test/jwk/issue-459.test.ts:30 test path return t.notThrowsAsync(() => importX509(cert, 'RS256'))
  40. test/jwk/issue-459.test.ts:37 test path await t.throwsAsync(importX509(truncated, 'RS256'))
  41. test/jwk/issue-459.test.ts:41 test path await t.notThrowsAsync(importX509(`${cert}AAAA`, 'RS256'))
  42. test/jwk/jwk2key.test.ts:85 test path 'RS256',
  43. test/jwk/thumbprint.test.ts:77 test path alg: 'RS256',
  44. test/jwks/local.test.ts:227 test path const key = await exportJWK((await generateKeyPair('RS256')).publicKey)
  45. test/jwks/local.test.ts:231 test path ['RS256', 'PS256'].map((alg) => Promise.all(Array.from({ length: 16 }, () => set({ alg })))),
  46. test/jwks/local.test.ts:239 test path t.is(await set({ alg: 'RS256' }), rs[0])
  47. test/jwks/remote.test.ts:81 test path alg: 'RS256',
  48. test/jwks/remote.test.ts:104 test path alg: 'RS256',
  49. test/jwks/remote.test.ts:118 test path alg: 'RS256',
  50. test/jwks/remote.test.ts:125 test path alg: 'RS256',
  51. test/jwks/remote.test.ts:159 test path const key = await importJWK({ ...jwk, alg: 'RS256' })
  52. test/jwks/remote.test.ts:160 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'RS256' }).sign(key)
  53. test/jwks/remote.test.ts:526 test path await t.throwsAsync(JWKS({ alg: 'RS256' }, {} as FlattenedJWSInput), {
  54. test/jwks/remote.test.ts:532 test path await t.throwsAsync(JWKS({ alg: 'RS256' }, {} as FlattenedJWSInput), {
  55. test/jwks/remote.test.ts:538 test path await t.throwsAsync(JWKS({ alg: 'RS256' }, {} as FlattenedJWSInput), {
  56. test/jwks/remote.test.ts:547 test path await t.throwsAsync(JWKS({ alg: 'RS256' }, {} as FlattenedJWSInput), {
  57. test/jwks/remote.test.ts:553 test path await t.throwsAsync(JWKS({ alg: 'RS256' }, {} as FlattenedJWSInput), {
  58. test/jwks/remote.test.ts:559 test path await t.throwsAsync(JWKS({ alg: 'RS256' }, {} as FlattenedJWSInput), {
  59. test/jwks/remote.test.ts:586 test path const err = await t.throwsAsync(JWKS({ alg: 'RS256' }, {} as FlattenedJWSInput))
  60. test/jwks/remote.test.ts:595 test path const err = await t.throwsAsync(JWKS({ alg: 'RS256' }, {} as FlattenedJWSInput))
  61. test/jwks/remote.test.ts:608 test path const err = await t.throwsAsync(JWKS({ alg: 'RS256' }, {} as FlattenedJWSInput))
  62. test/jws/restrictions.test.ts:109 test path test(testRSAsig, 'RS256')
  63. test/jws/restrictions.test.ts:111 test path test(testRSAsig, 'RS384')
  64. test/jws/restrictions.test.ts:113 test path test(testRSAsig, 'RS512')
  65. test/root_facades.test.ts:42 test path 'RS256',
  66. test/root_facades.test.ts:43 test path 'RS384',
  67. test/root_facades.test.ts:44 test path 'RS512',
jose.algorithm · CWE-327
RSA-OAEP Quantum-vulnerable Recorded traffic 62 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jwe.mjs:15 alg: 'RSA-OAEP',
  2. cookbook/jwe.mjs:23 alg: 'RSA-OAEP',
  3. cookbook/jwe.mjs:33 alg: 'RSA-OAEP',
  4. src/key/generate_key_pair.ts:25 | 'RSA-OAEP'
  5. src/key/generate_key_pair.ts:26 | 'RSA-OAEP-256'
  6. src/key/generate_key_pair.ts:27 | 'RSA-OAEP-384'
  7. src/key/generate_key_pair.ts:28 | 'RSA-OAEP-512'
  8. src/lib/jwe_algorithms.ts:18 name: 'RSA-OAEP' | 'ECDH' | 'AES-KW' | 'AES-GCM' | 'PBKDF2'
  9. src/lib/jwe_algorithms.ts:68 subtle: { name: 'RSA-OAEP', hash: `SHA-${bits}` },
  10. src/lib/jwe_algorithms.ts:128 'RSA-OAEP': rsaes(1),
  11. src/lib/jwe_algorithms.ts:129 'RSA-OAEP-256': rsaes(256),
  12. src/lib/jwe_algorithms.ts:130 'RSA-OAEP-384': rsaes(384),
  13. src/lib/jwe_algorithms.ts:131 'RSA-OAEP-512': rsaes(512),
  14. src/lib/key_management.ts:313 case 'RSA-OAEP': {
  15. src/lib/key_management.ts:317 await crypto.subtle.decrypt('RSA-OAEP', key, encryptedKey as Uint8Array<ArrayBuffer>),
  16. src/lib/key_management.ts:442 case 'RSA-OAEP': {
  17. src/lib/key_management.ts:446 await crypto.subtle.encrypt('RSA-OAEP', key, cek as Uint8Array<ArrayBuffer>),
  18. src/types.d.ts:47 | 'RSA-OAEP'
  19. src/types.d.ts:48 | 'RSA-OAEP-256'
  20. src/types.d.ts:49 | 'RSA-OAEP-384'
  21. src/types.d.ts:50 | 'RSA-OAEP-512'
  22. tap/general.ts:17 const b = await keys.generateKeyPair('RSA-OAEP-256', { extractable: true })
  23. tap/general.ts:26 .setUnprotectedHeader({ alg: 'RSA-OAEP-256' })
  24. tap/jwk.ts:32 ['RSA-OAEP-256', KEYS.RSA.jwk],
  25. tap/jwk.ts:33 ['RSA-OAEP-384', KEYS.RSA.jwk],
  26. tap/jwk.ts:34 ['RSA-OAEP-512', KEYS.RSA.jwk],
  27. tap/jwk.ts:35 ['RSA-OAEP', KEYS.RSA.jwk],
  28. tap/keyobject-stub.ts:73 case 'RSA-OAEP':
  29. tap/keyobject-stub.ts:74 case 'RSA-OAEP-256':
  30. tap/keyobject-stub.ts:75 case 'RSA-OAEP-384':
  31. tap/keyobject-stub.ts:76 case 'RSA-OAEP-512': {
  32. tap/pem.ts:47 ['RSA-OAEP-256', KEYS.RSA.pkcs8],
  33. tap/pem.ts:48 ['RSA-OAEP-256', KEYS.RSA.spki],
  34. tap/pem.ts:49 ['RSA-OAEP-256', KEYS.RSA.x509],
  35. tap/pem.ts:50 ['RSA-OAEP-384', KEYS.RSA.pkcs8],
  36. tap/pem.ts:51 ['RSA-OAEP-384', KEYS.RSA.spki],
  37. tap/pem.ts:52 ['RSA-OAEP-384', KEYS.RSA.x509],
  38. tap/pem.ts:53 ['RSA-OAEP-512', KEYS.RSA.pkcs8],
  39. tap/pem.ts:54 ['RSA-OAEP-512', KEYS.RSA.spki],
  40. tap/pem.ts:55 ['RSA-OAEP-512', KEYS.RSA.x509],
  41. tap/pem.ts:56 ['RSA-OAEP', KEYS.RSA.pkcs8],
  42. tap/pem.ts:57 ['RSA-OAEP', KEYS.RSA.spki],
  43. tap/pem.ts:58 ['RSA-OAEP', KEYS.RSA.x509],
  44. tap/rsaes.ts:16 const algorithms = ['RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512']
  45. test-d/api.ts:115 test path keyManagementAlgorithms: [anyString, 'RSA-OAEP'],
  46. test/jwe/flattened.decrypt.test.ts:607 test path const { publicKey, privateKey } = await generateKeyPair('RSA-OAEP-256')
  47. test/jwe/flattened.decrypt.test.ts:609 test path .setProtectedHeader({ alg: 'RSA-OAEP-256', enc: 'A128GCM' })
  48. test/jwe/flattened.decrypt.test.ts:613 test path await crypto.subtle.encrypt('RSA-OAEP', publicKey, new Uint8Array(1)),
  49. test/jwe/zip.test.ts:139 test path const protectedHeader = { alg: 'RSA-OAEP-256', enc: 'A256GCM', zip: 'DEF' }
  50. test/jws/restrictions.test.ts:116 test path test(testRSAenc, 'RSA-OAEP')
  51. test/jws/restrictions.test.ts:117 test path test(testRSAenc, 'RSA-OAEP-256')
  52. test/jws/restrictions.test.ts:118 test path test(testRSAenc, 'RSA-OAEP-384')
  53. test/jws/restrictions.test.ts:119 test path test(testRSAenc, 'RSA-OAEP-512')
  54. test/jwt/decrypt.test.ts:124 test path keyManagementAlgorithms: ['RSA-OAEP'],
  55. test/root_facades.test.ts:60 test path 'RSA-OAEP',
  56. test/root_facades.test.ts:61 test path 'RSA-OAEP-256',
  57. test/root_facades.test.ts:62 test path 'RSA-OAEP-384',
  58. test/root_facades.test.ts:63 test path 'RSA-OAEP-512',
  59. test/root_facades.test.ts:359 test path for (const algorithm of ['A256KW', 'RSA-OAEP-256', 'ECDH-ES+A256KW'] as const) {
  60. test/root_facades.test.ts:388 test path for (const algorithm of ['dir', 'ECDH-ES', 'A256KW', 'RSA-OAEP-256', 'ECDH-ES+A256KW'] as const) {
  61. test/root_facades.test.ts:408 test path for (const algorithm of ['A256KW', 'RSA-OAEP-256', 'ECDH-ES+A256KW'] as const) {
  62. tools/bundle-report.js:22 'RSA-OAEP',
jose.algorithm · CWE-327
RSA-PSS Quantum-vulnerable 56 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jws.mjs:112 alg: 'PS384',
  2. cookbook/jws.mjs:116 alg: 'PS384',
  3. src/key/generate_key_pair.ts:19 | 'PS256'
  4. src/key/generate_key_pair.ts:20 | 'PS384'
  5. src/key/generate_key_pair.ts:21 | 'PS512'
  6. src/types.d.ts:15 | 'PS256'
  7. src/types.d.ts:16 | 'PS384'
  8. src/types.d.ts:17 | 'PS512'
  9. tap/jwk.ts:26 ['PS256', KEYS.RSA.jwk],
  10. tap/jwk.ts:27 ['PS384', KEYS.RSA.jwk],
  11. tap/jwk.ts:28 ['PS512', KEYS.RSA.jwk],
  12. tap/jwks.ts:116 const key = await lib.importJWK({ ...jwk, alg: 'PS256' })
  13. tap/jwks.ts:118 .setProtectedHeader({ alg: 'PS256', kid: jwk.kid })
  14. tap/jwks.ts:127 const key = await lib.importJWK({ ...jwk, alg: 'PS256' })
  15. tap/jwks.ts:129 .setProtectedHeader({ alg: 'PS256', kid: jwk.kid })
  16. tap/jwks.ts:138 const key = await lib.importJWK({ ...jwk, alg: 'PS256' })
  17. tap/jwks.ts:140 .setProtectedHeader({ alg: 'PS256' })
  18. tap/jwks.ts:150 const key = await lib.importJWK({ ...jwk, alg: 'PS256' })
  19. tap/jwks.ts:153 .setProtectedHeader({ alg: 'PS256' })
  20. tap/jwks.ts:190 JWKS({ alg: 'PS256', kid }),
  21. tap/jws.ts:20 'PS256',
  22. tap/jws.ts:21 'PS384',
  23. tap/jws.ts:22 'PS512',
  24. tap/keyobject-stub.ts:70 case 'PS256':
  25. tap/keyobject-stub.ts:71 case 'PS384':
  26. tap/keyobject-stub.ts:72 case 'PS512':
  27. tap/pem.ts:29 ['PS256', KEYS.RSA.pkcs8],
  28. tap/pem.ts:30 ['PS256', KEYS.RSA.spki],
  29. tap/pem.ts:31 ['PS256', KEYS.RSA.x509],
  30. tap/pem.ts:32 ['PS384', KEYS.RSA.pkcs8],
  31. tap/pem.ts:33 ['PS384', KEYS.RSA.spki],
  32. tap/pem.ts:34 ['PS384', KEYS.RSA.x509],
  33. tap/pem.ts:35 ['PS512', KEYS.RSA.pkcs8],
  34. tap/pem.ts:36 ['PS512', KEYS.RSA.spki],
  35. tap/pem.ts:37 ['PS512', KEYS.RSA.x509],
  36. test/jwk/key_input.test.ts:154 test path new CompactSign(payload).setProtectedHeader({ alg: 'PS256' }).sign(new Uint8Array()),
  37. test/jwk/key_input.test.ts:165 test path const { privateKey, publicKey } = await generateKeyPair('PS256')
  38. test/jwk/key_input.test.ts:169 test path await t.throwsAsync(sign('PS256', secret), {
  39. test/jwk/key_input.test.ts:177 test path await t.throwsAsync(sign('PS256', publicKey), {
  40. test/jwk/key_input.test.ts:181 test path const jws = await sign('PS256', privateKey)
  41. test/jwk/key_input.test.ts:242 test path const { privateKey, publicKey } = await generateKeyPair('PS256', { extractable: true })
  42. test/jwk/key_input.test.ts:245 test path const jws = await new CompactSign(payload).setProtectedHeader({ alg: 'PS256' }).sign(privateJwk)
  43. test/jwk/key_input.test.ts:252 test path new CompactSign(payload).setProtectedHeader({ alg: 'PS256' }).sign(publicJwk),
  44. test/jwks/local.test.ts:231 test path ['RS256', 'PS256'].map((alg) => Promise.all(Array.from({ length: 16 }, () => set({ alg })))),
  45. test/jwks/local.test.ts:240 test path t.is(await set({ alg: 'PS256' }), ps[0])
  46. test/jwks/remote.test.ts:148 test path const key = await importJWK({ ...jwk, alg: 'PS256' })
  47. test/jwks/remote.test.ts:149 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'PS256', kid: jwk.kid }).sign(key)
  48. test/jwks/remote.test.ts:187 test path const key = await importJWK({ ...jwk, alg: 'PS256' })
  49. test/jwks/remote.test.ts:188 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'PS256', kid: jwk.kid }).sign(key)
  50. test/jws/restrictions.test.ts:110 test path test(testRSAsig, 'PS256')
  51. test/jws/restrictions.test.ts:112 test path test(testRSAsig, 'PS384')
  52. test/jws/restrictions.test.ts:114 test path test(testRSAsig, 'PS512')
  53. test/jwt/verify.test.ts:108 test path algorithms: ['PS256'],
  54. test/root_facades.test.ts:45 test path 'PS256',
  55. test/root_facades.test.ts:46 test path 'PS384',
  56. test/root_facades.test.ts:47 test path 'PS512',
jose.algorithm · CWE-327
ECDSA Quantum-vulnerable 45 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jws.mjs:158 alg: 'ES512',
  2. cookbook/jws.mjs:162 alg: 'ES512',
  3. tap/general.ts:50 .setProtectedHeader({ alg: 'ES256' })
  4. tap/jwks.ts:195 await JWKS({ alg: 'ES256' })
  5. test-d/api.ts:127 test path alg: 'ES256',
  6. test-d/api.ts:131 test path alg: 'ES256',
  7. test/jwk/embedded.test.ts:23 test path alg: 'ES256',
  8. test/jwk/embedded.test.ts:35 test path .setProtectedHeader({ alg: 'ES256', jwk: pubjwk(t.context.key) })
  9. test/jwk/embedded.test.ts:40 test path .setProtectedHeader({ alg: 'ES256' })
  10. test/jwk/embedded.test.ts:45 test path .setProtectedHeader({ alg: 'ES256', jwk: null })
  11. test/jwk/embedded.test.ts:50 test path .setProtectedHeader({ alg: 'ES256', jwk: t.context.key })
  12. test/jwk/embedded.test.ts:83 test path await t.throwsAsync(EmbeddedJWK({ alg: 'ES256', jwk }), {
  13. test/jwk/embedded.test.ts:91 test path await t.throwsAsync(EmbeddedJWK({ alg: 'ES256', jwk }), {
  14. test/jwk/embedded.test.ts:110 test path await t.notThrowsAsync(EmbeddedJWK({ alg: 'ES256', jwk }))
  15. test/jwk/embedded.test.ts:117 test path EmbeddedJWK({ alg: 'ES256', jwk: { ...pubjwk(t.context.key), ext: 'false' as never } }),
  16. test/jwk/jwk2key.test.ts:44 test path alg: ['ES256'],
  17. test/jwk/key_input.test.ts:45 test path firstPending = new CompactSign(payload).setProtectedHeader({ alg: 'ES256' }).sign(jwk)
  18. test/jwk/key_input.test.ts:55 test path const second = await new CompactSign(payload).setProtectedHeader({ alg: 'ES256' }).sign(jwk)
  19. test/jwk/key_input.test.ts:113 test path .setProtectedHeader({ alg: 'ES256' })
  20. test/jwk/key_input.test.ts:310 test path .setProtectedHeader({ alg: 'ES256' })
  21. test/jwks/local.test.ts:68 test path await t.throwsAsync(set({ alg: 'ES256' }), {
  22. test/jwks/local.test.ts:87 test path await t.throwsAsync(set({ alg: 'ES256' }), {
  23. test/jwks/local.test.ts:105 test path await t.throwsAsync(set({ alg: 'ES256', kid: 0 as never }), {
  24. test/jwks/local.test.ts:134 test path await t.throwsAsync(set({ alg: 'ES256' }), {
  25. test/jwks/local.test.ts:155 test path await t.throwsAsync(set({ alg: 'ES256', kid: 'inherited' }), {
  26. test/jwks/local.test.ts:185 test path const error = await t.throwsAsync(set({ alg: 'ES256' }), {
  27. test/jwks/local.test.ts:193 test path t.is(await set({ alg: 'ES256', kid: 'first' }), keys[0])
  28. test/jwks/local.test.ts:194 test path t.is(await set({ alg: 'ES256', kid: 'second' }), keys[1])
  29. test/jwks/local.test.ts:202 test path const keys = await Promise.all(Array.from({ length: 16 }, () => set({ alg: 'ES256' })))
  30. test/jwks/local.test.ts:206 test path t.is(await set({ alg: 'ES256' }), keys[0])
  31. test/jwks/local.test.ts:215 test path const results = await Promise.allSettled(Array.from({ length: 16 }, () => set({ alg: 'ES256' })))
  32. test/jwks/local.test.ts:219 test path const keys = await Promise.all(Array.from({ length: 16 }, () => set({ alg: 'ES256' })))
  33. test/jwks/local.test.ts:222 test path t.is(await set({ alg: 'ES256' }), keys[0])
  34. test/jwks/local.test.ts:258 test path await t.throwsAsync(privateKeySet({ alg: 'ES256' }), {
  35. test/jwks/remote.test.ts:196 test path const key = await importJWK({ ...jwk, alg: 'ES256' })
  36. test/jwks/remote.test.ts:197 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'ES256' }).sign(key)
  37. test/jwks/remote.test.ts:228 test path const key = await importJWK({ ...jwk, alg: 'ES256' })
  38. test/jwks/remote.test.ts:230 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'ES256', kid: 'one' }).sign(key)
  39. test/jwks/remote.test.ts:235 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'ES256', kid: 'two' }).sign(key)
  40. test/jwks/remote.test.ts:278 test path const key = await importJWK({ ...jwk, alg: 'ES256' })
  41. test/jwks/remote.test.ts:280 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'ES256', kid: 'two' }).sign(key)
  42. test/jwks/remote.test.ts:393 test path const key = await importJWK({ ...jwk, alg: 'ES256' })
  43. test/jwks/remote.test.ts:395 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'ES256', kid: 'one' }).sign(key)
  44. test/jwks/remote.test.ts:428 test path const key = await importJWK({ ...jwk, alg: 'ES256' })
  45. test/jwks/remote.test.ts:430 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'ES256', kid: 'one' }).sign(key)
js.jwt.algorithm · CWE-327
Ed25519255-bitother/Ed25519 Quantum-vulnerable 34 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jws.mjs:61 crv: 'Ed25519',
  2. cookbook/jws.mjs:65 alg: 'EdDSA',
  3. cookbook/jws.mjs:69 alg: 'EdDSA',
  4. src/key/generate_key_pair.ts:32 | 'Ed25519'
  5. src/key/generate_key_pair.ts:33 | 'EdDSA'
  6. src/lib/jws_algorithms.ts:52 const subtle = { name: 'Ed25519' }
  7. src/lib/jws_algorithms.ts:55 crv: 'Ed25519',
  8. src/types.d.ts:21 | 'EdDSA'
  9. src/types.d.ts:22 | 'Ed25519'
  10. tap/fixtures.ts:4 crv: 'Ed25519',
  11. tap/jwk.ts:21 ['Ed25519', KEYS.Ed25519.jwk],
  12. tap/jwk.ts:22 ['EdDSA', KEYS.Ed25519.jwk],
  13. tap/jwk.ts:56 if (alg === 'EdDSA' || alg === 'ECDH-ES') {
  14. tap/jws.ts:15 'Ed25519',
  15. tap/jws.ts:16 'EdDSA',
  16. tap/keyobject-stub.ts:90 case 'Ed25519': // Fall through
  17. tap/keyobject-stub.ts:91 case 'EdDSA':
  18. tap/pem.ts:70 ['Ed25519', KEYS.Ed25519.pkcs8],
  19. tap/pem.ts:71 ['Ed25519', KEYS.Ed25519.spki],
  20. tap/pem.ts:72 ['Ed25519', KEYS.Ed25519.x509],
  21. tap/pem.ts:73 [['EdDSA', 'Ed25519'], KEYS.Ed25519.pkcs8],
  22. tap/pem.ts:74 [['EdDSA', 'Ed25519'], KEYS.Ed25519.spki],
  23. tap/pem.ts:75 [['EdDSA', 'Ed25519'], KEYS.Ed25519.x509],
  24. test-d/api.ts:81 test path const _okp: jose.AnyJWK = { kty: 'OKP', crv: 'Ed25519', x: 'x' }
  25. test/jwk/generate_key_pair.test.ts:57 test path ['EdDSA', 'Ed448', 'Ed25519'],
  26. test/jwk/generate_key_pair.test.ts:58 test path ['Ed25519', 'Ed448', 'Ed25519'],
  27. test/jwk/generate_key_pair.test.ts:72 test path ['EdDSA', 'Ed25519'],
  28. test/jwk/generate_key_pair.test.ts:73 test path ['Ed25519', 'Ed25519'],
  29. test/jwk/generate_key_pair.test.ts:85 test path ['EdDSA', 'Ed25519'],
  30. test/jwk/generate_key_pair.test.ts:98 test path await t.throwsAsync(generateKeyPair('ECDH-ES', { crv: 'Ed25519' }), {
  31. test/jwk/thumbprint.test.ts:174 test path crv: 'Ed25519',
  32. test/root_facades.test.ts:51 test path 'EdDSA',
  33. test/root_facades.test.ts:52 test path 'Ed25519',
  34. tools/bundle-report.js:35 const JWS_ONLY = ['RSASSA-PKCS1-v1_5', 'RSA-PSS', 'ECDSA', 'ML-DSA', 'Ed25519']
jose.algorithm · CWE-327
RSASSA-PKCS1v15 Quantum-vulnerable 28 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jws.mjs:22 alg: 'RS256',
  2. cookbook/jws.mjs:26 alg: 'RS256',
  3. tap/jwks.ts:19 await t.rejects(jwks({ alg: 'RS256' }), 'multiple matching keys found in the JSON Web Key Set')
  4. tap/jwks.ts:21 jwks({ kid: 'foo', alg: 'RS256' }),
  5. tap/jwks.ts:55 alg: 'RS256',
  6. tap/jwks.ts:78 alg: 'RS256',
  7. tap/jwks.ts:92 alg: 'RS256',
  8. tap/jwks.ts:99 alg: 'RS256',
  9. tap/jwks.ts:162 JWKS({ alg: 'RS256' }),
  10. tap/jwks.ts:167 let error = (await JWKS({ alg: 'RS256' }).catch(
  11. tap/jwks.ts:176 error = (await JWKS({ alg: 'RS256' }).catch(
  12. test/jwk/thumbprint.test.ts:77 test path alg: 'RS256',
  13. test/jwks/local.test.ts:239 test path t.is(await set({ alg: 'RS256' }), rs[0])
  14. test/jwks/remote.test.ts:81 test path alg: 'RS256',
  15. test/jwks/remote.test.ts:104 test path alg: 'RS256',
  16. test/jwks/remote.test.ts:118 test path alg: 'RS256',
  17. test/jwks/remote.test.ts:125 test path alg: 'RS256',
  18. test/jwks/remote.test.ts:159 test path const key = await importJWK({ ...jwk, alg: 'RS256' })
  19. test/jwks/remote.test.ts:160 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'RS256' }).sign(key)
  20. test/jwks/remote.test.ts:526 test path await t.throwsAsync(JWKS({ alg: 'RS256' }, {} as FlattenedJWSInput), {
  21. test/jwks/remote.test.ts:532 test path await t.throwsAsync(JWKS({ alg: 'RS256' }, {} as FlattenedJWSInput), {
  22. test/jwks/remote.test.ts:538 test path await t.throwsAsync(JWKS({ alg: 'RS256' }, {} as FlattenedJWSInput), {
  23. test/jwks/remote.test.ts:547 test path await t.throwsAsync(JWKS({ alg: 'RS256' }, {} as FlattenedJWSInput), {
  24. test/jwks/remote.test.ts:553 test path await t.throwsAsync(JWKS({ alg: 'RS256' }, {} as FlattenedJWSInput), {
  25. test/jwks/remote.test.ts:559 test path await t.throwsAsync(JWKS({ alg: 'RS256' }, {} as FlattenedJWSInput), {
  26. test/jwks/remote.test.ts:586 test path const err = await t.throwsAsync(JWKS({ alg: 'RS256' }, {} as FlattenedJWSInput))
  27. test/jwks/remote.test.ts:595 test path const err = await t.throwsAsync(JWKS({ alg: 'RS256' }, {} as FlattenedJWSInput))
  28. test/jwks/remote.test.ts:608 test path const err = await t.throwsAsync(JWKS({ alg: 'RS256' }, {} as FlattenedJWSInput))
js.jwt.algorithm · CWE-327
ECDH Quantum-vulnerable Recorded traffic 21 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jwe.mjs:138 alg: 'ECDH-ES+A128KW',
  2. cookbook/jwe.mjs:156 alg: 'ECDH-ES+A128KW',
  3. cookbook/jwe.mjs:210 alg: 'ECDH-ES',
  4. cookbook/jwe.mjs:228 alg: 'ECDH-ES',
  5. test/jwe/compact.encrypt.test.ts:165 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  6. test/jwe/compact.encrypt.test.ts:176 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  7. test/jwe/compact.encrypt.test.ts:194 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  8. test/jwe/flattened.decrypt.test.ts:219 test path protected: base64url.encode(JSON.stringify({ alg: 'ECDH-ES+A128KW', enc: 'A128GCM' })),
  9. test/jwe/flattened.decrypt.test.ts:234 test path .setProtectedHeader({ alg: 'ECDH-ES+A128KW', enc: 'A128GCM' })
  10. test/jwe/flattened.encrypt.test.ts:403 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  11. test/jwe/flattened.encrypt.test.ts:467 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  12. test/jwe/flattened.encrypt.test.ts:492 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  13. test/jwe/flattened.encrypt.test.ts:512 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  14. test/jwe/flattened.encrypt.test.ts:549 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  15. test/jwe/general.test.ts:351 test path .setSharedUnprotectedHeader({ alg: 'ECDH-ES' })
  16. test/jwe/general.test.ts:481 test path recipients: [perRecipient.recipients[0], { header: { alg: 'ECDH-ES' } }],
  17. test/jwe/general.test.ts:670 test path .setUnprotectedHeader({ alg: 'ECDH-ES+A256KW' })
  18. test/jwk/embedded.test.ts:89 test path const jwk = { ...pubjwk(t.context.key), alg: 'ECDH-ES' }
  19. test/jwk/key_input.test.ts:189 test path new CompactEncrypt(payload).setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' }).encrypt(key)
  20. test/jwk/key_input.test.ts:266 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  21. test/root_facades.test.ts:443 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A256GCM' })
js.jwt.algorithm · CWE-327
RSA-PSS Quantum-vulnerable 20 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jws.mjs:112 alg: 'PS384',
  2. cookbook/jws.mjs:116 alg: 'PS384',
  3. tap/jwks.ts:116 const key = await lib.importJWK({ ...jwk, alg: 'PS256' })
  4. tap/jwks.ts:118 .setProtectedHeader({ alg: 'PS256', kid: jwk.kid })
  5. tap/jwks.ts:127 const key = await lib.importJWK({ ...jwk, alg: 'PS256' })
  6. tap/jwks.ts:129 .setProtectedHeader({ alg: 'PS256', kid: jwk.kid })
  7. tap/jwks.ts:138 const key = await lib.importJWK({ ...jwk, alg: 'PS256' })
  8. tap/jwks.ts:140 .setProtectedHeader({ alg: 'PS256' })
  9. tap/jwks.ts:150 const key = await lib.importJWK({ ...jwk, alg: 'PS256' })
  10. tap/jwks.ts:153 .setProtectedHeader({ alg: 'PS256' })
  11. tap/jwks.ts:190 JWKS({ alg: 'PS256', kid }),
  12. test/jwk/key_input.test.ts:154 test path new CompactSign(payload).setProtectedHeader({ alg: 'PS256' }).sign(new Uint8Array()),
  13. test/jwk/key_input.test.ts:245 test path const jws = await new CompactSign(payload).setProtectedHeader({ alg: 'PS256' }).sign(privateJwk)
  14. test/jwk/key_input.test.ts:252 test path new CompactSign(payload).setProtectedHeader({ alg: 'PS256' }).sign(publicJwk),
  15. test/jwks/local.test.ts:240 test path t.is(await set({ alg: 'PS256' }), ps[0])
  16. test/jwks/remote.test.ts:148 test path const key = await importJWK({ ...jwk, alg: 'PS256' })
  17. test/jwks/remote.test.ts:149 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'PS256', kid: jwk.kid }).sign(key)
  18. test/jwks/remote.test.ts:187 test path const key = await importJWK({ ...jwk, alg: 'PS256' })
  19. test/jwks/remote.test.ts:188 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'PS256', kid: jwk.kid }).sign(key)
  20. test/jwt/verify.test.ts:108 test path algorithms: ['PS256'],
js.jwt.algorithm · CWE-327
RSA-OAEP Quantum-vulnerable Recorded traffic 6 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jwe.mjs:15 alg: 'RSA-OAEP',
  2. cookbook/jwe.mjs:23 alg: 'RSA-OAEP',
  3. cookbook/jwe.mjs:33 alg: 'RSA-OAEP',
  4. tap/general.ts:26 .setUnprotectedHeader({ alg: 'RSA-OAEP-256' })
  5. test/jwe/flattened.decrypt.test.ts:609 test path .setProtectedHeader({ alg: 'RSA-OAEP-256', enc: 'A128GCM' })
  6. test/jwe/zip.test.ts:139 test path const protectedHeader = { alg: 'RSA-OAEP-256', enc: 'A256GCM', zip: 'DEF' }
js.jwt.algorithm · CWE-327
ECDH Quantum-vulnerable Recorded traffic 5 places See details

Classical key generated with WebCrypto

`subtle.generateKey({name: …})` naming RSA-OAEP, RSA-PSS, RSASSA-PKCS1-v1_5, ECDSA or ECDH. The algorithm name is taken from the object literal.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No post-quantum algorithm is in the WebCrypto specification yet. Where the key protects long-lived data, move that operation server-side.

  1. src/lib/jwe_algorithms.ts:79 subtle: { name: 'ECDH' },
  2. src/lib/jwe_algorithms.ts:87 return { name: 'ECDH', namedCurve: crv! }
  3. test/jwe/flattened.encrypt.test.ts:504 test path ['P-256', { name: 'ECDH', namedCurve: 'P-256' }],
  4. test/jwe/flattened.encrypt.test.ts:544 test path await crypto.subtle.generateKey({ name: 'ECDH', namedCurve: 'P-256' }, false, ['deriveBits'])
  5. test/jwe/integrated_encryption.test.ts:45 test path subtle: { name: 'ECDH', namedCurve: 'P-256' },
js.webcrypto.generatekey · CWE-327
EdDSA Quantum-vulnerable 3 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. tap/env.ts:61 case 'Ed448':
  2. test/jwk/generate_key_pair.test.ts:57 test path ['EdDSA', 'Ed448', 'Ed25519'],
  3. test/jwk/generate_key_pair.test.ts:58 test path ['Ed25519', 'Ed448', 'Ed25519'],
jose.algorithm · CWE-327
ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 2 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

  1. docs/key/import/functions/importPKCS8.md:34 -----BEGIN PRIVATE KEY-----
  2. src/key/import.ts:131 -----BEGIN PRIVATE KEY-----
pem.private-key · CWE-321, CWE-327
ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 2 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

  1. docs/key/import/functions/importSPKI.md:34 -----BEGIN PUBLIC KEY-----
  2. src/key/import.ts:53 -----BEGIN PUBLIC KEY-----
pem.public-key
ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 2 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

  1. docs/key/import/functions/importX509.md:34 -----BEGIN CERTIFICATE-----
  2. src/key/import.ts:89 -----BEGIN CERTIFICATE-----
pem.certificate
ECDSA Quantum-vulnerable 2 places See details

Classical key generated with WebCrypto

`subtle.generateKey({name: …})` naming RSA-OAEP, RSA-PSS, RSASSA-PKCS1-v1_5, ECDSA or ECDH. The algorithm name is taken from the object literal.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No post-quantum algorithm is in the WebCrypto specification yet. Where the key protects long-lived data, move that operation server-side.

  1. src/lib/jws_algorithms.ts:44 subtle: { name: 'ECDSA', namedCurve: crv },
  2. src/lib/jws_algorithms.ts:45 signing: { name: 'ECDSA', hash: `SHA-${bits}` },
js.webcrypto.generatekey · CWE-327
Ed25519255-bitother/Ed25519 Quantum-vulnerable 2 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jws.mjs:65 alg: 'EdDSA',
  2. cookbook/jws.mjs:69 alg: 'EdDSA',
js.jwt.algorithm · CWE-327
RSA2048-bit Quantum-vulnerable Recorded traffic 2 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

  1. docs/jwt/sign/classes/SignJWT.md:37 -----BEGIN PRIVATE KEY-----
  2. src/jwt/sign.ts:49 -----BEGIN PRIVATE KEY-----
pem.private-key · CWE-321, CWE-327
RSA2048-bit Quantum-vulnerable 2 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

  1. docs/jwt/verify/functions/jwtVerify.md:58 -----BEGIN PUBLIC KEY-----
  2. src/jwt/verify.ts:65 -----BEGIN PUBLIC KEY-----
pem.public-key
RSA2048-bit Quantum-vulnerable Recorded traffic Renamed import 2 places See details

Classical key pair generated with Node crypto

`crypto.generateKeyPair()` or its synchronous form. The detector resolves the algorithm through a `promisify()` wrapper and through an import alias, both of which are common enough that missing them would leave real key generation unreported.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Node exposes neither yet, so this usually means an addon or a service boundary.

  1. test/jwe/compact.encrypt.test.ts:12 test path const rsa = crypto.generateKeyPairSync('rsa', { modulusLength: 2048 })
  2. test/jwe/zip.test.ts:136 test path const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', { modulusLength: 2048 })
js.generatekeypair · CWE-327
RSA Quantum-vulnerable Recorded traffic Renamed import 2 places See details

One-shot signing or public-key encryption

`crypto.sign()`, `crypto.verify()`, `privateEncrypt()`, `publicDecrypt()`, `privateDecrypt()` or `publicEncrypt()`. These take the key at runtime, so the algorithm follows the key; every key type Node accepts here is classical.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures.

  1. test/jwe/zip.test.ts:146 test path const encryptedKey = crypto.publicEncrypt({ key: publicKey, oaepHash: 'sha256' }, cek)
  2. test/jws/restrictions.test.ts:99 test path crypto.sign(`sha${alg.slice(2, 5)}`, Buffer.from('foo'), await exportPKCS8(privateKey)),
js.node.oneshot · CWE-327
RSA-OAEP Quantum-vulnerable Recorded traffic 2 places See details

Classical key generated with WebCrypto

`subtle.generateKey({name: …})` naming RSA-OAEP, RSA-PSS, RSASSA-PKCS1-v1_5, ECDSA or ECDH. The algorithm name is taken from the object literal.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No post-quantum algorithm is in the WebCrypto specification yet. Where the key protects long-lived data, move that operation server-side.

  1. src/lib/jwe_algorithms.ts:18 name: 'RSA-OAEP' | 'ECDH' | 'AES-KW' | 'AES-GCM' | 'PBKDF2'
  2. src/lib/jwe_algorithms.ts:68 subtle: { name: 'RSA-OAEP', hash: `SHA-${bits}` },
js.webcrypto.generatekey · CWE-327
X25519255-bitother/Curve25519 Quantum-vulnerable Recorded traffic Renamed import 2 places See details

Classical key pair generated with Node crypto

`crypto.generateKeyPair()` or its synchronous form. The detector resolves the algorithm through a `promisify()` wrapper and through an import alias, both of which are common enough that missing them would leave real key generation unreported.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Node exposes neither yet, so this usually means an addon or a service boundary.

  1. test/jwe/compact.encrypt.test.ts:174 test path const x25519 = crypto.generateKeyPairSync('x25519')
  2. test/jwe/compact.encrypt.test.ts:185 test path const { publicKey } = crypto.generateKeyPairSync('x25519')
js.generatekeypair · CWE-327
ECDH256-bitsecg/secp256r1 Quantum-vulnerable Recorded traffic Renamed import 1 place See details

Classical key pair generated with Node crypto

`crypto.generateKeyPair()` or its synchronous form. The detector resolves the algorithm through a `promisify()` wrapper and through an import alias, both of which are common enough that missing them would leave real key generation unreported.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Node exposes neither yet, so this usually means an addon or a service boundary.

  1. test/jwk/key_input.test.ts:292 test path const { privateKey, publicKey } = generateKeyPairSync('ec', { namedCurve: 'P-256' })
js.generatekeypair · CWE-327
RSA2048-bit Quantum-vulnerable 1 place See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

  1. test/jwk/issue-459.test.ts:5 test path -----BEGIN CERTIFICATE-----
pem.certificate
secp256k1256-bitsecg/secp256k1 Quantum-vulnerable 1 place See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer. Bitcoin-family keys are additionally exposed because public keys are published on-chain, so the attacker does not have to wait for a signature.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. tap/env.ts:62 case 'ES256K':
jose.algorithm · CWE-327
AES-128 Reduced margin Renamed import 215 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Grover's algorithm halves the effective strength; the parameter, not the design, is the problem.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jwe.mjs:73 '{"keys":[{"kty":"oct","kid":"77c7e2b8-6e13-45cf-8672-617b5b45243a","use":"enc","alg":"A128GCM","k":"XctOhJAkA-pD9Lh7ZgW_2A"},{"kty":"oct","kid":"81b20965-8332-43d9-a468-82160ad91ac8","use":"enc","alg":"A128KW","k":"GZy6sIZ6wl9NJOKB-jnmVQ"}
  2. cookbook/jwe.mjs:76 enc: 'A128CBC-HS256',
  3. cookbook/jwe.mjs:92 enc: 'A128CBC-HS256',
  4. cookbook/jwe.mjs:139 enc: 'A128GCM',
  5. cookbook/jwe.mjs:164 enc: 'A128GCM',
  6. cookbook/jwe.mjs:211 enc: 'A128CBC-HS256',
  7. cookbook/jwe.mjs:236 enc: 'A128CBC-HS256',
  8. cookbook/jwe.mjs:271 alg: 'A128GCM',
  9. cookbook/jwe.mjs:275 enc: 'A128GCM',
  10. cookbook/jwe.mjs:284 enc: 'A128GCM',
  11. cookbook/jwe.mjs:324 enc: 'A128CBC-HS256',
  12. cookbook/jwe.mjs:340 enc: 'A128CBC-HS256',
  13. cookbook/jwe.mjs:382 alg: 'A128KW',
  14. cookbook/jwe.mjs:385 alg: 'A128KW',
  15. cookbook/jwe.mjs:386 enc: 'A128GCM',
  16. cookbook/jwe.mjs:395 alg: 'A128KW',
  17. cookbook/jwe.mjs:397 enc: 'A128GCM',
  18. cookbook/jwe.mjs:438 alg: 'A128KW',
  19. cookbook/jwe.mjs:441 alg: 'A128KW',
  20. cookbook/jwe.mjs:442 enc: 'A128GCM',
  21. cookbook/jwe.mjs:454 alg: 'A128KW',
  22. cookbook/jwe.mjs:456 enc: 'A128GCM',
  23. cookbook/jwe.mjs:499 alg: 'A128KW',
  24. cookbook/jwe.mjs:502 alg: 'A128KW',
  25. cookbook/jwe.mjs:503 enc: 'A128GCM',
  26. cookbook/jwe.mjs:515 alg: 'A128KW',
  27. cookbook/jwe.mjs:517 enc: 'A128GCM',
  28. cookbook/jwe.mjs:559 alg: 'A128KW',
  29. cookbook/jwe.mjs:562 alg: 'A128KW',
  30. cookbook/jwe.mjs:563 enc: 'A128GCM',
  31. cookbook/jwe.mjs:572 enc: 'A128GCM',
  32. cookbook/jwe.mjs:575 alg: 'A128KW',
  33. cookbook/jwe.mjs:587 alg: 'A128KW',
  34. cookbook/jwe.mjs:599 alg: 'A128KW',
  35. cookbook/jwe.mjs:621 alg: 'A128KW',
  36. cookbook/jwe.mjs:624 alg: 'A128KW',
  37. cookbook/jwe.mjs:625 enc: 'A128GCM',
  38. cookbook/jwe.mjs:634 alg: 'A128KW',
  39. cookbook/jwe.mjs:636 enc: 'A128GCM',
  40. cookbook/jwe.mjs:647 alg: 'A128KW',
  41. cookbook/jwe.mjs:649 enc: 'A128GCM',
  42. cookbook/jwe.mjs:658 alg: 'A128KW',
  43. cookbook/jwe.mjs:660 enc: 'A128GCM',
  44. src/key/generate_secret.ts:21 | 'A128CBC-HS256'
  45. src/key/generate_secret.ts:24 | 'A128KW'
  46. src/key/generate_secret.ts:27 | 'A128GCMKW'
  47. src/key/generate_secret.ts:30 | 'A128GCM'
  48. src/key/generate_secret.ts:42 'A128CBC-HS256' | 'A192CBC-HS384' | 'A256CBC-HS512'
  49. src/key/generate_secret.ts:103 case 'A128CBC-HS256':
  50. src/key/generate_secret.ts:108 case 'A128KW':
  51. src/key/generate_secret.ts:116 case 'A128GCMKW':
  52. src/key/generate_secret.ts:119 case 'A128GCM':
  53. src/lib/jwe_algorithms.ts:181 'A128CBC-HS256': contentEncryption(256, true),
  54. src/types.d.ts:37 | 'A128KW'
  55. src/types.d.ts:40 | 'A128GCMKW'
  56. src/types.d.ts:63 | 'A128CBC-HS256'
  57. src/types.d.ts:66 | 'A128GCM'
  58. tap/aes.ts:15 'A128GCM',
  59. tap/aes.ts:18 'A128CBC-HS256',
  60. tap/aeskw.ts:14 const algorithms = ['A128KW', 'A192KW', 'A256KW', 'A128GCMKW', 'A192GCMKW', 'A256GCMKW']
  61. tap/aeskw.ts:35 await roundtrip.jwe(t, lib, keys, alg, 'A128GCM', secret)
  62. tap/aeskw.ts:40 await roundtrip.jwt(t, lib, keys, alg, 'A128GCM', await secretsFor(alg)[0])
  63. tap/ecdh.ts:47 await roundtrip.jwe(t, lib, keys, alg, 'A128GCM', kps[k])
  64. tap/ecdh.ts:54 await roundtrip.jwt(t, lib, keys, alg, 'A128GCM', kps[k])
  65. tap/env.ts:99 case 'A128KW':
  66. tap/keyobject-stub.ts:42 case 'A128CBC-HS256':
  67. tap/keyobject-stub.ts:47 case 'A128KW':
  68. tap/keyobject-stub.ts:50 case 'A128GCMKW':
  69. tap/keyobject-stub.ts:53 case 'A128GCM':
  70. tap/pbes2.ts:28 await roundtrip.jwe(t, lib, keys, alg, 'A128GCM', password)
  71. tap/pbes2.ts:33 await roundtrip.jwt(t, lib, keys, alg, 'A128GCM', password)
  72. tap/rsaes.ts:33 await roundtrip.jwe(t, lib, keys, alg, 'A128GCM', kps[alg])
  73. tap/rsaes.ts:41 await roundtrip.jwt(t, lib, keys, alg, 'A128GCM', kps[alg])
  74. test-d/api.ts:299 test path const _gsLiteral: jose.GenerateSecretAlgorithm = 'A128CBC-HS256'
  75. test-d/api.ts:305 test path const cbc = await jose.generateSecret('A128CBC-HS256')
  76. test-d/api.ts:317 test path const _generatedCbc: Equals<GeneratedSecret<'A128CBC-HS256'>, Uint8Array> = true
  77. test/jwe/compact.decrypt.test.ts:34 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  78. test/jwe/compact.decrypt.test.ts:39 test path t.deepEqual(protectedHeader, { alg: 'dir', enc: 'A128GCM' })
  79. test/jwe/compact.decrypt.test.ts:60 test path const protectedHeader = { alg: 'dir', enc: 'A128GCM' } as const
  80. test/jwe/compact.encrypt.test.ts:32 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  81. test/jwe/compact.encrypt.test.ts:48 test path enc: 'A128GCM',
  82. test/jwe/compact.encrypt.test.ts:141 test path .setProtectedHeader({ enc: 'A128GCM' })
  83. test/jwe/compact.encrypt.test.ts:165 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  84. test/jwe/compact.encrypt.test.ts:176 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  85. test/jwe/compact.encrypt.test.ts:194 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  86. test/jwe/flattened.decrypt.test.ts:24 test path .setSharedUnprotectedHeader({ alg: 'dir', enc: 'A128GCM' })
  87. test/jwe/flattened.decrypt.test.ts:187 test path jwe.unprotected = { enc: 'A128GCM' }
  88. test/jwe/flattened.decrypt.test.ts:219 test path protected: base64url.encode(JSON.stringify({ alg: 'ECDH-ES+A128KW', enc: 'A128GCM' })),
  89. test/jwe/flattened.decrypt.test.ts:234 test path .setProtectedHeader({ alg: 'ECDH-ES+A128KW', enc: 'A128GCM' })
  90. test/jwe/flattened.decrypt.test.ts:298 test path .setProtectedHeader({ alg: 'A128GCMKW', enc: 'A128GCM' })
  91. test/jwe/flattened.decrypt.test.ts:328 test path .setSharedUnprotectedHeader({ alg: 'dir', enc: 'A128GCM' })
  92. test/jwe/flattened.decrypt.test.ts:330 test path const unprotected = { alg: 'A256KW', enc: 'A128GCM' }
  93. test/jwe/flattened.decrypt.test.ts:347 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  94. test/jwe/flattened.decrypt.test.ts:367 test path const protectedHeader = base64url.encode(JSON.stringify({ alg: 'dir', enc: 'A128GCM' }))
  95. test/jwe/flattened.decrypt.test.ts:411 test path .setProtectedHeader({ alg: 'dir', enc: 'A128CBC-HS256' })
  96. test/jwe/flattened.decrypt.test.ts:447 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128CBC-HS256' })
  97. test/jwe/flattened.decrypt.test.ts:489 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128CBC-HS256' })
  98. test/jwe/flattened.decrypt.test.ts:510 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128CBC-HS256' })
  99. test/jwe/flattened.decrypt.test.ts:537 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128CBC-HS256' })
  100. test/jwe/flattened.decrypt.test.ts:549 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  101. test/jwe/flattened.decrypt.test.ts:566 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  102. test/jwe/flattened.decrypt.test.ts:609 test path .setProtectedHeader({ alg: 'RSA-OAEP-256', enc: 'A128GCM' })
  103. test/jwe/flattened.decrypt.test.ts:634 test path const key = await generateSecret('A128GCMKW')
  104. test/jwe/flattened.decrypt.test.ts:636 test path .setProtectedHeader({ alg: 'A128GCMKW', enc: 'A128GCM' })
  105. test/jwe/flattened.decrypt.test.ts:664 test path .setSharedUnprotectedHeader({ alg: 'dir', enc: 'A128GCM' })
  106. test/jwe/flattened.encrypt.test.ts:24 test path .setUnprotectedHeader({ enc: 'A128GCM' })
  107. test/jwe/flattened.encrypt.test.ts:29 test path enc: 'A128GCM',
  108. test/jwe/flattened.encrypt.test.ts:40 test path .setSharedUnprotectedHeader({ enc: 'A128GCM' })
  109. test/jwe/flattened.encrypt.test.ts:45 test path enc: 'A128GCM',
  110. test/jwe/flattened.encrypt.test.ts:55 test path .setSharedUnprotectedHeader({ alg: 'dir', enc: 'A128GCM' })
  111. test/jwe/flattened.encrypt.test.ts:61 test path enc: 'A128GCM',
  112. test/jwe/flattened.encrypt.test.ts:72 test path .setSharedUnprotectedHeader({ enc: 'A128GCM' })
  113. test/jwe/flattened.encrypt.test.ts:78 test path enc: 'A128GCM',
  114. test/jwe/flattened.encrypt.test.ts:146 test path .setUnprotectedHeader({ alg: 'dir', enc: 'A128GCM' })
  115. test/jwe/flattened.encrypt.test.ts:153 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  116. test/jwe/flattened.encrypt.test.ts:161 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  117. test/jwe/flattened.encrypt.test.ts:173 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  118. test/jwe/flattened.encrypt.test.ts:185 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', crit: ['foo'], foo })
  119. test/jwe/flattened.encrypt.test.ts:192 test path .setProtectedHeader({ enc: 'A128GCM', crit: ['foo'] })
  120. test/jwe/flattened.encrypt.test.ts:201 test path .setProtectedHeader({ enc: 'A128GCM', crit: ['foo'] })
  121. test/jwe/flattened.encrypt.test.ts:210 test path enc: 'A128GCM',
  122. test/jwe/flattened.encrypt.test.ts:224 test path const inherited = Object.create({ alg: 'dir', enc: 'A128GCM' })
  123. test/jwe/flattened.encrypt.test.ts:229 test path enc: { value: 'A128GCM' },
  124. test/jwe/flattened.encrypt.test.ts:283 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  125. test/jwe/flattened.encrypt.test.ts:294 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  126. test/jwe/flattened.encrypt.test.ts:310 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  127. test/jwe/flattened.encrypt.test.ts:321 test path .setProtectedHeader({ alg: 'A128GCMKW', enc: 'A128GCM' })
  128. test/jwe/flattened.encrypt.test.ts:335 test path .setProtectedHeader({ enc: 'A128GCM' })
  129. test/jwe/flattened.encrypt.test.ts:360 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  130. test/jwe/flattened.encrypt.test.ts:371 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  131. test/jwe/flattened.encrypt.test.ts:386 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  132. test/jwe/flattened.encrypt.test.ts:403 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  133. test/jwe/flattened.encrypt.test.ts:418 test path .setProtectedHeader({ alg, enc: 'A128GCM' })
  134. test/jwe/flattened.encrypt.test.ts:437 test path protectedParameters ? { alg, enc: 'A128GCM', apu, apv } : { alg, enc: 'A128GCM' },
  135. test/jwe/flattened.encrypt.test.ts:451 test path .setProtectedHeader({ alg: 'A128GCMKW', enc: 'A128GCM' })
  136. test/jwe/flattened.encrypt.test.ts:467 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  137. test/jwe/flattened.encrypt.test.ts:479 test path .setProtectedHeader({ alg: 'A128GCMKW', enc: 'A128GCM' })
  138. test/jwe/flattened.encrypt.test.ts:492 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  139. test/jwe/flattened.encrypt.test.ts:512 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  140. test/jwe/flattened.encrypt.test.ts:549 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  141. test/jwe/general.test.ts:33 test path .setUnprotectedHeader({ alg: 'A128GCMKW' })
  142. test/jwe/general.test.ts:65 test path .setProtectedHeader({ enc: 'A128GCM', crit: ['foo'] })
  143. test/jwe/general.test.ts:69 test path .setUnprotectedHeader({ alg: 'A128KW', foo: () => true })
  144. test/jwe/general.test.ts:80 test path return 'A128GCM'
  145. test/jwe/general.test.ts:89 test path return recipientReads === 1 ? 'A128KW' : 'A256KW'
  146. test/jwe/general.test.ts:96 test path t.is(jwe.recipients[1].header!.alg, 'A128KW')
  147. test/jwe/general.test.ts:107 test path return 'A128GCM'
  148. test/jwe/general.test.ts:129 test path return { alg: 'A128KW' }
  149. test/jwe/general.test.ts:148 test path return 'A128GCM'
  150. test/jwe/general.test.ts:165 test path .setUnprotectedHeader({ alg: 'A128KW' })
  151. test/jwe/general.test.ts:179 test path .setProtectedHeader({ enc: 'A128GCM' })
  152. test/jwe/general.test.ts:183 test path .setUnprotectedHeader({ alg: 'A128GCMKW' })
  153. test/jwe/general.test.ts:194 test path .setProtectedHeader({ enc: 'A128GCM' })
  154. test/jwe/general.test.ts:199 test path .setUnprotectedHeader({ alg: 'A128KW' })
  155. test/jwe/general.test.ts:212 test path .setUnprotectedHeader({ alg: 'A128GCMKW' })
  156. test/jwe/general.test.ts:242 test path enc: 'A128GCM',
  157. test/jwe/general.test.ts:245 test path encrypt.addRecipient(t.context.secret2).setUnprotectedHeader({ alg: 'A128KW' })
  158. test/jwe/general.test.ts:278 test path .setProtectedHeader({ enc: 'A128GCM' })
  159. test/jwe/general.test.ts:293 test path .setUnprotectedHeader({ alg: 'unsupported', enc: 'A128GCM' })
  160. test/jwe/general.test.ts:295 test path .setUnprotectedHeader({ alg: 'A128KW', enc: 'A256GCM' })
  161. test/jwe/general.test.ts:308 test path .setProtectedHeader({ enc: 'A128GCM' })
  162. test/jwe/general.test.ts:310 test path .setUnprotectedHeader({ alg: 'A128KW' })
  163. test/jwe/general.test.ts:474 test path .setUnprotectedHeader({ alg: 'A128GCMKW' })
  164. test/jwe/general.test.ts:636 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  165. test/jwe/general.test.ts:649 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  166. test/jwe/general.test.ts:695 test path .setProtectedHeader({ enc: 'A128GCM', p2c: 4096 })
  167. test/jwe/general.test.ts:699 test path .setUnprotectedHeader({ alg: 'A128GCMKW' })
  168. test/jwe/general.test.ts:705 test path .setProtectedHeader({ enc: 'A128GCM' })
  169. test/jwe/general.test.ts:708 test path .setUnprotectedHeader({ alg: 'A128GCMKW' })
  170. test/jwe/zip.test.ts:22 test path t.context.secret = await generateSecret('A128GCM')
  171. test/jwe/zip.test.ts:28 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  172. test/jwe/zip.test.ts:37 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  173. test/jwe/zip.test.ts:46 test path .setProtectedHeader({ enc: 'A128GCM', zip: 'DEF' })
  174. test/jwe/zip.test.ts:48 test path .setUnprotectedHeader({ alg: 'A128GCMKW' })
  175. test/jwe/zip.test.ts:57 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  176. test/jwe/zip.test.ts:67 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  177. test/jwe/zip.test.ts:79 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  178. test/jwe/zip.test.ts:92 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  179. test/jwe/zip.test.ts:111 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  180. test/jwe/zip.test.ts:124 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  181. test/jwe/zip.test.ts:168 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'gzip' })
  182. test/jwe/zip.test.ts:180 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  183. test/jwe/zip.test.ts:191 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  184. test/jwe/zip.test.ts:202 test path const secret1 = await generateSecret('A128KW')
  185. test/jwe/zip.test.ts:203 test path const secret2 = await generateSecret('A128KW')
  186. test/jwe/zip.test.ts:207 test path .setProtectedHeader({ enc: 'A128GCM' })
  187. test/jwe/zip.test.ts:210 test path .setUnprotectedHeader({ alg: 'A128KW' })
  188. test/jwe/zip.test.ts:212 test path .setUnprotectedHeader({ alg: 'A128KW' })
  189. test/jwe/zip.test.ts:222 test path .setProtectedHeader({ enc: 'A128GCM' })
  190. test/jwe/zip.test.ts:224 test path .setUnprotectedHeader({ alg: 'A128KW' })
  191. test/jwe/zip.test.ts:226 test path .setUnprotectedHeader({ alg: 'A128KW', zip: 'DEF' })
  192. test/jwe/zip.test.ts:237 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  193. test/jwe/zip.test.ts:258 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  194. test/jwe/zip.test.ts:264 test path protected: btoa(JSON.stringify({ alg: 'dir', enc: 'A128GCM', zip: 'gzip' }))
  195. test/jwe/zip.test.ts:279 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  196. test/jwk/import.test.ts:22 test path for (const alg of ['HS256', 'A128KW']) {
  197. test/jwk/key_input.test.ts:189 test path new CompactEncrypt(payload).setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' }).encrypt(key)
  198. test/jwk/key_input.test.ts:266 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  199. test/jwk/key_input.test.ts:278 test path new CompactEncrypt(payload).setProtectedHeader({ alg: 'A256KW', enc: 'A128GCM' }).encrypt(key),
  200. test/jwk/key_input.test.ts:285 test path .setProtectedHeader({ alg: 'A256GCMKW', enc: 'A128GCM' })

Showing the first 200. The CBOM has every one.

jose.algorithm · CWE-327
AES-128 Reduced margin 162 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Grover's algorithm halves the effective strength; the parameter, not the design, is the problem.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jwe.mjs:76 enc: 'A128CBC-HS256',
  2. cookbook/jwe.mjs:92 enc: 'A128CBC-HS256',
  3. cookbook/jwe.mjs:139 enc: 'A128GCM',
  4. cookbook/jwe.mjs:164 enc: 'A128GCM',
  5. cookbook/jwe.mjs:211 enc: 'A128CBC-HS256',
  6. cookbook/jwe.mjs:236 enc: 'A128CBC-HS256',
  7. cookbook/jwe.mjs:271 alg: 'A128GCM',
  8. cookbook/jwe.mjs:275 enc: 'A128GCM',
  9. cookbook/jwe.mjs:284 enc: 'A128GCM',
  10. cookbook/jwe.mjs:324 enc: 'A128CBC-HS256',
  11. cookbook/jwe.mjs:340 enc: 'A128CBC-HS256',
  12. cookbook/jwe.mjs:382 alg: 'A128KW',
  13. cookbook/jwe.mjs:385 alg: 'A128KW',
  14. cookbook/jwe.mjs:386 enc: 'A128GCM',
  15. cookbook/jwe.mjs:395 alg: 'A128KW',
  16. cookbook/jwe.mjs:397 enc: 'A128GCM',
  17. cookbook/jwe.mjs:438 alg: 'A128KW',
  18. cookbook/jwe.mjs:441 alg: 'A128KW',
  19. cookbook/jwe.mjs:442 enc: 'A128GCM',
  20. cookbook/jwe.mjs:454 alg: 'A128KW',
  21. cookbook/jwe.mjs:456 enc: 'A128GCM',
  22. cookbook/jwe.mjs:499 alg: 'A128KW',
  23. cookbook/jwe.mjs:502 alg: 'A128KW',
  24. cookbook/jwe.mjs:503 enc: 'A128GCM',
  25. cookbook/jwe.mjs:515 alg: 'A128KW',
  26. cookbook/jwe.mjs:517 enc: 'A128GCM',
  27. cookbook/jwe.mjs:559 alg: 'A128KW',
  28. cookbook/jwe.mjs:562 alg: 'A128KW',
  29. cookbook/jwe.mjs:563 enc: 'A128GCM',
  30. cookbook/jwe.mjs:572 enc: 'A128GCM',
  31. cookbook/jwe.mjs:575 alg: 'A128KW',
  32. cookbook/jwe.mjs:587 alg: 'A128KW',
  33. cookbook/jwe.mjs:599 alg: 'A128KW',
  34. cookbook/jwe.mjs:621 alg: 'A128KW',
  35. cookbook/jwe.mjs:624 alg: 'A128KW',
  36. cookbook/jwe.mjs:625 enc: 'A128GCM',
  37. cookbook/jwe.mjs:634 alg: 'A128KW',
  38. cookbook/jwe.mjs:636 enc: 'A128GCM',
  39. cookbook/jwe.mjs:647 alg: 'A128KW',
  40. cookbook/jwe.mjs:649 enc: 'A128GCM',
  41. cookbook/jwe.mjs:658 alg: 'A128KW',
  42. cookbook/jwe.mjs:660 enc: 'A128GCM',
  43. test/jwe/compact.decrypt.test.ts:34 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  44. test/jwe/compact.decrypt.test.ts:39 test path t.deepEqual(protectedHeader, { alg: 'dir', enc: 'A128GCM' })
  45. test/jwe/compact.decrypt.test.ts:60 test path const protectedHeader = { alg: 'dir', enc: 'A128GCM' } as const
  46. test/jwe/compact.encrypt.test.ts:32 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  47. test/jwe/compact.encrypt.test.ts:48 test path enc: 'A128GCM',
  48. test/jwe/compact.encrypt.test.ts:141 test path .setProtectedHeader({ enc: 'A128GCM' })
  49. test/jwe/compact.encrypt.test.ts:165 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  50. test/jwe/compact.encrypt.test.ts:176 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  51. test/jwe/compact.encrypt.test.ts:194 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  52. test/jwe/flattened.decrypt.test.ts:24 test path .setSharedUnprotectedHeader({ alg: 'dir', enc: 'A128GCM' })
  53. test/jwe/flattened.decrypt.test.ts:187 test path jwe.unprotected = { enc: 'A128GCM' }
  54. test/jwe/flattened.decrypt.test.ts:219 test path protected: base64url.encode(JSON.stringify({ alg: 'ECDH-ES+A128KW', enc: 'A128GCM' })),
  55. test/jwe/flattened.decrypt.test.ts:234 test path .setProtectedHeader({ alg: 'ECDH-ES+A128KW', enc: 'A128GCM' })
  56. test/jwe/flattened.decrypt.test.ts:298 test path .setProtectedHeader({ alg: 'A128GCMKW', enc: 'A128GCM' })
  57. test/jwe/flattened.decrypt.test.ts:328 test path .setSharedUnprotectedHeader({ alg: 'dir', enc: 'A128GCM' })
  58. test/jwe/flattened.decrypt.test.ts:330 test path const unprotected = { alg: 'A256KW', enc: 'A128GCM' }
  59. test/jwe/flattened.decrypt.test.ts:347 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  60. test/jwe/flattened.decrypt.test.ts:367 test path const protectedHeader = base64url.encode(JSON.stringify({ alg: 'dir', enc: 'A128GCM' }))
  61. test/jwe/flattened.decrypt.test.ts:411 test path .setProtectedHeader({ alg: 'dir', enc: 'A128CBC-HS256' })
  62. test/jwe/flattened.decrypt.test.ts:447 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128CBC-HS256' })
  63. test/jwe/flattened.decrypt.test.ts:489 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128CBC-HS256' })
  64. test/jwe/flattened.decrypt.test.ts:510 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128CBC-HS256' })
  65. test/jwe/flattened.decrypt.test.ts:537 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128CBC-HS256' })
  66. test/jwe/flattened.decrypt.test.ts:549 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  67. test/jwe/flattened.decrypt.test.ts:566 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  68. test/jwe/flattened.decrypt.test.ts:609 test path .setProtectedHeader({ alg: 'RSA-OAEP-256', enc: 'A128GCM' })
  69. test/jwe/flattened.decrypt.test.ts:636 test path .setProtectedHeader({ alg: 'A128GCMKW', enc: 'A128GCM' })
  70. test/jwe/flattened.decrypt.test.ts:664 test path .setSharedUnprotectedHeader({ alg: 'dir', enc: 'A128GCM' })
  71. test/jwe/flattened.encrypt.test.ts:24 test path .setUnprotectedHeader({ enc: 'A128GCM' })
  72. test/jwe/flattened.encrypt.test.ts:29 test path enc: 'A128GCM',
  73. test/jwe/flattened.encrypt.test.ts:40 test path .setSharedUnprotectedHeader({ enc: 'A128GCM' })
  74. test/jwe/flattened.encrypt.test.ts:45 test path enc: 'A128GCM',
  75. test/jwe/flattened.encrypt.test.ts:55 test path .setSharedUnprotectedHeader({ alg: 'dir', enc: 'A128GCM' })
  76. test/jwe/flattened.encrypt.test.ts:61 test path enc: 'A128GCM',
  77. test/jwe/flattened.encrypt.test.ts:72 test path .setSharedUnprotectedHeader({ enc: 'A128GCM' })
  78. test/jwe/flattened.encrypt.test.ts:78 test path enc: 'A128GCM',
  79. test/jwe/flattened.encrypt.test.ts:146 test path .setUnprotectedHeader({ alg: 'dir', enc: 'A128GCM' })
  80. test/jwe/flattened.encrypt.test.ts:153 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  81. test/jwe/flattened.encrypt.test.ts:161 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  82. test/jwe/flattened.encrypt.test.ts:173 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  83. test/jwe/flattened.encrypt.test.ts:185 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', crit: ['foo'], foo })
  84. test/jwe/flattened.encrypt.test.ts:192 test path .setProtectedHeader({ enc: 'A128GCM', crit: ['foo'] })
  85. test/jwe/flattened.encrypt.test.ts:201 test path .setProtectedHeader({ enc: 'A128GCM', crit: ['foo'] })
  86. test/jwe/flattened.encrypt.test.ts:210 test path enc: 'A128GCM',
  87. test/jwe/flattened.encrypt.test.ts:224 test path const inherited = Object.create({ alg: 'dir', enc: 'A128GCM' })
  88. test/jwe/flattened.encrypt.test.ts:283 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  89. test/jwe/flattened.encrypt.test.ts:294 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  90. test/jwe/flattened.encrypt.test.ts:310 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  91. test/jwe/flattened.encrypt.test.ts:321 test path .setProtectedHeader({ alg: 'A128GCMKW', enc: 'A128GCM' })
  92. test/jwe/flattened.encrypt.test.ts:335 test path .setProtectedHeader({ enc: 'A128GCM' })
  93. test/jwe/flattened.encrypt.test.ts:360 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  94. test/jwe/flattened.encrypt.test.ts:371 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  95. test/jwe/flattened.encrypt.test.ts:386 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  96. test/jwe/flattened.encrypt.test.ts:403 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  97. test/jwe/flattened.encrypt.test.ts:418 test path .setProtectedHeader({ alg, enc: 'A128GCM' })
  98. test/jwe/flattened.encrypt.test.ts:437 test path protectedParameters ? { alg, enc: 'A128GCM', apu, apv } : { alg, enc: 'A128GCM' },
  99. test/jwe/flattened.encrypt.test.ts:451 test path .setProtectedHeader({ alg: 'A128GCMKW', enc: 'A128GCM' })
  100. test/jwe/flattened.encrypt.test.ts:467 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  101. test/jwe/flattened.encrypt.test.ts:479 test path .setProtectedHeader({ alg: 'A128GCMKW', enc: 'A128GCM' })
  102. test/jwe/flattened.encrypt.test.ts:492 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  103. test/jwe/flattened.encrypt.test.ts:512 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  104. test/jwe/flattened.encrypt.test.ts:549 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  105. test/jwe/general.test.ts:33 test path .setUnprotectedHeader({ alg: 'A128GCMKW' })
  106. test/jwe/general.test.ts:65 test path .setProtectedHeader({ enc: 'A128GCM', crit: ['foo'] })
  107. test/jwe/general.test.ts:69 test path .setUnprotectedHeader({ alg: 'A128KW', foo: () => true })
  108. test/jwe/general.test.ts:129 test path return { alg: 'A128KW' }
  109. test/jwe/general.test.ts:165 test path .setUnprotectedHeader({ alg: 'A128KW' })
  110. test/jwe/general.test.ts:179 test path .setProtectedHeader({ enc: 'A128GCM' })
  111. test/jwe/general.test.ts:183 test path .setUnprotectedHeader({ alg: 'A128GCMKW' })
  112. test/jwe/general.test.ts:194 test path .setProtectedHeader({ enc: 'A128GCM' })
  113. test/jwe/general.test.ts:199 test path .setUnprotectedHeader({ alg: 'A128KW' })
  114. test/jwe/general.test.ts:212 test path .setUnprotectedHeader({ alg: 'A128GCMKW' })
  115. test/jwe/general.test.ts:242 test path enc: 'A128GCM',
  116. test/jwe/general.test.ts:245 test path encrypt.addRecipient(t.context.secret2).setUnprotectedHeader({ alg: 'A128KW' })
  117. test/jwe/general.test.ts:278 test path .setProtectedHeader({ enc: 'A128GCM' })
  118. test/jwe/general.test.ts:293 test path .setUnprotectedHeader({ alg: 'unsupported', enc: 'A128GCM' })
  119. test/jwe/general.test.ts:295 test path .setUnprotectedHeader({ alg: 'A128KW', enc: 'A256GCM' })
  120. test/jwe/general.test.ts:308 test path .setProtectedHeader({ enc: 'A128GCM' })
  121. test/jwe/general.test.ts:310 test path .setUnprotectedHeader({ alg: 'A128KW' })
  122. test/jwe/general.test.ts:474 test path .setUnprotectedHeader({ alg: 'A128GCMKW' })
  123. test/jwe/general.test.ts:636 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  124. test/jwe/general.test.ts:649 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  125. test/jwe/general.test.ts:695 test path .setProtectedHeader({ enc: 'A128GCM', p2c: 4096 })
  126. test/jwe/general.test.ts:699 test path .setUnprotectedHeader({ alg: 'A128GCMKW' })
  127. test/jwe/general.test.ts:705 test path .setProtectedHeader({ enc: 'A128GCM' })
  128. test/jwe/general.test.ts:708 test path .setUnprotectedHeader({ alg: 'A128GCMKW' })
  129. test/jwe/zip.test.ts:28 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  130. test/jwe/zip.test.ts:37 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  131. test/jwe/zip.test.ts:46 test path .setProtectedHeader({ enc: 'A128GCM', zip: 'DEF' })
  132. test/jwe/zip.test.ts:48 test path .setUnprotectedHeader({ alg: 'A128GCMKW' })
  133. test/jwe/zip.test.ts:57 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  134. test/jwe/zip.test.ts:67 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  135. test/jwe/zip.test.ts:79 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  136. test/jwe/zip.test.ts:92 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  137. test/jwe/zip.test.ts:111 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  138. test/jwe/zip.test.ts:124 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  139. test/jwe/zip.test.ts:168 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'gzip' })
  140. test/jwe/zip.test.ts:180 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  141. test/jwe/zip.test.ts:191 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  142. test/jwe/zip.test.ts:207 test path .setProtectedHeader({ enc: 'A128GCM' })
  143. test/jwe/zip.test.ts:210 test path .setUnprotectedHeader({ alg: 'A128KW' })
  144. test/jwe/zip.test.ts:212 test path .setUnprotectedHeader({ alg: 'A128KW' })
  145. test/jwe/zip.test.ts:222 test path .setProtectedHeader({ enc: 'A128GCM' })
  146. test/jwe/zip.test.ts:224 test path .setUnprotectedHeader({ alg: 'A128KW' })
  147. test/jwe/zip.test.ts:226 test path .setUnprotectedHeader({ alg: 'A128KW', zip: 'DEF' })
  148. test/jwe/zip.test.ts:237 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  149. test/jwe/zip.test.ts:258 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  150. test/jwe/zip.test.ts:264 test path protected: btoa(JSON.stringify({ alg: 'dir', enc: 'A128GCM', zip: 'gzip' }))
  151. test/jwe/zip.test.ts:279 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  152. test/jwk/key_input.test.ts:189 test path new CompactEncrypt(payload).setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' }).encrypt(key)
  153. test/jwk/key_input.test.ts:266 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A128GCM' })
  154. test/jwk/key_input.test.ts:278 test path new CompactEncrypt(payload).setProtectedHeader({ alg: 'A256KW', enc: 'A128GCM' }).encrypt(key),
  155. test/jwk/key_input.test.ts:285 test path .setProtectedHeader({ alg: 'A256GCMKW', enc: 'A128GCM' })
  156. test/jwt/encrypt.test.ts:30 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  157. test/jwt/encrypt.test.ts:46 test path enc: 'A128GCM',
  158. test/jwt/encrypt.test.ts:62 test path enc: 'A128GCM',
  159. test/jwt/encrypt.test.ts:80 test path let enc = new EncryptJWT().setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })[method](value)
  160. test/jwt/encrypt.test.ts:130 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  161. test/jwt/encrypt.test.ts:203 test path enc: 'A128GCM',
  162. test/jwt/encrypt.test.ts:242 test path enc: 'A128GCM',
js.jwt.algorithm · CWE-327
PBKDF2 Reduced margin 36 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Not broken by a quantum computer, but weak against modern GPU cracking at low iteration counts, which is a present-day concern.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jwe.mjs:75 alg: 'PBES2-HS512+A256KW',
  2. cookbook/jwe.mjs:88 alg: 'PBES2-HS512+A256KW',
  3. src/lib/jwe_algorithms.ts:142 'PBES2-HS256+A128KW': pbes2(),
  4. src/lib/jwe_algorithms.ts:143 'PBES2-HS384+A192KW': pbes2(),
  5. src/lib/jwe_algorithms.ts:144 'PBES2-HS512+A256KW': pbes2(),
  6. src/types.d.ts:51 | 'PBES2-HS256+A128KW'
  7. src/types.d.ts:52 | 'PBES2-HS384+A192KW'
  8. src/types.d.ts:53 | 'PBES2-HS512+A256KW'
  9. tap/env.ts:92 case 'PBES2-HS384+A192KW':
  10. tap/env.ts:102 case 'PBES2-HS256+A128KW':
  11. tap/env.ts:103 case 'PBES2-HS384+A192KW':
  12. tap/env.ts:104 case 'PBES2-HS512+A256KW':
  13. tap/pbes2.ts:14 const algorithms = ['PBES2-HS256+A128KW', 'PBES2-HS384+A192KW', 'PBES2-HS512+A256KW']
  14. test/jwe/flattened.decrypt.test.ts:447 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128CBC-HS256' })
  15. test/jwe/flattened.decrypt.test.ts:452 test path flattenedDecrypt(jwe, new Uint8Array(32), { keyManagementAlgorithms: ['PBES2-HS256+A128KW'] }),
  16. test/jwe/flattened.decrypt.test.ts:458 test path keyManagementAlgorithms: ['PBES2-HS256+A128KW'],
  17. test/jwe/flattened.decrypt.test.ts:469 test path keyManagementAlgorithms: ['PBES2-HS256+A128KW'],
  18. test/jwe/flattened.decrypt.test.ts:477 test path keyManagementAlgorithms: ['PBES2-HS256+A128KW'],
  19. test/jwe/flattened.decrypt.test.ts:489 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128CBC-HS256' })
  20. test/jwe/flattened.decrypt.test.ts:499 test path keyManagementAlgorithms: ['PBES2-HS256+A128KW'],
  21. test/jwe/flattened.decrypt.test.ts:510 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128CBC-HS256' })
  22. test/jwe/flattened.decrypt.test.ts:528 test path { keyManagementAlgorithms: ['PBES2-HS256+A128KW'] },
  23. test/jwe/flattened.decrypt.test.ts:537 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128CBC-HS256' })
  24. test/jwe/flattened.encrypt.test.ts:310 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  25. test/jwe/flattened.encrypt.test.ts:360 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  26. test/jwe/flattened.encrypt.test.ts:371 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  27. test/jwe/flattened.encrypt.test.ts:386 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  28. test/jwe/general.test.ts:636 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  29. test/jwe/general.test.ts:649 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  30. test/jwe/general.test.ts:657 test path keyManagementAlgorithms: ['PBES2-HS256+A128KW'],
  31. test/jwe/general.test.ts:697 test path .setUnprotectedHeader({ alg: 'PBES2-HS256+A128KW' })
  32. test/jwe/general.test.ts:710 test path .setUnprotectedHeader({ alg: 'PBES2-HS256+A128KW' })
  33. test/jwk/key_input.test.ts:207 test path for (const alg of ['dir', 'PBES2-HS256+A128KW', 'A256GCMKW', 'A256KW']) {
  34. test/root_facades.test.ts:74 test path 'PBES2-HS256+A128KW',
  35. test/root_facades.test.ts:75 test path 'PBES2-HS384+A192KW',
  36. test/root_facades.test.ts:76 test path 'PBES2-HS512+A256KW',
jose.algorithm · CWE-327
AES-192 Reduced margin 30 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Grover's algorithm halves the effective strength; the parameter, not the design, is the problem.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. src/key/generate_secret.ts:22 | 'A192CBC-HS384'
  2. src/key/generate_secret.ts:25 | 'A192KW'
  3. src/key/generate_secret.ts:28 | 'A192GCMKW'
  4. src/key/generate_secret.ts:31 | 'A192GCM'
  5. src/key/generate_secret.ts:42 'A128CBC-HS256' | 'A192CBC-HS384' | 'A256CBC-HS512'
  6. src/key/generate_secret.ts:104 case 'A192CBC-HS384':
  7. src/key/generate_secret.ts:109 case 'A192KW':
  8. src/key/generate_secret.ts:117 case 'A192GCMKW':
  9. src/key/generate_secret.ts:120 case 'A192GCM':
  10. src/lib/jwe_algorithms.ts:182 'A192CBC-HS384': contentEncryption(384, true),
  11. src/types.d.ts:38 | 'A192KW'
  12. src/types.d.ts:41 | 'A192GCMKW'
  13. src/types.d.ts:64 | 'A192CBC-HS384'
  14. src/types.d.ts:67 | 'A192GCM'
  15. tap/aes.ts:16 'A192GCM',
  16. tap/aes.ts:19 'A192CBC-HS384',
  17. tap/aeskw.ts:14 const algorithms = ['A128KW', 'A192KW', 'A256KW', 'A128GCMKW', 'A192GCMKW', 'A256GCMKW']
  18. tap/env.ts:88 case 'A192CBC-HS384':
  19. tap/env.ts:89 case 'A192GCM':
  20. tap/env.ts:90 case 'A192GCMKW':
  21. tap/env.ts:91 case 'A192KW':
  22. tap/env.ts:100 case 'A192KW':
  23. tap/keyobject-stub.ts:43 case 'A192CBC-HS384':
  24. tap/keyobject-stub.ts:48 case 'A192KW':
  25. tap/keyobject-stub.ts:51 case 'A192GCMKW':
  26. tap/keyobject-stub.ts:54 case 'A192GCM':
  27. test/root_facades.test.ts:69 test path 'A192KW',
  28. test/root_facades.test.ts:72 test path 'A192GCMKW',
  29. test/root_facades.test.ts:81 test path 'A192GCM',
  30. test/root_facades.test.ts:84 test path 'A192CBC-HS384',
jose.algorithm · CWE-327
PBKDF2 Reduced margin 14 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Not broken by a quantum computer, but weak against modern GPU cracking at low iteration counts, which is a present-day concern.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jwe.mjs:75 alg: 'PBES2-HS512+A256KW',
  2. cookbook/jwe.mjs:88 alg: 'PBES2-HS512+A256KW',
  3. test/jwe/flattened.decrypt.test.ts:447 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128CBC-HS256' })
  4. test/jwe/flattened.decrypt.test.ts:489 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128CBC-HS256' })
  5. test/jwe/flattened.decrypt.test.ts:510 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128CBC-HS256' })
  6. test/jwe/flattened.decrypt.test.ts:537 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128CBC-HS256' })
  7. test/jwe/flattened.encrypt.test.ts:310 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  8. test/jwe/flattened.encrypt.test.ts:360 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  9. test/jwe/flattened.encrypt.test.ts:371 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  10. test/jwe/flattened.encrypt.test.ts:386 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  11. test/jwe/general.test.ts:636 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  12. test/jwe/general.test.ts:649 test path .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128GCM' })
  13. test/jwe/general.test.ts:697 test path .setUnprotectedHeader({ alg: 'PBES2-HS256+A128KW' })
  14. test/jwe/general.test.ts:710 test path .setUnprotectedHeader({ alg: 'PBES2-HS256+A128KW' })
js.jwt.algorithm · CWE-327
unknown Could not be determined 14 places See details

Key pair algorithm chosen at runtime

`generateKeyPair(x, …)` where the first argument is an identifier rather than a literal. Reported as unresolved rather than assumed.

This code picks its encryption method while it runs. A scan cannot tell which one it ends up using.

What to do. Trace the value to its configuration source and record the concrete algorithm by hand.

  1. tap/ecdh.ts:45 kps[k] = await keys.generateKeyPair(alg, { ...options, extractable: true })
  2. tap/ecdh.ts:52 kps[k] = await keys.generateKeyPair(alg, { ...options, extractable: true })
  3. tap/jws.ts:45 kps[alg] = await keys.generateKeyPair(alg, { extractable: true })
  4. tap/jws.ts:52 kps[alg] = await keys.generateKeyPair(alg, { extractable: true })
  5. tap/keyobject-stub.ts:65 async generateKeyPair(alg, options) {
  6. tap/rsaes.ts:30 kps[alg] = await keys.generateKeyPair(alg, { extractable: true })
  7. tap/rsaes.ts:38 kps[alg] = await keys.generateKeyPair(alg, { extractable: true })
  8. test/jwk/generate_key_pair.test.ts:14 test path await t.throwsAsync(generateKeyPair(alg), {
  9. test/jwk/generate_key_pair.test.ts:63 test path await t.throwsAsync(generateKeyPair(alg, { crv }), {
  10. test/jwk/generate_key_pair.test.ts:78 test path const { publicKey } = await generateKeyPair(alg, { crv, extractable: true })
  11. test/jwk/generate_key_pair.test.ts:89 test path const { publicKey } = await generateKeyPair(alg, { extractable: true })
  12. test/jws/restrictions.test.ts:92 test path const { privateKey, publicKey } = await generateKeyPair(alg, { extractable: true })
  13. test/root_facades.test.ts:98 test path const { privateKey, publicKey } = await generateKeyPair(algorithm)
  14. test/root_facades.test.ts:154 test path const { privateKey, publicKey } = await generateKeyPair(algorithm)
js.generatekeypair.variable · CWE-327
unknown Could not be determined Renamed import 4 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

The algorithm could not be established from the source. Usually it is selected while the program runs, but it may equally be that the call gives no clue, or that it is decided somewhere this scan does not reach. Somebody has to check.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. src/jwt/unsecured.ts:79 const encodedProtectedHeader = b64u.encode(JSON.stringify({ alg: 'none' }))
  2. test/jwt/unsecured.test.ts:52 test path JSON.stringify({ alg: 'none', crit: ['urn:example:critical'], 'urn:example:critical': true }),
  3. test/jwt/unsecured.test.ts:63 test path const header = base64url.encode(JSON.stringify({ alg: 'none', b64: false, crit: ['b64'] }))
  4. test/jwt/unsecured.test.ts:75 test path `${base64url.encode(JSON.stringify({ alg: 'none', ...header }))}.${payload}.`
js.jwt.algorithm · CWE-327
unknown Could not be determined 2 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

The algorithm could not be established from the source. Usually it is selected while the program runs, but it may equally be that the call gives no clue, or that it is decided somewhere this scan does not reach. Somebody has to check.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. docs/jwt/unsecured/README.md:9 | [UnsecuredJWT](classes/UnsecuredJWT.md) | Encodes and decodes `{ "alg": "none" }` Unsecured JWTs. |
  2. docs/jwt/unsecured/classes/UnsecuredJWT.md:7 Encodes and decodes `{ "alg": "none" }` Unsecured JWTs.
jose.algorithm · CWE-327
unknown255-bitother/Curve25519 Could not be determined 2 places See details

Classical key generated with WebCrypto

`subtle.generateKey({name: …})` naming RSA-OAEP, RSA-PSS, RSASSA-PKCS1-v1_5, ECDSA or ECDH. The algorithm name is taken from the object literal.

The algorithm could not be established from the source. Usually it is selected while the program runs, but it may equally be that the call gives no clue, or that it is decided somewhere this scan does not reach. Somebody has to check.

What to do. No post-quantum algorithm is in the WebCrypto specification yet. Where the key protects long-lived data, move that operation server-side.

  1. src/lib/jwe_algorithms.ts:82 return { name: 'X25519' }
  2. test/jwe/flattened.encrypt.test.ts:505 test path ['X25519', { name: 'X25519' }],
js.webcrypto.generatekey · CWE-327
unknown255-bitother/Ed25519 Could not be determined 1 place See details

Classical key generated with WebCrypto

`subtle.generateKey({name: …})` naming RSA-OAEP, RSA-PSS, RSASSA-PKCS1-v1_5, ECDSA or ECDH. The algorithm name is taken from the object literal.

The algorithm could not be established from the source. Usually it is selected while the program runs, but it may equally be that the call gives no clue, or that it is decided somewhere this scan does not reach. Somebody has to check.

What to do. No post-quantum algorithm is in the WebCrypto specification yet. Where the key protects long-lived data, move that operation server-side.

  1. src/lib/jws_algorithms.ts:52 const subtle = { name: 'Ed25519' }
js.webcrypto.generatekey · CWE-327
ML-DSA-44 Quantum-safe 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

  1. tap/fixtures.ts:221 -----BEGIN PRIVATE KEY-----
pem.private-key · CWE-321, CWE-327
ML-DSA-65 Quantum-safe 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

  1. tap/fixtures.ts:264 -----BEGIN PRIVATE KEY-----
pem.private-key · CWE-321, CWE-327
ML-DSA-87 Quantum-safe 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

  1. tap/fixtures.ts:321 -----BEGIN PRIVATE KEY-----
pem.private-key · CWE-321, CWE-327
HMAC Quantum-safe 196 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. A keyed MAC is not affected by Shor and only marginally by Grover.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jws.mjs:200 alg: 'HS256',
  2. cookbook/jws.mjs:203 alg: 'HS256',
  3. cookbook/jws.mjs:207 alg: 'HS256',
  4. cookbook/jws.mjs:245 alg: 'HS256',
  5. cookbook/jws.mjs:248 alg: 'HS256',
  6. cookbook/jws.mjs:252 alg: 'HS256',
  7. cookbook/jws.mjs:294 alg: 'HS256',
  8. cookbook/jws.mjs:297 alg: 'HS256',
  9. cookbook/jws.mjs:301 alg: 'HS256',
  10. cookbook/jws.mjs:312 alg: 'HS256',
  11. cookbook/jws.mjs:323 alg: 'HS256',
  12. cookbook/jws.mjs:338 alg: 'HS256',
  13. cookbook/jws.mjs:341 alg: 'HS256',
  14. cookbook/jws.mjs:345 alg: 'HS256',
  15. src/key/generate_secret.ts:18 | 'HS256'
  16. src/key/generate_secret.ts:19 | 'HS384'
  17. src/key/generate_secret.ts:20 | 'HS512'
  18. src/key/generate_secret.ts:95 case 'HS256':
  19. src/key/generate_secret.ts:96 case 'HS384':
  20. src/key/generate_secret.ts:97 case 'HS512':
  21. src/types.d.ts:9 | 'HS256'
  22. src/types.d.ts:10 | 'HS384'
  23. src/types.d.ts:11 | 'HS512'
  24. tap/general.ts:46 const b = await keys.generateSecret('HS256', { extractable: true })
  25. tap/general.ts:52 .setProtectedHeader({ alg: 'HS256' })
  26. tap/general.ts:62 const stranger = await keys.generateSecret('HS256', { extractable: true })
  27. tap/generate_options.ts:15 const secret = (await lib.generateSecret('HS256', { extractable })) as CryptoKey
  28. tap/hmac.ts:13 const algorithms = ['HS256', 'HS384', 'HS512']
  29. tap/keyobject-stub.ts:39 case 'HS256':
  30. tap/keyobject-stub.ts:40 case 'HS384':
  31. tap/keyobject-stub.ts:41 case 'HS512':
  32. test-d/api.ts:304 test path const hs = await jose.generateSecret('HS256')
  33. test-d/api.ts:318 test path const _generatedHmac: Equals<GeneratedSecret<'HS256'>, jose.CryptoKey> = true
  34. test-d/api.ts:481 test path .setProtectedHeader({ alg: 'HS256' })
  35. test/jwk/generate_key_pair.test.ts:33 test path await t.throwsAsync(generateSecret('HS256', { extractable: 'false' as never }), {
  36. test/jwk/generate_key_pair.test.ts:41 test path (options) => generateSecret('HS256', options),
  37. test/jwk/import.test.ts:22 test path for (const alg of ['HS256', 'A128KW']) {
  38. test/jwk/issue-459.test.ts:45 test path await t.throwsAsync(importX509(cert, 'HS256'), {
  39. test/jwk/jwk2key.test.ts:35 test path await t.throwsAsync(importJWK({ kty: 'unrecognized' }, 'HS256'), {
  40. test/jwk/jwk2key.test.ts:58 test path await t.throwsAsync(importJWK({ kty: 'oct' }, 'HS256'), {
  41. test/jwk/jwk2key.test.ts:100 test path [...(await importJWK(oct, 'HS256'))],
  42. test/jwk/jwk2key.test.ts:117 test path 'HS256',
  43. test/jwk/jwk2key.test.ts:146 test path 'HS256',
  44. test/jwk/jwk2key.test.ts:179 test path 'HS256',
  45. test/jwk/jwk2key.test.ts:182 test path t.deepEqual(secret, await importJWK({ k: first, kty: 'oct' }, 'HS256'))
  46. test/jwk/jwk2key.test.ts:210 test path 'HS256',
  47. test/jwk/key_input.test.ts:80 test path .setProtectedHeader({ alg: 'HS256' })
  48. test/jwk/key_input.test.ts:102 test path const signature = await new CompactSign(payload).setProtectedHeader({ alg: 'HS256' }).sign(jwk)
  49. test/jwk/key_input.test.ts:145 test path new CompactSign(payload).setProtectedHeader({ alg: 'HS256' }).sign(key as never),
  50. test/jwk/key_input.test.ts:164 test path const secret = await generateSecret('HS256')
  51. test/jwk/key_input.test.ts:173 test path await t.throwsAsync(sign('HS256', privateKey), {
  52. test/jwk/key_input.test.ts:203 test path for (const key of [bytes, await generateSecret('HS256'), createSecretKey(bytes)]) {
  53. test/jwk/key_input.test.ts:204 test path const jws = await new CompactSign(payload).setProtectedHeader({ alg: 'HS256' }).sign(key)
  54. test/jwk/key_input.test.ts:223 test path new CompactSign(payload).setProtectedHeader({ alg: 'HS256' }).sign(jwk)
  55. test/jwk/key_input.test.ts:224 test path for (const metadata of [{}, { use: 'sig' }, { key_ops: ['sign'] }, { alg: 'HS256' }]) {
  56. test/jwk/key_input.test.ts:229 test path [{ alg: 'HS384' }, 'Invalid key for this operation, its "alg" must be "HS256" when present'],
  57. test/jws/compact.sign.test.ts:13 test path .setProtectedHeader({ alg: 'HS256' })
  58. test/jws/compact.verify.test.ts:15 test path .setProtectedHeader({ alg: 'HS256' })
  59. test/jws/compact.verify.test.ts:34 test path .setProtectedHeader({ alg: 'HS256' })
  60. test/jws/compact.verify.test.ts:44 test path const encoded = base64url.encode(JSON.stringify({ alg: 'HS256' }))
  61. test/jws/compact.verify.test.ts:45 test path const unencoded = base64url.encode(JSON.stringify({ alg: 'HS256', b64: false, crit: ['b64'] }))
  62. test/jws/compact.verify.test.ts:91 test path const original = base64url.encode(JSON.stringify({ alg: 'HS256', kid: 'original' }))
  63. test/jws/compact.verify.test.ts:93 test path .setProtectedHeader({ alg: 'HS256', kid: 'mutated' })
  64. test/jws/compact.verify.test.ts:108 test path .setProtectedHeader({ alg: 'HS256' })
  65. test/jws/compact.verify.test.ts:117 test path t.deepEqual(result.protectedHeader, { alg: 'HS256' })
  66. test/jws/compact.verify.test.ts:124 test path .setProtectedHeader({ alg: 'HS256' })
  67. test/jws/crit.test.ts:10 test path .setProtectedHeader({ alg: 'HS256' })
  68. test/jws/crit.test.ts:20 test path .setProtectedHeader({ alg: 'HS256', crit: [null], b64: false })
  69. test/jws/crit.test.ts:30 test path .setProtectedHeader({ alg: 'HS256', crit: ['nope'], nope: 'foo' })
  70. test/jws/crit.test.ts:43 test path .setProtectedHeader({ alg: 'HS256', crit: ['foo'], foo: true })
  71. test/jws/crit.test.ts:56 test path .setProtectedHeader({ alg: 'HS256', crit: ['foo'], foo })
  72. test/jws/crit.test.ts:64 test path .setUnprotectedHeader({ alg: 'HS256', foo })
  73. test/jws/crit.test.ts:73 test path .setUnprotectedHeader({ alg: 'HS256', foo: true })
  74. test/jws/crit.test.ts:81 test path alg: 'HS256',
  75. test/jws/crit.test.ts:86 test path return { alg: 'HS256' }
  76. test/jws/crit.test.ts:97 test path .setProtectedHeader({ alg: 'HS256', b64: true, crit: ['b64', 'b64'] })
  77. test/jws/crit.test.ts:107 test path .setProtectedHeader({ alg: 'HS256', b64: true, crit: ['b64'] })
  78. test/jws/crit.test.ts:124 test path const protectedHeader = base64url.encode(JSON.stringify({ alg: 'HS256', crit: [parameter] }))
  79. test/jws/crit.test.ts:148 test path .setProtectedHeader({ alg: 'HS256', b64: true, crit: ['b64'] })
  80. test/jws/flattened.sign.test.ts:14 test path alg: 'HS256',
  81. test/jws/flattened.sign.test.ts:34 test path .setProtectedHeader({ alg: 'HS256' })
  82. test/jws/flattened.sign.test.ts:48 test path .setProtectedHeader({ alg: 'HS256' })
  83. test/jws/flattened.sign.test.ts:58 test path .setUnprotectedHeader({ alg: 'HS256' })
  84. test/jws/flattened.sign.test.ts:62 test path alg: 'HS256',
  85. test/jws/flattened.sign.test.ts:115 test path .setUnprotectedHeader({ alg: 'HS256' })
  86. test/jws/flattened.sign.test.ts:122 test path .setProtectedHeader({ alg: 'HS256' })
  87. test/jws/flattened.sign.test.ts:140 test path .setProtectedHeader({ alg: 'HS256' })
  88. test/jws/flattened.sign.test.ts:141 test path .setUnprotectedHeader({ alg: 'HS256' })
  89. test/jws/flattened.sign.test.ts:163 test path .setProtectedHeader({ alg: 'HS256' })
  90. test/jws/flattened.sign.test.ts:169 test path .setProtectedHeader({ alg: 'HS256' })
  91. test/jws/flattened.sign.test.ts:175 test path .setUnprotectedHeader({ alg: 'HS256' })
  92. test/jws/flattened.sign.test.ts:180 test path .setUnprotectedHeader({ alg: 'HS256' })
  93. test/jws/flattened.sign.test.ts:186 test path const inherited = Object.create({ alg: 'HS256' })
  94. test/jws/flattened.sign.test.ts:187 test path const nonEnumerable = Object.defineProperty({}, 'alg', { value: 'HS256' })
  95. test/jws/flattened.verify.test.ts:15 test path .setUnprotectedHeader({ alg: 'HS256' })
  96. test/jws/flattened.verify.test.ts:40 test path .setProtectedHeader({ alg: 'HS256' })
  97. test/jws/flattened.verify.test.ts:112 test path jws.header = { alg: 'HS256', bar: 'bar' }
  98. test/jws/flattened.verify.test.ts:152 test path .setProtectedHeader({ alg: 'HS256' })
  99. test/jws/flattened.verify.test.ts:170 test path .setProtectedHeader({ alg: 'HS256' })
  100. test/jws/flattened.verify.test.ts:182 test path .setProtectedHeader({ alg: 'HS256' })
  101. test/jws/flattened.verify.test.ts:198 test path .setUnprotectedHeader({ alg: 'HS256' })
  102. test/jws/general.test.ts:16 test path .setUnprotectedHeader({ alg: 'HS256' })
  103. test/jws/general.test.ts:19 test path .setUnprotectedHeader({ alg: 'HS384' })
  104. test/jws/general.test.ts:33 test path .setProtectedHeader({ alg: 'HS256' })
  105. test/jws/general.test.ts:38 test path return 'HS256'
  106. test/jws/general.test.ts:59 test path .setUnprotectedHeader({ alg: 'HS256' })
  107. test/jws/general.test.ts:62 test path .setUnprotectedHeader({ alg: 'HS384' })
  108. test/jws/general.test.ts:72 test path alg: 'HS256',
  109. test/jws/general.test.ts:84 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  110. test/jws/general.test.ts:99 test path .setProtectedHeader({ bar: 'baz', crit: ['b64'], b64: false, alg: 'HS256' })
  111. test/jws/general.test.ts:100 test path .setProtectedHeader({ bar: 'baz', crit: ['b64'], b64: false, alg: 'HS256' })
  112. test/jws/general.test.ts:109 test path .setProtectedHeader({ bar: 'baz', crit: ['b64'], b64: true, alg: 'HS384' })
  113. test/jws/general.test.ts:128 test path .setUnprotectedHeader({ alg: 'HS256' })
  114. test/jws/general.test.ts:136 test path .setProtectedHeader({ alg: 'HS256' })
  115. test/jws/general.test.ts:146 test path .setProtectedHeader({ alg: 'HS256' })
  116. test/jws/general.test.ts:149 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  117. test/jws/general.test.ts:178 test path .setProtectedHeader({ alg: 'HS256', b64: false })
  118. test/jws/general.test.ts:191 test path alg: 'HS256',
  119. test/jws/general.test.ts:240 test path t.deepEqual(afterSwitching.protectedHeader, { alg: 'HS256' })
  120. test/jws/general.test.ts:257 test path .setUnprotectedHeader({ alg: 'HS256' })
  121. test/jws/general.test.ts:266 test path .setProtectedHeader({ alg: 'HS256' })
  122. test/jws/general.test.ts:325 test path .setUnprotectedHeader({ alg: 'HS256' })
  123. test/jws/general.test.ts:338 test path .setProtectedHeader({ alg: 'HS256' })
  124. test/jws/general.test.ts:348 test path .setProtectedHeader({ alg: 'HS256' })
  125. test/jws/general.test.ts:350 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  126. test/jws/unencoded.test.ts:8 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  127. test/jws/unencoded.test.ts:24 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  128. test/jws/unencoded.test.ts:38 test path .setProtectedHeader({ alg: 'HS256', b64: null, crit: ['b64'] })
  129. test/jws/unencoded.test.ts:47 test path .setProtectedHeader({ alg: 'HS256', crit: ['b64'] })
  130. test/jws/unencoded.test.ts:53 test path .setProtectedHeader({ alg: 'HS256', crit: ['b64'] })
  131. test/jws/unencoded.test.ts:66 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  132. test/jws/unencoded.test.ts:80 test path alg: 'HS256',
  133. test/jws/unencoded.test.ts:98 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  134. test/jws/unencoded.test.ts:107 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  135. test/jws/unencoded.test.ts:116 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  136. test/jws/unencoded.test.ts:129 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  137. test/jws/unencoded.test.ts:139 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  138. test/jws/unencoded.test.ts:151 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  139. test/jws/unencoded.test.ts:170 test path .setProtectedHeader({ alg: 'HS256', b64 })
  140. test/jws/unencoded.test.ts:178 test path .setProtectedHeader({ alg: 'HS256', b64: null } as never)
  141. test/jws/unencoded.test.ts:184 test path .setProtectedHeader({ alg: 'HS256' })
  142. test/jws/unencoded.test.ts:191 test path .setProtectedHeader({ alg: 'HS256', b64: true, crit: ['b64'] })
  143. test/jwt/property.test.ts:13 test path return new SignJWT(claims).setProtectedHeader({ alg: 'HS256' }).sign(key)
  144. test/jwt/sign.test.ts:20 test path .setProtectedHeader({ alg: 'HS256' })
  145. test/jwt/sign.test.ts:29 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'HS256' }).sign(t.context.secret)
  146. test/jwt/sign.test.ts:39 test path alg: 'HS256',
  147. test/jwt/sign.test.ts:53 test path alg: 'HS256',
  148. test/jwt/sign.test.ts:74 test path .setProtectedHeader({ alg: 'HS256', crit: ['b64'], b64: false })
  149. test/jwt/sign.test.ts:95 test path alg: 'HS256',
  150. test/jwt/sign.test.ts:112 test path () => new SignJWT().setProtectedHeader({ alg: 'HS256' }).setProtectedHeader({ alg: 'HS384' }),
  151. test/jwt/sign.test.ts:164 test path new SignJWT({ [claim]: value }).setProtectedHeader({ alg: 'HS256' }).sign(t.context.secret),
  152. test/jwt/sign.test.ts:173 test path .setProtectedHeader({ alg: 'HS256', b64: false })
  153. test/jwt/sign.test.ts:183 test path .setProtectedHeader({ alg: 'HS256' })
  154. test/jwt/sign.test.ts:188 test path t.is(header.alg, 'HS256')
  155. test/jwt/verify.test.ts:27 test path .setProtectedHeader({ alg: 'HS256', typ })
  156. test/jwt/verify.test.ts:58 test path alg: 'HS256',
  157. test/jwt/verify.test.ts:70 test path .setProtectedHeader({ alg: 'HS256' })
  158. test/jwt/verify.test.ts:81 test path .setProtectedHeader({ alg: 'HS256' })
  159. test/jwt/verify.test.ts:93 test path .setProtectedHeader({ alg: 'HS256' })
  160. test/jwt/verify.test.ts:103 test path .setProtectedHeader({ alg: 'HS256' })
  161. test/jwt/verify.test.ts:129 test path .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
  162. test/jwt/verify.test.ts:140 test path .setProtectedHeader({ alg: 'HS256', typ })
  163. test/jwt/verify.test.ts:166 test path .setProtectedHeader({ alg: 'HS256', typ })
  164. test/jwt/verify.test.ts:192 test path .setProtectedHeader({ alg: 'HS256', typ })
  165. test/jwt/verify.test.ts:213 test path .setProtectedHeader({ alg: 'HS256' })
  166. test/jwt/verify.test.ts:227 test path .setProtectedHeader({ alg: 'HS256' })
  167. test/jwt/verify.test.ts:242 test path .setProtectedHeader({ alg: 'HS256' })
  168. test/jwt/verify.test.ts:256 test path .setProtectedHeader({ alg: 'HS256' })
  169. test/jwt/verify.test.ts:270 test path .setProtectedHeader({ alg: 'HS256' })
  170. test/jwt/verify.test.ts:285 test path .setProtectedHeader({ alg: 'HS256' })
  171. test/jwt/verify.test.ts:300 test path .setProtectedHeader({ alg: 'HS256' })
  172. test/jwt/verify.test.ts:314 test path .setProtectedHeader({ alg: 'HS256' })
  173. test/jwt/verify.test.ts:326 test path .setProtectedHeader({ alg: 'HS256' })
  174. test/jwt/verify.test.ts:335 test path .setProtectedHeader({ alg: 'HS256' })
  175. test/jwt/verify.test.ts:434 test path .setProtectedHeader({ alg: 'HS256', b64: false })
  176. test/jwt/verify.test.ts:445 test path .setProtectedHeader({ alg: 'HS256' })
  177. test/jwt/verify.test.ts:461 test path .setProtectedHeader({ alg: 'HS256' })
  178. test/jwt/verify.test.ts:498 test path .setProtectedHeader({ alg: 'HS256' })
  179. test/jwt/verify.test.ts:516 test path .setProtectedHeader({ alg: 'HS256' })
  180. test/jwt/verify.test.ts:529 test path .setProtectedHeader({ alg: 'HS256' })
  181. test/jwt/verify.test.ts:537 test path .setProtectedHeader({ alg: 'HS256' })
  182. test/jwt/verify.test.ts:554 test path .setProtectedHeader({ alg: 'HS256' })
  183. test/jwt/verify.test.ts:572 test path .setProtectedHeader({ alg: 'HS256' })
  184. test/jwt/verify.test.ts:585 test path .setProtectedHeader({ alg: 'HS256' })
  185. test/jwt/verify.test.ts:600 test path const header = base64url.encode(JSON.stringify({ alg: 'HS256' }))
  186. test/property.test.ts:38 test path const jws = await new CompactSign(payload).setProtectedHeader({ alg: 'HS256' }).sign(key)
  187. test/property.test.ts:42 test path t.deepEqual(result.protectedHeader, { alg: 'HS256' })
  188. test/property.test.ts:51 test path const jws = await new CompactSign(payload).setProtectedHeader({ alg: 'HS256' }).sign(key)
  189. test/property.test.ts:152 test path const jwt = await new SignJWT(payload).setProtectedHeader({ alg: 'HS256' }).sign(key)
  190. test/property.test.ts:157 test path t.deepEqual(result.protectedHeader, { alg: 'HS256' })
  191. test/root_facades.test.ts:39 test path 'HS256',
  192. test/root_facades.test.ts:40 test path 'HS384',
  193. test/root_facades.test.ts:41 test path 'HS512',
  194. test/util/decode_protected_header.test.ts:81 test path t.deepEqual(decodeProtectedHeader('eyJhbGciOiJIUzI1NiJ9..'), { alg: 'HS256' })
  195. test/util/decode_protected_header.test.ts:82 test path t.deepEqual(decodeProtectedHeader('eyJhbGciOiJIUzI1NiJ9....'), { alg: 'HS256' })
  196. test/util/decode_protected_header.test.ts:83 test path t.deepEqual(decodeProtectedHeader({ protected: 'eyJhbGciOiJIUzI1NiJ9' }), { alg: 'HS256' })
jose.algorithm · CWE-327
HMAC Quantum-safe 157 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

No known quantum attack changes how strong this is. A keyed MAC is not affected by Shor and only marginally by Grover.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jws.mjs:200 alg: 'HS256',
  2. cookbook/jws.mjs:203 alg: 'HS256',
  3. cookbook/jws.mjs:207 alg: 'HS256',
  4. cookbook/jws.mjs:245 alg: 'HS256',
  5. cookbook/jws.mjs:248 alg: 'HS256',
  6. cookbook/jws.mjs:252 alg: 'HS256',
  7. cookbook/jws.mjs:294 alg: 'HS256',
  8. cookbook/jws.mjs:297 alg: 'HS256',
  9. cookbook/jws.mjs:301 alg: 'HS256',
  10. cookbook/jws.mjs:312 alg: 'HS256',
  11. cookbook/jws.mjs:323 alg: 'HS256',
  12. cookbook/jws.mjs:338 alg: 'HS256',
  13. cookbook/jws.mjs:341 alg: 'HS256',
  14. cookbook/jws.mjs:345 alg: 'HS256',
  15. tap/general.ts:52 .setProtectedHeader({ alg: 'HS256' })
  16. test-d/api.ts:481 test path .setProtectedHeader({ alg: 'HS256' })
  17. test/jwk/key_input.test.ts:80 test path .setProtectedHeader({ alg: 'HS256' })
  18. test/jwk/key_input.test.ts:102 test path const signature = await new CompactSign(payload).setProtectedHeader({ alg: 'HS256' }).sign(jwk)
  19. test/jwk/key_input.test.ts:145 test path new CompactSign(payload).setProtectedHeader({ alg: 'HS256' }).sign(key as never),
  20. test/jwk/key_input.test.ts:204 test path const jws = await new CompactSign(payload).setProtectedHeader({ alg: 'HS256' }).sign(key)
  21. test/jwk/key_input.test.ts:223 test path new CompactSign(payload).setProtectedHeader({ alg: 'HS256' }).sign(jwk)
  22. test/jwk/key_input.test.ts:224 test path for (const metadata of [{}, { use: 'sig' }, { key_ops: ['sign'] }, { alg: 'HS256' }]) {
  23. test/jwk/key_input.test.ts:229 test path [{ alg: 'HS384' }, 'Invalid key for this operation, its "alg" must be "HS256" when present'],
  24. test/jws/compact.sign.test.ts:13 test path .setProtectedHeader({ alg: 'HS256' })
  25. test/jws/compact.verify.test.ts:15 test path .setProtectedHeader({ alg: 'HS256' })
  26. test/jws/compact.verify.test.ts:34 test path .setProtectedHeader({ alg: 'HS256' })
  27. test/jws/compact.verify.test.ts:44 test path const encoded = base64url.encode(JSON.stringify({ alg: 'HS256' }))
  28. test/jws/compact.verify.test.ts:45 test path const unencoded = base64url.encode(JSON.stringify({ alg: 'HS256', b64: false, crit: ['b64'] }))
  29. test/jws/compact.verify.test.ts:91 test path const original = base64url.encode(JSON.stringify({ alg: 'HS256', kid: 'original' }))
  30. test/jws/compact.verify.test.ts:93 test path .setProtectedHeader({ alg: 'HS256', kid: 'mutated' })
  31. test/jws/compact.verify.test.ts:108 test path .setProtectedHeader({ alg: 'HS256' })
  32. test/jws/compact.verify.test.ts:117 test path t.deepEqual(result.protectedHeader, { alg: 'HS256' })
  33. test/jws/compact.verify.test.ts:124 test path .setProtectedHeader({ alg: 'HS256' })
  34. test/jws/crit.test.ts:10 test path .setProtectedHeader({ alg: 'HS256' })
  35. test/jws/crit.test.ts:20 test path .setProtectedHeader({ alg: 'HS256', crit: [null], b64: false })
  36. test/jws/crit.test.ts:30 test path .setProtectedHeader({ alg: 'HS256', crit: ['nope'], nope: 'foo' })
  37. test/jws/crit.test.ts:43 test path .setProtectedHeader({ alg: 'HS256', crit: ['foo'], foo: true })
  38. test/jws/crit.test.ts:56 test path .setProtectedHeader({ alg: 'HS256', crit: ['foo'], foo })
  39. test/jws/crit.test.ts:64 test path .setUnprotectedHeader({ alg: 'HS256', foo })
  40. test/jws/crit.test.ts:73 test path .setUnprotectedHeader({ alg: 'HS256', foo: true })
  41. test/jws/crit.test.ts:81 test path alg: 'HS256',
  42. test/jws/crit.test.ts:86 test path return { alg: 'HS256' }
  43. test/jws/crit.test.ts:97 test path .setProtectedHeader({ alg: 'HS256', b64: true, crit: ['b64', 'b64'] })
  44. test/jws/crit.test.ts:107 test path .setProtectedHeader({ alg: 'HS256', b64: true, crit: ['b64'] })
  45. test/jws/crit.test.ts:124 test path const protectedHeader = base64url.encode(JSON.stringify({ alg: 'HS256', crit: [parameter] }))
  46. test/jws/crit.test.ts:148 test path .setProtectedHeader({ alg: 'HS256', b64: true, crit: ['b64'] })
  47. test/jws/flattened.sign.test.ts:14 test path alg: 'HS256',
  48. test/jws/flattened.sign.test.ts:34 test path .setProtectedHeader({ alg: 'HS256' })
  49. test/jws/flattened.sign.test.ts:48 test path .setProtectedHeader({ alg: 'HS256' })
  50. test/jws/flattened.sign.test.ts:58 test path .setUnprotectedHeader({ alg: 'HS256' })
  51. test/jws/flattened.sign.test.ts:62 test path alg: 'HS256',
  52. test/jws/flattened.sign.test.ts:115 test path .setUnprotectedHeader({ alg: 'HS256' })
  53. test/jws/flattened.sign.test.ts:122 test path .setProtectedHeader({ alg: 'HS256' })
  54. test/jws/flattened.sign.test.ts:140 test path .setProtectedHeader({ alg: 'HS256' })
  55. test/jws/flattened.sign.test.ts:141 test path .setUnprotectedHeader({ alg: 'HS256' })
  56. test/jws/flattened.sign.test.ts:163 test path .setProtectedHeader({ alg: 'HS256' })
  57. test/jws/flattened.sign.test.ts:169 test path .setProtectedHeader({ alg: 'HS256' })
  58. test/jws/flattened.sign.test.ts:175 test path .setUnprotectedHeader({ alg: 'HS256' })
  59. test/jws/flattened.sign.test.ts:180 test path .setUnprotectedHeader({ alg: 'HS256' })
  60. test/jws/flattened.sign.test.ts:186 test path const inherited = Object.create({ alg: 'HS256' })
  61. test/jws/flattened.verify.test.ts:15 test path .setUnprotectedHeader({ alg: 'HS256' })
  62. test/jws/flattened.verify.test.ts:40 test path .setProtectedHeader({ alg: 'HS256' })
  63. test/jws/flattened.verify.test.ts:112 test path jws.header = { alg: 'HS256', bar: 'bar' }
  64. test/jws/flattened.verify.test.ts:152 test path .setProtectedHeader({ alg: 'HS256' })
  65. test/jws/flattened.verify.test.ts:170 test path .setProtectedHeader({ alg: 'HS256' })
  66. test/jws/flattened.verify.test.ts:182 test path .setProtectedHeader({ alg: 'HS256' })
  67. test/jws/flattened.verify.test.ts:198 test path .setUnprotectedHeader({ alg: 'HS256' })
  68. test/jws/general.test.ts:16 test path .setUnprotectedHeader({ alg: 'HS256' })
  69. test/jws/general.test.ts:19 test path .setUnprotectedHeader({ alg: 'HS384' })
  70. test/jws/general.test.ts:33 test path .setProtectedHeader({ alg: 'HS256' })
  71. test/jws/general.test.ts:59 test path .setUnprotectedHeader({ alg: 'HS256' })
  72. test/jws/general.test.ts:62 test path .setUnprotectedHeader({ alg: 'HS384' })
  73. test/jws/general.test.ts:72 test path alg: 'HS256',
  74. test/jws/general.test.ts:84 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  75. test/jws/general.test.ts:99 test path .setProtectedHeader({ bar: 'baz', crit: ['b64'], b64: false, alg: 'HS256' })
  76. test/jws/general.test.ts:100 test path .setProtectedHeader({ bar: 'baz', crit: ['b64'], b64: false, alg: 'HS256' })
  77. test/jws/general.test.ts:109 test path .setProtectedHeader({ bar: 'baz', crit: ['b64'], b64: true, alg: 'HS384' })
  78. test/jws/general.test.ts:128 test path .setUnprotectedHeader({ alg: 'HS256' })
  79. test/jws/general.test.ts:136 test path .setProtectedHeader({ alg: 'HS256' })
  80. test/jws/general.test.ts:146 test path .setProtectedHeader({ alg: 'HS256' })
  81. test/jws/general.test.ts:149 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  82. test/jws/general.test.ts:178 test path .setProtectedHeader({ alg: 'HS256', b64: false })
  83. test/jws/general.test.ts:191 test path alg: 'HS256',
  84. test/jws/general.test.ts:240 test path t.deepEqual(afterSwitching.protectedHeader, { alg: 'HS256' })
  85. test/jws/general.test.ts:257 test path .setUnprotectedHeader({ alg: 'HS256' })
  86. test/jws/general.test.ts:266 test path .setProtectedHeader({ alg: 'HS256' })
  87. test/jws/general.test.ts:325 test path .setUnprotectedHeader({ alg: 'HS256' })
  88. test/jws/general.test.ts:338 test path .setProtectedHeader({ alg: 'HS256' })
  89. test/jws/general.test.ts:348 test path .setProtectedHeader({ alg: 'HS256' })
  90. test/jws/general.test.ts:350 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  91. test/jws/unencoded.test.ts:8 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  92. test/jws/unencoded.test.ts:24 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  93. test/jws/unencoded.test.ts:38 test path .setProtectedHeader({ alg: 'HS256', b64: null, crit: ['b64'] })
  94. test/jws/unencoded.test.ts:47 test path .setProtectedHeader({ alg: 'HS256', crit: ['b64'] })
  95. test/jws/unencoded.test.ts:53 test path .setProtectedHeader({ alg: 'HS256', crit: ['b64'] })
  96. test/jws/unencoded.test.ts:66 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  97. test/jws/unencoded.test.ts:80 test path alg: 'HS256',
  98. test/jws/unencoded.test.ts:98 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  99. test/jws/unencoded.test.ts:107 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  100. test/jws/unencoded.test.ts:116 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  101. test/jws/unencoded.test.ts:129 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  102. test/jws/unencoded.test.ts:139 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  103. test/jws/unencoded.test.ts:151 test path .setProtectedHeader({ alg: 'HS256', b64: false, crit: ['b64'] })
  104. test/jws/unencoded.test.ts:170 test path .setProtectedHeader({ alg: 'HS256', b64 })
  105. test/jws/unencoded.test.ts:178 test path .setProtectedHeader({ alg: 'HS256', b64: null } as never)
  106. test/jws/unencoded.test.ts:184 test path .setProtectedHeader({ alg: 'HS256' })
  107. test/jws/unencoded.test.ts:191 test path .setProtectedHeader({ alg: 'HS256', b64: true, crit: ['b64'] })
  108. test/jwt/property.test.ts:13 test path return new SignJWT(claims).setProtectedHeader({ alg: 'HS256' }).sign(key)
  109. test/jwt/sign.test.ts:20 test path .setProtectedHeader({ alg: 'HS256' })
  110. test/jwt/sign.test.ts:29 test path const jwt = await new SignJWT().setProtectedHeader({ alg: 'HS256' }).sign(t.context.secret)
  111. test/jwt/sign.test.ts:39 test path alg: 'HS256',
  112. test/jwt/sign.test.ts:53 test path alg: 'HS256',
  113. test/jwt/sign.test.ts:74 test path .setProtectedHeader({ alg: 'HS256', crit: ['b64'], b64: false })
  114. test/jwt/sign.test.ts:95 test path alg: 'HS256',
  115. test/jwt/sign.test.ts:112 test path () => new SignJWT().setProtectedHeader({ alg: 'HS256' }).setProtectedHeader({ alg: 'HS384' }),
  116. test/jwt/sign.test.ts:164 test path new SignJWT({ [claim]: value }).setProtectedHeader({ alg: 'HS256' }).sign(t.context.secret),
  117. test/jwt/sign.test.ts:173 test path .setProtectedHeader({ alg: 'HS256', b64: false })
  118. test/jwt/sign.test.ts:183 test path .setProtectedHeader({ alg: 'HS256' })
  119. test/jwt/verify.test.ts:27 test path .setProtectedHeader({ alg: 'HS256', typ })
  120. test/jwt/verify.test.ts:58 test path alg: 'HS256',
  121. test/jwt/verify.test.ts:70 test path .setProtectedHeader({ alg: 'HS256' })
  122. test/jwt/verify.test.ts:81 test path .setProtectedHeader({ alg: 'HS256' })
  123. test/jwt/verify.test.ts:93 test path .setProtectedHeader({ alg: 'HS256' })
  124. test/jwt/verify.test.ts:103 test path .setProtectedHeader({ alg: 'HS256' })
  125. test/jwt/verify.test.ts:129 test path .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
  126. test/jwt/verify.test.ts:140 test path .setProtectedHeader({ alg: 'HS256', typ })
  127. test/jwt/verify.test.ts:166 test path .setProtectedHeader({ alg: 'HS256', typ })
  128. test/jwt/verify.test.ts:192 test path .setProtectedHeader({ alg: 'HS256', typ })
  129. test/jwt/verify.test.ts:213 test path .setProtectedHeader({ alg: 'HS256' })
  130. test/jwt/verify.test.ts:227 test path .setProtectedHeader({ alg: 'HS256' })
  131. test/jwt/verify.test.ts:242 test path .setProtectedHeader({ alg: 'HS256' })
  132. test/jwt/verify.test.ts:256 test path .setProtectedHeader({ alg: 'HS256' })
  133. test/jwt/verify.test.ts:270 test path .setProtectedHeader({ alg: 'HS256' })
  134. test/jwt/verify.test.ts:285 test path .setProtectedHeader({ alg: 'HS256' })
  135. test/jwt/verify.test.ts:300 test path .setProtectedHeader({ alg: 'HS256' })
  136. test/jwt/verify.test.ts:314 test path .setProtectedHeader({ alg: 'HS256' })
  137. test/jwt/verify.test.ts:326 test path .setProtectedHeader({ alg: 'HS256' })
  138. test/jwt/verify.test.ts:335 test path .setProtectedHeader({ alg: 'HS256' })
  139. test/jwt/verify.test.ts:434 test path .setProtectedHeader({ alg: 'HS256', b64: false })
  140. test/jwt/verify.test.ts:445 test path .setProtectedHeader({ alg: 'HS256' })
  141. test/jwt/verify.test.ts:461 test path .setProtectedHeader({ alg: 'HS256' })
  142. test/jwt/verify.test.ts:498 test path .setProtectedHeader({ alg: 'HS256' })
  143. test/jwt/verify.test.ts:516 test path .setProtectedHeader({ alg: 'HS256' })
  144. test/jwt/verify.test.ts:529 test path .setProtectedHeader({ alg: 'HS256' })
  145. test/jwt/verify.test.ts:537 test path .setProtectedHeader({ alg: 'HS256' })
  146. test/jwt/verify.test.ts:554 test path .setProtectedHeader({ alg: 'HS256' })
  147. test/jwt/verify.test.ts:572 test path .setProtectedHeader({ alg: 'HS256' })
  148. test/jwt/verify.test.ts:585 test path .setProtectedHeader({ alg: 'HS256' })
  149. test/jwt/verify.test.ts:600 test path const header = base64url.encode(JSON.stringify({ alg: 'HS256' }))
  150. test/property.test.ts:38 test path const jws = await new CompactSign(payload).setProtectedHeader({ alg: 'HS256' }).sign(key)
  151. test/property.test.ts:42 test path t.deepEqual(result.protectedHeader, { alg: 'HS256' })
  152. test/property.test.ts:51 test path const jws = await new CompactSign(payload).setProtectedHeader({ alg: 'HS256' }).sign(key)
  153. test/property.test.ts:152 test path const jwt = await new SignJWT(payload).setProtectedHeader({ alg: 'HS256' }).sign(key)
  154. test/property.test.ts:157 test path t.deepEqual(result.protectedHeader, { alg: 'HS256' })
  155. test/util/decode_protected_header.test.ts:81 test path t.deepEqual(decodeProtectedHeader('eyJhbGciOiJIUzI1NiJ9..'), { alg: 'HS256' })
  156. test/util/decode_protected_header.test.ts:82 test path t.deepEqual(decodeProtectedHeader('eyJhbGciOiJIUzI1NiJ9....'), { alg: 'HS256' })
  157. test/util/decode_protected_header.test.ts:83 test path t.deepEqual(decodeProtectedHeader({ protected: 'eyJhbGciOiJIUzI1NiJ9' }), { alg: 'HS256' })
js.jwt.algorithm · CWE-327
AES-256 Quantum-safe 143 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jwe.mjs:24 enc: 'A256GCM',
  2. cookbook/jwe.mjs:35 enc: 'A256GCM',
  3. cookbook/jwe.mjs:274 alg: 'dir',
  4. cookbook/jwe.mjs:282 alg: 'dir',
  5. cookbook/jwe.mjs:320 alg: 'A256GCMKW',
  6. cookbook/jwe.mjs:323 alg: 'A256GCMKW',
  7. cookbook/jwe.mjs:336 alg: 'A256GCMKW',
  8. tap/general.ts:21 .setProtectedHeader({ enc: 'A256GCM' })
  9. tap/general.ts:24 .setUnprotectedHeader({ alg: 'A256KW' })
  10. tap/general.ts:28 .setUnprotectedHeader({ alg: 'A256GCMKW' })
  11. test/jwe/compact.decrypt.test.ts:34 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  12. test/jwe/compact.decrypt.test.ts:39 test path t.deepEqual(protectedHeader, { alg: 'dir', enc: 'A128GCM' })
  13. test/jwe/compact.decrypt.test.ts:60 test path const protectedHeader = { alg: 'dir', enc: 'A128GCM' } as const
  14. test/jwe/compact.encrypt.test.ts:32 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  15. test/jwe/compact.encrypt.test.ts:47 test path alg: 'dir',
  16. test/jwe/compact.encrypt.test.ts:153 test path .setProtectedHeader({ alg: 'dir' })
  17. test/jwe/flattened.decrypt.test.ts:24 test path .setSharedUnprotectedHeader({ alg: 'dir', enc: 'A128GCM' })
  18. test/jwe/flattened.decrypt.test.ts:197 test path jwe.unprotected = { alg: 'dir' }
  19. test/jwe/flattened.decrypt.test.ts:328 test path .setSharedUnprotectedHeader({ alg: 'dir', enc: 'A128GCM' })
  20. test/jwe/flattened.decrypt.test.ts:330 test path const unprotected = { alg: 'A256KW', enc: 'A128GCM' }
  21. test/jwe/flattened.decrypt.test.ts:347 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  22. test/jwe/flattened.decrypt.test.ts:367 test path const protectedHeader = base64url.encode(JSON.stringify({ alg: 'dir', enc: 'A128GCM' }))
  23. test/jwe/flattened.decrypt.test.ts:411 test path .setProtectedHeader({ alg: 'dir', enc: 'A128CBC-HS256' })
  24. test/jwe/flattened.decrypt.test.ts:549 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  25. test/jwe/flattened.decrypt.test.ts:566 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  26. test/jwe/flattened.decrypt.test.ts:664 test path .setSharedUnprotectedHeader({ alg: 'dir', enc: 'A128GCM' })
  27. test/jwe/flattened.encrypt.test.ts:23 test path .setProtectedHeader({ alg: 'dir' })
  28. test/jwe/flattened.encrypt.test.ts:39 test path .setProtectedHeader({ alg: 'dir' })
  29. test/jwe/flattened.encrypt.test.ts:55 test path .setSharedUnprotectedHeader({ alg: 'dir', enc: 'A128GCM' })
  30. test/jwe/flattened.encrypt.test.ts:60 test path alg: 'dir',
  31. test/jwe/flattened.encrypt.test.ts:70 test path .setProtectedHeader({ alg: 'dir' })
  32. test/jwe/flattened.encrypt.test.ts:146 test path .setUnprotectedHeader({ alg: 'dir', enc: 'A128GCM' })
  33. test/jwe/flattened.encrypt.test.ts:153 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  34. test/jwe/flattened.encrypt.test.ts:161 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  35. test/jwe/flattened.encrypt.test.ts:173 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  36. test/jwe/flattened.encrypt.test.ts:185 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', crit: ['foo'], foo })
  37. test/jwe/flattened.encrypt.test.ts:193 test path .setUnprotectedHeader({ alg: 'dir', foo })
  38. test/jwe/flattened.encrypt.test.ts:202 test path .setUnprotectedHeader({ alg: 'dir', foo: true })
  39. test/jwe/flattened.encrypt.test.ts:209 test path alg: 'dir',
  40. test/jwe/flattened.encrypt.test.ts:224 test path const inherited = Object.create({ alg: 'dir', enc: 'A128GCM' })
  41. test/jwe/flattened.encrypt.test.ts:283 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  42. test/jwe/flattened.encrypt.test.ts:284 test path .setUnprotectedHeader({ alg: 'dir' })
  43. test/jwe/flattened.encrypt.test.ts:294 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  44. test/jwe/flattened.encrypt.test.ts:295 test path .setSharedUnprotectedHeader({ alg: 'dir' })
  45. test/jwe/flattened.encrypt.test.ts:347 test path .setProtectedHeader({ alg: 'dir' })
  46. test/jwe/flattened.encrypt.test.ts:569 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  47. test/jwe/flattened.encrypt.test.ts:583 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  48. test/jwe/flattened.encrypt.test.ts:594 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  49. test/jwe/general.test.ts:28 test path .setProtectedHeader({ enc: 'A256GCM' })
  50. test/jwe/general.test.ts:31 test path .setUnprotectedHeader({ alg: 'A256GCMKW' })
  51. test/jwe/general.test.ts:67 test path .setUnprotectedHeader({ alg: 'A256KW', foo: true })
  52. test/jwe/general.test.ts:84 test path .setUnprotectedHeader({ alg: 'A256KW' })
  53. test/jwe/general.test.ts:121 test path return { alg: 'A256KW' }
  54. test/jwe/general.test.ts:181 test path .setUnprotectedHeader({ alg: 'A256GCMKW' })
  55. test/jwe/general.test.ts:196 test path .setUnprotectedHeader({ alg: 'A256KW' })
  56. test/jwe/general.test.ts:208 test path .setProtectedHeader({ enc: 'A256GCM' })
  57. test/jwe/general.test.ts:210 test path .setUnprotectedHeader({ alg: 'A256GCMKW' })
  58. test/jwe/general.test.ts:244 test path encrypt.addRecipient(t.context.secret).setUnprotectedHeader({ alg: 'A256KW' })
  59. test/jwe/general.test.ts:282 test path .setUnprotectedHeader({ alg: 'dir' })
  60. test/jwe/general.test.ts:295 test path .setUnprotectedHeader({ alg: 'A128KW', enc: 'A256GCM' })
  61. test/jwe/general.test.ts:324 test path .setProtectedHeader({ enc: 'A256GCM' })
  62. test/jwe/general.test.ts:325 test path .setSharedUnprotectedHeader({ alg: 'dir' })
  63. test/jwe/general.test.ts:350 test path .setProtectedHeader({ enc: 'A256GCM' })
  64. test/jwe/general.test.ts:376 test path encrypt.addRecipient(t.context.secret).setUnprotectedHeader({ alg: 'A256GCMKW', enc: 'A256GCM' })
  65. test/jwe/general.test.ts:447 test path .setSharedUnprotectedHeader({ alg: 'dir', enc: 'A256GCM' })
  66. test/jwe/general.test.ts:460 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  67. test/jwe/general.test.ts:470 test path .setProtectedHeader({ enc: 'A256GCM' })
  68. test/jwe/general.test.ts:472 test path .setUnprotectedHeader({ alg: 'A256GCMKW' })
  69. test/jwe/general.test.ts:497 test path { header: { alg: 'dir' }, encrypted_key: 0 as never },
  70. test/jwe/general.test.ts:508 test path const mutatingHeader = { alg: 'dir' }
  71. test/jwe/general.test.ts:529 test path header: { alg: 'dir' },
  72. test/jwe/general.test.ts:547 test path alg: 'dir',
  73. test/jwe/general.test.ts:567 test path .setProtectedHeader({ enc: 'A256GCM' })
  74. test/jwe/general.test.ts:568 test path .setUnprotectedHeader({ alg: 'dir' })
  75. test/jwe/general.test.ts:574 test path return reads === 1 ? { alg: 'A256KW' } : { alg: 'dir' }
  76. test/jwe/general.test.ts:599 test path .setProtectedHeader({ enc: 'A256GCM' })
  77. test/jwe/general.test.ts:600 test path .setUnprotectedHeader({ alg: 'dir' })
  78. test/jwe/general.test.ts:616 test path { header: { alg: 'dir' as const } },
  79. test/jwe/general.test.ts:618 test path header: { alg: 'A256KW' as const },
  80. test/jwe/general.test.ts:668 test path .setProtectedHeader({ enc: 'A256GCM' })
  81. test/jwe/integrated_encryption.test.ts:133 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  82. test/jwe/integrated_encryption.test.ts:332 test path .setProtectedHeader({ alg, enc: 'A256GCM' } as unknown as types.JWEHeaderParameters)
  83. test/jwe/integrated_encryption.test.ts:373 test path flattenedDecrypt(replaceProtectedHeader(jwe, { alg, enc: 'A256GCM' }), privateKey),
  84. test/jwe/zip.test.ts:28 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  85. test/jwe/zip.test.ts:37 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  86. test/jwe/zip.test.ts:57 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  87. test/jwe/zip.test.ts:67 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  88. test/jwe/zip.test.ts:79 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  89. test/jwe/zip.test.ts:92 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  90. test/jwe/zip.test.ts:111 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  91. test/jwe/zip.test.ts:124 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  92. test/jwe/zip.test.ts:139 test path const protectedHeader = { alg: 'RSA-OAEP-256', enc: 'A256GCM', zip: 'DEF' }
  93. test/jwe/zip.test.ts:168 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'gzip' })
  94. test/jwe/zip.test.ts:180 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  95. test/jwe/zip.test.ts:191 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  96. test/jwe/zip.test.ts:237 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  97. test/jwe/zip.test.ts:258 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  98. test/jwe/zip.test.ts:264 test path protected: btoa(JSON.stringify({ alg: 'dir', enc: 'A128GCM', zip: 'gzip' }))
  99. test/jwe/zip.test.ts:279 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM', zip: 'DEF' })
  100. test/jwk/key_input.test.ts:212 test path .setProtectedHeader({ alg, enc: 'A256GCM' })
  101. test/jwk/key_input.test.ts:278 test path new CompactEncrypt(payload).setProtectedHeader({ alg: 'A256KW', enc: 'A128GCM' }).encrypt(key),
  102. test/jwk/key_input.test.ts:285 test path .setProtectedHeader({ alg: 'A256GCMKW', enc: 'A128GCM' })
  103. test/jws/restrictions.test.ts:75 test path .setProtectedHeader({ alg, enc: 'A256GCM' })
  104. test/jws/restrictions.test.ts:81 test path .setProtectedHeader({ alg, enc: 'A256GCM' })
  105. test/jwt/decrypt.test.ts:27 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM', typ })
  106. test/jwt/decrypt.test.ts:58 test path alg: 'dir',
  107. test/jwt/decrypt.test.ts:59 test path enc: 'A256GCM',
  108. test/jwt/decrypt.test.ts:71 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  109. test/jwt/decrypt.test.ts:82 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  110. test/jwt/decrypt.test.ts:109 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  111. test/jwt/decrypt.test.ts:119 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  112. test/jwt/decrypt.test.ts:164 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM', typ })
  113. test/jwt/decrypt.test.ts:190 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM', typ })
  114. test/jwt/decrypt.test.ts:218 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  115. test/jwt/decrypt.test.ts:232 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  116. test/jwt/decrypt.test.ts:247 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  117. test/jwt/decrypt.test.ts:261 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  118. test/jwt/decrypt.test.ts:275 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  119. test/jwt/decrypt.test.ts:290 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  120. test/jwt/decrypt.test.ts:305 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  121. test/jwt/decrypt.test.ts:319 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  122. test/jwt/decrypt.test.ts:331 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  123. test/jwt/decrypt.test.ts:344 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  124. test/jwt/decrypt.test.ts:429 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM', [claim]: 'urn:example' })
  125. test/jwt/decrypt.test.ts:436 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM', [claim]: 'urn:example' })
  126. test/jwt/encrypt.test.ts:30 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  127. test/jwt/encrypt.test.ts:45 test path alg: 'dir',
  128. test/jwt/encrypt.test.ts:61 test path alg: 'dir',
  129. test/jwt/encrypt.test.ts:80 test path let enc = new EncryptJWT().setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })[method](value)
  130. test/jwt/encrypt.test.ts:130 test path .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
  131. test/jwt/encrypt.test.ts:241 test path alg: 'dir',
  132. test/property.test.ts:70 test path .setProtectedHeader({ alg: 'dir', enc })
  133. test/property.test.ts:75 test path t.deepEqual(result.protectedHeader, { alg: 'dir', enc })
  134. test/property.test.ts:85 test path .setProtectedHeader({ alg: 'dir', enc })
  135. test/property.test.ts:104 test path .setProtectedHeader({ alg: 'dir', enc })
  136. test/property.test.ts:110 test path t.deepEqual(result.protectedHeader, { alg: 'dir', enc })
  137. test/property.test.ts:127 test path .setProtectedHeader({ alg: 'dir', enc })
  138. test/root_facades.test.ts:362 test path .setProtectedHeader({ alg: algorithm, enc: 'A256GCM' })
  139. test/root_facades.test.ts:391 test path .setProtectedHeader({ alg: algorithm, enc: 'A256GCM' })
  140. test/root_facades.test.ts:412 test path .setProtectedHeader({ alg: algorithm, enc: 'A256GCM' })
  141. test/root_facades.test.ts:430 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  142. test/root_facades.test.ts:443 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A256GCM' })
  143. test/root_facades.test.ts:456 test path .setProtectedHeader({ alg: 'A256KW', enc: 'A256GCM' })
js.jwt.algorithm · CWE-327
AES-256 Quantum-safe 122 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jwe.mjs:24 enc: 'A256GCM',
  2. cookbook/jwe.mjs:35 enc: 'A256GCM',
  3. cookbook/jwe.mjs:73 '{"keys":[{"kty":"oct","kid":"77c7e2b8-6e13-45cf-8672-617b5b45243a","use":"enc","alg":"A128GCM","k":"XctOhJAkA-pD9Lh7ZgW_2A"},{"kty":"oct","kid":"81b20965-8332-43d9-a468-82160ad91ac8","use":"enc","alg":"A128KW","k":"GZy6sIZ6wl9NJOKB-jnmVQ"}
  4. cookbook/jwe.mjs:320 alg: 'A256GCMKW',
  5. cookbook/jwe.mjs:323 alg: 'A256GCMKW',
  6. cookbook/jwe.mjs:336 alg: 'A256GCMKW',
  7. src/key/generate_secret.ts:23 | 'A256CBC-HS512'
  8. src/key/generate_secret.ts:26 | 'A256KW'
  9. src/key/generate_secret.ts:29 | 'A256GCMKW'
  10. src/key/generate_secret.ts:32 | 'A256GCM'
  11. src/key/generate_secret.ts:42 'A128CBC-HS256' | 'A192CBC-HS384' | 'A256CBC-HS512'
  12. src/key/generate_secret.ts:105 case 'A256CBC-HS512':
  13. src/key/generate_secret.ts:110 case 'A256KW':
  14. src/key/generate_secret.ts:118 case 'A256GCMKW':
  15. src/key/generate_secret.ts:121 case 'A256GCM':
  16. src/lib/jwe_algorithms.ts:183 'A256CBC-HS512': contentEncryption(512, true),
  17. src/types.d.ts:39 | 'A256KW'
  18. src/types.d.ts:42 | 'A256GCMKW'
  19. src/types.d.ts:65 | 'A256CBC-HS512'
  20. src/types.d.ts:68 | 'A256GCM'
  21. tap/aes.ts:17 'A256GCM',
  22. tap/aes.ts:20 'A256CBC-HS512',
  23. tap/aeskw.ts:14 const algorithms = ['A128KW', 'A192KW', 'A256KW', 'A128GCMKW', 'A192GCMKW', 'A256GCMKW']
  24. tap/env.ts:101 case 'A256KW':
  25. tap/general.ts:16 const a = await keys.generateSecret('A256KW', { extractable: true })
  26. tap/general.ts:21 .setProtectedHeader({ enc: 'A256GCM' })
  27. tap/general.ts:24 .setUnprotectedHeader({ alg: 'A256KW' })
  28. tap/general.ts:28 .setUnprotectedHeader({ alg: 'A256GCMKW' })
  29. tap/general.ts:40 const stranger = await keys.generateSecret('A256KW', { extractable: true })
  30. tap/keyobject-stub.ts:44 case 'A256CBC-HS512':
  31. tap/keyobject-stub.ts:49 case 'A256KW':
  32. tap/keyobject-stub.ts:52 case 'A256GCMKW':
  33. tap/keyobject-stub.ts:55 case 'A256GCM':
  34. test-d/api.ts:116 test path contentEncryptionAlgorithms: [anyString, 'A256GCM'],
  35. test/jwe/flattened.decrypt.test.ts:330 test path const unprotected = { alg: 'A256KW', enc: 'A128GCM' }
  36. test/jwe/flattened.encrypt.test.ts:569 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  37. test/jwe/flattened.encrypt.test.ts:583 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  38. test/jwe/flattened.encrypt.test.ts:594 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  39. test/jwe/general.test.ts:28 test path .setProtectedHeader({ enc: 'A256GCM' })
  40. test/jwe/general.test.ts:31 test path .setUnprotectedHeader({ alg: 'A256GCMKW' })
  41. test/jwe/general.test.ts:67 test path .setUnprotectedHeader({ alg: 'A256KW', foo: true })
  42. test/jwe/general.test.ts:84 test path .setUnprotectedHeader({ alg: 'A256KW' })
  43. test/jwe/general.test.ts:89 test path return recipientReads === 1 ? 'A128KW' : 'A256KW'
  44. test/jwe/general.test.ts:121 test path return { alg: 'A256KW' }
  45. test/jwe/general.test.ts:181 test path .setUnprotectedHeader({ alg: 'A256GCMKW' })
  46. test/jwe/general.test.ts:196 test path .setUnprotectedHeader({ alg: 'A256KW' })
  47. test/jwe/general.test.ts:208 test path .setProtectedHeader({ enc: 'A256GCM' })
  48. test/jwe/general.test.ts:210 test path .setUnprotectedHeader({ alg: 'A256GCMKW' })
  49. test/jwe/general.test.ts:244 test path encrypt.addRecipient(t.context.secret).setUnprotectedHeader({ alg: 'A256KW' })
  50. test/jwe/general.test.ts:295 test path .setUnprotectedHeader({ alg: 'A128KW', enc: 'A256GCM' })
  51. test/jwe/general.test.ts:324 test path .setProtectedHeader({ enc: 'A256GCM' })
  52. test/jwe/general.test.ts:350 test path .setProtectedHeader({ enc: 'A256GCM' })
  53. test/jwe/general.test.ts:376 test path encrypt.addRecipient(t.context.secret).setUnprotectedHeader({ alg: 'A256GCMKW', enc: 'A256GCM' })
  54. test/jwe/general.test.ts:447 test path .setSharedUnprotectedHeader({ alg: 'dir', enc: 'A256GCM' })
  55. test/jwe/general.test.ts:460 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  56. test/jwe/general.test.ts:470 test path .setProtectedHeader({ enc: 'A256GCM' })
  57. test/jwe/general.test.ts:472 test path .setUnprotectedHeader({ alg: 'A256GCMKW' })
  58. test/jwe/general.test.ts:512 test path mutatingHeader.alg = 'A256KW'
  59. test/jwe/general.test.ts:567 test path .setProtectedHeader({ enc: 'A256GCM' })
  60. test/jwe/general.test.ts:574 test path return reads === 1 ? { alg: 'A256KW' } : { alg: 'dir' }
  61. test/jwe/general.test.ts:599 test path .setProtectedHeader({ enc: 'A256GCM' })
  62. test/jwe/general.test.ts:618 test path header: { alg: 'A256KW' as const },
  63. test/jwe/general.test.ts:668 test path .setProtectedHeader({ enc: 'A256GCM' })
  64. test/jwe/integrated_encryption.test.ts:133 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  65. test/jwe/integrated_encryption.test.ts:332 test path .setProtectedHeader({ alg, enc: 'A256GCM' } as unknown as types.JWEHeaderParameters)
  66. test/jwe/integrated_encryption.test.ts:373 test path flattenedDecrypt(replaceProtectedHeader(jwe, { alg, enc: 'A256GCM' }), privateKey),
  67. test/jwe/zip.test.ts:139 test path const protectedHeader = { alg: 'RSA-OAEP-256', enc: 'A256GCM', zip: 'DEF' }
  68. test/jwk/key_input.test.ts:207 test path for (const alg of ['dir', 'PBES2-HS256+A128KW', 'A256GCMKW', 'A256KW']) {
  69. test/jwk/key_input.test.ts:209 test path if (!alg.startsWith('PBES2')) keys.push(await generateSecret(alg === 'dir' ? 'A256GCM' : alg))
  70. test/jwk/key_input.test.ts:212 test path .setProtectedHeader({ alg, enc: 'A256GCM' })
  71. test/jwk/key_input.test.ts:278 test path new CompactEncrypt(payload).setProtectedHeader({ alg: 'A256KW', enc: 'A128GCM' }).encrypt(key),
  72. test/jwk/key_input.test.ts:285 test path .setProtectedHeader({ alg: 'A256GCMKW', enc: 'A128GCM' })
  73. test/jws/restrictions.test.ts:75 test path .setProtectedHeader({ alg, enc: 'A256GCM' })
  74. test/jws/restrictions.test.ts:81 test path .setProtectedHeader({ alg, enc: 'A256GCM' })
  75. test/jwt/decrypt.test.ts:27 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM', typ })
  76. test/jwt/decrypt.test.ts:59 test path enc: 'A256GCM',
  77. test/jwt/decrypt.test.ts:71 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  78. test/jwt/decrypt.test.ts:82 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  79. test/jwt/decrypt.test.ts:109 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  80. test/jwt/decrypt.test.ts:119 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  81. test/jwt/decrypt.test.ts:164 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM', typ })
  82. test/jwt/decrypt.test.ts:190 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM', typ })
  83. test/jwt/decrypt.test.ts:218 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  84. test/jwt/decrypt.test.ts:232 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  85. test/jwt/decrypt.test.ts:247 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  86. test/jwt/decrypt.test.ts:261 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  87. test/jwt/decrypt.test.ts:275 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  88. test/jwt/decrypt.test.ts:290 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  89. test/jwt/decrypt.test.ts:305 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  90. test/jwt/decrypt.test.ts:319 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  91. test/jwt/decrypt.test.ts:331 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  92. test/jwt/decrypt.test.ts:344 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  93. test/jwt/decrypt.test.ts:429 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM', [claim]: 'urn:example' })
  94. test/jwt/decrypt.test.ts:436 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM', [claim]: 'urn:example' })
  95. test/property.test.ts:25 test path const contentEncryptionAlgorithms = ['A256GCM', 'A128CBC-HS256'] as const
  96. test/root_facades.test.ts:70 test path 'A256KW',
  97. test/root_facades.test.ts:73 test path 'A256GCMKW',
  98. test/root_facades.test.ts:82 test path 'A256GCM',
  99. test/root_facades.test.ts:85 test path 'A256CBC-HS512',
  100. test/root_facades.test.ts:294 test path const contentEncryptionAlgorithm = 'A256GCM'
  101. test/root_facades.test.ts:343 test path const contentEncryptionAlgorithm = 'A256GCM'
  102. test/root_facades.test.ts:359 test path for (const algorithm of ['A256KW', 'RSA-OAEP-256', 'ECDH-ES+A256KW'] as const) {
  103. test/root_facades.test.ts:360 test path const [encryptionKey, decryptionKey] = await jweKeys(algorithm, 'A256GCM')
  104. test/root_facades.test.ts:362 test path .setProtectedHeader({ alg: algorithm, enc: 'A256GCM' })
  105. test/root_facades.test.ts:388 test path for (const algorithm of ['dir', 'ECDH-ES', 'A256KW', 'RSA-OAEP-256', 'ECDH-ES+A256KW'] as const) {
  106. test/root_facades.test.ts:389 test path const [encryptionKey, decryptionKey] = await jweKeys(algorithm, 'A256GCM')
  107. test/root_facades.test.ts:391 test path .setProtectedHeader({ alg: algorithm, enc: 'A256GCM' })
  108. test/root_facades.test.ts:408 test path for (const algorithm of ['A256KW', 'RSA-OAEP-256', 'ECDH-ES+A256KW'] as const) {
  109. test/root_facades.test.ts:409 test path const [firstEncryptionKey, firstDecryptionKey] = await jweKeys(algorithm, 'A256GCM')
  110. test/root_facades.test.ts:410 test path const [secondEncryptionKey, secondDecryptionKey] = await jweKeys(algorithm, 'A256GCM')
  111. test/root_facades.test.ts:412 test path .setProtectedHeader({ alg: algorithm, enc: 'A256GCM' })
  112. test/root_facades.test.ts:427 test path const directKey = await generateSecret('A256GCM')
  113. test/root_facades.test.ts:430 test path .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  114. test/root_facades.test.ts:443 test path .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A256GCM' })
  115. test/root_facades.test.ts:453 test path const firstWrappingKey = await generateSecret('A256KW')
  116. test/root_facades.test.ts:454 test path const secondWrappingKey = await generateSecret('A256KW')
  117. test/root_facades.test.ts:456 test path .setProtectedHeader({ alg: 'A256KW', enc: 'A256GCM' })
  118. test/unit/cek.test.ts:12 test path t.is(generateCek(jweEncryption('A256CBC-HS512')).byteLength, 64)
  119. test/unit/check_iv_length.test.ts:7 test path const gcm = jweEncryption('A256GCM')
  120. test/unit/check_iv_length.test.ts:13 test path t.notThrows(() => checkIvLength(jweEncryption('A256CBC-HS512'), new Uint8Array(16)))
  121. test/unit/iv.test.ts:11 test path t.is(generateIv(jweEncryption('A256GCM')).byteLength, 12)
  122. test/unit/iv.test.ts:12 test path t.is(generateIv(jweEncryption('A256CBC-HS512')).byteLength, 16)
jose.algorithm · CWE-327
ML-DSA-44 Quantum-safe 18 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jws.mjs:374 alg: 'ML-DSA-44',
  2. cookbook/jws.mjs:378 alg: 'ML-DSA-44',
  3. cookbook/jws.mjs:382 alg: 'ML-DSA-44',
  4. src/key/generate_key_pair.ts:34 | 'ML-DSA-44'
  5. src/lib/jws_algorithms.ts:90 'ML-DSA-44': mldsa(44),
  6. src/types.d.ts:23 | 'ML-DSA-44'
  7. tap/env.ts:68 case 'ML-DSA-44':
  8. tap/fixtures.ts:214 'ML-DSA-44': {
  9. tap/fixtures.ts:217 alg: 'ML-DSA-44',
  10. tap/jwk.ts:36 ['ML-DSA-44', KEYS['ML-DSA-44'].jwk],
  11. tap/jws.ts:26 'ML-DSA-44',
  12. tap/keyobject-stub.ts:109 case 'ML-DSA-44':
  13. tap/pem.ts:76 ['ML-DSA-44', KEYS['ML-DSA-44'].pkcs8],
  14. tap/pem.ts:77 ['ML-DSA-44', KEYS['ML-DSA-44'].spki],
  15. test-d/api.ts:82 test path const _akp: jose.AnyJWK = { kty: 'AKP', alg: 'ML-DSA-44', pub: 'pub' }
  16. test/jwk/embedded.test.ts:143 test path await t.throwsAsync(EmbeddedJWK({ alg: 'ML-DSA-44', jwk: { ...jwk, alg } }), {
  17. test/jwk/thumbprint.test.ts:247 test path alg: 'ML-DSA-44',
  18. test/root_facades.test.ts:53 test path 'ML-DSA-44',
jose.algorithm · CWE-327
ML-DSA-65 Quantum-safe 18 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jws.mjs:415 alg: 'ML-DSA-65',
  2. cookbook/jws.mjs:419 alg: 'ML-DSA-65',
  3. cookbook/jws.mjs:423 alg: 'ML-DSA-65',
  4. src/key/generate_key_pair.ts:35 | 'ML-DSA-65'
  5. src/lib/jws_algorithms.ts:91 'ML-DSA-65': mldsa(65),
  6. src/types.d.ts:24 | 'ML-DSA-65'
  7. tap/env.ts:69 case 'ML-DSA-65':
  8. tap/fixtures.ts:257 'ML-DSA-65': {
  9. tap/fixtures.ts:260 alg: 'ML-DSA-65',
  10. tap/jwk.ts:37 ['ML-DSA-65', KEYS['ML-DSA-65'].jwk],
  11. tap/jws.ts:27 'ML-DSA-65',
  12. tap/keyobject-stub.ts:110 case 'ML-DSA-65':
  13. tap/pem.ts:78 ['ML-DSA-65', KEYS['ML-DSA-65'].pkcs8],
  14. tap/pem.ts:79 ['ML-DSA-65', KEYS['ML-DSA-65'].spki],
  15. test/jwk/embedded.test.ts:12 test path const mlDsaTest = SubtleCrypto.supports?.('generateKey', 'ML-DSA-65') === true ? test : test.skip
  16. test/jwk/embedded.test.ts:136 test path const { publicKey } = await generateKeyPair('ML-DSA-65', { extractable: true })
  17. test/jwk/embedded.test.ts:139 test path const incomplete = await t.throwsAsync(EmbeddedJWK({ alg: 'ML-DSA-65', jwk }))
  18. test/root_facades.test.ts:54 test path 'ML-DSA-65',
jose.algorithm · CWE-327
ML-DSA-87 Quantum-safe 15 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jws.mjs:456 alg: 'ML-DSA-87',
  2. cookbook/jws.mjs:460 alg: 'ML-DSA-87',
  3. cookbook/jws.mjs:464 alg: 'ML-DSA-87',
  4. src/key/generate_key_pair.ts:36 | 'ML-DSA-87'
  5. src/lib/jws_algorithms.ts:92 'ML-DSA-87': mldsa(87),
  6. src/types.d.ts:25 | 'ML-DSA-87'
  7. tap/env.ts:70 case 'ML-DSA-87':
  8. tap/fixtures.ts:314 'ML-DSA-87': {
  9. tap/fixtures.ts:317 alg: 'ML-DSA-87',
  10. tap/jwk.ts:38 ['ML-DSA-87', KEYS['ML-DSA-87'].jwk],
  11. tap/jws.ts:28 'ML-DSA-87',
  12. tap/keyobject-stub.ts:111 case 'ML-DSA-87':
  13. tap/pem.ts:80 ['ML-DSA-87', KEYS['ML-DSA-87'].pkcs8],
  14. tap/pem.ts:81 ['ML-DSA-87', KEYS['ML-DSA-87'].spki],
  15. test/root_facades.test.ts:55 test path 'ML-DSA-87',
jose.algorithm · CWE-327
CSPRNG Quantum-safe Renamed import 13 places See details

Random number generation

`crypto.randomBytes()`, `randomUUID()` or `getRandomValues()`. A platform CSPRNG is not a quantum exposure; it is recorded because an inventory that omits the randomness source is incomplete. `Math.random()` is a separate, present-day defect.

This is where the software gets its random numbers. Quantum computers do not weaken it.

What to do. No action.

  1. src/key/generate_secret.ts:106 return crypto.getRandomValues(new Uint8Array(+alg.slice(-3) >> 3))
  2. src/lib/content_encryption.ts:11 crypto.getRandomValues(new Uint8Array(enc.cekBits >> 3))
  3. src/lib/key_management.ts:453 const { p2c = 2048, p2s = crypto.getRandomValues(new Uint8Array(16)) } = providedParameters
  4. tap/aes.ts:35 crypto.getRandomValues(
  5. tap/aeskw.ts:28 crypto.getRandomValues(new Uint8Array(parseInt(alg.slice(1, 4), 10) >> 3)),
  6. tap/encrypt.ts:76 cleartext = crypto.getRandomValues(new Uint8Array(16)),
  7. tap/general.ts:12 const plaintext = crypto.getRandomValues(new Uint8Array(64))
  8. tap/hmac.ts:18 crypto.getRandomValues(new Uint8Array(parseInt(alg.slice(2, 5), 10) >> 3)),
  9. tap/keyobject-stub.ts:62 return crypto.createSecretKey(crypto.randomBytes(length >> 3))
  10. tap/sign.ts:57 payload = crypto.getRandomValues(new Uint8Array(16)),
  11. test/jwe/integrated_encryption.test.ts:131 test path const conventionalKey = crypto.getRandomValues(new Uint8Array(32))
  12. test/jwe/zip.test.ts:137 test path const cek = crypto.randomBytes(32)
  13. test/root_facades.test.ts:164 test path const password = crypto.getRandomValues(new Uint8Array(32))
js.rng
ML-DSA-44 Quantum-safe 7 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jws.mjs:374 alg: 'ML-DSA-44',
  2. cookbook/jws.mjs:378 alg: 'ML-DSA-44',
  3. cookbook/jws.mjs:382 alg: 'ML-DSA-44',
  4. tap/fixtures.ts:217 alg: 'ML-DSA-44',
  5. test-d/api.ts:82 test path const _akp: jose.AnyJWK = { kty: 'AKP', alg: 'ML-DSA-44', pub: 'pub' }
  6. test/jwk/embedded.test.ts:143 test path await t.throwsAsync(EmbeddedJWK({ alg: 'ML-DSA-44', jwk: { ...jwk, alg } }), {
  7. test/jwk/thumbprint.test.ts:247 test path alg: 'ML-DSA-44',
js.jwt.algorithm · CWE-327
ML-DSA-65 Quantum-safe 5 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jws.mjs:415 alg: 'ML-DSA-65',
  2. cookbook/jws.mjs:419 alg: 'ML-DSA-65',
  3. cookbook/jws.mjs:423 alg: 'ML-DSA-65',
  4. tap/fixtures.ts:260 alg: 'ML-DSA-65',
  5. test/jwk/embedded.test.ts:139 test path const incomplete = await t.throwsAsync(EmbeddedJWK({ alg: 'ML-DSA-65', jwk }))
js.jwt.algorithm · CWE-327
ML-DSA-87 Quantum-safe 4 places See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

  1. cookbook/jws.mjs:456 alg: 'ML-DSA-87',
  2. cookbook/jws.mjs:460 alg: 'ML-DSA-87',
  3. cookbook/jws.mjs:464 alg: 'ML-DSA-87',
  4. tap/fixtures.ts:317 alg: 'ML-DSA-87',
js.jwt.algorithm · CWE-327
AES-256 Quantum-safe Renamed import 1 place See details

Symmetric cipher in use

`createCipheriv('aes-…')` or a ChaCha20 suite. Symmetric encryption is not broken by a quantum computer; the key length is the only question. The suite name carries it.

This is the kind of encryption that quantum computers do not break.

What to do. Use a 256-bit key. No change of algorithm is required.

  1. test/jwe/zip.test.ts:142 test path const cipher = crypto.createCipheriv('aes-256-gcm', cek, iv, { authTagLength: 16 })
js.cipher.symmetric
ML-DSA-44 Quantum-safe 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Inventory only; a public key is not itself a secret.

  1. tap/fixtures.ts:225 -----BEGIN PUBLIC KEY-----
pem.public-key
ML-DSA-65 Quantum-safe 1 place See details

Post-quantum algorithm in use

A post-quantum binding. Recorded so the inventory shows completed migration work.

This is already a quantum-safe algorithm.

What to do. None. Confirm the parameter set matches the required NIST category.

  1. src/lib/jws_algorithms.ts:64 function mldsa(parameterSet: 44 | 65 | 87): Entry {
js.pqc
ML-DSA-65 Quantum-safe 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Inventory only; a public key is not itself a secret.

  1. tap/fixtures.ts:268 -----BEGIN PUBLIC KEY-----
pem.public-key
ML-DSA-87 Quantum-safe 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Inventory only; a public key is not itself a secret.

  1. tap/fixtures.ts:325 -----BEGIN PUBLIC KEY-----
pem.public-key

Cryptographic assets

Algorithm Assessment What it means Occurrences
AES-128 Reduced margin Grover's algorithm halves the effective strength; the parameter, not the design, is the problem. 377
HMAC Quantum-safe A keyed MAC is not affected by Shor and only marginally by Grover. 353
AES-256 Quantum-safe No known quantum algorithm changes the security margin. 266
ECDSA Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 166
ECDH Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 117
RSASSA-PKCS1v15 Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both. 95
RSA-PSS Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 76
RSA-OAEP Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 70
PBKDF2 Reduced margin Not broken by a quantum computer, but weak against modern GPU cracking at low iteration counts, which is a present-day concern. 50
Ed25519 Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 36
unknown Could not be determined The algorithm could not be established from the source - chosen at runtime, or decided somewhere this scan does not reach. 36
AES-192 Reduced margin Grover's algorithm halves the effective strength; the parameter, not the design, is the problem. 30
ML-DSA-44 Quantum-safe No known quantum algorithm changes the security margin. 27
ML-DSA-65 Quantum-safe No known quantum algorithm changes the security margin. 26
ML-DSA-87 Quantum-safe No known quantum algorithm changes the security margin. 21
CSPRNG Quantum-safe A cryptographically secure random number generator provided by the platform. Not weakened by a quantum computer. 13
RSA Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 9
EdDSA Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 3
X25519 Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. 2
secp256k1 Quantum-vulnerable Broken by Shor's algorithm on a cryptographically relevant quantum computer. Bitcoin-family keys are additionally exposed because public keys are published on-chain, so the attacker does not have to wait for a signature. 1
RSAES-PKCS1v15 Already broken PKCS#1 v1.5 encryption padding is vulnerable to Bleichenbacher oracles today, and the underlying RSA is broken by Shor. 1

Imported cryptographic libraries

Library Files
node:crypto the Node crypto module 12