smallstep/certificates

RSA-10241024-bit Already broken 38 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. authority/provisioner/aws_certificates.pem:6 -----BEGIN CERTIFICATE-----
2. authority/provisioner/aws_certificates.pem:27 -----BEGIN CERTIFICATE-----
3. authority/provisioner/aws_certificates.pem:48 -----BEGIN CERTIFICATE-----
4. authority/provisioner/aws_certificates.pem:69 -----BEGIN CERTIFICATE-----
5. authority/provisioner/aws_certificates.pem:90 -----BEGIN CERTIFICATE-----
6. authority/provisioner/aws_certificates.pem:106 -----BEGIN CERTIFICATE-----
7. authority/provisioner/aws_certificates.pem:123 -----BEGIN CERTIFICATE-----
8. authority/provisioner/aws_certificates.pem:139 -----BEGIN CERTIFICATE-----
9. authority/provisioner/aws_certificates.pem:161 -----BEGIN CERTIFICATE-----
10. authority/provisioner/aws_certificates.pem:182 -----BEGIN CERTIFICATE-----
11. authority/provisioner/aws_certificates.pem:203 -----BEGIN CERTIFICATE-----
12. authority/provisioner/aws_certificates.pem:224 -----BEGIN CERTIFICATE-----
13. authority/provisioner/aws_certificates.pem:240 -----BEGIN CERTIFICATE-----
14. authority/provisioner/aws_certificates.pem:261 -----BEGIN CERTIFICATE-----
15. authority/provisioner/aws_certificates.pem:277 -----BEGIN CERTIFICATE-----
16. authority/provisioner/aws_certificates.pem:298 -----BEGIN CERTIFICATE-----
17. authority/provisioner/aws_certificates.pem:319 -----BEGIN CERTIFICATE-----
18. authority/provisioner/aws_certificates.pem:335 -----BEGIN CERTIFICATE-----
19. authority/provisioner/aws_certificates.pem:351 -----BEGIN CERTIFICATE-----
20. authority/provisioner/aws_certificates.pem:367 -----BEGIN CERTIFICATE-----
21. authority/provisioner/aws_certificates.pem:383 -----BEGIN CERTIFICATE-----
22. authority/provisioner/aws_certificates.pem:399 -----BEGIN CERTIFICATE-----
23. authority/provisioner/aws_certificates.pem:420 -----BEGIN CERTIFICATE-----
24. authority/provisioner/aws_certificates.pem:441 -----BEGIN CERTIFICATE-----
25. authority/provisioner/aws_certificates.pem:457 -----BEGIN CERTIFICATE-----
26. authority/provisioner/aws_certificates.pem:478 -----BEGIN CERTIFICATE-----
27. authority/provisioner/aws_certificates.pem:499 -----BEGIN CERTIFICATE-----
28. authority/provisioner/aws_certificates.pem:515 -----BEGIN CERTIFICATE-----
29. authority/provisioner/aws_certificates.pem:536 -----BEGIN CERTIFICATE-----
30. authority/provisioner/aws_certificates.pem:557 -----BEGIN CERTIFICATE-----
31. authority/provisioner/aws_certificates.pem:578 -----BEGIN CERTIFICATE-----
32. authority/provisioner/aws_certificates.pem:599 -----BEGIN CERTIFICATE-----
33. authority/provisioner/aws_certificates.pem:620 -----BEGIN CERTIFICATE-----
34. authority/provisioner/testdata/certs/aws-test.crt:1 test path -----BEGIN CERTIFICATE-----
35. authority/provisioner/testdata/certs/aws-test.crt:20 test path -----BEGIN CERTIFICATE-----
36. authority/provisioner/testdata/certs/aws.crt:1 test path -----BEGIN CERTIFICATE-----
37. authority/provisioner/utils_test.go:58 test path -----BEGIN CERTIFICATE-----
38. authority/tls_test.go:372 test path -----BEGIN CERTIFICATE REQUEST-----

pem.certificate

RSA-10241024-bit Already broken Recorded traffic 5 places See details

RSA in the Go standard library

`rsa.GenerateKey()`, `rsa.SignPKCS1v15()`, `rsa.EncryptOAEP()` or an import of `crypto/rsa`.

This is already unsafe today, with no quantum computer involved. A modulus of 1024 bits or less is below the NIST SP 800-57 floor and is within reach of classical factorisation. Shor is not the nearest problem here.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Go 1.24 ships ML-KEM as `crypto/mlkem`.

1. authority/provisioner/aws_test.go:755 test path rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)
2. authority/provisioner/azure_test.go:667 test path rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)
3. authority/provisioner/gcp_test.go:649 test path rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)
4. authority/provisioner/jwk_test.go:423 test path rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)
5. authority/provisioner/oidc_test.go:559 test path rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)

go.rsa · CWE-327

SHA-1 Already broken 4 places See details

Broken hash function

An import of `crypto/md5` or `crypto/sha1`, or a call to `New()` on either.

This is already unsafe today, with no quantum computer involved. SHAttered and subsequent work produced practical collisions; NIST withdrew SHA-1 in 2030 guidance and it is already unacceptable for signatures.

What to do. `crypto/sha256`, or `crypto/sha512` for long-lived signatures.

1. authority/provisioner/collection.go:325 sum := sha1.Sum([]byte(p.GetID()))
2. authority/tls_test.go:224 test path hash := sha1.Sum(info.SubjectPublicKey.Bytes)
3. ca/ca_test.go:70 test path hash := sha1.Sum(info.SubjectPublicKey.Bytes)
4. test/integration/scep/common_test.go:456 test path h := sha1.Sum(publicKeyBytes)

go.hash.weak · CWE-328

RSA-10241048-bit Already broken 1 place See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. authority/provisioner/testdata/certs/short-rsa.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----

pem.certificate

TLS Quantum-vulnerable Recorded traffic 65 places See details

TLS configuration in code

A `tls.Config` field pinning versions, cipher suites or curve preferences. Every available suite negotiates a classical key exchange.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Every TLS cipher suite in general use negotiates a classical key exchange, so a recorded session is decryptable once that exchange falls.

What to do. Set `MinVersion: tls.VersionTLS13`. Go 1.24 enables the hybrid X25519MLKEM768 group by default, which is the single highest-value change available today.

1. acme/challenge.go:242 config := &tls.Config{
2. acme/challenge_test.go:2304 test path srv.TLS = &tls.Config{
3. acme/client.go:59 TLSClientConfig: &tls.Config{
4. authority/config/config_test.go:167 test path CipherSuites: CipherSuites{
5. authority/config/config_test.go:176 test path CipherSuites: CipherSuites{
6. authority/config/config_test.go:196 test path CipherSuites: CipherSuites{
7. authority/config/tls_options.go:42 CipherSuites: DefaultTLSCipherSuites,
8. authority/config/tls_options.go:164 func (t *TLSOptions) TLSConfig() *tls.Config {
9. authority/config/tls_options.go:172 return &tls.Config{
10. authority/config/tls_options.go:173 CipherSuites: t.CipherSuites.Value(),
11. authority/config/tls_options_test.go:143 test path {"default", fields{DefaultTLSCipherSuites, DefaultTLSMinVersion, DefaultTLSMaxVersion, DefaultTLSRenegotiation}, &tls.Config{
12. authority/config/tls_options_test.go:144 test path CipherSuites: []uint16{tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
13. authority/config/tls_options_test.go:149 test path {"renegotation", fields{DefaultTLSCipherSuites, DefaultTLSMinVersion, DefaultTLSMaxVersion, true}, &tls.Config{
14. authority/config/tls_options_test.go:150 test path CipherSuites: []uint16{tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
15. authority/config/tls_options_test.go:159 test path CipherSuites: tt.fields.CipherSuites,
16. authority/http_client.go:47 tr.TLSClientConfig = &tls.Config{
17. authority/http_client_test.go:84 test path srv.TLS = &tls.Config{
18. authority/linkedca.go:482 conn, err := grpc.NewClient(endpoint, grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{
19. authority/linkedca.go:532 conn, err := grpc.NewClient(endpoint, grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{
20. authority/linkedca.go:609 return cert, &tls.Config{
21. authority/provisioner/webhook_test.go:654 test path transport.TLSClientConfig = &tls.Config{
22. authority/tls_test.go:1481 test path CipherSuites: CipherSuites{
23. ca/bootstrap_test.go:232 test path {"fail with TLSConfig", args{context.Background(), token(), &http.Server{TLSConfig: &tls.Config{}}}, true},
24. ca/bootstrap_test.go:290 test path {"fail with TLSConfig", args{context.Background(), token(), &http.Server{TLSConfig: &tls.Config{}}}, true},
25. ca/ca.go:634 serverTLSConfig = &tls.Config{
26. ca/client.go:70 Transport: getDefaultTransport(&tls.Config{InsecureSkipVerify: true}),
27. ca/client.go:257 tr.TLSClientConfig = &tls.Config{
28. ca/client.go:267 tr.TLSClientConfig = &tls.Config{
29. ca/client.go:311 TLSClientConfig: &tls.Config{
30. ca/client.go:433 return getDefaultTransport(&tls.Config{
31. ca/client.go:451 return getDefaultTransport(&tls.Config{
32. ca/client.go:462 return getDefaultTransport(&tls.Config{
33. ca/identity/client.go:65 tr.TLSClientConfig = &tls.Config{
34. ca/identity/client_test.go:59 test path okServer.TLS = &tls.Config{
35. ca/identity/client_test.go:135 test path tr.TLSClientConfig = &tls.Config{
36. ca/identity/identity.go:300 tr.TLSClientConfig = &tls.Config{
37. ca/tls.go:66 Config: &tls.Config{
38. ca/tls.go:294 func getDefaultTLSConfig(sign *api.SignResponse) *tls.Config {
39. ca/tls.go:298 return &tls.Config{
40. ca/tls_options_test.go:35 test path {"ok", args{client, &tls.Config{}, &api.SignResponse{}}, &TLSOptionCtx{Client: client, Config: &tls.Config{}, Sign: &api.SignResponse{}, mutableConfig: newMutableTLSConfig()}},
41. ca/tls_options_test.go:66 test path {"ok", fields{&tls.Config{}}, args{[]TLSOption{RequireAndVerifyClientCert()}}, false},
42. ca/tls_options_test.go:67 test path {"ok", fields{&tls.Config{}}, args{[]TLSOption{VerifyClientCertIfGiven()}}, false},
43. ca/tls_options_test.go:68 test path {"fail", fields{&tls.Config{}}, args{[]TLSOption{VerifyClientCertIfGiven(), fail()}}, true},
44. ca/tls_options_test.go:89 test path {"ok", &tls.Config{ClientAuth: tls.RequireAndVerifyClientCert}},
45. ca/tls_options_test.go:94 test path Config: &tls.Config{},
46. ca/tls_options_test.go:114 test path {"ok", &tls.Config{ClientAuth: tls.VerifyClientCertIfGiven}},
47. ca/tls_options_test.go:119 test path Config: &tls.Config{},
48. ca/tls_options_test.go:147 test path {"ok", args{cert}, &tls.Config{RootCAs: pool}},
49. ca/tls_options_test.go:152 test path Config: &tls.Config{},
50. ca/tls_options_test.go:180 test path {"ok", args{cert}, &tls.Config{ClientCAs: pool}},
51. ca/tls_options_test.go:185 test path Config: &tls.Config{},
52. ca/tls_options_test.go:227 test path {"ok", args{client, &tls.Config{}}, &tls.Config{RootCAs: pool}, false},
53. ca/tls_options_test.go:228 test path {"fail", args{clientFail, &tls.Config{}}, &tls.Config{}, true},
54. ca/tls_options_test.go:276 test path {"ok", args{client, &tls.Config{}}, &tls.Config{ClientCAs: pool}, false},
55. ca/tls_options_test.go:277 test path {"fail", args{clientFail, &tls.Config{}}, &tls.Config{}, true},
56. ca/tls_options_test.go:330 test path {"ok", args{client, &tls.Config{}}, &tls.Config{RootCAs: pool}, false},
57. ca/tls_options_test.go:331 test path {"fail", args{clientFail, &tls.Config{}}, &tls.Config{}, true},
58. ca/tls_options_test.go:387 test path {"ok", args{client, &tls.Config{}}, &tls.Config{ClientCAs: pool}, false},
59. ca/tls_options_test.go:388 test path {"fail", args{clientFail, &tls.Config{}}, &tls.Config{}, true},
60. ca/tls_options_test.go:439 test path {"ok", args{client, &tls.Config{}}, &tls.Config{ClientCAs: pool, RootCAs: pool}, false},
61. ca/tls_options_test.go:440 test path {"fail", args{clientFail, &tls.Config{}}, &tls.Config{}, true},
62. ca/tls_options_test.go:493 test path {"ok", args{client, &tls.Config{}}, &tls.Config{ClientCAs: pool, RootCAs: pool}, false},
63. ca/tls_options_test.go:494 test path {"fail", args{clientFail, &tls.Config{}}, &tls.Config{}, true},
64. test/integration/requestid_test.go:280 test path srv.TLS = &tls.Config{
65. test/integration/scep/common_test.go:178 test path transport.TLSClientConfig = &tls.Config{

go.tls.config · CWE-757

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 61 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. api/api_test.go:71 test path -----BEGIN CERTIFICATE-----
2. api/api_test.go:121 test path -----BEGIN CERTIFICATE-----
3. authority/provisioner/testdata/certs/bad-extension.crt:1 test path -----BEGIN CERTIFICATE-----
4. authority/provisioner/testdata/certs/ecdsa.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----
5. authority/provisioner/testdata/certs/foo.crt:1 test path -----BEGIN CERTIFICATE-----
6. authority/provisioner/testdata/certs/good-extension.crt:1 test path -----BEGIN CERTIFICATE-----
7. authority/provisioner/testdata/certs/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
8. authority/provisioner/testdata/certs/x5c-leaf.crt:1 test path -----BEGIN CERTIFICATE-----
9. authority/provisioner/testdata/certs/x5c-leaf.crt:13 test path -----BEGIN CERTIFICATE-----
10. authority/provisioner/utils_test.go:269 test path -----BEGIN CERTIFICATE-----
11. authority/provisioner/x5c_test.go:105 test path -----BEGIN CERTIFICATE-----
12. authority/provisioner/x5c_test.go:117 test path -----BEGIN CERTIFICATE-----
13. authority/provisioner/x5c_test.go:192 test path -----BEGIN CERTIFICATE-----
14. authority/provisioner/x5c_test.go:220 test path -----BEGIN CERTIFICATE-----
15. authority/provisioner/x5c_test.go:231 test path -----BEGIN CERTIFICATE-----
16. authority/provisioner/x5c_test.go:259 test path -----BEGIN CERTIFICATE-----
17. authority/provisioner/x5c_test.go:271 test path -----BEGIN CERTIFICATE-----
18. authority/provisioner/x5c_test.go:301 test path -----BEGIN CERTIFICATE-----
19. authority/provisioner/x5c_test.go:313 test path -----BEGIN CERTIFICATE-----
20. authority/testdata/certs/badsig.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----
21. authority/testdata/certs/foo.crt:1 test path -----BEGIN CERTIFICATE-----
22. authority/testdata/certs/foo.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----
23. authority/testdata/certs/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
24. authority/testdata/certs/provisioner-not-found.crt:1 test path -----BEGIN CERTIFICATE-----
25. authority/testdata/certs/renew-disabled.crt:1 test path -----BEGIN CERTIFICATE-----
26. authority/testdata/certs/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
27. authority/testdata/scep/root.crt:1 test path -----BEGIN CERTIFICATE-----
28. ca/client_test.go:60 test path -----BEGIN CERTIFICATE-----
29. ca/identity/testdata/certs/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
30. ca/identity/testdata/certs/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
31. ca/identity/testdata/certs/server.crt:1 test path -----BEGIN CERTIFICATE-----
32. ca/identity/testdata/certs/server.crt:15 test path -----BEGIN CERTIFICATE-----
33. ca/identity/testdata/identity/expired.crt:1 test path -----BEGIN CERTIFICATE-----
34. ca/identity/testdata/identity/expired.crt:15 test path -----BEGIN CERTIFICATE-----
35. ca/identity/testdata/identity/identity.crt:1 test path -----BEGIN CERTIFICATE-----
36. ca/identity/testdata/identity/identity.crt:15 test path -----BEGIN CERTIFICATE-----
37. ca/identity/testdata/identity/not_before.crt:1 test path -----BEGIN CERTIFICATE-----
38. ca/identity/testdata/identity/not_before.crt:15 test path -----BEGIN CERTIFICATE-----
39. ca/testdata/rotated/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
40. ca/testdata/rotated/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
41. ca/testdata/secrets/federated_ca.crt:1 test path -----BEGIN CERTIFICATE-----
42. ca/testdata/secrets/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
43. ca/testdata/secrets/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
44. cas/cloudcas/cloudcas_test.go:54 test path -----BEGIN CERTIFICATE-----
45. cas/cloudcas/cloudcas_test.go:64 test path -----BEGIN CERTIFICATE-----
46. cas/cloudcas/cloudcas_test.go:75 test path -----BEGIN CERTIFICATE-----
47. cas/cloudcas/cloudcas_test.go:87 test path -----BEGIN CERTIFICATE-----
48. cas/cloudcas/cloudcas_test.go:100 test path -----BEGIN CERTIFICATE REQUEST-----
49. cas/vaultcas/vaultcas_test.go:22 test path -----BEGIN CERTIFICATE-----
50. cas/vaultcas/vaultcas_test.go:35 test path -----BEGIN CERTIFICATE REQUEST-----
51. cas/vaultcas/vaultcas_test.go:64 test path -----BEGIN CERTIFICATE-----
52. examples/basic-federation/pki/cloud/certs/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
53. examples/basic-federation/pki/cloud/certs/kubernetes_root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
54. examples/basic-federation/pki/cloud/certs/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
55. examples/basic-federation/pki/kubernetes/certs/cloud_root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
56. examples/basic-federation/pki/kubernetes/certs/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
57. examples/basic-federation/pki/kubernetes/certs/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
58. examples/docker/ca/pki/secrets/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
59. examples/docker/ca/pki/secrets/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----
60. examples/pki/secrets/intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
61. examples/pki/secrets/root_ca.crt:1 test path -----BEGIN CERTIFICATE-----

pem.certificate

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 40 places See details

ECDSA in the Go standard library

`ecdsa.GenerateKey()` or `ecdsa.Sign*()`. The curve is read from the `elliptic.P###()` argument.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

1. acme/challenge_test.go:146 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
2. acme/challenge_test.go:203 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
3. acme/challenge_test.go:248 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
4. acme/challenge_test.go:302 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
5. acme/challenge_test.go:3530 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
6. acme/challenge_test.go:3679 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
7. acme/challenge_test.go:3704 test path otherSigner, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
8. acme/challenge_test.go:3923 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
9. acme/challenge_test.go:4684 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
10. acme/challenge_test.go:4819 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
11. acme/challenge_test.go:5116 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
12. acme/challenge_test.go:5201 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
13. acme/challenge_test.go:5283 test path signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
14. api/api_test.go:1469 test path p256, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
15. api/ssh_test.go:39 test path priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
16. authority/provisioner/nebula_test.go:83 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
17. authority/provisioner/nebula_test.go:135 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
18. authority/ssh_test.go:139 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
19. authority/ssh_test.go:143 test path signKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
20. authority/ssh_test.go:321 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
21. authority/ssh_test.go:325 test path signKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
22. authority/ssh_test.go:413 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
23. authority/ssh_test.go:418 test path key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
24. authority/ssh_test.go:455 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
25. authority/ssh_test.go:460 test path key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
26. authority/ssh_test.go:497 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
27. authority/ssh_test.go:505 test path key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
28. authority/ssh_test.go:883 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
29. authority/ssh_test.go:887 test path signKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
30. authority/tls_test.go:86 test path priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
31. authority/tls_test.go:114 test path priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
32. authority/tls_test.go:132 test path priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
33. ca/client.go:1461 pk, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
34. ca/client_test.go:113 test path priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
35. cas/softcas/softcas_test.go:475 test path rootSigner, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
36. cas/stepcas/x5c_issuer_test.go:246 test path p256 := mustSigner(ecdsa.GenerateKey(elliptic.P256(), rand.Reader))
37. templates/templates_test.go:220 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
38. templates/templates_test.go:226 test path key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
39. templates/templates_test.go:291 test path key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
40. templates/templates_test.go:297 test path key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

go.ecdsa · CWE-327

ECDSA Quantum-vulnerable 31 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. authority/provisioner/testdata/secrets/ecdsa.key:1 test path -----BEGIN EC PRIVATE KEY-----
2. authority/provisioner/testdata/secrets/foo.key:1 test path -----BEGIN EC PRIVATE KEY-----
3. authority/provisioner/testdata/secrets/x5c-leaf.key:1 test path -----BEGIN EC PRIVATE KEY-----
4. authority/testdata/scep/root.key:1 test path -----BEGIN EC PRIVATE KEY-----
5. authority/testdata/secrets/foo.key:1 test path -----BEGIN EC PRIVATE KEY-----
6. authority/testdata/secrets/provisioner-not-found.key:1 test path -----BEGIN EC PRIVATE KEY-----
7. authority/testdata/secrets/renew-disabled.key:1 test path -----BEGIN EC PRIVATE KEY-----
8. cas/cloudcas/cloudcas_test.go:107 test path -----BEGIN EC PRIVATE KEY-----
9. cas/cloudcas/cloudcas_test.go:113 test path -----BEGIN EC PRIVATE KEY-----
10. pki/testdata/helm/simple.yml:67 test path -----BEGIN EC PRIVATE KEY-----
11. pki/testdata/helm/simple.yml:78 test path -----BEGIN EC PRIVATE KEY-----
12. pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:68 test path -----BEGIN EC PRIVATE KEY-----
13. pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:79 test path -----BEGIN EC PRIVATE KEY-----
14. pki/testdata/helm/with-acme.yml:68 test path -----BEGIN EC PRIVATE KEY-----
15. pki/testdata/helm/with-acme.yml:79 test path -----BEGIN EC PRIVATE KEY-----
16. pki/testdata/helm/with-admin.yml:67 test path -----BEGIN EC PRIVATE KEY-----
17. pki/testdata/helm/with-admin.yml:78 test path -----BEGIN EC PRIVATE KEY-----
18. pki/testdata/helm/with-provisioner.yml:67 test path -----BEGIN EC PRIVATE KEY-----
19. pki/testdata/helm/with-provisioner.yml:78 test path -----BEGIN EC PRIVATE KEY-----
20. pki/testdata/helm/with-ssh-and-acme.yml:77 test path -----BEGIN EC PRIVATE KEY-----
21. pki/testdata/helm/with-ssh-and-acme.yml:88 test path -----BEGIN EC PRIVATE KEY-----
22. pki/testdata/helm/with-ssh-and-acme.yml:95 test path -----BEGIN EC PRIVATE KEY-----
23. pki/testdata/helm/with-ssh-and-acme.yml:102 test path -----BEGIN EC PRIVATE KEY-----
24. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:76 test path -----BEGIN EC PRIVATE KEY-----
25. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:87 test path -----BEGIN EC PRIVATE KEY-----
26. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:94 test path -----BEGIN EC PRIVATE KEY-----
27. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:101 test path -----BEGIN EC PRIVATE KEY-----
28. pki/testdata/helm/with-ssh.yml:76 test path -----BEGIN EC PRIVATE KEY-----
29. pki/testdata/helm/with-ssh.yml:87 test path -----BEGIN EC PRIVATE KEY-----
30. pki/testdata/helm/with-ssh.yml:94 test path -----BEGIN EC PRIVATE KEY-----
31. pki/testdata/helm/with-ssh.yml:101 test path -----BEGIN EC PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 30 places See details

Public key declared as a JSON Web Key

A `kty` field, with the curve read from the sibling `crv` where the family needs one. A JWKS document declares a key without naming an algorithm anywhere, so it is invisible to a scan that only looks for `alg`.

This file publishes the public keys other systems use to check this system's signatures. Everyone who trusts these keys has to accept the new kind of key before the old ones can be retired.

What to do. A published JWKS is what relying parties trust. It has to accept a post-quantum key type before the keys behind it can change, so put it early in the migration order.

1. ca/identity/testdata/config/ca.json:21 test path "kty": "EC",
2. ca/testdata/ca.json:28 test path "kty": "EC",
3. ca/testdata/ca.json:41 test path "kty": "EC",
4. ca/testdata/ca.json:54 test path "kty": "EC",
5. ca/testdata/ca.json:67 test path "kty": "EC",
6. ca/testdata/ca.json:83 test path "kty": "EC",
7. ca/testdata/federated-ca.json:28 test path "kty": "EC",
8. ca/testdata/rotate-ca-0.json:27 test path "kty": "EC",
9. ca/testdata/rotate-ca-1.json:27 test path "kty": "EC",
10. ca/testdata/rotate-ca-2.json:27 test path "kty": "EC",
11. ca/testdata/rotate-ca-3.json:27 test path "kty": "EC",
12. ca/testdata/rsaca.json:32 test path "kty": "EC",
13. examples/basic-federation/pki/cloud/config/ca.federated.json:20 test path "kty": "EC",
14. examples/basic-federation/pki/cloud/config/ca.json:20 test path "kty": "EC",
15. examples/basic-federation/pki/kubernetes/config/ca.federated.json:20 test path "kty": "EC",
16. examples/basic-federation/pki/kubernetes/config/ca.json:20 test path "kty": "EC",
17. examples/docker/ca/pki/config/ca.json:20 test path "kty": "EC",
18. examples/docker/ca/pki/config/ca.json:34 test path "kty": "EC",
19. examples/pki/config/ca.json:20 test path "kty": "EC",
20. examples/pki/config/ca.json:34 test path "kty": "EC",
21. examples/pki/config/ca.json:52 test path "kty": "EC",
22. examples/pki/config/ca.json:70 test path "kty": "EC",
23. pki/testdata/helm/simple.yml:23 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD
24. pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:23 test path - {"type":"JWK","name":"acme","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFDOI"}
25. pki/testdata/helm/with-acme.yml:23 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD
26. pki/testdata/helm/with-admin.yml:23 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD
27. pki/testdata/helm/with-provisioner.yml:23 test path - {"type":"JWK","name":"a-provisioner","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvr
28. pki/testdata/helm/with-ssh-and-acme.yml:26 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD
29. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:26 test path - {"type":"JWK","name":"sshpop","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFDOI
30. pki/testdata/helm/with-ssh.yml:26 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD

jose.jwk · CWE-327

ECDSA Quantum-vulnerable 30 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. ca/identity/testdata/config/ca.json:24 test path "alg": "ES256",
2. ca/testdata/ca.json:31 test path "alg": "ES256",
3. ca/testdata/ca.json:44 test path "alg": "ES256",
4. ca/testdata/ca.json:57 test path "alg": "ES256",
5. ca/testdata/ca.json:70 test path "alg": "ES256",
6. ca/testdata/ca.json:86 test path "alg": "ES256",
7. ca/testdata/federated-ca.json:31 test path "alg": "ES256",
8. ca/testdata/rotate-ca-0.json:30 test path "alg": "ES256",
9. ca/testdata/rotate-ca-1.json:30 test path "alg": "ES256",
10. ca/testdata/rotate-ca-2.json:30 test path "alg": "ES256",
11. ca/testdata/rotate-ca-3.json:30 test path "alg": "ES256",
12. ca/testdata/rsaca.json:35 test path "alg": "ES256",
13. examples/basic-federation/pki/cloud/config/ca.federated.json:23 test path "alg": "ES256",
14. examples/basic-federation/pki/cloud/config/ca.json:23 test path "alg": "ES256",
15. examples/basic-federation/pki/kubernetes/config/ca.federated.json:23 test path "alg": "ES256",
16. examples/basic-federation/pki/kubernetes/config/ca.json:23 test path "alg": "ES256",
17. examples/docker/ca/pki/config/ca.json:23 test path "alg": "ES256",
18. examples/docker/ca/pki/config/ca.json:37 test path "alg": "ES256",
19. examples/pki/config/ca.json:23 test path "alg": "ES256",
20. examples/pki/config/ca.json:37 test path "alg": "ES256",
21. examples/pki/config/ca.json:55 test path "alg": "ES256",
22. examples/pki/config/ca.json:73 test path "alg": "ES256",
23. pki/testdata/helm/simple.yml:23 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD
24. pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:23 test path - {"type":"JWK","name":"acme","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFDOI"}
25. pki/testdata/helm/with-acme.yml:23 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD
26. pki/testdata/helm/with-admin.yml:23 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD
27. pki/testdata/helm/with-provisioner.yml:23 test path - {"type":"JWK","name":"a-provisioner","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvr
28. pki/testdata/helm/with-ssh-and-acme.yml:26 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD
29. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:26 test path - {"type":"JWK","name":"sshpop","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFDOI
30. pki/testdata/helm/with-ssh.yml:26 test path - {"type":"JWK","name":"step-cli","key":{"use":"sig","kty":"EC","kid":"zsUmysmDVoGJ71YoPHyZ-68tNihDaDaO5Mu7xX3M-_I","crv":"P-256","alg":"ES256","x":"Pqnua4CzqKz6ua41J3yeWZ1sRkGt0UlCkbHv8H2DGuY","y":"UhoZ_2ItDen9KQTcjay-ph-SBXH0mwqhHyvrrqIFD

jose.algorithm · CWE-327

RSA2048-bit Quantum-vulnerable Recorded traffic 19 places See details

RSA in the Go standard library

`rsa.GenerateKey()`, `rsa.SignPKCS1v15()`, `rsa.EncryptOAEP()` or an import of `crypto/rsa`.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Go 1.24 ships ML-KEM as `crypto/mlkem`.

1. acme/challenge_test.go:2343 test path privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
2. api/api_test.go:1473 test path rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
3. authority/provisioner/aws_test.go:319 test path badKey, err := rsa.GenerateKey(rand.Reader, 2048)
4. authority/provisioner/aws_test.go:582 test path badKey, err := rsa.GenerateKey(rand.Reader, 2048)
5. authority/provisioner/aws_test.go:752 test path rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
6. authority/provisioner/azure_test.go:664 test path rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
7. authority/provisioner/gcp_test.go:646 test path rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
8. authority/provisioner/jwk_test.go:420 test path rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
9. authority/provisioner/oidc_test.go:556 test path rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
10. authority/provisioner/scep_test.go:35 test path key, err := rsa.GenerateKey(rand.Reader, 2048)
11. authority/provisioner/scep_test.go:522 test path key, err := rsa.GenerateKey(rand.Reader, 2048)
12. authority/provisioner/scep_test.go:524 test path badKey, err := rsa.GenerateKey(rand.Reader, 2048)
13. cas/softcas/softcas_test.go:414 test path signer, err := rsa.GenerateKey(rand.Reader, 2048)
14. cas/softcas/softcas_test.go:480 test path intSigner, err := rsa.GenerateKey(rand.Reader, 2048)
15. cas/stepcas/x5c_issuer_test.go:250 test path rsaKey := mustSigner(rsa.GenerateKey(rand.Reader, 2048))
16. scep/authority_test.go:140 test path return rsa.GenerateKey(rand.Reader, 2048)
17. test/integration/scep/common_test.go:305 test path signer, err = rsa.GenerateKey(rand.Reader, 2048)
18. test/integration/scep/windows_go1.23_test.go:47 test path signer, err := rsa.GenerateKey(rand.Reader, 2048)
19. test/integration/scep/windows_test.go:33 test path signer, err := rsa.GenerateKey(rand.Reader, 2048)

go.rsa · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable 14 places See details

Ed25519 in the Go standard library

`ed25519.GenerateKey()` or `ed25519.Sign()`.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204). Go 1.24 ships ML-DSA as `crypto/mldsa`.

1. acme/api/wire_integration_test.go:600 test path _, priv, err := ed25519.GenerateKey(rand.Reader)
2. acme/challenge.go:1628 if !ed25519.Verify(pub, []byte(keyAuth), sig) {
3. acme/challenge.go:1808 if !ed25519.Verify(pub, []byte(keyAuth), sig) {
4. api/api_test.go:977 test path rootPub, rootPriv, err := ed25519.GenerateKey(rand.Reader)
5. api/api_test.go:981 test path leafPub, leafPriv, err := ed25519.GenerateKey(rand.Reader)
6. api/api_test.go:1477 test path edPub, edPriv, err := ed25519.GenerateKey(rand.Reader)
7. authority/authorize_test.go:1435 test path _, signer, err := ed25519.GenerateKey(rand.Reader)
8. authority/authorize_test.go:1443 test path _, otherSigner, err := ed25519.GenerateKey(rand.Reader)
9. authority/provisioner/nebula_test.go:38 test path pub, priv, err := ed25519.GenerateKey(rand.Reader)
10. authority/provisioner/nebula_test.go:60 test path pub, priv, err := ed25519.GenerateKey(rand.Reader)
11. cas/cloudcas/certificate_test.go:110 test path edpub, _, err := ed25519.GenerateKey(rand.Reader)
12. cas/cloudcas/cloudcas_test.go:228 test path pub, _, err := ed25519.GenerateKey(rand.Reader)
13. cas/stepcas/stepcas_test.go:56 test path pub, priv, err := ed25519.GenerateKey(rand.Reader)
14. cas/stepcas/x5c_issuer_test.go:249 test path edKey := mustSigner(ed25519.GenerateKey(rand.Reader))

go.ed25519 · CWE-327

ECDSAsecp256r1 Quantum-vulnerable 12 places See details

SSH public key

An `ssh-rsa`, `ecdsa-sha2-*`, `ssh-ed25519` or `ssh-dss` key. `ssh-dss` is disabled by default in current OpenSSH and is reported as broken.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Replace `ssh-dss` now. For the rest, enable the `sntrup761x25519-sha512` key exchange, which protects recorded sessions even while host keys stay classical.

1. authority/provisioner/testdata/certs/ssh_host_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJj80EJX
2. authority/provisioner/testdata/certs/ssh_user_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ8einS8
3. authority/testdata/certs/ssh_host_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJj80EJX
4. authority/testdata/certs/ssh_user_ca_key.pub:1 test path ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ8einS8
5. pki/helm_test.go:239 test path p.Files[p.Ssh.HostPublicKey] = []byte("ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItb
6. pki/helm_test.go:244 test path p.Files[p.Ssh.UserPublicKey] = []byte("ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItb
7. pki/testdata/helm/with-ssh-and-acme.yml:61 test path ssh_host_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY
8. pki/testdata/helm/with-ssh-and-acme.yml:64 test path ssh_user_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY
9. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:60 test path ssh_host_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY
10. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:63 test path ssh_user_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY
11. pki/testdata/helm/with-ssh.yml:60 test path ssh_host_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY
12. pki/testdata/helm/with-ssh.yml:63 test path ssh_user_ca: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY

ssh.public-key · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable 10 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

1. acme/api/order_test.go:560 test path -----BEGIN PUBLIC KEY-----
2. acme/api/order_test.go:1067 test path -----BEGIN PUBLIC KEY-----
3. acme/challenge_test.go:563 test path -----BEGIN PUBLIC KEY-----
4. acme/challenge_wire_test.go:27 test path -----BEGIN PUBLIC KEY-----
5. acme/challenge_wire_test.go:2683 test path -----BEGIN PUBLIC KEY-----
6. acme/challenge_wire_test.go:3940 test path -----BEGIN PUBLIC KEY-----
7. acme/challenge_wire_test.go:4011 test path -----BEGIN PUBLIC KEY-----
8. acme/challenge_wire_test.go:4062 test path -----BEGIN PUBLIC KEY-----
9. authority/provisioner/acme_test.go:103 test path -----BEGIN PUBLIC KEY-----
10. authority/provisioner/wire/wire_options_test.go:11 test path -----BEGIN PUBLIC KEY-----

pem.public-key

RSA2048-bit Quantum-vulnerable 10 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. acme/challenge.go:1664 -----BEGIN CERTIFICATE-----
2. acme/challenge.go:1686 -----BEGIN CERTIFICATE-----
3. api/api_test.go:46 test path -----BEGIN CERTIFICATE-----
4. authority/provisioner/testdata/certs/rsa.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----
5. authority/provisioner/testdata/certs/yubico-piv-ca.crt:1 test path -----BEGIN CERTIFICATE-----
6. authority/testdata/scep/intermediate.crt:1 test path -----BEGIN CERTIFICATE-----
7. ca/ca_test.go:125 test path -----BEGIN CERTIFICATE REQUEST-----
8. ca/client_test.go:35 test path -----BEGIN CERTIFICATE-----
9. cas/cloudcas/certificate_test.go:27 test path -----BEGIN CERTIFICATE-----
10. cas/vaultcas/vaultcas_test.go:42 test path -----BEGIN CERTIFICATE REQUEST-----

pem.certificate

RSA4096-bit Quantum-vulnerable 5 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. acme/challenge.go:1406 -----BEGIN CERTIFICATE-----
2. api/api_test.go:94 test path -----BEGIN CERTIFICATE REQUEST-----
3. ca/client_test.go:83 test path -----BEGIN CERTIFICATE REQUEST-----
4. ca/testdata/secrets/rsa_intermediate_ca.crt:1 test path -----BEGIN CERTIFICATE-----
5. ca/testdata/secrets/rsa_root_ca.crt:1 test path -----BEGIN CERTIFICATE-----

pem.certificate

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 4 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

1. authority/provisioner/testdata/certs/bar.pub:1 test path -----BEGIN PUBLIC KEY-----
2. authority/provisioner/testdata/certs/foo.pub:1 test path -----BEGIN PUBLIC KEY-----
3. cas/cloudcas/certificate_test.go:22 test path -----BEGIN PUBLIC KEY-----
4. cosign.pub:1 -----BEGIN PUBLIC KEY-----

pem.public-key

ECDSA Quantum-vulnerable 3 places See details

ECDSA in the Go standard library

`ecdsa.GenerateKey()` or `ecdsa.Sign*()`. The curve is read from the `elliptic.P###()` argument.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

1. acme/api/revoke_test.go:174 test path r, s, err := ecdsa.Sign(rand.Reader, key, digest)
2. acme/challenge.go:1619 if !ecdsa.VerifyASN1(pub, sum[:], sig) {
3. acme/challenge.go:1799 if !ecdsa.VerifyASN1(pub, sum[:], sig) {

go.ecdsa · CWE-327

ECDSA384-bitsecg/secp384r1 Quantum-vulnerable 3 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. acme/challenge.go:1300 -----BEGIN CERTIFICATE-----
2. acme/challenge.go:1438 -----BEGIN CERTIFICATE-----
3. authority/provisioner/testdata/certs/apple-att-ca.crt:1 test path -----BEGIN CERTIFICATE-----

pem.certificate

Ed25519255-bitother/Ed25519 Quantum-vulnerable 3 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. authority/provisioner/testdata/certs/ed25519.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----
2. cas/softcas/softcas_test.go:32 test path -----BEGIN CERTIFICATE-----
3. cas/vaultcas/vaultcas_test.go:58 test path -----BEGIN CERTIFICATE REQUEST-----

pem.certificate

RSA Quantum-vulnerable Recorded traffic 3 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. authority/provisioner/testdata/secrets/rsa.key:1 test path -----BEGIN RSA PRIVATE KEY-----
2. authority/provisioner/utils_test.go:73 test path -----BEGIN RSA PRIVATE KEY-----
3. authority/testdata/scep/intermediate.key:1 test path -----BEGIN RSA PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

DSA Quantum-vulnerable 2 places See details

DSA in the Go standard library

`crypto/dsa`, which the Go team deprecated in 1.16 and froze.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65.

1. api/api_test.go:1482 test path if err := dsa.GenerateParameters(&dsa2048.Parameters, rand.Reader, dsa.L2048N256); err != nil {
2. api/api_test.go:1485 test path if err := dsa.GenerateKey(&dsa2048, rand.Reader); err != nil {

go.dsa · CWE-327

RSA Quantum-vulnerable Recorded traffic 2 places See details

RSA in the Go standard library

`rsa.GenerateKey()`, `rsa.SignPKCS1v15()`, `rsa.EncryptOAEP()` or an import of `crypto/rsa`.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Go 1.24 ships ML-KEM as `crypto/mlkem`.

1. acme/challenge.go:1624 if err := rsa.VerifyPKCS1v15(pub, crypto.SHA256, sum[:], sig); err != nil {
2. acme/challenge.go:1804 if err := rsa.VerifyPKCS1v15(pub, crypto.SHA256, sum[:], sig); err != nil {

go.rsa · CWE-327

ECDH256-bitsecg/secp256r1 Quantum-vulnerable Recorded traffic 1 place See details

Key agreement in Go

`ecdh.P256()`, `ecdh.X25519()` or `curve25519.X25519()`. Key agreement is the highest priority: recorded traffic is decrypted retrospectively.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 (`crypto/mlkem` in Go 1.24), or a hybrid construction.

1. authority/provisioner/nebula.go:346 ecdhPub, err := ecdh.P256().NewPublicKey(c.PublicKey())

go.ecdh · CWE-327

ECDSA224-bitsecg/secp224r1 Quantum-vulnerable 1 place See details

ECDSA in the Go standard library

`ecdsa.GenerateKey()` or `ecdsa.Sign*()`. The curve is read from the `elliptic.P###()` argument.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

1. cas/stepcas/x5c_issuer_test.go:245 test path p224 := mustSigner(ecdsa.GenerateKey(elliptic.P224(), rand.Reader))

go.ecdsa · CWE-327

ECDSA384-bitsecg/secp384r1 Quantum-vulnerable 1 place See details

ECDSA in the Go standard library

`ecdsa.GenerateKey()` or `ecdsa.Sign*()`. The curve is read from the `elliptic.P###()` argument.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

1. cas/stepcas/x5c_issuer_test.go:247 test path p384 := mustSigner(ecdsa.GenerateKey(elliptic.P384(), rand.Reader))

go.ecdsa · CWE-327

ECDSA521-bitsecg/secp521r1 Quantum-vulnerable 1 place See details

ECDSA in the Go standard library

`ecdsa.GenerateKey()` or `ecdsa.Sign*()`. The curve is read from the `elliptic.P###()` argument.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

1. cas/stepcas/x5c_issuer_test.go:248 test path p521 := mustSigner(ecdsa.GenerateKey(elliptic.P521(), rand.Reader))

go.ecdsa · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. cas/softcas/softcas_test.go:42 test path -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

RSA Quantum-vulnerable Recorded traffic 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

1. cas/cloudcas/certificate_test.go:44 test path -----BEGIN RSA PUBLIC KEY-----

pem.public-key

unknown Could not be determined 16 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. pki/testdata/helm/simple.yml:43 test path -----BEGIN CERTIFICATE-----
2. pki/testdata/helm/simple.yml:51 test path -----BEGIN CERTIFICATE-----
3. pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:44 test path -----BEGIN CERTIFICATE-----
4. pki/testdata/helm/with-acme-and-duplicate-provisioner-name.yml:52 test path -----BEGIN CERTIFICATE-----
5. pki/testdata/helm/with-acme.yml:44 test path -----BEGIN CERTIFICATE-----
6. pki/testdata/helm/with-acme.yml:52 test path -----BEGIN CERTIFICATE-----
7. pki/testdata/helm/with-admin.yml:43 test path -----BEGIN CERTIFICATE-----
8. pki/testdata/helm/with-admin.yml:51 test path -----BEGIN CERTIFICATE-----
9. pki/testdata/helm/with-provisioner.yml:43 test path -----BEGIN CERTIFICATE-----
10. pki/testdata/helm/with-provisioner.yml:51 test path -----BEGIN CERTIFICATE-----
11. pki/testdata/helm/with-ssh-and-acme.yml:48 test path -----BEGIN CERTIFICATE-----
12. pki/testdata/helm/with-ssh-and-acme.yml:56 test path -----BEGIN CERTIFICATE-----
13. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:47 test path -----BEGIN CERTIFICATE-----
14. pki/testdata/helm/with-ssh-and-duplicate-provisioner-name.yml:55 test path -----BEGIN CERTIFICATE-----
15. pki/testdata/helm/with-ssh.yml:47 test path -----BEGIN CERTIFICATE-----
16. pki/testdata/helm/with-ssh.yml:55 test path -----BEGIN CERTIFICATE-----

pem.certificate

unknown Could not be determined 14 places See details

X.509 certificate handling

`x509.CreateCertificate()` or a PKCS#1/PKCS#8/EC key parser. Certificates are the longest-lived cryptographic artefacts most systems own, and their validity periods often outrun the migration.

The algorithm could not be established from the source. Usually it is selected while the program runs, but it may equally be that the call gives no clue, or that it is decided somewhere this scan does not reach. Somebody has to check.

What to do. Shorten certificate lifetimes now so the eventual re-issue with a post-quantum key is routine rather than an incident.

1. acme/api/wire_integration_test.go:620 test path csr, err := x509.CreateCertificateRequest(rand.Reader, csrTemplate, priv)
2. acme/challenge_test.go:2378 test path cert, err := x509.CreateCertificate(rand.Reader, certTemplate, certTemplate, privateKey.Public(), privateKey)
3. api/api_test.go:1533 test path der, err := x509.CreateCertificate(rand.Reader, &template, &template, pub, priv)
4. authority/authority_test.go:435 test path cr, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{
5. authority/provisioner/aws_test.go:317 test path key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
6. authority/provisioner/aws_test.go:579 test path key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
7. authority/provisioner/utils_test.go:434 test path key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
8. authority/provisioner/utils_test.go:542 test path key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
9. authority/tls_test.go:198 test path csrBytes, err := x509.CreateCertificateRequest(rand.Reader, _csr, priv)
10. ca/ca_test.go:49 test path csrBytes, err := x509.CreateCertificateRequest(rand.Reader, _csr, priv)
11. ca/client.go:1482 csr, err := x509.CreateCertificateRequest(rand.Reader, template, pk)
12. ca/client.go:1548 csr, err := x509.CreateCertificateRequest(rand.Reader, template, key)
13. cas/cloudcas/cloudcas_test.go:297 test path key, err := x509.ParseECPrivateKey(block.Bytes)
14. test/integration/scep/common_test.go:345 test path selfSigned, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, signer.Public(), signer)

go.x509

unknown Could not be determined 12 places See details

SSH implementation in use

`golang.org/x/crypto/ssh`. Host keys are long-lived and awkward to rotate.

The algorithm could not be established from the source. Usually it is selected while the program runs, but it may equally be that the call gives no clue, or that it is decided somewhere this scan does not reach. Somebody has to check.

What to do. OpenSSH's `sntrup761x25519` hybrid key exchange addresses the recorded-traffic half; the host-key signature has no standardised replacement yet.

1. api/ssh_test.go:47 test path signerKey, err := ssh.NewPublicKey(sshSignerKey.Public())
2. authority/authorize_test.go:1020 test path cert.Key, err = ssh.NewPublicKey(jwk.Public().Key)
3. authority/config/ssh.go:77 key, err := ssh.NewPublicKey(k.Key.Key)
4. authority/config/ssh_test.go:49 test path pub, err := ssh.NewPublicKey(key.Public().Key)
5. authority/provisioner/jwk_test.go:427 test path sshPub, err := ssh.NewPublicKey(pub)
6. authority/provisioner/sign_ssh_options_test.go:233 test path sshPub, err := ssh.NewPublicKey(pub)
7. authority/provisioner/ssh_test.go:49 test path pub, err := ssh.NewPublicKey(key)
8. authority/provisioner/sshpop_test.go:49 test path cert.Key, err = ssh.NewPublicKey(jwk.Public().Key)
9. authority/ssh_test.go:141 test path pub, err := ssh.NewPublicKey(key.Public())
10. ca/client_test.go:796 test path key, err := ssh.NewPublicKey(mustKey(t).Public())
11. pki/pki.go:681 sshKey, err := ssh.NewPublicKey(resp.PublicKey)
12. templates/templates_test.go:222 test path user, err := ssh.NewPublicKey(key.Public())

go.ssh · CWE-327

unknown Could not be determined 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. authority/provisioner/testdata/secrets/ed25519.key:1 test path -----BEGIN ENCRYPTED PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

unknown Could not be determined 1 place See details

Cryptographic library in the dependency manifest

A dependency known to implement classical asymmetric cryptography. Its presence is inventory, not a finding about this codebase: the library may never be called with a quantum-vulnerable algorithm.

The project depends on a cryptography library. Listed so the inventory is complete; it is not by itself a problem.

What to do. Check the version. Several of these libraries have shipped ML-KEM and ML-DSA support since 2024, so the migration may need an upgrade rather than a replacement.

1. go.mod:43 golang.org/x/crypto v0.55.0

dep.crypto-library

CSPRNG Quantum-safe 2 places See details

Random number generation

`crypto/rand`. Recorded so the inventory names its randomness source. `math/rand` reaching key material would be a present-day defect, and is a different thing entirely.

This is where the software gets its random numbers. Quantum computers do not weaken it.

What to do. No action.

1. acme/api/revoke_test.go:45 test path return rand.Int(rand.Reader, big.NewInt(1000000000000000000))
2. acme/db/nosql/eab.go:66 _, err = rand.Read(random)

go.rng

HMAC Quantum-safe 2 places See details

Keyed hash in use

`hmac.New()`. Not broken by Shor and only marginally affected by Grover.

This is a fingerprint proving a message was not altered. Quantum computers do not break it.

What to do. No action, unless the digest is MD5 or SHA-1.

1. authority/provisioner/webhook.go:240 h := hmac.New(sha256.New, secret)
2. authority/provisioner/webhook_test.go:582 test path h := hmac.New(sha256.New, secret)

go.hmac