tink-crypto/tink-java

RSASSA-PKCS1v15 Quantum-vulnerable Renamed import 53 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. src/main/java/com/google/crypto/tink/jwt/JwkSetConverter.java:277 case "RS256":
2. src/main/java/com/google/crypto/tink/jwt/JwkSetConverter.java:280 case "RS384":
3. src/main/java/com/google/crypto/tink/jwt/JwkSetConverter.java:283 case "RS512":
4. src/main/java/com/google/crypto/tink/jwt/JwtRsaSsaPkcs1Parameters.java:90 public static final Algorithm RS256 = new Algorithm("RS256");
5. src/main/java/com/google/crypto/tink/jwt/JwtRsaSsaPkcs1Parameters.java:93 public static final Algorithm RS384 = new Algorithm("RS384");
6. src/main/java/com/google/crypto/tink/jwt/JwtRsaSsaPkcs1Parameters.java:96 public static final Algorithm RS512 = new Algorithm("RS512");
7. src/main/java/com/google/crypto/tink/jwt/internal/JwtFormat.java:97 case "RS256":
8. src/main/java/com/google/crypto/tink/jwt/internal/JwtFormat.java:98 case "RS384":
9. src/main/java/com/google/crypto/tink/jwt/internal/JwtFormat.java:99 case "RS512":
10. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:228 alg = "RS256";
11. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:230 alg = "RS384";
12. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:232 alg = "RS512";
13. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:371 case "RS256":
14. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:374 case "RS384":
15. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:377 case "RS512":
16. src/test/java/com/google/crypto/tink/jwt/JwkSetConverterTest.java:1066 test path String psJwksString = jwksString.replace("RS256", "PS256");
17. src/test/java/com/google/crypto/tink/jwt/JwkSetConverterTest.java:1085 test path String psJwksString = jwksString.replace("RS256", "PS256");
18. src/test/java/com/google/crypto/tink/jwt/JwkSetConverterTest.java:1130 test path String psJwksString = jwksString.replace("RS256", "PS256");
19. src/test/java/com/google/crypto/tink/jwt/JwkSetConverterTest.java:1163 test path String psJwksString = jwksString.replace("RS256", "PS256");
20. src/test/java/com/google/crypto/tink/jwt/JwkSetConverterTest.java:1177 test path String psJwksString = jwksString.replace("RS256", "PS256");
21. src/test/java/com/google/crypto/tink/jwt/JwkSetConverterTest.java:1195 test path String psJwksString = jwksString.replace("RS256", "PS256");
22. src/test/java/com/google/crypto/tink/jwt/JwkSetConverterTest.java:1213 test path String psJwksString = jwksString.replace("RS256", "PS256");
23. src/test/java/com/google/crypto/tink/jwt/JwkSetConverterTest.java:1231 test path String psJwksString = jwksString.replace("RS256", "PS256");
24. src/test/java/com/google/crypto/tink/jwt/JwkSetConverterTest.java:1249 test path String psJwksString = jwksString.replace("RS256", "PS256");
25. src/test/java/com/google/crypto/tink/jwt/JwtHmacKeyManagerTest.java:644 test path badAlgoHeader.addProperty("alg", "RS256");
26. src/test/java/com/google/crypto/tink/jwt/JwtHmacKeyManagerTest.java:708 test path headerWithBadAlg.addProperty("alg", "RS256");
27. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:42 test path JwtFormat.decodeHeader(JwtFormat.createHeader("RS256", Optional.empty(), Optional.empty()));
28. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:50 test path JwtFormat.createHeader("RS256", Optional.of("JWT"), Optional.empty()));
29. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:58 test path JwtFormat.createHeader("RS256", Optional.of("JWT"), Optional.of("GsapRA")));
30. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:192 test path JwtFormat.createHeader("RS256", Optional.empty(), Optional.empty()))),
31. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:193 test path "RS256",
32. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:207 test path "RS256",
33. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:208 test path "RS384",
34. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:209 test path "RS512",
35. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:387 test path String unsignedCompact = JwtFormat.createUnsignedCompact("RS256", Optional.empty(), rawJwt);
36. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:392 test path JsonUtil.parseJson(parts.header), "RS256", Optional.empty(), true);
37. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:410 test path String unsignedCompact = JwtFormat.createUnsignedCompact("RS256", Optional.empty(), rawJwt);
38. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:414 test path JwtFormat.validateHeader(parsedHeader, "RS256", Optional.empty(), true);
39. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:431 test path String unsignedCompact = JwtFormat.createUnsignedCompact("RS256", Optional.of(kid), rawJwt);
40. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:435 test path JwtFormat.validateHeader(parsedHeader, "RS256", Optional.empty(), true);
41. src/test/java/com/google/crypto/tink/jwt/subtle/JwtEcdsaPublicKeySignTest.java:165 test path badAlgoHeader.addProperty("alg", "RS256");
42. src/test/java/com/google/crypto/tink/jwt/subtle/JwtHmacTest.java:487 test path badAlgoHeader.addProperty("alg", "RS256");
43. src/test/java/com/google/crypto/tink/jwt/subtle/JwtHmacTest.java:550 test path headerWithBadAlg.addProperty("alg", "RS256");
44. src/test/java/com/google/crypto/tink/jwt/subtle/JwtMlDsaPublicKeySignVerifyTest.java:306 test path badAlgoHeader.addProperty("alg", "RS256");
45. src/test/java/com/google/crypto/tink/jwt/subtle/JwtMlDsaPublicKeySignVerifyTest.java:358 test path headerWithBadAlg.addProperty("alg", "RS256");
46. src/test/java/com/google/crypto/tink/jwt/subtle/JwtRsaSsaPkcs1PublicKeySignTest.java:244 test path goodHeader.addProperty("alg", "RS256");
47. src/test/java/com/google/crypto/tink/jwt/subtle/JwtRsaSsaPkcs1PublicKeySignTest.java:272 test path unknownKidHeader.addProperty("alg", "RS256");
48. src/test/java/com/google/crypto/tink/jwt/subtle/JwtRsaSsaPkcs1PublicKeySignTest.java:322 test path validHeader.addProperty("alg", "RS256");
49. src/test/java/com/google/crypto/tink/jwt/subtle/JwtRsaSsaPkcs1PublicKeySignTest.java:329 test path headerWithoutKid.addProperty("alg", "RS256");
50. src/test/java/com/google/crypto/tink/jwt/subtle/JwtRsaSsaPkcs1PublicKeySignTest.java:351 test path headerWithUnknownKid.addProperty("alg", "RS256");
51. src/test/java/com/google/crypto/tink/jwt/subtle/JwtRsaSsaPssPublicKeySignTest.java:265 test path badAlgoHeader.addProperty("alg", "RS256");
52. src/test/java/com/google/crypto/tink/jwt/subtle/JwtRsaSsaPssPublicKeySignTest.java:346 test path headerWithBadAlg.addProperty("alg", "RS256");
53. src/test/java/com/google/crypto/tink/signature/SignatureJwkSetConverterTest.java:112 test path assertThat(jsonKey.get("alg").getAsString()).isEqualTo("RS256");

jose.algorithm · CWE-327

ECDSA Quantum-vulnerable Renamed import 35 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. src/main/java/com/google/crypto/tink/jwt/JwkSetConverter.java:143 alg = "ES256";
2. src/main/java/com/google/crypto/tink/jwt/JwkSetConverter.java:147 alg = "ES384";
3. src/main/java/com/google/crypto/tink/jwt/JwkSetConverter.java:151 alg = "ES512";
4. src/main/java/com/google/crypto/tink/jwt/JwkSetConverter.java:398 case "ES256":
5. src/main/java/com/google/crypto/tink/jwt/JwkSetConverter.java:403 case "ES384":
6. src/main/java/com/google/crypto/tink/jwt/JwkSetConverter.java:408 case "ES512":
7. src/main/java/com/google/crypto/tink/jwt/JwtEcdsaParameters.java:86 new Algorithm("ES256", EllipticCurvesUtil.NIST_P256_PARAMS);
8. src/main/java/com/google/crypto/tink/jwt/JwtEcdsaParameters.java:89 new Algorithm("ES384", EllipticCurvesUtil.NIST_P384_PARAMS);
9. src/main/java/com/google/crypto/tink/jwt/JwtEcdsaParameters.java:92 new Algorithm("ES512", EllipticCurvesUtil.NIST_P521_PARAMS);
10. src/main/java/com/google/crypto/tink/jwt/internal/JwtFormat.java:94 case "ES256":
11. src/main/java/com/google/crypto/tink/jwt/internal/JwtFormat.java:95 case "ES384":
12. src/main/java/com/google/crypto/tink/jwt/internal/JwtFormat.java:96 case "ES512":
13. src/main/java/com/google/crypto/tink/jwt/internal/testing/JwtSignatureTestUtil.java:380 test path result.put("ES256", JWT_ECDSA_ES256_RAW_PRIVATE_KEY);
14. src/main/java/com/google/crypto/tink/jwt/internal/testing/JwtSignatureTestUtil.java:381 test path result.put("ES384", JWT_ECDSA_ES384_RAW_PRIVATE_KEY);
15. src/main/java/com/google/crypto/tink/jwt/internal/testing/JwtSignatureTestUtil.java:382 test path result.put("ES512", JWT_ECDSA_ES512_RAW_PRIVATE_KEY);
16. src/main/java/com/google/crypto/tink/jwt/internal/testing/JwtSignatureTestUtil.java:391 test path result.put("ES256", JWT_ECDSA_ES256_CUSTOM_KID_PRIVATE_KEY);
17. src/main/java/com/google/crypto/tink/jwt/internal/testing/JwtSignatureTestUtil.java:392 test path result.put("ES384", JWT_ECDSA_ES384_CUSTOM_KID_PRIVATE_KEY);
18. src/main/java/com/google/crypto/tink/jwt/internal/testing/JwtSignatureTestUtil.java:393 test path result.put("ES512", JWT_ECDSA_ES512_CUSTOM_KID_PRIVATE_KEY);
19. src/main/java/com/google/crypto/tink/jwt/internal/testing/JwtSignatureTestUtil.java:402 test path result.put("ES256", JWT_ECDSA_ES256_WRONG_KID_PRIVATE_KEY);
20. src/main/java/com/google/crypto/tink/jwt/internal/testing/JwtSignatureTestUtil.java:403 test path result.put("ES384", JWT_ECDSA_ES384_WRONG_KID_PRIVATE_KEY);
21. src/main/java/com/google/crypto/tink/jwt/internal/testing/JwtSignatureTestUtil.java:404 test path result.put("ES512", JWT_ECDSA_ES512_WRONG_KID_PRIVATE_KEY);
22. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:157 alg = "ES256";
23. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:164 alg = "ES384";
24. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:171 alg = "ES512";
25. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:296 case "ES256":
26. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:302 case "ES384":
27. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:308 case "ES512":
28. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:185 test path JwtFormat.createHeader("ES256", Optional.empty(), Optional.empty()))),
29. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:186 test path "ES256",
30. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:204 test path "ES256",
31. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:205 test path "ES384",
32. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:206 test path "ES512",
33. src/test/java/com/google/crypto/tink/jwt/internal/testing/JwtSignatureTestUtilTest.java:35 test path header.addProperty("alg", "ES256");
34. src/test/java/com/google/crypto/tink/jwt/subtle/JwtEcdsaPublicKeySignTest.java:64 test path public static final String[] jwtAlgorithms = new String[] {"ES256", "ES384", "ES512"};
35. src/test/java/com/google/crypto/tink/signature/SignatureJwkSetConverterTest.java:74 test path assertThat(jsonKey.get("alg").getAsString()).isEqualTo("ES256");

jose.algorithm · CWE-327

RSA-PSS Quantum-vulnerable Renamed import 35 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. src/main/java/com/google/crypto/tink/jwt/JwkSetConverter.java:337 case "PS256":
2. src/main/java/com/google/crypto/tink/jwt/JwkSetConverter.java:340 case "PS384":
3. src/main/java/com/google/crypto/tink/jwt/JwkSetConverter.java:343 case "PS512":
4. src/main/java/com/google/crypto/tink/jwt/JwtRsaSsaPssParameters.java:89 public static final Algorithm PS256 = new Algorithm("PS256");
5. src/main/java/com/google/crypto/tink/jwt/JwtRsaSsaPssParameters.java:92 public static final Algorithm PS384 = new Algorithm("PS384");
6. src/main/java/com/google/crypto/tink/jwt/JwtRsaSsaPssParameters.java:95 public static final Algorithm PS512 = new Algorithm("PS512");
7. src/main/java/com/google/crypto/tink/jwt/internal/JwtFormat.java:100 case "PS256":
8. src/main/java/com/google/crypto/tink/jwt/internal/JwtFormat.java:101 case "PS384":
9. src/main/java/com/google/crypto/tink/jwt/internal/JwtFormat.java:102 case "PS512":
10. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:260 alg = "PS256";
11. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:263 alg = "PS384";
12. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:266 alg = "PS512";
13. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:417 case "PS256":
14. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:420 case "PS384":
15. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:423 case "PS512":
16. src/test/java/com/google/crypto/tink/jwt/JwkSetConverterTest.java:1066 test path String psJwksString = jwksString.replace("RS256", "PS256");
17. src/test/java/com/google/crypto/tink/jwt/JwkSetConverterTest.java:1085 test path String psJwksString = jwksString.replace("RS256", "PS256");
18. src/test/java/com/google/crypto/tink/jwt/JwkSetConverterTest.java:1130 test path String psJwksString = jwksString.replace("RS256", "PS256");
19. src/test/java/com/google/crypto/tink/jwt/JwkSetConverterTest.java:1163 test path String psJwksString = jwksString.replace("RS256", "PS256");
20. src/test/java/com/google/crypto/tink/jwt/JwkSetConverterTest.java:1177 test path String psJwksString = jwksString.replace("RS256", "PS256");
21. src/test/java/com/google/crypto/tink/jwt/JwkSetConverterTest.java:1195 test path String psJwksString = jwksString.replace("RS256", "PS256");
22. src/test/java/com/google/crypto/tink/jwt/JwkSetConverterTest.java:1213 test path String psJwksString = jwksString.replace("RS256", "PS256");
23. src/test/java/com/google/crypto/tink/jwt/JwkSetConverterTest.java:1231 test path String psJwksString = jwksString.replace("RS256", "PS256");
24. src/test/java/com/google/crypto/tink/jwt/JwkSetConverterTest.java:1249 test path String psJwksString = jwksString.replace("RS256", "PS256");
25. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:210 test path "PS256",
26. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:211 test path "PS384",
27. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:212 test path "PS512",
28. src/test/java/com/google/crypto/tink/jwt/subtle/JwtRsaSsaPkcs1PublicKeySignTest.java:264 test path badAlgoHeader.addProperty("alg", "PS256");
29. src/test/java/com/google/crypto/tink/jwt/subtle/JwtRsaSsaPkcs1PublicKeySignTest.java:343 test path headerWithBadAlg.addProperty("alg", "PS256");
30. src/test/java/com/google/crypto/tink/jwt/subtle/JwtRsaSsaPssPublicKeySignTest.java:245 test path goodHeader.addProperty("alg", "PS256");
31. src/test/java/com/google/crypto/tink/jwt/subtle/JwtRsaSsaPssPublicKeySignTest.java:273 test path unknownKidHeader.addProperty("alg", "PS256");
32. src/test/java/com/google/crypto/tink/jwt/subtle/JwtRsaSsaPssPublicKeySignTest.java:325 test path validHeader.addProperty("alg", "PS256");
33. src/test/java/com/google/crypto/tink/jwt/subtle/JwtRsaSsaPssPublicKeySignTest.java:332 test path headerWithoutKid.addProperty("alg", "PS256");
34. src/test/java/com/google/crypto/tink/jwt/subtle/JwtRsaSsaPssPublicKeySignTest.java:354 test path headerWithUnknownKid.addProperty("alg", "PS256");
35. src/test/java/com/google/crypto/tink/signature/SignatureJwkSetConverterTest.java:130 test path assertThat(jsonKey.get("alg").getAsString()).isEqualTo("PS256");

jose.algorithm · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable Renamed import 26 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. src/main/java/com/google/crypto/tink/PemKeyType.java:65 ED25519("EdDSA", "EdDSA", 256),
2. src/main/java/com/google/crypto/tink/PemKeyType.java:96 if (this.keyType.equals("ML-DSA") || this.keyType.equals("EdDSA")) {
3. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:202 jsonKey.addProperty("crv", "Ed25519");
4. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:205 jsonKey.addProperty("alg", "EdDSA");
5. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:353 expectStringItem(jsonKey, "alg", "EdDSA");
6. src/main/java/com/google/crypto/tink/signature/SignatureJwkSetConverter.java:354 expectStringItem(jsonKey, "crv", "Ed25519");
7. src/main/java/com/google/crypto/tink/signature/internal/Ed25519SignJce.java:48 private static final String ALGORITHM_NAME = "Ed25519";
8. src/main/java/com/google/crypto/tink/signature/internal/Ed25519SignJce.java:120 KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM_NAME, provider);
9. src/main/java/com/google/crypto/tink/signature/internal/Ed25519SignJce.java:136 KeyFactory unusedKeyFactory = KeyFactory.getInstance(ALGORITHM_NAME, provider);
10. src/main/java/com/google/crypto/tink/signature/internal/Ed25519SignJce.java:137 Signature unusedSignature = Signature.getInstance(ALGORITHM_NAME, provider);
11. src/main/java/com/google/crypto/tink/signature/internal/Ed25519SignJce.java:146 Signature signer = Signature.getInstance(ALGORITHM_NAME, provider);
12. src/main/java/com/google/crypto/tink/signature/internal/Ed25519VerifyJce.java:49 private static final String ALGORITHM_NAME = "Ed25519";
13. src/main/java/com/google/crypto/tink/signature/internal/Ed25519VerifyJce.java:126 KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM_NAME, provider);
14. src/main/java/com/google/crypto/tink/signature/internal/Ed25519VerifyJce.java:141 KeyFactory unusedKeyFactory = KeyFactory.getInstance(ALGORITHM_NAME, provider);
15. src/main/java/com/google/crypto/tink/signature/internal/Ed25519VerifyJce.java:142 Signature unusedSignature = Signature.getInstance(ALGORITHM_NAME, provider);
16. src/main/java/com/google/crypto/tink/signature/internal/Ed25519VerifyJce.java:158 Signature verifier = Signature.getInstance(ALGORITHM_NAME, provider);
17. src/main/java/com/google/crypto/tink/signature/internal/testing/CompositeMlDsaTestUtil.java:326 test path if (testVector.tcId.contains("Ed25519")) {
18. src/main/java/com/google/crypto/tink/signature/internal/testing/CompositeMlDsaTestUtil.java:374 test path if (testVector.tcId.contains("Ed25519")) {
19. src/test/java/com/google/crypto/tink/signature/SignatureJwkSetConverterTest.java:93 test path assertThat(jsonKey.get("alg").getAsString()).isEqualTo("EdDSA");
20. src/test/java/com/google/crypto/tink/signature/SignatureJwkSetConverterTest.java:95 test path assertThat(jsonKey.get("crv").getAsString()).isEqualTo("Ed25519");
21. src/test/java/com/google/crypto/tink/signature/subtle/CompositeMlDsaSignerVerifierTest.java:68 test path assumeTrue(testVector.tcId.contains("Ed25519"));
22. src/test/java/com/google/crypto/tink/signature/subtle/CompositeMlDsaSignerVerifierTest.java:87 test path assumeTrue(testVector.tcId.contains("Ed25519"));
23. src/test/java/com/google/crypto/tink/signature/subtle/CompositeMlDsaSignerVerifierTest.java:104 test path assumeTrue(testVector.tcId.contains("Ed25519"));
24. src/test/java/com/google/crypto/tink/signature/subtle/CompositeMlDsaSignerVerifierTest.java:124 test path assumeTrue(testVector.tcId.contains("Ed25519"));
25. src/test/java/com/google/crypto/tink/signature/subtle/CompositeMlDsaSignerVerifierTest.java:146 test path assumeTrue(testVector.tcId.contains("Ed25519"));
26. src/test/java/com/google/crypto/tink/signature/subtle/CompositeMlDsaSignerVerifierTest.java:172 test path assumeTrue(testVector.tcId.contains("Ed25519"));

jose.algorithm · CWE-327

EC Quantum-vulnerable 21 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. src/main/java/com/google/crypto/tink/testing/TestUtil.java:371 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
2. src/main/java/com/google/crypto/tink/testing/TestUtil.java:474 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
3. src/test/java/com/google/crypto/tink/internal/LegacyKeyManagerImplTest.java:84 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
4. src/test/java/com/google/crypto/tink/signature/EcdsaPrivateKeyTest.java:134 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
5. src/test/java/com/google/crypto/tink/signature/EcdsaVerifyKeyManagerTest.java:200 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
6. src/test/java/com/google/crypto/tink/signature/KeyConversionTest.java:57 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
7. src/test/java/com/google/crypto/tink/signature/internal/EcdsaSignJceTest.java:80 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
8. src/test/java/com/google/crypto/tink/signature/internal/EcdsaSignVerifyFipsTest.java:93 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
9. src/test/java/com/google/crypto/tink/signature/internal/EcdsaSignVerifyFipsTest.java:115 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
10. src/test/java/com/google/crypto/tink/signature/internal/EcdsaSignVerifyFipsTest.java:134 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
11. src/test/java/com/google/crypto/tink/signature/internal/EcdsaVerifyJceTest.java:181 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
12. src/test/java/com/google/crypto/tink/signature/internal/EcdsaVerifyJceTest.java:246 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
13. src/test/java/com/google/crypto/tink/signature/internal/EcdsaVerifyJceTest.java:268 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
14. src/test/java/com/google/crypto/tink/signature/internal/EcdsaVerifyJceTest.java:342 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
15. src/test/java/com/google/crypto/tink/subtle/EcdsaSignJceTest.java:74 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
16. src/test/java/com/google/crypto/tink/subtle/EcdsaSignVerifyFipsTest.java:92 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
17. src/test/java/com/google/crypto/tink/subtle/EcdsaSignVerifyFipsTest.java:114 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
18. src/test/java/com/google/crypto/tink/subtle/EcdsaSignVerifyFipsTest.java:133 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
19. src/test/java/com/google/crypto/tink/subtle/EcdsaVerifyJceTest.java:63 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
20. src/test/java/com/google/crypto/tink/subtle/EcdsaVerifyJceTest.java:107 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
21. src/test/java/com/google/crypto/tink/subtle/SignatureThreadSafetyTest.java:224 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");

java.keypairgenerator · CWE-327

RSA Quantum-vulnerable Recorded traffic 12 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. src/main/java/com/google/crypto/tink/signature/internal/RsaSsaPkcs1SignJce.java:127 keyFactory = KeyFactory.getInstance("RSA", providerOrNull);
2. src/main/java/com/google/crypto/tink/signature/internal/RsaSsaPkcs1VerifyConscrypt.java:109 KeyFactory keyFactory = KeyFactory.getInstance("RSA", conscrypt);
3. src/main/java/com/google/crypto/tink/signature/internal/RsaSsaPssSignConscrypt.java:74 KeyFactory keyFactory = KeyFactory.getInstance("RSA", conscrypt);
4. src/main/java/com/google/crypto/tink/signature/internal/RsaSsaPssVerifyConscrypt.java:161 KeyFactory keyFactory = KeyFactory.getInstance("RSA", conscrypt);
5. src/test/java/com/google/crypto/tink/hybrid/subtle/RsaKemHybridDecryptTest.java:168 test path KeyFactory kf = KeyFactory.getInstance("RSA");
6. src/test/java/com/google/crypto/tink/hybrid/subtle/RsaKemTest.java:84 test path KeyFactory keyFactory = KeyFactory.getInstance("RSA");
7. src/test/java/com/google/crypto/tink/hybrid/subtle/RsaKemTest.java:104 test path KeyFactory keyFactory = KeyFactory.getInstance("RSA");
8. src/test/java/com/google/crypto/tink/hybrid/subtle/RsaKemTest.java:139 test path KeyFactory keyFactory = KeyFactory.getInstance("RSA");
9. src/test/java/com/google/crypto/tink/signature/KeyConversionTest.java:208 test path KeyFactory.getInstance("RSA")
10. src/test/java/com/google/crypto/tink/signature/KeyConversionTest.java:237 test path KeyFactory.getInstance("RSA")
11. src/test/java/com/google/crypto/tink/signature/RsaSsaPkcs1PrivateKeyTest.java:483 test path KeyFactory keyFactory = KeyFactory.getInstance("RSA");
12. src/test/java/com/google/crypto/tink/signature/RsaSsaPssPrivateKeyTest.java:497 test path KeyFactory keyFactory = KeyFactory.getInstance("RSA");

java.keyfactory · CWE-327

RSA Quantum-vulnerable 8 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. src/test/java/com/google/crypto/tink/signature/KeyConversionTest.java:186 test path Signature signatureVerify = Signature.getInstance("SHA256withRSA");
2. src/test/java/com/google/crypto/tink/signature/KeyConversionTest.java:227 test path Signature signatureSigner = Signature.getInstance("SHA256withRSA");
3. src/test/java/com/google/crypto/tink/signature/KeyConversionTest.java:242 test path Signature signatureVerify = Signature.getInstance("SHA256withRSA");
4. src/test/java/com/google/crypto/tink/signature/internal/RsaSsaPkcs1SignJceTest.java:117 test path Provider defaultProvider = Signature.getInstance("SHA256withRSA").getProvider();
5. src/test/java/com/google/crypto/tink/subtle/RsaSsaPkcs1SignJceTest.java:90 test path Signature verifier = Signature.getInstance("SHA256withRSA");
6. src/test/java/com/google/crypto/tink/subtle/RsaSsaPkcs1SignJceTest.java:102 test path Signature verifier = Signature.getInstance("SHA384withRSA");
7. src/test/java/com/google/crypto/tink/subtle/RsaSsaPkcs1SignJceTest.java:114 test path Signature verifier = Signature.getInstance("SHA512withRSA");
8. src/test/java/com/google/crypto/tink/subtle/RsaSsaPkcs1SignJceTest.java:145 test path Signature verifier = Signature.getInstance("SHA512WithRSA");

java.signature · CWE-327

EC Quantum-vulnerable 6 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. src/main/java/com/google/crypto/tink/signature/internal/EcdsaSignJce.java:131 keyFactory = KeyFactory.getInstance("EC", provider);
2. src/main/java/com/google/crypto/tink/signature/internal/EcdsaVerifyJce.java:124 keyFactory = KeyFactory.getInstance("EC", provider);
3. src/test/java/com/google/crypto/tink/hybrid/EciesPrivateKeyTest.java:107 test path KeyFactory keyFactory = KeyFactory.getInstance("EC");
4. src/test/java/com/google/crypto/tink/hybrid/EciesPublicKeyTest.java:97 test path KeyFactory keyFactory = KeyFactory.getInstance("EC");
5. src/test/java/com/google/crypto/tink/signature/EcdsaPrivateKeyTest.java:170 test path KeyFactory keyFactory = KeyFactory.getInstance("EC");
6. src/test/java/com/google/crypto/tink/signature/subtle/EcdsaVerifierTest.java:212 test path KeyFactory kf = KeyFactory.getInstance("EC");

java.keyfactory · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable 5 places See details

Edwards-curve signatures through BouncyCastle

Ed25519 or Ed448 through BouncyCastle. Edwards curves are modern and well built, and Shor breaks them exactly as it breaks every other discrete-logarithm scheme.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204).

1. src/main/java/com/google/crypto/tink/signature/SignatureConfig2026.java:137 Ed25519Signer::create, Ed25519PrivateKey.class, PublicKeySign.class)
2. src/main/java/com/google/crypto/tink/signature/SignatureConfigurationV0.java:106 return Ed25519Signer.create((Ed25519PrivateKey) reparsedKey);
3. src/main/java/com/google/crypto/tink/signature/subtle/Ed25519Signer.java:33 public final class Ed25519Signer {
4. src/main/java/com/google/crypto/tink/signature/subtle/Ed25519Signer.java:46 private Ed25519Signer() {}
5. src/test/java/com/google/crypto/tink/signature/subtle/Ed25519SignerTest.java:42 test path PublicKeySign signer = Ed25519Signer.create(key);

java.bouncycastle.eddsa · CWE-327

ECDSA Quantum-vulnerable 4 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. src/test/java/com/google/crypto/tink/signature/EcdsaVerifyKeyManagerTest.java:163 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
2. src/test/java/com/google/crypto/tink/signature/internal/EcdsaSignJceTest.java:59 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
3. src/test/java/com/google/crypto/tink/signature/internal/EcdsaVerifyJceTest.java:226 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
4. src/test/java/com/google/crypto/tink/subtle/EcdsaSignJceTest.java:53 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");

java.keypairgenerator · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable From a constant 4 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. src/main/java/com/google/crypto/tink/signature/internal/Ed25519SignJce.java:120 KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM_NAME, provider);
2. src/main/java/com/google/crypto/tink/signature/internal/Ed25519SignJce.java:136 KeyFactory unusedKeyFactory = KeyFactory.getInstance(ALGORITHM_NAME, provider);
3. src/main/java/com/google/crypto/tink/signature/internal/Ed25519VerifyJce.java:126 KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM_NAME, provider);
4. src/main/java/com/google/crypto/tink/signature/internal/Ed25519VerifyJce.java:141 KeyFactory unusedKeyFactory = KeyFactory.getInstance(ALGORITHM_NAME, provider);

java.keyfactory · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable From a constant 4 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. src/main/java/com/google/crypto/tink/signature/internal/Ed25519SignJce.java:137 Signature unusedSignature = Signature.getInstance(ALGORITHM_NAME, provider);
2. src/main/java/com/google/crypto/tink/signature/internal/Ed25519SignJce.java:146 Signature signer = Signature.getInstance(ALGORITHM_NAME, provider);
3. src/main/java/com/google/crypto/tink/signature/internal/Ed25519VerifyJce.java:142 Signature unusedSignature = Signature.getInstance(ALGORITHM_NAME, provider);
4. src/main/java/com/google/crypto/tink/signature/internal/Ed25519VerifyJce.java:158 Signature verifier = Signature.getInstance(ALGORITHM_NAME, provider);

java.signature · CWE-327

ECDSA Quantum-vulnerable 3 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. src/test/java/com/google/crypto/tink/signature/internal/EcdsaSignJceTest.java:71 test path Signature verifier = Signature.getInstance("SHA256WithECDSA");
2. src/test/java/com/google/crypto/tink/signature/internal/EcdsaSignJceTest.java:160 test path Provider defaultProvider = Signature.getInstance("SHA256WithECDSA").getProvider();
3. src/test/java/com/google/crypto/tink/subtle/EcdsaSignJceTest.java:65 test path Signature verifier = Signature.getInstance("SHA256WithECDSA");

java.signature · CWE-327

RSA Quantum-vulnerable Recorded traffic 2 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. src/main/java/com/google/crypto/tink/hybrid/subtle/RsaKem.java:108 rsaGenerator = KeyPairGenerator.getInstance("RSA");
2. src/test/java/com/google/crypto/tink/signature/KeyConversionTest.java:123 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");

java.keypairgenerator · CWE-327

RSA2048-bit Quantum-vulnerable Recorded traffic 2 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. src/test/java/com/google/crypto/tink/signature/RsaSsaPkcs1PrivateKeyTest.java:408 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
2. src/test/java/com/google/crypto/tink/signature/RsaSsaPssPrivateKeyTest.java:418 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");

java.keypairgenerator · CWE-327

RSA3072-bit Quantum-vulnerable Recorded traffic 2 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. src/test/java/com/google/crypto/tink/subtle/RsaSsaPkcs1SignJceTest.java:76 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
2. src/test/java/com/google/crypto/tink/subtle/RsaSsaPkcs1SignJceTest.java:166 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");

java.keypairgenerator · CWE-327

RSA-OAEP Quantum-vulnerable Recorded traffic 2 places See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. src/main/java/com/google/crypto/tink/hybrid/subtle/RsaKem.java:57 Cipher rsaCipher = Cipher.getInstance("RSA/ECB/NoPadding");
2. src/main/java/com/google/crypto/tink/hybrid/subtle/RsaKem.java:75 Cipher rsaCipher = Cipher.getInstance("RSA/ECB/NoPadding");

java.cipher · CWE-327

X25519255-bitother/Curve25519 Quantum-vulnerable Recorded traffic 2 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. src/main/java/com/google/crypto/tink/hybrid/internal/X25519Conscrypt.java:82 KeyFactory unusedKeyFactory = KeyFactory.getInstance("XDH", provider);
2. src/main/java/com/google/crypto/tink/hybrid/internal/X25519Conscrypt.java:123 KeyFactory keyFactory = KeyFactory.getInstance("XDH", provider);

java.keyfactory · CWE-327

X25519255-bitother/Curve25519 Quantum-vulnerable Recorded traffic 2 places See details

Classical key agreement through the JCA

`KeyAgreement.getInstance()` with ECDH, DH or XDH. Key agreement is the highest-priority class of finding: traffic recorded today is decrypted once the key exchange is broken.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 (FIPS 203), or a hybrid X25519+ML-KEM-768 construction that keeps the classical guarantee while adding the quantum one.

1. src/main/java/com/google/crypto/tink/hybrid/internal/X25519Conscrypt.java:83 KeyAgreement unusedKeyAgreement = KeyAgreement.getInstance("XDH", provider);
2. src/main/java/com/google/crypto/tink/hybrid/internal/X25519Conscrypt.java:138 KeyAgreement keyAgreementA = KeyAgreement.getInstance("XDH", provider);

java.keyagreement · CWE-327

ECDSA Quantum-vulnerable 1 place See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. src/test/java/com/google/crypto/tink/signature/internal/EcdsaVerifyJceTest.java:135 test path KeyFactory kf = KeyFactory.getInstance("EC");

java.keyfactory · CWE-327

RSA4096-bit Quantum-vulnerable Recorded traffic 1 place See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. src/test/java/com/google/crypto/tink/subtle/RsaSsaPkcs1SignJceTest.java:132 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");

java.keypairgenerator · CWE-327

X25519255-bitother/Curve25519 Quantum-vulnerable Recorded traffic 1 place See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. src/main/java/com/google/crypto/tink/hybrid/internal/X25519Conscrypt.java:91 KeyPairGenerator keyGen = KeyPairGenerator.getInstance("XDH", provider);

java.keypairgenerator · CWE-327

AES Reduced margin Renamed import 19 places See details

Cipher transformation named away from the call

A JCA transformation string - `algorithm/mode/padding` - written somewhere other than a `getInstance()` argument, which is how a codebase that centralises its cryptography passes the choice to a helper. The string is unambiguous wherever it appears: nothing but a transformation is spelled that way.

This names an encryption method as text, and passes it to code elsewhere that does the work. It is the same choice, made in a different place.

What to do. The same migration applies as to the call that consumes it. Move the constant and the call together, so the inventory keeps naming the algorithm after the change.

1. src/main/java/com/google/crypto/tink/aead/internal/AesGcmJceUtil.java:43 return EngineFactory.CIPHER.getInstance("AES/GCM/NoPadding");
2. src/main/java/com/google/crypto/tink/mac/internal/ChunkedAesCmacComputation.java:67 aes = EngineFactory.CIPHER.getInstance("AES/ECB/NoPadding");
3. src/main/java/com/google/crypto/tink/prf/internal/PrfAesCmac.java:59 return EngineFactory.CIPHER.getInstance("AES/ECB/NoPadding");
4. src/main/java/com/google/crypto/tink/subtle/AesCtrHmacStreaming.java:273 return EngineFactory.CIPHER.getInstance("AES/CTR/NoPadding");
5. src/main/java/com/google/crypto/tink/subtle/AesCtrJceCipher.java:44 return EngineFactory.CIPHER.getInstance(CIPHER_ALGORITHM);
6. src/main/java/com/google/crypto/tink/subtle/AesCtrJceCipher.java:52 private static final String CIPHER_ALGORITHM = "AES/CTR/NoPadding";
7. src/main/java/com/google/crypto/tink/subtle/AesGcmHkdfStreaming.java:212 return EngineFactory.CIPHER.getInstance("AES/GCM/NoPadding");
8. src/main/java/com/google/crypto/tink/subtle/AesSiv.java:81 return EngineFactory.CIPHER.getInstance("AES/CTR/NoPadding");
9. src/main/java/com/google/crypto/tink/subtle/Kwp.java:100 Cipher aes = EngineFactory.CIPHER.getInstance("AES/ECB/NoPadding");
10. src/main/java/com/google/crypto/tink/subtle/Kwp.java:137 Cipher aes = EngineFactory.CIPHER.getInstance("AES/ECB/NoPadding");
11. src/main/java/com/google/crypto/tink/testing/TestUtil.java:639 test path int maxKeySize = Cipher.getMaxAllowedKeyLength("AES/CTR/NoPadding");
12. src/test/java/com/google/crypto/tink/subtle/EngineFactoryFipsTest.java:58 test path assertThat(EngineFactory.CIPHER.getInstance("AES/GCM/NoPadding").getProvider().getName())
13. src/test/java/com/google/crypto/tink/subtle/EngineFactoryFipsTest.java:60 test path assertThat(EngineFactory.CIPHER.getInstance("AES/CTR/NoPadding").getProvider().getName())
14. src/test/java/com/google/crypto/tink/subtle/EngineFactoryTest.java:68 test path assertThat(EngineFactory.CIPHER.getInstance("AES/GCM/NoPadding").getProvider().getName())
15. src/test/java/com/google/crypto/tink/subtle/EngineFactoryTest.java:86 test path .getInstance("AES/GCM/NoPadding", preferredProviders)
16. src/test/java/com/google/crypto/tink/subtle/EngineFactoryTest.java:99 test path assertThat(EngineFactory.CIPHER.getInstance("AES/GCM/NoPadding").getProvider().getName())
17. src/test/java/com/google/crypto/tink/subtle/EngineFactoryTest.java:103 test path assertThat(EngineFactory.CIPHER.getInstance("AES/GCM/NoPadding").getProvider().getName())
18. src/test/java/com/google/crypto/tink/subtle/EngineFactoryTest.java:119 test path .getInstance("AES/GCM/NoPadding", preferredProviders)
19. src/test/java/com/google/crypto/tink/subtle/EngineFactoryTest.java:127 test path .getInstance("AES/GCM/NoPadding", preferredProviders)

java.transformation · CWE-327

AES Reduced margin 15 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. src/main/java/com/google/crypto/tink/aead/internal/AesGcmJceUtil.java:57 return new SecretKeySpec(key, "AES");
2. src/main/java/com/google/crypto/tink/aead/internal/AesGcmSiv.java:67 cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(testKey, "AES"), params);
3. src/main/java/com/google/crypto/tink/aead/internal/AesGcmSiv.java:112 keySpec = new SecretKeySpec(key, "AES");
4. src/main/java/com/google/crypto/tink/integration/android/internal/FakeAndroidKeystoreProvider.java:175 SecretKey newKey = new SecretKeySpec(Random.randBytes(32), "AES");
5. src/main/java/com/google/crypto/tink/mac/internal/ChunkedAesCmacComputation.java:70 new SecretKeySpec(this.key.getAesKey().toByteArray(InsecureSecretKeyAccess.get()), "AES"));
6. src/main/java/com/google/crypto/tink/mac/internal/ChunkedAesCmacConscrypt.java:59 return new SecretKeySpec(key.getAesKey().toByteArray(InsecureSecretKeyAccess.get()), "AES");
7. src/main/java/com/google/crypto/tink/prf/internal/PrfAesCmac.java:76 keySpec = new SecretKeySpec(key, "AES");
8. src/main/java/com/google/crypto/tink/prf/internal/PrfAesCmacConscrypt.java:78 this.key = new SecretKeySpec(keyBytes, "AES");
9. src/main/java/com/google/crypto/tink/subtle/AesCtrHmacStreaming.java:305 return new SecretKeySpec(keyMaterial, 0, keySizeInBytes, "AES");
10. src/main/java/com/google/crypto/tink/subtle/AesCtrJceCipher.java:74 this.keySpec = new SecretKeySpec(key, KEY_ALGORITHM);
11. src/main/java/com/google/crypto/tink/subtle/AesEaxJce.java:112 keySpec = new SecretKeySpec(key, "AES");
12. src/main/java/com/google/crypto/tink/subtle/AesGcmHkdfStreaming.java:235 return new SecretKeySpec(key, "AES");
13. src/main/java/com/google/crypto/tink/subtle/AesSiv.java:181 new SecretKeySpec(this.aesCtrKey, "AES"),
14. src/main/java/com/google/crypto/tink/subtle/AesSiv.java:235 new SecretKeySpec(this.aesCtrKey, "AES"),
15. src/main/java/com/google/crypto/tink/subtle/Kwp.java:67 aesKey = new SecretKeySpec(key, "AES");

java.keyspec · CWE-327

AES Reduced margin Renamed import 6 places See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Grover's algorithm halves the effective strength; the parameter, not the design, is the problem. The key size was not visible at this call site, so the weaker case is assumed.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. src/main/java/com/google/crypto/tink/aead/subtle/AesGcmSiv.java:63 Cipher cipher = Cipher.getInstance("AES/GCM-SIV/NoPadding", conscryptProvider);
2. src/main/java/com/google/crypto/tink/integration/android/AndroidKeystore.java:152 Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
3. src/main/java/com/google/crypto/tink/integration/android/AndroidKeystore.java:177 Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
4. src/test/java/com/google/crypto/tink/aead/internal/AesGcmSivTest.java:62 test path conscrypt = Cipher.getInstance("AES/GCM-SIV/NoPadding").getProvider();
5. src/test/java/com/google/crypto/tink/aead/internal/AesGcmSivTest.java:71 test path Cipher cipher = Cipher.getInstance("AES/GCM-SIV/NoPadding", conscrypt);
6. src/test/java/com/google/crypto/tink/subtle/EngineFactoryTest.java:81 test path assertThat(Cipher.getInstance("AES/GCM/NoPadding", conscrypt)).isNotNull();

java.cipher · CWE-327

SHA-256 Reduced margin 1 place See details

Mask-generation digest named for RSA padding

`MGF1ParameterSpec.SHA256` names the digest inside RSA-OAEP and RSA-PSS padding. It is a separate choice from the digest the signature or the cipher uses, it is frequently left at SHA-1 by default, and a static import of it - `import static java.security.spec.MGF1ParameterSpec.SHA512` - is the only place the choice appears in the file that makes it.

This picks the hash used inside RSA padding. It matters because the default is often SHA-1, which is broken today without any quantum computer.

What to do. The mask-generation digest travels with the RSA key it pads. When that key moves to ML-KEM or ML-DSA the padding goes with it; until then, SHA-256 or better.

1. src/main/java/com/google/crypto/tink/signature/internal/RsaSsaPssVerifyConscrypt.java:109 return MGF1ParameterSpec.SHA256;

java.mgf1 · CWE-327

SHA-256 Reduced margin 8 places See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. src/test/java/com/google/crypto/tink/signature/KeyConversionTest.java:186 test path Signature signatureVerify = Signature.getInstance("SHA256withRSA");
2. src/test/java/com/google/crypto/tink/signature/KeyConversionTest.java:227 test path Signature signatureSigner = Signature.getInstance("SHA256withRSA");
3. src/test/java/com/google/crypto/tink/signature/KeyConversionTest.java:242 test path Signature signatureVerify = Signature.getInstance("SHA256withRSA");
4. src/test/java/com/google/crypto/tink/signature/internal/EcdsaSignJceTest.java:71 test path Signature verifier = Signature.getInstance("SHA256WithECDSA");
5. src/test/java/com/google/crypto/tink/signature/internal/EcdsaSignJceTest.java:160 test path Provider defaultProvider = Signature.getInstance("SHA256WithECDSA").getProvider();
6. src/test/java/com/google/crypto/tink/signature/internal/RsaSsaPkcs1SignJceTest.java:117 test path Provider defaultProvider = Signature.getInstance("SHA256withRSA").getProvider();
7. src/test/java/com/google/crypto/tink/subtle/EcdsaSignJceTest.java:65 test path Signature verifier = Signature.getInstance("SHA256WithECDSA");
8. src/test/java/com/google/crypto/tink/subtle/RsaSsaPkcs1SignJceTest.java:90 test path Signature verifier = Signature.getInstance("SHA256withRSA");

java.messagedigest · CWE-328

unknown Could not be determined 31 places See details

Key pair algorithm chosen at runtime

`KeyPairGenerator.getInstance(x)` where the argument is an identifier. The algorithm cannot be resolved without running the program, so this is reported as an unknown rather than assumed to be classical.

This code picks its encryption method while it runs, so a scan cannot tell which one it ends up using. Somebody has to check the configuration.

What to do. Trace the value to its configuration source and record the concrete algorithm in the cryptographic inventory by hand.

1. src/main/java/com/google/crypto/tink/integration/android/AndroidKeystore.java:75 KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore");
2. src/main/java/com/google/crypto/tink/signature/internal/CompositeMlDsaKeyCreator.java:68 KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(algorithmName, provider);
3. src/main/java/com/google/crypto/tink/signature/internal/CompositeMlDsaKeyCreator.java:69 KeyFactory keyFactory = KeyFactory.getInstance(algorithmName, provider);
4. src/main/java/com/google/crypto/tink/signature/internal/CompositeMlDsaSignConscrypt.java:129 KeyFactory keyFactory = KeyFactory.getInstance(algorithm, nonNullProvider);
5. src/main/java/com/google/crypto/tink/signature/internal/CompositeMlDsaSignConscrypt.java:180 Signature signer = Signature.getInstance(algorithm, provider);
6. src/main/java/com/google/crypto/tink/signature/internal/CompositeMlDsaVerifyConscrypt.java:127 KeyFactory keyFactory = KeyFactory.getInstance(algorithm, nonNullProvider);
7. src/main/java/com/google/crypto/tink/signature/internal/CompositeMlDsaVerifyConscrypt.java:163 Signature verifier = Signature.getInstance(algorithm, provider);
8. src/main/java/com/google/crypto/tink/signature/internal/EcdsaSignJce.java:150 return Signature.getInstance(signatureAlgorithm, provider);
9. src/main/java/com/google/crypto/tink/signature/internal/EcdsaVerifyJce.java:170 return Signature.getInstance(signatureAlgorithm, provider);
10. src/main/java/com/google/crypto/tink/signature/internal/MlDsaSignConscrypt.java:90 KeyFactory.getInstance(ML_DSA_44_ALGORITHM, provider)
11. src/main/java/com/google/crypto/tink/signature/internal/MlDsaSignConscrypt.java:98 KeyFactory.getInstance(ML_DSA_65_ALGORITHM, provider)
12. src/main/java/com/google/crypto/tink/signature/internal/MlDsaSignConscrypt.java:106 KeyFactory.getInstance(ML_DSA_87_ALGORITHM, provider)
13. src/main/java/com/google/crypto/tink/signature/internal/MlDsaSignConscrypt.java:172 Signature signer = Signature.getInstance(algorithm, provider);
14. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:143 Signature verifier = Signature.getInstance(algorithm, provider);
15. src/main/java/com/google/crypto/tink/signature/internal/RsaSsaPkcs1SignJce.java:165 return Signature.getInstance(signatureAlgorithm, conscryptOrNull);
16. src/main/java/com/google/crypto/tink/signature/internal/RsaSsaPkcs1VerifyConscrypt.java:150 Signature verifier = Signature.getInstance(signatureAlgorithm, conscrypt);
17. src/main/java/com/google/crypto/tink/signature/internal/RsaSsaPssSignConscrypt.java:126 Signature signer = Signature.getInstance(signatureAlgorithm, conscrypt);
18. src/main/java/com/google/crypto/tink/signature/internal/RsaSsaPssVerifyConscrypt.java:184 Signature verifier = Signature.getInstance(signatureAlgorithm, conscrypt);
19. src/main/java/com/google/crypto/tink/signature/internal/SlhDsaSignConscrypt.java:93 KeyFactory.getInstance(SLH_DSA_SHA2_128S_ALGORITHM, provider)
20. src/main/java/com/google/crypto/tink/signature/internal/SlhDsaSignConscrypt.java:158 Signature signer = Signature.getInstance(algorithm, provider);
21. src/main/java/com/google/crypto/tink/signature/internal/SlhDsaVerifyConscrypt.java:124 Signature verifier = Signature.getInstance(algorithm, provider);
22. src/main/java/com/google/crypto/tink/subtle/EngineWrapper.java:45 return Cipher.getInstance(algorithm);
23. src/main/java/com/google/crypto/tink/subtle/EngineWrapper.java:47 return Cipher.getInstance(algorithm, provider);
24. src/main/java/com/google/crypto/tink/subtle/EngineWrapper.java:72 return KeyPairGenerator.getInstance(algorithm);
25. src/main/java/com/google/crypto/tink/subtle/EngineWrapper.java:74 return KeyPairGenerator.getInstance(algorithm, provider);
26. src/main/java/com/google/crypto/tink/subtle/EngineWrapper.java:100 return Signature.getInstance(algorithm);
27. src/main/java/com/google/crypto/tink/subtle/EngineWrapper.java:102 return Signature.getInstance(algorithm, provider);
28. src/main/java/com/google/crypto/tink/subtle/EngineWrapper.java:114 return KeyFactory.getInstance(algorithm);
29. src/main/java/com/google/crypto/tink/subtle/EngineWrapper.java:116 return KeyFactory.getInstance(algorithm, provider);
30. src/main/java/com/google/crypto/tink/subtle/EngineWrapper.java:128 return KeyAgreement.getInstance(algorithm);
31. src/main/java/com/google/crypto/tink/subtle/EngineWrapper.java:130 return KeyAgreement.getInstance(algorithm, provider);

java.keypairgenerator.variable · CWE-327

unknown Could not be determined 4 places See details

Non-cryptographic randomness near key material

`new Random()` or `Math.random()` in a file that also imports `java.security`, `javax.crypto` or BouncyCastle. `java.util.Random` is a linear congruential generator and its output is predictable from a handful of samples. The import check is what keeps this from firing on every retry jitter and test fixture in the tree.

Part of this code uses a predictable source of random numbers. If any key comes from it, that key can be guessed today, with no quantum computer needed.

What to do. `java.security.SecureRandom`. This is a classical defect, not a quantum one, and it is worth fixing first.

1. examples/android/helloworld/app/src/main/java/com/helloworld/TinkApplication.java:78 test path int waitTimeMillis = (int) (Math.random() * maxWaitTimeMillis);
2. src/main/java/com/google/crypto/tink/integration/android/AndroidKeystoreAesGcm.java:75 int waitTimeMillis = (int) (Math.random() * MAX_WAIT_TIME_MILLISECONDS_BEFORE_RETRY);
3. src/main/java/com/google/crypto/tink/integration/android/AndroidKeystoreKmsClient.java:187 int waitTimeMillis = (int) (Math.random() * MAX_WAIT_TIME_MILLISECONDS_BEFORE_RETRY);
4. src/test/java/com/google/crypto/tink/hybrid/subtle/RsaKemTest.java:45 test path BigInteger max = new BigInteger(2048, new Random());

java.random.insecure · CWE-338

unknown Could not be determined 1 place See details

Cryptographic library in the dependency manifest

A dependency known to implement classical asymmetric cryptography. Its presence is inventory, not a finding about this codebase: the library may never be called with a quantum-vulnerable algorithm.

The project depends on a cryptography library. Listed so the inventory is complete; it is not by itself a problem.

What to do. Check the version. Several of these libraries have shipped ML-KEM and ML-DSA support since 2024, so the migration may need an upgrade rather than a replacement.

1. examples/maven/pom.xml:20 test path <artifactId>tink</artifactId>

dep.crypto-library

HMAC Quantum-safe 39 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. A keyed MAC is not affected by Shor and only marginally by Grover.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. src/main/java/com/google/crypto/tink/jwt/JwtHmacParameters.java:81 public static final Algorithm HS256 = new Algorithm("HS256");
2. src/main/java/com/google/crypto/tink/jwt/JwtHmacParameters.java:82 public static final Algorithm HS384 = new Algorithm("HS384");
3. src/main/java/com/google/crypto/tink/jwt/JwtHmacParameters.java:83 public static final Algorithm HS512 = new Algorithm("HS512");
4. src/main/java/com/google/crypto/tink/jwt/internal/JwtFormat.java:91 case "HS256":
5. src/main/java/com/google/crypto/tink/jwt/internal/JwtFormat.java:92 case "HS384":
6. src/main/java/com/google/crypto/tink/jwt/internal/JwtFormat.java:93 case "HS512":
7. src/test/java/com/google/crypto/tink/jwt/JwtHmacKeyManagerTest.java:618 test path normalHeader.addProperty("alg", "HS256");
8. src/test/java/com/google/crypto/tink/jwt/JwtHmacKeyManagerTest.java:624 test path goodHeader.addProperty("alg", "HS256");
9. src/test/java/com/google/crypto/tink/jwt/JwtHmacKeyManagerTest.java:652 test path headerWithUnknownKid.addProperty("alg", "HS256");
10. src/test/java/com/google/crypto/tink/jwt/JwtHmacKeyManagerTest.java:679 test path normalHeader.addProperty("alg", "HS256");
11. src/test/java/com/google/crypto/tink/jwt/JwtHmacKeyManagerTest.java:686 test path headerWithTyp.addProperty("alg", "HS256");
12. src/test/java/com/google/crypto/tink/jwt/JwtHmacKeyManagerTest.java:717 test path headerWithUnknownKid.addProperty("alg", "HS256");
13. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:164 test path JwtFormat.createHeader("HS256", Optional.empty(), Optional.empty()))),
14. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:165 test path "HS256",
15. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:171 test path JwtFormat.createHeader("HS384", Optional.empty(), Optional.empty()))),
16. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:172 test path "HS384",
17. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:178 test path JwtFormat.createHeader("HS512", Optional.empty(), Optional.empty()))),
18. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:179 test path "HS512",
19. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:201 test path "HS256",
20. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:202 test path "HS384",
21. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:203 test path "HS512",
22. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:229 test path JwtFormat.decodeHeader(JwtFormat.createHeader("HS256", Optional.empty(), Optional.empty()));
23. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:234 test path JsonUtil.parseJson(header), "HS384", Optional.empty(), true));
24. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:241 test path "HS256",
25. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:274 test path "HS256",
26. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:283 test path "HS256",
27. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:294 test path JsonUtil.parseJson("{}"), "HS256", Optional.empty(), true));
28. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:301 test path "HS256",
29. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:309 test path "HS256",
30. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:318 test path "HS256",
31. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:327 test path "HS256",
32. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:335 test path "HS256",
33. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:341 test path "HS256",
34. src/test/java/com/google/crypto/tink/jwt/subtle/JwtHmacTest.java:461 test path normalHeader.addProperty("alg", "HS256");
35. src/test/java/com/google/crypto/tink/jwt/subtle/JwtHmacTest.java:467 test path goodHeader.addProperty("alg", "HS256");
36. src/test/java/com/google/crypto/tink/jwt/subtle/JwtHmacTest.java:495 test path headerWithUnknownKid.addProperty("alg", "HS256");
37. src/test/java/com/google/crypto/tink/jwt/subtle/JwtHmacTest.java:521 test path normalHeader.addProperty("alg", "HS256");
38. src/test/java/com/google/crypto/tink/jwt/subtle/JwtHmacTest.java:528 test path headerWithTyp.addProperty("alg", "HS256");
39. src/test/java/com/google/crypto/tink/jwt/subtle/JwtHmacTest.java:559 test path headerWithUnknownKid.addProperty("alg", "HS256");

jose.algorithm · CWE-327

HMAC Quantum-safe 26 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. src/main/java/com/google/crypto/tink/aead/internal/LegacyAesCtrHmacTestKeyManager.java:102 test path SecretKeySpec keySpec = new SecretKeySpec(keyValue, "HMAC");
2. src/main/java/com/google/crypto/tink/mac/internal/LegacyHmacTestKeyManager.java:75 test path SecretKeySpec keySpec = new SecretKeySpec(keyValue, "HMAC");
3. src/main/java/com/google/crypto/tink/prf/internal/LegacyHmacPrfTestKeyManager.java:54 test path SecretKeySpec keySpec = new SecretKeySpec(keyValue, "HMAC");
4. src/main/java/com/google/crypto/tink/subtle/EncryptThenAuthenticate.java:89 SecretKeySpec hmacKeySpec = new SecretKeySpec(hmacKey, "HMAC");
5. src/main/java/com/google/crypto/tink/subtle/PrfHmacJce.java:104 new SecretKeySpec(key.getKeyBytes().toByteArray(InsecureSecretKeyAccess.get()), "HMAC"));
6. src/test/java/com/google/crypto/tink/jwt/JwtHmacKeyManagerTest.java:607 test path SecretKeySpec keySpec = new SecretKeySpec(keyValue, "HMAC");
7. src/test/java/com/google/crypto/tink/jwt/JwtHmacKeyManagerTest.java:667 test path SecretKeySpec keySpec = new SecretKeySpec(keyValue, "HMAC");
8. src/test/java/com/google/crypto/tink/jwt/subtle/JwtHmacTest.java:450 test path SecretKeySpec keySpec = new SecretKeySpec(keyValue, "HMAC");
9. src/test/java/com/google/crypto/tink/jwt/subtle/JwtHmacTest.java:509 test path SecretKeySpec keySpec = new SecretKeySpec(keyValue, "HMAC");
10. src/test/java/com/google/crypto/tink/subtle/AeadThreadSafetyTest.java:152 test path SecretKeySpec keySpec = new SecretKeySpec(macKey, "HMAC");
11. src/test/java/com/google/crypto/tink/subtle/PrfHmacJceTest.java:120 test path new PrfMac(new PrfHmacJce(t.algName, new SecretKeySpec(t.key, "HMAC")), t.tag.length);
12. src/test/java/com/google/crypto/tink/subtle/PrfHmacJceTest.java:135 test path Prf prf = new PrfHmacJce(t.algName, new SecretKeySpec(t.key, "HMAC"));
13. src/test/java/com/google/crypto/tink/subtle/PrfHmacJceTest.java:151 test path Prf prf = new PrfHmacJce(t.algName, new SecretKeySpec(t.key, "HMAC"));
14. src/test/java/com/google/crypto/tink/subtle/PrfHmacJceTest.java:167 test path new PrfMac(new PrfHmacJce(t.algName, new SecretKeySpec(t.key, "HMAC")), t.tag.length);
15. src/test/java/com/google/crypto/tink/subtle/PrfHmacJceTest.java:177 test path new PrfHmacJce(t.algName, new SecretKeySpec(Random.randBytes(t.key.length), "HMAC")),
16. src/test/java/com/google/crypto/tink/subtle/PrfHmacJceTest.java:192 test path new PrfMac(new PrfHmacJce(t.algName, new SecretKeySpec(t.key, "HMAC")), t.tag.length);
17. src/test/java/com/google/crypto/tink/subtle/PrfHmacJceTest.java:205 test path new PrfHmacJce(t.algName, new SecretKeySpec(Random.randBytes(t.key.length), "HMAC")),
18. src/test/java/com/google/crypto/tink/subtle/PrfHmacJceTest.java:220 test path new PrfMac(new PrfHmacJce(t.algName, new SecretKeySpec(t.key, "HMAC")), t.tag.length);
19. src/test/java/com/google/crypto/tink/subtle/PrfHmacJceTest.java:233 test path new PrfHmacJce(t.algName, new SecretKeySpec(Random.randBytes(t.key.length), "HMAC")),
20. src/test/java/com/google/crypto/tink/subtle/PrfHmacJceTest.java:253 test path new PrfHmacJce("HMACSHA1", new SecretKeySpec(Random.randBytes(15), "HMAC")), 16));
21. src/test/java/com/google/crypto/tink/subtle/PrfHmacJceTest.java:268 test path new PrfMac(new PrfHmacJce(algoName, new SecretKeySpec(Random.randBytes(16), "HMAC")), i);
22. src/test/java/com/google/crypto/tink/subtle/PrfHmacJceTest.java:289 test path new PrfHmacJce(algoName, new SecretKeySpec(Random.randBytes(16), "HMAC"))
23. src/test/java/com/google/crypto/tink/subtle/PrfHmacJceTest.java:312 test path new PrfHmacJce(algoName, new SecretKeySpec(Random.randBytes(16), "HMAC")), tagSize);
24. src/test/java/com/google/crypto/tink/subtle/PrfHmacJceTest.java:322 test path Prf r = new PrfHmacJce(algoName, new SecretKeySpec(Random.randBytes(16), "HMAC"));
25. src/test/java/com/google/crypto/tink/subtle/PrfHmacJceTest.java:336 test path () -> new PrfHmacJce("HMACSHA256", new SecretKeySpec(Random.randBytes(16), "HMAC")));
26. src/test/java/com/google/crypto/tink/subtle/PrfHmacJceTest.java:375 test path Prf byteArrayPrf = new PrfHmacJce(t.algName, new SecretKeySpec(t.key, "HMAC"));

java.keyspec · CWE-327

ML-DSA-44 Quantum-safe 20 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. src/main/java/com/google/crypto/tink/jwt/JwtMlDsaParameters.java:79 public static final Algorithm ML_DSA_44 = new Algorithm("ML-DSA-44");
2. src/main/java/com/google/crypto/tink/jwt/internal/JwtFormat.java:103 case "ML-DSA-44":
3. src/main/java/com/google/crypto/tink/jwt/internal/JwtMlDsaKeyCreator.java:38 private static final String ML_DSA_44_ALGORITHM = "ML-DSA-44";
4. src/main/java/com/google/crypto/tink/jwt/internal/JwtMlDsaKeyCreator.java:56 keyPairGenerator = KeyPairGenerator.getInstance(ML_DSA_44_ALGORITHM, provider);
5. src/main/java/com/google/crypto/tink/jwt/internal/JwtMlDsaKeyCreator.java:57 keyFactory = KeyFactory.getInstance(ML_DSA_44_ALGORITHM, provider);
6. src/main/java/com/google/crypto/tink/signature/internal/MlDsaKeyCreator.java:39 private static final String ML_DSA_44_ALGORITHM = "ML-DSA-44";
7. src/main/java/com/google/crypto/tink/signature/internal/MlDsaKeyCreator.java:56 keyPairGenerator = KeyPairGenerator.getInstance(ML_DSA_44_ALGORITHM, provider);
8. src/main/java/com/google/crypto/tink/signature/internal/MlDsaKeyCreator.java:57 keyFactory = KeyFactory.getInstance(ML_DSA_44_ALGORITHM, provider);
9. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:42 static final String ML_DSA_44_ALGORITHM = "ML-DSA-44";
10. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:89 algorithm = ML_DSA_44_ALGORITHM;
11. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:91 KeyFactory.getInstance(ML_DSA_44_ALGORITHM, provider)
12. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:165 KeyFactory unusedKeyFactory44 = KeyFactory.getInstance(ML_DSA_44_ALGORITHM, provider);
13. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:166 Signature unusedSignature44 = Signature.getInstance(ML_DSA_44_ALGORITHM, provider);
14. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:213 test path "ML-DSA-44",
15. src/test/java/com/google/crypto/tink/jwt/subtle/JwtMlDsaPublicKeySignVerifyTest.java:337 test path validHeader.addProperty("alg", "ML-DSA-44");
16. src/test/java/com/google/crypto/tink/jwt/subtle/JwtMlDsaPublicKeySignVerifyTest.java:344 test path headerWithoutKid.addProperty("alg", "ML-DSA-44");
17. src/test/java/com/google/crypto/tink/jwt/subtle/JwtMlDsaPublicKeySignVerifyTest.java:366 test path headerWithUnknownKid.addProperty("alg", "ML-DSA-44");
18. src/test/java/com/google/crypto/tink/signature/internal/MlDsaSignConscryptTest.java:610 test path if (algorithm.equals("ML-DSA-44")) {
19. src/test/java/com/google/crypto/tink/signature/subtle/MlDsaSignerTest.java:590 test path if (algorithm.equals("ML-DSA-44")) {
20. src/test/java/com/google/crypto/tink/signature/subtle/MlDsaVerifierTest.java:590 test path if (algorithm.equals("ML-DSA-44")) {

jose.algorithm · CWE-327

ML-DSA-65 Quantum-safe 19 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. src/main/java/com/google/crypto/tink/jwt/JwtMlDsaParameters.java:80 public static final Algorithm ML_DSA_65 = new Algorithm("ML-DSA-65");
2. src/main/java/com/google/crypto/tink/jwt/internal/JwtFormat.java:104 case "ML-DSA-65":
3. src/main/java/com/google/crypto/tink/jwt/internal/JwtMlDsaKeyCreator.java:39 private static final String ML_DSA_65_ALGORITHM = "ML-DSA-65";
4. src/main/java/com/google/crypto/tink/jwt/internal/JwtMlDsaKeyCreator.java:59 keyPairGenerator = KeyPairGenerator.getInstance(ML_DSA_65_ALGORITHM, provider);
5. src/main/java/com/google/crypto/tink/jwt/internal/JwtMlDsaKeyCreator.java:60 keyFactory = KeyFactory.getInstance(ML_DSA_65_ALGORITHM, provider);
6. src/main/java/com/google/crypto/tink/signature/internal/MlDsaKeyCreator.java:40 private static final String ML_DSA_65_ALGORITHM = "ML-DSA-65";
7. src/main/java/com/google/crypto/tink/signature/internal/MlDsaKeyCreator.java:59 keyPairGenerator = KeyPairGenerator.getInstance(ML_DSA_65_ALGORITHM, provider);
8. src/main/java/com/google/crypto/tink/signature/internal/MlDsaKeyCreator.java:60 keyFactory = KeyFactory.getInstance(ML_DSA_65_ALGORITHM, provider);
9. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:44 static final String ML_DSA_65_ALGORITHM = "ML-DSA-65";
10. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:96 algorithm = ML_DSA_65_ALGORITHM;
11. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:98 KeyFactory.getInstance(ML_DSA_65_ALGORITHM, provider)
12. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:167 KeyFactory unusedKeyFactory65 = KeyFactory.getInstance(ML_DSA_65_ALGORITHM, provider);
13. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:168 Signature unusedSignature65 = Signature.getInstance(ML_DSA_65_ALGORITHM, provider);
14. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:214 test path "ML-DSA-65",
15. src/test/java/com/google/crypto/tink/jwt/subtle/JwtMlDsaPublicKeySignVerifyTest.java:286 test path goodHeader.addProperty("alg", "ML-DSA-65");
16. src/test/java/com/google/crypto/tink/jwt/subtle/JwtMlDsaPublicKeySignVerifyTest.java:314 test path unknownKidHeader.addProperty("alg", "ML-DSA-65");
17. src/test/java/com/google/crypto/tink/signature/internal/MlDsaSignConscryptTest.java:612 test path } else if (algorithm.equals("ML-DSA-65")) {
18. src/test/java/com/google/crypto/tink/signature/subtle/MlDsaSignerTest.java:592 test path } else if (algorithm.equals("ML-DSA-65")) {
19. src/test/java/com/google/crypto/tink/signature/subtle/MlDsaVerifierTest.java:592 test path } else if (algorithm.equals("ML-DSA-65")) {

jose.algorithm · CWE-327

ML-DSA-87 Quantum-safe 17 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. src/main/java/com/google/crypto/tink/jwt/JwtMlDsaParameters.java:81 public static final Algorithm ML_DSA_87 = new Algorithm("ML-DSA-87");
2. src/main/java/com/google/crypto/tink/jwt/internal/JwtFormat.java:105 case "ML-DSA-87":
3. src/main/java/com/google/crypto/tink/jwt/internal/JwtMlDsaKeyCreator.java:40 private static final String ML_DSA_87_ALGORITHM = "ML-DSA-87";
4. src/main/java/com/google/crypto/tink/jwt/internal/JwtMlDsaKeyCreator.java:62 keyPairGenerator = KeyPairGenerator.getInstance(ML_DSA_87_ALGORITHM, provider);
5. src/main/java/com/google/crypto/tink/jwt/internal/JwtMlDsaKeyCreator.java:63 keyFactory = KeyFactory.getInstance(ML_DSA_87_ALGORITHM, provider);
6. src/main/java/com/google/crypto/tink/signature/internal/MlDsaKeyCreator.java:41 private static final String ML_DSA_87_ALGORITHM = "ML-DSA-87";
7. src/main/java/com/google/crypto/tink/signature/internal/MlDsaKeyCreator.java:62 keyPairGenerator = KeyPairGenerator.getInstance(ML_DSA_87_ALGORITHM, provider);
8. src/main/java/com/google/crypto/tink/signature/internal/MlDsaKeyCreator.java:63 keyFactory = KeyFactory.getInstance(ML_DSA_87_ALGORITHM, provider);
9. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:46 static final String ML_DSA_87_ALGORITHM = "ML-DSA-87";
10. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:103 algorithm = ML_DSA_87_ALGORITHM;
11. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:105 KeyFactory.getInstance(ML_DSA_87_ALGORITHM, provider)
12. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:169 KeyFactory unusedKeyFactory87 = KeyFactory.getInstance(ML_DSA_87_ALGORITHM, provider);
13. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:170 Signature unusedSignature87 = Signature.getInstance(ML_DSA_87_ALGORITHM, provider);
14. src/test/java/com/google/crypto/tink/jwt/internal/JwtFormatTest.java:215 test path "ML-DSA-87",
15. src/test/java/com/google/crypto/tink/signature/internal/MlDsaSignConscryptTest.java:614 test path } else if (algorithm.equals("ML-DSA-87")) {
16. src/test/java/com/google/crypto/tink/signature/subtle/MlDsaSignerTest.java:594 test path } else if (algorithm.equals("ML-DSA-87")) {
17. src/test/java/com/google/crypto/tink/signature/subtle/MlDsaVerifierTest.java:594 test path } else if (algorithm.equals("ML-DSA-87")) {

jose.algorithm · CWE-327

CSPRNG Quantum-safe 6 places See details

Random number generation

`SecureRandom`. A platform CSPRNG is not a quantum exposure; it is recorded because an inventory that omits the randomness source is incomplete. `SHA1PRNG` is named explicitly where it appears, since it is a legacy algorithm even though its output is adequate.

This is where the software gets its random numbers. Quantum computers do not weaken it.

What to do. No action. Prefer the platform default over naming an algorithm.

1. src/main/java/com/google/crypto/tink/hybrid/subtle/RsaKem.java:92 Random rand = new SecureRandom();
2. src/main/java/com/google/crypto/tink/internal/Random.java:53 return new SecureRandom();
3. src/main/java/com/google/crypto/tink/testing/StreamingTestUtil.java:1228 test path SecureRandom random = new SecureRandom();
4. src/test/java/com/google/crypto/tink/internal/Field25519Test.java:46 test path private static final SecureRandom rand = new SecureRandom();
5. src/test/java/com/google/crypto/tink/subtle/StreamingAeadThreadSafetyTest.java:356 test path SecureRandom rand = new SecureRandom();
6. src/test/java/com/google/crypto/tink/testing/TestUtilTest.java:45 test path random = SecureRandom.getInstanceStrong();

java.rng

ChaCha20-Poly1305 Quantum-safe From a constant 6 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. src/main/java/com/google/crypto/tink/aead/internal/ChaCha20Poly1305Jce.java:68 cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(testKey, KEY_NAME), params);
2. src/main/java/com/google/crypto/tink/aead/internal/ChaCha20Poly1305Jce.java:74 cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(testKey, KEY_NAME), params);
3. src/main/java/com/google/crypto/tink/aead/internal/ChaCha20Poly1305Jce.java:102 this.keySpec = new SecretKeySpec(key, KEY_NAME);
4. src/main/java/com/google/crypto/tink/aead/internal/InsecureNonceChaCha20Poly1305Jce.java:65 this.keySpec = new SecretKeySpec(key, KEY_NAME);
5. src/main/java/com/google/crypto/tink/aead/internal/XChaCha20Poly1305Jce.java:99 SecretKeySpec keySpec = new SecretKeySpec(subkey, KEY_NAME);
6. src/main/java/com/google/crypto/tink/aead/internal/XChaCha20Poly1305Jce.java:147 SecretKeySpec keySpec = new SecretKeySpec(subkey, KEY_NAME);

java.keyspec · CWE-327

ML-DSA-44 Quantum-safe From a constant 4 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. src/main/java/com/google/crypto/tink/jwt/internal/JwtMlDsaKeyCreator.java:57 keyFactory = KeyFactory.getInstance(ML_DSA_44_ALGORITHM, provider);
2. src/main/java/com/google/crypto/tink/signature/internal/MlDsaKeyCreator.java:57 keyFactory = KeyFactory.getInstance(ML_DSA_44_ALGORITHM, provider);
3. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:91 KeyFactory.getInstance(ML_DSA_44_ALGORITHM, provider)
4. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:165 KeyFactory unusedKeyFactory44 = KeyFactory.getInstance(ML_DSA_44_ALGORITHM, provider);

java.keyfactory · CWE-327

ML-DSA-65 Quantum-safe From a constant 4 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. src/main/java/com/google/crypto/tink/jwt/internal/JwtMlDsaKeyCreator.java:60 keyFactory = KeyFactory.getInstance(ML_DSA_65_ALGORITHM, provider);
2. src/main/java/com/google/crypto/tink/signature/internal/MlDsaKeyCreator.java:60 keyFactory = KeyFactory.getInstance(ML_DSA_65_ALGORITHM, provider);
3. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:98 KeyFactory.getInstance(ML_DSA_65_ALGORITHM, provider)
4. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:167 KeyFactory unusedKeyFactory65 = KeyFactory.getInstance(ML_DSA_65_ALGORITHM, provider);

java.keyfactory · CWE-327

ML-DSA-87 Quantum-safe From a constant 4 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. src/main/java/com/google/crypto/tink/jwt/internal/JwtMlDsaKeyCreator.java:63 keyFactory = KeyFactory.getInstance(ML_DSA_87_ALGORITHM, provider);
2. src/main/java/com/google/crypto/tink/signature/internal/MlDsaKeyCreator.java:63 keyFactory = KeyFactory.getInstance(ML_DSA_87_ALGORITHM, provider);
3. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:105 KeyFactory.getInstance(ML_DSA_87_ALGORITHM, provider)
4. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:169 KeyFactory unusedKeyFactory87 = KeyFactory.getInstance(ML_DSA_87_ALGORITHM, provider);

java.keyfactory · CWE-327

SLH-DSA Quantum-safe From a constant 3 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. src/main/java/com/google/crypto/tink/signature/internal/SlhDsaKeyCreator.java:60 KeyFactory keyFactory = KeyFactory.getInstance(SLH_DSA_SHA2_128S_ALGORITHM, provider);
2. src/main/java/com/google/crypto/tink/signature/internal/SlhDsaVerifyConscrypt.java:90 KeyFactory.getInstance(SLH_DSA_SHA2_128S_ALGORITHM, provider)
3. src/main/java/com/google/crypto/tink/signature/internal/SlhDsaVerifyConscrypt.java:144 KeyFactory unusedKeyFactory = KeyFactory.getInstance(SLH_DSA_SHA2_128S_ALGORITHM, provider);

java.keyfactory · CWE-327

ML-DSA-44 Quantum-safe From a constant 2 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. src/main/java/com/google/crypto/tink/jwt/internal/JwtMlDsaKeyCreator.java:56 keyPairGenerator = KeyPairGenerator.getInstance(ML_DSA_44_ALGORITHM, provider);
2. src/main/java/com/google/crypto/tink/signature/internal/MlDsaKeyCreator.java:56 keyPairGenerator = KeyPairGenerator.getInstance(ML_DSA_44_ALGORITHM, provider);

java.keypairgenerator · CWE-327

ML-DSA-65 Quantum-safe From a constant 2 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. src/main/java/com/google/crypto/tink/jwt/internal/JwtMlDsaKeyCreator.java:59 keyPairGenerator = KeyPairGenerator.getInstance(ML_DSA_65_ALGORITHM, provider);
2. src/main/java/com/google/crypto/tink/signature/internal/MlDsaKeyCreator.java:59 keyPairGenerator = KeyPairGenerator.getInstance(ML_DSA_65_ALGORITHM, provider);

java.keypairgenerator · CWE-327

ML-DSA-87 Quantum-safe From a constant 2 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. src/main/java/com/google/crypto/tink/jwt/internal/JwtMlDsaKeyCreator.java:62 keyPairGenerator = KeyPairGenerator.getInstance(ML_DSA_87_ALGORITHM, provider);
2. src/main/java/com/google/crypto/tink/signature/internal/MlDsaKeyCreator.java:62 keyPairGenerator = KeyPairGenerator.getInstance(ML_DSA_87_ALGORITHM, provider);

java.keypairgenerator · CWE-327

SHA-512 Quantum-safe 2 places See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. src/test/java/com/google/crypto/tink/subtle/RsaSsaPkcs1SignJceTest.java:114 test path Signature verifier = Signature.getInstance("SHA512withRSA");
2. src/test/java/com/google/crypto/tink/subtle/RsaSsaPkcs1SignJceTest.java:145 test path Signature verifier = Signature.getInstance("SHA512WithRSA");

java.messagedigest · CWE-328

ChaCha20-Poly1305 Quantum-safe From a constant 1 place See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. src/main/java/com/google/crypto/tink/aead/internal/ChaCha20Poly1305Jce.java:137 return Cipher.getInstance(CIPHER_NAME, provider);

java.cipher · CWE-327

ML-DSA-44 Quantum-safe From a constant 1 place See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:166 Signature unusedSignature44 = Signature.getInstance(ML_DSA_44_ALGORITHM, provider);

java.signature · CWE-327

ML-DSA-65 Quantum-safe From a constant 1 place See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:168 Signature unusedSignature65 = Signature.getInstance(ML_DSA_65_ALGORITHM, provider);

java.signature · CWE-327

ML-DSA-87 Quantum-safe From a constant 1 place See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. src/main/java/com/google/crypto/tink/signature/internal/MlDsaVerifyConscrypt.java:170 Signature unusedSignature87 = Signature.getInstance(ML_DSA_87_ALGORITHM, provider);

java.signature · CWE-327

SHA-384 Quantum-safe 1 place See details

Mask-generation digest named for RSA padding

`MGF1ParameterSpec.SHA256` names the digest inside RSA-OAEP and RSA-PSS padding. It is a separate choice from the digest the signature or the cipher uses, it is frequently left at SHA-1 by default, and a static import of it - `import static java.security.spec.MGF1ParameterSpec.SHA512` - is the only place the choice appears in the file that makes it.

This picks the hash used inside RSA padding. It matters because the default is often SHA-1, which is broken today without any quantum computer.

What to do. The mask-generation digest travels with the RSA key it pads. When that key moves to ML-KEM or ML-DSA the padding goes with it; until then, SHA-256 or better.

1. src/main/java/com/google/crypto/tink/signature/internal/RsaSsaPssVerifyConscrypt.java:111 return MGF1ParameterSpec.SHA384;

java.mgf1 · CWE-327

SHA-384 Quantum-safe 1 place See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. src/test/java/com/google/crypto/tink/subtle/RsaSsaPkcs1SignJceTest.java:102 test path Signature verifier = Signature.getInstance("SHA384withRSA");

java.messagedigest · CWE-328

SHA-512 Quantum-safe 1 place See details

Mask-generation digest named for RSA padding

`MGF1ParameterSpec.SHA256` names the digest inside RSA-OAEP and RSA-PSS padding. It is a separate choice from the digest the signature or the cipher uses, it is frequently left at SHA-1 by default, and a static import of it - `import static java.security.spec.MGF1ParameterSpec.SHA512` - is the only place the choice appears in the file that makes it.

This picks the hash used inside RSA padding. It matters because the default is often SHA-1, which is broken today without any quantum computer.

What to do. The mask-generation digest travels with the RSA key it pads. When that key moves to ML-KEM or ML-DSA the padding goes with it; until then, SHA-256 or better.

1. src/main/java/com/google/crypto/tink/signature/internal/RsaSsaPssVerifyConscrypt.java:113 return MGF1ParameterSpec.SHA512;

java.mgf1 · CWE-327

SLH-DSA Quantum-safe From a constant 1 place See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. src/main/java/com/google/crypto/tink/signature/internal/SlhDsaKeyCreator.java:58 KeyPairGenerator.getInstance(SLH_DSA_SHA2_128S_ALGORITHM, provider);

java.keypairgenerator · CWE-327

SLH-DSA Quantum-safe From a constant 1 place See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. src/main/java/com/google/crypto/tink/signature/internal/SlhDsaVerifyConscrypt.java:145 Signature unusedSignature = Signature.getInstance(SLH_DSA_SHA2_128S_ALGORITHM, provider);

java.signature · CWE-327