andy-goryachev/PasswordSafe

RSA Quantum-vulnerable Recorded traffic 18 places See details

RSA through the BouncyCastle low-level API

A BouncyCastle RSA engine or key-pair generator. These classes bypass the JCA algorithm strings, so they are invisible to a scan that only reads `getInstance()` arguments.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures.

1. src/goryachev/crypto/APublicKey.java:3 import org.bouncycastle.crypto.params.RSAKeyParameters;
2. src/goryachev/crypto/APublicKey.java:13 public APublicKey(RSAKeyParameters key)
3. src/goryachev/crypto/Crypto.java:19 import org.bouncycastle.crypto.encodings.PKCS1Encoding;
4. src/goryachev/crypto/Crypto.java:20 import org.bouncycastle.crypto.engines.RSAEngine;
5. src/goryachev/crypto/Crypto.java:21 import org.bouncycastle.crypto.generators.RSAKeyPairGenerator;
6. src/goryachev/crypto/Crypto.java:25 import org.bouncycastle.crypto.params.RSAKeyParameters;
7. src/goryachev/crypto/Crypto.java:27 import org.bouncycastle.crypto.signers.RSADigestSigner;
8. src/goryachev/crypto/Crypto.java:174 public static RSAPublicKey toRSAPublicKey(RSAKeyParameters k) throws Exception
9. src/goryachev/crypto/Crypto.java:180 public static byte[] toByteArray(RSAKeyParameters spec) throws Exception
10. src/goryachev/crypto/Crypto.java:230 return new APublicKey(new RSAKeyParameters(false, k.getModulus(), k.getPublicExponent()));
11. src/goryachev/crypto/Crypto.java:271 else if(x instanceof RSAKeyParameters)
12. src/goryachev/crypto/Crypto.java:273 return toByteArray((RSAKeyParameters)x);
13. src/goryachev/crypto/Crypto.java:294 RSAKeyPairGenerator g = new RSAKeyPairGenerator();
14. src/goryachev/crypto/Crypto.java:299 RSAKeyParameters pub = (RSAKeyParameters)kp.getPublic();
15. src/goryachev/crypto/Crypto.java:308 RSADigestSigner signer = new RSADigestSigner(new SHA256Digest());
16. src/goryachev/crypto/Crypto.java:321 RSADigestSigner signer = new RSADigestSigner(new SHA256Digest());
17. src/goryachev/crypto/Crypto.java:330 PKCS1Encoding rsa = new PKCS1Encoding(new RSAEngine());
18. src/goryachev/crypto/Crypto.java:348 PKCS1Encoding rsa = new PKCS1Encoding(new RSAEngine());

java.bouncycastle.rsa · CWE-327

AES Reduced margin 16 places See details

Symmetric cipher through BouncyCastle

A BouncyCastle symmetric engine or mode. Symmetric encryption is not broken by a quantum computer, so these are inventoried rather than flagged - but a complete cryptographic inventory has to contain them, and the mode is where AES-256 or a 64-bit block shows up.

This is the kind of encryption that quantum computers do not break. It is listed so the inventory is complete.

What to do. Use a 256-bit key. No change of algorithm is required unless the engine is DES, RC4 or Blowfish.

1. src/goryachev/crypto/MemCrypt.java:6 import org.bouncycastle.crypto.engines.AESEngine;
2. src/goryachev/crypto/MemCrypt.java:7 import org.bouncycastle.crypto.modes.EAXBlockCipher;
3. src/goryachev/crypto/MemCrypt.java:33 EAXBlockCipher cipher = new EAXBlockCipher(new AESEngine());
4. src/goryachev/crypto/MemCrypt.java:64 EAXBlockCipher cipher = new EAXBlockCipher(new AESEngine());
5. src/goryachev/crypto/eax/EAXCipher.java:4 import org.bouncycastle.crypto.engines.AESEngine;
6. src/goryachev/crypto/eax/EAXCipher.java:5 import org.bouncycastle.crypto.modes.EAXBlockCipher;
7. src/goryachev/crypto/eax/EAXCipher.java:21 EAXBlockCipher cipher = new EAXBlockCipher(new AESEngine());
8. src/goryachev/crypto/eax/EAXCipher.java:46 EAXBlockCipher cipher = new EAXBlockCipher(new AESEngine());
9. src/goryachev/crypto/eax/EAXDecryptStream.java:7 import org.bouncycastle.crypto.engines.AESEngine;
10. src/goryachev/crypto/eax/EAXDecryptStream.java:8 import org.bouncycastle.crypto.modes.EAXBlockCipher;
11. src/goryachev/crypto/eax/EAXDecryptStream.java:20 private EAXBlockCipher cipher;
12. src/goryachev/crypto/eax/EAXDecryptStream.java:36 this.cipher = new EAXBlockCipher(new AESEngine());
13. src/goryachev/crypto/eax/EAXEncryptStream.java:7 import org.bouncycastle.crypto.engines.AESEngine;
14. src/goryachev/crypto/eax/EAXEncryptStream.java:8 import org.bouncycastle.crypto.modes.EAXBlockCipher;
15. src/goryachev/crypto/eax/EAXEncryptStream.java:18 private EAXBlockCipher cipher;
16. src/goryachev/crypto/eax/EAXEncryptStream.java:31 this.cipher = new EAXBlockCipher(new AESEngine());

java.bouncycastle.symmetric

SHA-256 Reduced margin 13 places See details

Digest through BouncyCastle

A BouncyCastle digest class. The digest name is read from the class, so `MD5Digest` and `SHA512Digest` are the same rule with opposite conclusions.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something long-lived. MD5 and SHA-1 need replacing now.

1. src/goryachev/crypto/Crypto.java:18 import org.bouncycastle.crypto.digests.SHA256Digest;
2. src/goryachev/crypto/Crypto.java:308 RSADigestSigner signer = new RSADigestSigner(new SHA256Digest());
3. src/goryachev/crypto/Crypto.java:321 RSADigestSigner signer = new RSADigestSigner(new SHA256Digest());
4. src/goryachev/crypto/MemCrypt.java:5 import org.bouncycastle.crypto.digests.SHA256Digest;
5. src/goryachev/crypto/MemCrypt.java:94 SHA256Digest d = new SHA256Digest();
6. src/goryachev/memsafecrypto/bc/SCrypt.java:124 PKCS5S2ParametersGenerator pGen = new PKCS5S2ParametersGenerator(new SHA256Digest());
7. src/goryachev/memsafecrypto/bc/SHA256Digest.java:18 public class SHA256Digest
8. src/goryachev/memsafecrypto/bc/SHA256Digest.java:47 public SHA256Digest()
9. src/goryachev/memsafecrypto/bc/SHA256Digest.java:57 public SHA256Digest(SHA256Digest t)
10. src/goryachev/memsafecrypto/bc/SHA256Digest.java:70 public SHA256Digest(CByteArray encodedState)
11. src/goryachev/memsafecrypto/bc/SHA256Digest.java:92 private void copyIn(SHA256Digest t)
12. src/goryachev/memsafecrypto/bc/SHA256Digest.java:369 return new SHA256Digest(this);
13. src/goryachev/memsafecrypto/bc/SHA256Digest.java:375 SHA256Digest d = (SHA256Digest)other;

java.bouncycastle.digest · CWE-328

PBKDF2 Reduced margin 3 places See details

Password hashing or key derivation

A `SecretKeyFactory` for PBKDF2, or a BouncyCastle password KDF. Not a quantum exposure, and part of a complete inventory.

This is how passwords are stored. Quantum computers do not meaningfully weaken it.

What to do. PBKDF2 needs a high iteration count. Argon2 through BouncyCastle is stronger.

1. src/goryachev/memsafecrypto/bc/PKCS5S2ParametersGenerator.java:14 public class PKCS5S2ParametersGenerator
2. src/goryachev/memsafecrypto/bc/PKCS5S2ParametersGenerator.java:21 public PKCS5S2ParametersGenerator(Digest digest)
3. src/goryachev/memsafecrypto/bc/SCrypt.java:124 PKCS5S2ParametersGenerator pGen = new PKCS5S2ParametersGenerator(new SHA256Digest());

java.kdf

Salsa20 Quantum-safe 23 places See details

Symmetric cipher through BouncyCastle

A BouncyCastle symmetric engine or mode. Symmetric encryption is not broken by a quantum computer, so these are inventoried rather than flagged - but a complete cryptographic inventory has to contain them, and the mode is where AES-256 or a 64-bit block shows up.

This is the kind of encryption that quantum computers do not break. It is listed so the inventory is complete.

What to do. Use a 256-bit key. No change of algorithm is required unless the engine is DES, RC4 or Blowfish.

1. src/goryachev/memsafecrypto/bc/SCrypt.java:201 Salsa20Engine.salsaCore(8, X2, X1);
2. src/goryachev/memsafecrypto/bc/Salsa20Engine.java:11 public class Salsa20Engine
3. src/goryachev/memsafecrypto/bc/Salsa20Engine.java:42 public Salsa20Engine()
4. src/goryachev/memsafecrypto/bc/Salsa20Engine.java:52 public Salsa20Engine(int rounds)
5. src/goryachev/memsafecrypto/bc/XSalsa20Engine.java:12 public class XSalsa20Engine
6. src/goryachev/memsafecrypto/bc/XSalsa20Engine.java:13 extends Salsa20Engine
7. src/goryachev/memsafecrypto/salsa/XSalsa20Poly1305DecryptStream.java:9 import goryachev.memsafecrypto.bc.XSalsa20Engine;
8. src/goryachev/memsafecrypto/salsa/XSalsa20Poly1305DecryptStream.java:29 private XSalsa20Engine xsalsa20 = new XSalsa20Engine();
9. src/goryachev/memsafecrypto/salsa/XSalsa20Poly1305EncryptStream.java:9 import goryachev.memsafecrypto.bc.XSalsa20Engine;
10. src/goryachev/memsafecrypto/salsa/XSalsa20Poly1305EncryptStream.java:21 private XSalsa20Engine engine = new XSalsa20Engine();
11. src/goryachev/memsafecrypto/salsa/XSalsaOutputStream.java:9 import goryachev.memsafecrypto.bc.XSalsa20Engine;
12. src/goryachev/memsafecrypto/salsa/XSalsaOutputStream.java:23 private final XSalsa20Engine engine;
13. src/goryachev/memsafecrypto/salsa/XSalsaOutputStream.java:33 this.engine = new XSalsa20Engine();
14. src/goryachev/memsafecrypto/salsa/XSalsaRandomAccessFile.java:9 import goryachev.memsafecrypto.bc.XSalsa20Engine;
15. src/goryachev/memsafecrypto/salsa/XSalsaRandomAccessFile.java:29 private final XSalsa20Engine engine;
16. src/goryachev/memsafecrypto/salsa/XSalsaRandomAccessFile.java:41 this.engine = new XSalsa20Engine();
17. src/goryachev/memsafecrypto/salsa/XSalsaTools.java:7 import goryachev.memsafecrypto.bc.XSalsa20Engine;
18. src/goryachev/memsafecrypto/salsa/XSalsaTools.java:29 XSalsa20Engine engine = new XSalsa20Engine();
19. src/goryachev/memsafecrypto/salsa/XSalsaTools.java:67 XSalsa20Engine engine = new XSalsa20Engine();
20. src/goryachev/memsafecrypto/salsa/XSalsaTools.java:105 XSalsa20Engine engine = new XSalsa20Engine();
21. src/goryachev/memsafecrypto/salsa/XSalsaTools.java:143 XSalsa20Engine engine = new XSalsa20Engine();
22. src/goryachev/memsafecrypto/salsa/XSalsaTools.java:190 XSalsa20Engine engine = new XSalsa20Engine();
23. src/goryachev/memsafecrypto/salsa/XSalsaTools.java:267 XSalsa20Engine engine = new XSalsa20Engine();

java.bouncycastle.symmetric

BLAKE2 Quantum-safe 22 places See details

Digest through BouncyCastle

A BouncyCastle digest class. The digest name is read from the class, so `MD5Digest` and `SHA512Digest` are the same rule with opposite conclusions.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something long-lived. MD5 and SHA-1 need replacing now.

1. src/goryachev/memsafecrypto/CDigestBlake2b.java:6 import goryachev.memsafecrypto.bc.Blake2bDigest;
2. src/goryachev/memsafecrypto/CDigestBlake2b.java:28 private final Blake2bDigest digest;
3. src/goryachev/memsafecrypto/CDigestBlake2b.java:33 this.digest = new Blake2bDigest(bits);
4. src/goryachev/memsafecrypto/CRandomSpi.java:3 import goryachev.memsafecrypto.bc.Blake2bDigest;
5. src/goryachev/memsafecrypto/CRandomSpi.java:25 generator = new DigestRandomGenerator(new Blake2bDigest(512));
6. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:433 Blake2bDigest blake = new Blake2bDigest(outLen * 8);
7. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:441 Blake2bDigest digest = new Blake2bDigest(blake2bLength * 8);
8. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:467 digest = new Blake2bDigest(lastLength * 8);
9. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:541 Blake2bDigest blake = new Blake2bDigest(ARGON2_PREHASH_DIGEST_LENGTH * 8);
10. src/goryachev/memsafecrypto/bc/Blake2bDigest.java:43 public class Blake2bDigest
11. src/goryachev/memsafecrypto/bc/Blake2bDigest.java:118 public Blake2bDigest()
12. src/goryachev/memsafecrypto/bc/Blake2bDigest.java:124 public Blake2bDigest(Blake2bDigest digest)
13. src/goryachev/memsafecrypto/bc/Blake2bDigest.java:145 public Blake2bDigest(int digestSize)
14. src/goryachev/memsafecrypto/bc/Blake2bDigest.java:168 public Blake2bDigest(byte[] key)
15. src/goryachev/memsafecrypto/bc/Blake2bDigest.java:201 public Blake2bDigest(byte[] key, int digestLength, byte[] salt, byte[] personalization)
16. src/goryachev/memsafecrypto/util/MemCrypt.java:4 import goryachev.memsafecrypto.bc.Blake2bDigest;
17. src/goryachev/memsafecrypto/util/MemCrypt.java:75 Blake2bDigest d = new Blake2bDigest(XSalsaTools.KEY_LENGTH_BYTES * 8);
18. src/goryachev/memsafecrypto/util/MemCrypt.java:92 private static final void update(Blake2bDigest d, int x)
19. src/goryachev/password/data/v3/EncryptionHandlerV3.java:9 import goryachev.memsafecrypto.bc.Blake2bDigest;
20. src/goryachev/password/data/v3/EncryptionHandlerV3.java:233 Blake2bDigest d = new Blake2bDigest(NONCE_SIZE_BYTES * 8);
21. src/goryachev/password/data/v4/EncryptionHandlerV4.java:11 import goryachev.memsafecrypto.bc.Blake2bDigest;
22. src/goryachev/password/data/v4/EncryptionHandlerV4.java:238 Blake2bDigest d = new Blake2bDigest(NONCE_SIZE_BYTES * 8);

java.bouncycastle.digest · CWE-328

Argon2 Quantum-safe 18 places See details

Password hashing or key derivation

A `SecretKeyFactory` for PBKDF2, or a BouncyCastle password KDF. Not a quantum exposure, and part of a complete inventory.

This is how passwords are stored. Quantum computers do not meaningfully weaken it.

What to do. PBKDF2 needs a high iteration count. Argon2 through BouncyCastle is stronger.

1. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:14 public class Argon2BytesGenerator
2. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:46 public Argon2BytesGenerator()
3. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:60 if(parameters.getLanes() < Argon2BytesGenerator.MIN_PARALLELISM)
4. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:62 throw new IllegalStateException("lanes must be greater than " + Argon2BytesGenerator.MIN_PARALLELISM);
5. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:64 else if(parameters.getLanes() > Argon2BytesGenerator.MAX_PARALLELISM)
6. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:66 throw new IllegalStateException("lanes must be less than " + Argon2BytesGenerator.MAX_PARALLELISM);
7. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:72 else if(parameters.getIterations() < Argon2BytesGenerator.MIN_ITERATIONS)
8. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:74 throw new IllegalStateException("iterations is less than: " + Argon2BytesGenerator.MIN_ITERATIONS);
9. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:117 if(outLen < Argon2BytesGenerator.MIN_OUTLEN)
10. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:119 throw new IllegalStateException("output length less than " + Argon2BytesGenerator.MIN_OUTLEN);
11. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:164 if(memoryBlocks < 2 * Argon2BytesGenerator.ARGON2_SYNC_POINTS * parameters.getLanes())
12. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:166 memoryBlocks = 2 * Argon2BytesGenerator.ARGON2_SYNC_POINTS * parameters.getLanes();
13. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:169 this.segmentLength = memoryBlocks / (parameters.getLanes() * Argon2BytesGenerator.ARGON2_SYNC_POINTS);
14. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:170 this.laneLength = segmentLength * Argon2BytesGenerator.ARGON2_SYNC_POINTS;
15. src/goryachev/memsafecrypto/bc/Argon2BytesGenerator.java:173 memoryBlocks = segmentLength * (parameters.getLanes() * Argon2BytesGenerator.ARGON2_SYNC_POINTS);
16. src/goryachev/password/data/v4/EncryptionHandlerV4.java:9 import goryachev.memsafecrypto.bc.Argon2BytesGenerator;
17. src/goryachev/password/data/v4/EncryptionHandlerV4.java:98 Argon2BytesGenerator ms = new Argon2BytesGenerator();
18. src/goryachev/password/data/v4/EncryptionHandlerV4.java:187 Argon2BytesGenerator ms = new Argon2BytesGenerator();

java.kdf

scrypt Quantum-safe 10 places See details

Password hashing or key derivation

A `SecretKeyFactory` for PBKDF2, or a BouncyCastle password KDF. Not a quantum exposure, and part of a complete inventory.

This is how passwords are stored. Quantum computers do not meaningfully weaken it.

What to do. PBKDF2 needs a high iteration count. Argon2 through BouncyCastle is stronger.

1. src/goryachev/memsafecrypto/bc/SCrypt.java:14 public class SCrypt
2. src/goryachev/memsafecrypto/bc/SCrypt.java:16 private SCrypt()
3. src/goryachev/password/data/v2/EncryptionHandlerV2.java:9 import goryachev.memsafecrypto.bc.SCrypt;
4. src/goryachev/password/data/v2/EncryptionHandlerV2.java:86 CByteArray key = SCrypt.generate(pw, salt, n, r, p, KEY_SIZE_BYTES);
5. src/goryachev/password/data/v2/EncryptionHandlerV2.java:174 CByteArray key = SCrypt.generate(pw, salt, n, r, p, KEY_SIZE_BYTES);
6. src/goryachev/password/data/v3/EncryptionHandlerV3.java:10 import goryachev.memsafecrypto.bc.SCrypt;
7. src/goryachev/password/data/v3/EncryptionHandlerV3.java:98 CByteArray key = SCrypt.generate(pw, salt, n, r, p, KEY_SIZE_BYTES);
8. src/goryachev/password/data/v3/EncryptionHandlerV3.java:183 CByteArray key = SCrypt.generate(pw, salt, n, r, p, KEY_SIZE_BYTES);
9. test/goryachev/password/TestScryptParameters.java:8 test path import org.bouncycastle.crypto.generators.SCrypt;
10. test/goryachev/password/TestScryptParameters.java:232 test path SCrypt.generate(pw, s, n, r, p, 32);

java.kdf

CSPRNG Quantum-safe 9 places See details

Random number generation

`SecureRandom`. A platform CSPRNG is not a quantum exposure; it is recorded because an inventory that omits the randomness source is incomplete. `SHA1PRNG` is named explicitly where it appears, since it is a legacy algorithm even though its output is adequate.

This is where the software gets its random numbers. Quantum computers do not weaken it.

What to do. No action. Prefer the platform default over naming an algorithm.

1. src/goryachev/common/util/GUID.java:50 new SecureRandom().nextBytes(b);
2. src/goryachev/crypto/Crypto.java:291 SecureRandom rnd = new SecureRandom();
3. src/goryachev/crypto/EntropyGathererBase.java:40 jvmRandom = new SecureRandom();
4. src/goryachev/crypto/MemCrypt.java:36 new SecureRandom().nextBytes(nonce);
5. src/goryachev/memsafecrypto/CRandomSpi.java:28 SecureRandom r = new SecureRandom();
6. src/goryachev/memsafecrypto/bc/CryptoServicesRegistrar.java:34 SecureRandom tmp = new SecureRandom();
7. src/goryachev/memsafecrypto/bc/DigestRandomGenerator.java:13 public class DigestRandomGenerator
8. src/goryachev/memsafecrypto/util/MemCrypt.java:31 CUtils.nextBytes(new SecureRandom(), nonce);
9. test/goryachev/password/TestEncryptionHandlers.java:54 test path SecureRandom r = new SecureRandom();

java.rng

SHA-512 Quantum-safe 2 places See details

Digest through BouncyCastle

A BouncyCastle digest class. The digest name is read from the class, so `MD5Digest` and `SHA512Digest` are the same rule with opposite conclusions.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something long-lived. MD5 and SHA-1 need replacing now.

1. src/goryachev/crypto/EntropyGathererBase.java:8 import org.bouncycastle.crypto.digests.SHA512Digest;
2. src/goryachev/crypto/EntropyGathererBase.java:42 random = new DigestRandomGenerator(new SHA512Digest());

java.bouncycastle.digest · CWE-328