keycloak/keycloak

SHA-1 Already broken 23 places See details

XML signature or encryption algorithm

An XML Signature or XML Encryption algorithm URI - SAML, XAdES or WS-Security. The URI names the algorithm exactly, and a signature URI names its digest as well, so `#rsa-sha1` reports both the key and the broken digest.

Federated login and signed XML documents name their cryptography in a web address. Some of those addresses name algorithms that are already broken.

What to do. Move off `#rsa-sha1` first: that signature is forgeable today, with no quantum computer involved. The key algorithm changes with the wider migration.

1. js/apps/admin-ui/src/clients/add/SamlEncryption.tsx:125 { key: "http://www.w3.org/2000/09/xmldsig#sha1", value: "SHA-1" },
2. model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/custom/JpaUpdate26_4_0_SamlEncryptionAttributes.java:38 statements.add(createInsertQueryForAttribute("saml.encryption.digestMethod", "http://www.w3.org/2000/09/xmldsig#sha1"));
3. model/storage-private/src/main/java/org/keycloak/storage/datastore/DefaultExportImportManager.java:589 app.setAttribute("saml.encryption.digestMethod", "http://www.w3.org/2000/09/xmldsig#sha1");
4. saml-core-api/src/main/java/org/keycloak/saml/common/constants/JBossSAMLConstants.java:231 SIGNATURE_SHA1_WITH_DSA("http://www.w3.org/2000/09/xmldsig#dsa-sha1"),
5. saml-core-api/src/main/java/org/keycloak/saml/common/constants/JBossSAMLConstants.java:232 SIGNATURE_SHA1_WITH_RSA("http://www.w3.org/2000/09/xmldsig#rsa-sha1"),
6. saml-core-api/src/main/java/org/keycloak/saml/common/constants/JBossSAMLURIConstants.java:86 SIGNATURE_DSA_SHA1("http://www.w3.org/2000/09/xmldsig#dsa-sha1"),
7. saml-core-api/src/main/java/org/keycloak/saml/common/constants/JBossSAMLURIConstants.java:87 SIGNATURE_RSA_SHA1("http://www.w3.org/2000/09/xmldsig#rsa-sha1"),
8. saml-core/src/main/java/org/keycloak/saml/SignatureAlgorithm.java:29 RSA_SHA1("http://www.w3.org/2000/09/xmldsig#rsa-sha1", "http://www.w3.org/2000/09/xmldsig#sha1", "SHA1withRSA"),
9. saml-core/src/main/java/org/keycloak/saml/SignatureAlgorithm.java:34 DSA_SHA1("http://www.w3.org/2000/09/xmldsig#dsa-sha1", "http://www.w3.org/2000/09/xmldsig#sha1", "SHA1withDSA")
10. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4040-sharefile-metadata.xml:11 test path <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
11. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4040-sharefile-metadata.xml:17 test path <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
12. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:5 test path <dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
13. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:11 test path <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
14. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/saml20-assertion-advice.xml:11 test path <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
15. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/saml20-assertion-advice.xml:19 test path <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
16. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/saml20-assertion-example.xml:11 test path <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
17. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/saml20-assertion-example.xml:19 test path <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
18. services/src/test/resources/org/keycloak/test/broker/saml/saml-response-ds-ns-above-signature.xml:23 test path <dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
19. services/src/test/resources/org/keycloak/test/broker/saml/saml-response-ds-ns-above-signature.xml:29 test path <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
20. services/src/test/resources/org/keycloak/test/broker/saml/saml-response-ds-ns-in-signature.xml:22 test path <dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
21. services/src/test/resources/org/keycloak/test/broker/saml/saml-response-ds-ns-in-signature.xml:28 test path <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
22. tests/base/src/test/resources/org/keycloak/tests/admin/client/KEYCLOAK-4040-sharefile-metadata.xml:11 test path <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
23. tests/base/src/test/resources/org/keycloak/tests/admin/client/KEYCLOAK-4040-sharefile-metadata.xml:17 test path <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />

xmldsig.algorithm · CWE-327

RSAES-PKCS1v15 Already broken Renamed import 10 places See details

XML signature or encryption algorithm

An XML Signature or XML Encryption algorithm URI - SAML, XAdES or WS-Security. The URI names the algorithm exactly, and a signature URI names its digest as well, so `#rsa-sha1` reports both the key and the broken digest.

Federated login and signed XML documents name their cryptography in a web address. Some of those addresses name algorithms that are already broken.

What to do. Move off `#rsa-sha1` first: that signature is forgeable today, with no quantum computer involved. The key algorithm changes with the wider migration.

1. js/apps/admin-ui/src/clients/add/SamlEncryption.tsx:100 { key: "http://www.w3.org/2001/04/xmlenc#rsa-1_5", value: "RSA1_5" },
2. saml-core/src/test/java/org/keycloak/saml/processing/core/parsers/saml/SAMLParserTest.java:509 test path assertThat(encryptionMethods.get(0).getAlgorithm(), is("http://www.w3.org/2001/04/xmlenc#rsa-1_5"));
3. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:54 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
4. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:95 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
5. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:134 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
6. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:173 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
7. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4489-encrypted-assertion-with-newlines.xml:17 test path <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
8. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/saml20-encrypted-signed-redirect-response-two-extensions.xml:17 test path <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
9. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/saml20-encrypted-signed-redirect-response.xml:14 test path <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
10. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/saml20-entity-descriptor-sp.xml:17 test path <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>

xmldsig.algorithm · CWE-327

RSAES-PKCS1v15 Already broken Recorded traffic 7 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

This is already unsafe today, with no quantum computer involved. PKCS#1 v1.5 encryption padding is vulnerable to Bleichenbacher oracles today, and the underlying RSA is broken by Shor.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. common/src/main/java/org/keycloak/common/crypto/CryptoConstants.java:10 public static final String RSA1_5 = "RSA1_5";
2. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:577 test path "RSA1_5":{
3. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:413 test path "RSA1_5": { "order": 0 }
4. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:4793 test path "options": ["RSA1_5", "RSA-OAEP", "RSA-OAEP-256"],
5. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:4842 test path "options": ["RSA1_5", "RSA-OAEP", "RSA-OAEP-256"],
6. js/apps/admin-ui/src/identity-providers/add/DescriptorSettings.tsx:265 options={["RSA-OAEP", "RSA1_5"]}
7. js/apps/admin-ui/test/clients/saml.spec.ts:171 test path await selectEncryptionKeyAlgorithmInput(page, "RSA1_5");

jose.algorithm · CWE-327

3DES Already broken 4 places See details

XML signature or encryption algorithm

An XML Signature or XML Encryption algorithm URI - SAML, XAdES or WS-Security. The URI names the algorithm exactly, and a signature URI names its digest as well, so `#rsa-sha1` reports both the key and the broken digest.

Federated login and signed XML documents name their cryptography in a web address. Some of those addresses name algorithms that are already broken.

What to do. Move off `#rsa-sha1` first: that signature is forgeable today, with no quantum computer involved. The key algorithm changes with the wider migration.

1. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:58 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
2. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:99 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
3. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:138 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
4. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:177 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>

xmldsig.algorithm · CWE-327

SHA-1 Already broken 4 places See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

This is already unsafe today, with no quantum computer involved. SHAttered and subsequent work produced practical collisions; NIST withdrew SHA-1 in 2030 guidance and it is already unacceptable for signatures.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. distribution/downloads/src/main/java/CopyDependencies.java:93 MessageDigest sha1 = MessageDigest.getInstance("SHA-1");
2. server-spi-private/src/main/java/org/keycloak/protocol/saml/util/ArtifactBindingUtils.java:48 MessageDigest sha1Digester = MessageDigest.getInstance("SHA-1");
3. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/saml/ArtifactBindingTest.java:195 test path MessageDigest sha1Digester = MessageDigest.getInstance("SHA-1");
4. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/saml/ArtifactBindingTest.java:455 test path MessageDigest sha1Digester = MessageDigest.getInstance("SHA-1");

java.messagedigest · CWE-328

MD5 Already broken 2 places See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

This is already unsafe today, with no quantum computer involved. Practical chosen-prefix collisions exist; MD5 has no remaining security as a digest.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. distribution/downloads/src/main/java/CopyDependencies.java:92 MessageDigest md5 = MessageDigest.getInstance("MD5");
2. services/src/main/java/org/keycloak/cache/ComputedKey.java:34 return MessageDigest.getInstance("MD5");

java.messagedigest · CWE-328

RSAES-PKCS1v15 Already broken Recorded traffic 2 places See details

Cipher transformation named away from the call

A JCA transformation string - `algorithm/mode/padding` - written somewhere other than a `getInstance()` argument, which is how a codebase that centralises its cryptography passes the choice to a helper. The string is unambiguous wherever it appears: nothing but a transformation is spelled that way.

This names an encryption method as text, and passes it to code elsewhere that does the work. It is the same choice, made in a different place.

What to do. The same migration applies as to the call that consumes it. Move the constant and the call together, so the inventory keeps naming the algorithm after the change.

1. crypto/default/src/main/java/org/keycloak/crypto/def/DefaultCryptoProvider.java:59 providers.put(CryptoConstants.RSA1_5, new DefaultRsaKeyEncryptionJWEAlgorithmProvider("RSA/ECB/PKCS1Padding"));
2. crypto/elytron/src/main/java/org/keycloak/crypto/elytron/WildFlyElytronProvider.java:60 providers.put(CryptoConstants.RSA1_5, new ElytronRsaKeyEncryptionJWEAlgorithmProvider("RSA/ECB/PKCS1Padding"));

java.transformation · CWE-327

ECDSA Quantum-vulnerable Renamed import 141 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. core/src/main/java/org/keycloak/crypto/Algorithm.java:35 String ES256 = "ES256";
2. core/src/main/java/org/keycloak/crypto/Algorithm.java:36 String ES384 = "ES384";
3. core/src/main/java/org/keycloak/crypto/Algorithm.java:37 String ES512 = "ES512";
4. core/src/test/java/org/keycloak/jose/jwk/JWKTest.java:153 test path JWK jwk = JWKBuilder.create().kid(KeyUtils.createKeyId(keyPair.getPublic())).algorithm("ES256").ec(publicKey);
5. core/src/test/java/org/keycloak/jose/jwk/JWKTest.java:156 test path assertEquals("ES256", jwk.getAlgorithm());
6. core/src/test/java/org/keycloak/sdjwt/TestSettings.java:113 test path holderSigContext = initSigContext(keySettings, "holder_key", "ES256", "holder");
7. core/src/test/java/org/keycloak/sdjwt/TestSettings.java:114 test path issuerSigContext = initSigContext(keySettings, "issuer_key", "ES256", "doc-signer-05-25-2022");
8. core/src/test/java/org/keycloak/sdjwt/TestSettings.java:116 test path holderVerifierContext = initVerifierContext(keySettings, "holder_key", "ES256", "holder");
9. core/src/test/java/org/keycloak/sdjwt/TestSettings.java:117 test path issuerVerifierContext = initVerifierContext(keySettings, "issuer_key", "ES256", "doc-signer-05-25-2022");
10. core/src/test/java/org/keycloak/sdjwt/sdjwtvp/SdJwtVPVerificationTest.java:210 test path assertEquals("JWS header algorithm 'ES384' does not match verifier algorithm 'ES256'",
11. core/src/test/java/org/keycloak/sdjwt/sdjwtvp/SdJwtVPVerificationTest.java:235 test path assertEquals("JWS header algorithm 'null' does not match verifier algorithm 'ES256'",
12. core/src/test/java/org/keycloak/util/JWKSUtilsTest.java:164 test path assertEquals("ES384", key.getAlgorithmOrDefault());
13. core/src/test/java/org/keycloak/util/JWKSUtilsTest.java:171 test path assertEquals("ES384", key.getAlgorithmOrDefault());
14. core/src/test/java/org/keycloak/util/JWKSUtilsTest.java:177 test path key = keyWrappersForUse.getKeyByKidAndAlg(null, "ES384");
15. core/src/test/java/org/keycloak/util/JWKSUtilsTest.java:179 test path assertEquals("ES384", key.getAlgorithmOrDefault());
16. core/src/test/resources/sdjwt/s30.1-jwt-vc-metadata-jwks.json:20 test path "alg": "ES256"
17. core/src/test/resources/sdjwt/s30.1-jwt-vc-metadata-jwks.json:28 test path "alg": "ES256"
18. js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_cs.properties:3678 credentialSigningAlgorithmHelp=Podepisovací algoritmus používaný k výběru aktivního klíče realmu propodepisování pověření (např. "ES256"). Pokud není zadáno, aktivní klíč budevybrán pomocí výchozího algoritmu realmu. Tato možnost je zakázán
19. js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_es.properties:3727 credentialSigningAlgorithmHelp=Algoritmo de firma utilizado para seleccionar la clave de realm activa para firmar credenciales (p. ej., "ES256"). Si no se especifica, la clave activa se seleccionará mediante el algoritmo predeterminado del
20. js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_fr.properties:3669 credentialSigningAlgorithmHelp=L'algorithme de signature utilisé pour sélectionner la clé active du domaine pour la signature des identifiants (par exemple "ES256"). Si non spécifié, la clé active sera sélectionnée à l'aide de l'algorithme
21. js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_id.properties:3993 credentialSigningAlgorithmHelp=Algoritme penandatanganan yang digunakan untuk memilih kunci realm aktif untuk menandatangani kredensial (misalnya, "ES256"). Jika tidak ditentukan, kunci aktif akan dipilih menggunakan algoritme default realm
22. js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_pt_BR.properties:4008 credentialSigningAlgorithmHelp=Algoritmo de assinatura usado para selecionar a chave de realm ativo para assinatura de credenciais (por exemplo, "ES256"). Se não for especificado, a chave ativa será selecionada usando o algoritmo padrão da
23. js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_sv.properties:3661 credentialSigningAlgorithmHelp=Signeringsalgoritm som används för att välja aktiv realm-nyckel för signering av autentiseringsuppgifter (t.ex. "ES256"). Om inget anges väljs den aktiva nyckeln med hjälp av domänens standardalgoritm. Detta a
24. js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_tr.properties:3669 credentialSigningAlgorithmHelp=Kimlik bilgilerini imzalamak için aktif realm anahtarını seçmek üzere kullanılan imzalama algoritmasıdır (örneğin, "ES256"). Belirtilmezse, realm'in varsayılan algoritması kullanılarak aktif anahtar seçilir. B
25. js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_uk.properties:3711 credentialSigningAlgorithmHelp=Алгоритм підпису, що використовується для вибору активного ключа області для підпису облікових даних (наприклад, "ES256"). Якщо не указано, активний ключ буде вибрано за допомогою алгоритму області за замовчув
26. js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_vi.properties:3689 credentialSigningAlgorithmHelp=Thuật toán ký dùng để chọn khóa realm hoạt động để ký credential (ví dụ "ES256"). Nếu không chỉ định, khóa hoạt động sẽ được chọn bằng thuật toán mặc định của realm. Tùy chọn này bị tắt nếu chọn 'Signing Key I
27. js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties:4087 credentialSigningAlgorithmHelp=Signing algorithm used to select the active realm key for signing credentials (e.g., "ES256"). If not specified, the active key will be selected using the realm's default algorithm. This option is disabled if
28. js/apps/admin-ui/src/authentication/policies/WebauthnPolicy.tsx:39 "ES256",
29. js/apps/admin-ui/src/authentication/policies/WebauthnPolicy.tsx:40 "ES384",
30. js/apps/admin-ui/src/authentication/policies/WebauthnPolicy.tsx:41 "ES512",
31. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:734 test path "ES384":{
32. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:746 test path "ES256":{
33. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:761 test path "ES512":{
34. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:1501 test path "ES384":{
35. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:1513 test path "ES256":{
36. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:1528 test path "ES512":{
37. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:524 test path "ES384": { "order": 0 },
38. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:528 test path "ES256": { "order": 0 },
39. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:533 test path "ES512": { "order": 0 },
40. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:926 test path "ES384": { "order": 0 },
41. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:930 test path "ES256": { "order": 0 },
42. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:935 test path "ES512": { "order": 0 },
43. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:6218 test path "options": ["PS256", "PS384", "PS512", "ES256", "ES384", "ES512"],
44. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:6370 test path "options": ["PS256", "PS384", "PS512", "ES256", "ES384", "ES512"],
45. js/apps/admin-ui/test/client-scope/oid4vci-client-scope.spec.ts:126 test path SIGNING_ALG: "ES256",
46. js/apps/admin-ui/test/client-scope/oid4vci-client-scope.spec.ts:758 test path await expect(page.getByRole("option", { name: "ES256" })).toBeVisible();
47. js/apps/admin-ui/test/clients/advanced.spec.ts:70 test path const algorithm = "ES384";
48. js/apps/admin-ui/test/realm-settings/oid4vci-attributes.spec.ts:273 test path await selectItem(page, signedMetadataAlgField, "ES256");
49. js/apps/admin-ui/test/realm-settings/oid4vci-attributes.spec.ts:303 test path expect(realmData?.attributes?.["oid4vci.signed_metadata.alg"]).toBe("ES256");
50. quarkus/tests/integration/src/test/resources/fgap-realm.json:441 test path "webAuthnPolicySignatureAlgorithms" : [ "ES256", "RS256" ],
51. quarkus/tests/integration/src/test/resources/fgap-realm.json:452 test path "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256", "RS256" ],
52. services/src/test/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AttestationValidatorUtilTest.java:150 test path new SupportedProofTypeData(List.of("ES256"), null));
53. services/src/test/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AttestationValidatorUtilTest.java:169 test path new SupportedProofTypeData(List.of("ES256"), jwtAttestation));
54. services/src/test/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AttestationValidatorUtilTest.java:173 test path new SupportedProofTypeData(List.of("ES256"), attestationAttestation));
55. services/src/test/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtProofValidatorTest.java:43 test path assertBlocked("ES256", "EC", "d", "secret");
56. services/src/test/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtProofValidatorTest.java:52 test path assertAllowed("ES256", jwk);
57. test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/OAuthIdentityProvider.java:139 test path jwk.setAlgorithm("ES256");
58. tests/base/src/test/java/org/keycloak/tests/broker/oidc/KcOidcBrokerPrivateKeyJwtMissingUseTest.java:45 test path idp.getConfig().put("clientAssertionSigningAlg", "ES384");
59. tests/base/src/test/java/org/keycloak/tests/broker/oidc/KcOidcBrokerPrivateKeyJwtUnsupportedKeyTest.java:45 test path idp.getConfig().put("clientAssertionSigningAlg", "ES384");
60. tests/base/src/test/java/org/keycloak/tests/oid4vc/CredentialSigningAlgorithmResolverTest.java:54 test path List<String> globalSupportedSigningAlgorithms = List.of("PS256", "ES256", key.getAlgorithm());
61. tests/base/src/test/java/org/keycloak/tests/oid4vc/CredentialSigningAlgorithmResolverTest.java:71 test path List<String> globalSupportedSigningAlgorithms = List.of("PS256", "ES256", key.getAlgorithm());
62. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCINaturalPersonTest.java:131 test path ensureEcSigningKeyProvider("mdoc-natural-person-issuer-key", "P-256", "ES256", 200);
63. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCINaturalPersonTest.java:144 test path ensureEcSigningKeyProvider("mdoc-natural-person-issuer-key", "P-256", "ES256", 200);
64. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerTestBase.java:310 test path .setSigningAlg("ES256")
65. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCMdocIssuerEndpointTest.java:47 test path ensureEcSigningKeyProvider("mdoc-endpoint-issuer-key", "P-256", "ES256", 200);
66. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCMdocIssuerWellKnownProviderTest.java:58 test path ensureEcSigningKeyProvider("mdoc-issuer-key", "P-256", "ES256", 200);
67. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCMdocIssuerWellKnownProviderTest.java:141 test path ensureEcSigningKeyProvider("mdoc-issuer-key-es384", "P-384", "ES384", 210);
68. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCMdocIssuerWellKnownProviderTest.java:143 test path scope.setSigningAlg("ES384");
69. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCMdocIssuerWellKnownProviderTest.java:156 test path ensureEcSigningKeyProvider("mdoc-default-signing-key-es384", "P-384", "ES384", 210);
70. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCMdocIssuerWellKnownProviderTest.java:185 test path "ES256",
71. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCMdocMapperTest.java:53 test path ensureEcSigningKeyProvider("mdoc-mapper-issuer-key", "P-256", "ES256", 200);
72. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCMdocMapperTest.java:106 test path ensureEcSigningKeyProvider("mdoc-vc-level-mapper-issuer-key", "P-256", "ES256", 200);
73. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCMdocMapperTest.java:188 test path ensureEcSigningKeyProvider("mdoc-namespace-collision-issuer-key", "P-256", "ES256", 200);
74. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCMdocTestBase.java:89 test path "ES256",
75. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCMdocTestBase.java:97 test path return createCustomMdocCredentialScope(this, scopeName, credentialConfigurationId, protocolMappers, "ES256", true);
76. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCProofTestUtils.java:140 test path kw.setAlgorithm("ES256");
77. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/OID4VCMdocAuthorizationCodeFlowTest.java:38 test path ensureEcSigningKeyProvider("mdoc-issuer-key", "P-256", "ES256", 200);
78. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCKeyAttestationTest.java:551 test path () -> keyResolver.resolveX5c(x5c, Map.of(JWK.ALGORITHM, "ES256"), Map.of()));
79. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCKeyAttestationTest.java:630 test path attestationKey.setAlgorithm("ES256");
80. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCKeyAttestationTest.java:919 test path ProofTypesSupported proofTypesSupported = ProofTypesSupported.parse(session, keyAttestationsRequired, List.of("ES256"));
81. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCKeyAttestationTest.java:920 test path SupportedProofTypeData defaultJwtData = new SupportedProofTypeData(List.of("ES256"), keyAttestationsRequired);
82. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCKeyAttestationTest.java:1201 test path attestationKey.setAlgorithm("ES256");
83. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCKeyAttestationTest.java:1203 test path proofKey.setAlgorithm("ES256");
84. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCKeyAttestationTest.java:1363 test path proofKey.setAlgorithm("ES256");
85. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCKeyAttestationTest.java:1614 test path signerKey.setAlgorithm("ES256");
86. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCKeyAttestationTest.java:1684 test path signerKey.setAlgorithm("ES256");
87. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCMdocAuthorizationDetailsFlowTest.java:30 test path ensureEcSigningKeyProvider("mdoc-auth-details-issuer-key", "P-256", "ES256", 200);
88. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCSdJwtIssuingEndpointTest.java:522 test path .getCredentialSigningAlgValuesSupported().contains("ES256"),
89. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCSdJwtIssuingEndpointTest.java:537 test path .contains("ES256"),
90. tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCMdocAuthorizationDetailsFlowPreAuthTest.java:38 test path ensureEcSigningKeyProvider("mdoc-preauth-auth-details-issuer-key", "P-256", "ES256", 200);
91. tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCMdocIssuerEndpointPreAuthTest.java:50 test path ensureEcSigningKeyProvider("mdoc-preauth-endpoint-issuer-key", "P-256", "ES256", 200);
92. tests/base/src/test/resources/org/keycloak/tests/admin/user/testrealm-user-null-attr.json:281 test path "webAuthnPolicySignatureAlgorithms" : [ "ES256" ],
93. tests/base/src/test/resources/org/keycloak/tests/admin/user/testrealm-user-null-attr.json:1591 test path "webAuthnPolicySignatureAlgorithms" : "ES256",
94. tests/base/src/test/resources/org/keycloak/tests/model/acr-values-import-bug.json:436 test path "ES256",
95. tests/base/src/test/resources/org/keycloak/tests/model/acr-values-import-bug.json:450 test path "ES256",
96. tests/webauthn/src/test/java/org/keycloak/tests/webauthn/AbstractWebAuthnVirtualTest.java:506 test path builder.webAuthnPolicySignatureAlgorithms(List.of("ES256", "RS256", "RS1"))
97. tests/webauthn/src/test/java/org/keycloak/tests/webauthn/AbstractWebAuthnVirtualTest.java:515 test path builder.webAuthnPolicyPasswordlessSignatureAlgorithms(List.of("ES256", "RS256", "RS1"))
98. tests/webauthn/src/test/java/org/keycloak/tests/webauthn/WebAuthnPolicyComplianceTest.java:63 test path .webAuthnPolicySignatureAlgorithms(List.of("ES512")));
99. tests/webauthn/src/test/java/org/keycloak/tests/webauthn/WebAuthnRegisterAndLoginTest.java:476 test path managedRealm.updateWithCleanup(r -> r.webAuthnPolicySignatureAlgorithms(List.of("ES256"))
100. testsuite/integration-arquillian/tests/base/src/test/resources/authorization-test/keycloak-with-jwt-es512-authentication.json:12 test path "algorithm": "ES512",
101. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:468 test path "webAuthnPolicySignatureAlgorithms" : [ "ES256" ],
102. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:478 test path "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256" ],
103. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:701 test path "id.token.signed.response.alg" : "ES256",
104. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:702 test path "request.object.signature.alg" : "ES256",
105. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:890 test path "id.token.signed.response.alg" : "ES256",
106. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:891 test path "request.object.signature.alg" : "ES256",
107. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1076 test path "id.token.signed.response.alg" : "ES256",
108. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1077 test path "request.object.signature.alg" : "ES256",
109. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1265 test path "id.token.signed.response.alg" : "ES256",
110. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1266 test path "request.object.signature.alg" : "ES256",
111. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:2086 test path "name" : "ES256",
112. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-17.0.0.json:370 test path "webAuthnPolicySignatureAlgorithms" : [ "ES256" ],
113. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-17.0.0.json:380 test path "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256" ],
114. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-17.0.0.json:2230 test path "webAuthnPolicySignatureAlgorithms" : [ "ES256" ],
115. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-17.0.0.json:2240 test path "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256" ],
116. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-17.0.0.json:4309 test path "webAuthnPolicySignatureAlgorithms" : [ "ES256" ],
117. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-17.0.0.json:4319 test path "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256" ],
118. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-19.0.3.json:373 test path "webAuthnPolicySignatureAlgorithms" : [ "ES256" ],
119. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-19.0.3.json:383 test path "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256" ],
120. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-19.0.3.json:2277 test path "webAuthnPolicySignatureAlgorithms" : [ "ES256" ],
121. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-19.0.3.json:2287 test path "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256" ],
122. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-19.0.3.json:4425 test path "webAuthnPolicySignatureAlgorithms" : [ "ES256" ],
123. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-19.0.3.json:4435 test path "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256" ],
124. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-24.0.4.json:703 test path "webAuthnPolicySignatureAlgorithms" : [ "ES256" ],
125. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-24.0.4.json:714 test path "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256" ],
126. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-24.0.4.json:2595 test path "webAuthnPolicySignatureAlgorithms" : [ "ES256" ],
127. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-24.0.4.json:2606 test path "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256" ],
128. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-24.0.4.json:4570 test path "webAuthnPolicySignatureAlgorithms" : [ "ES256" ],
129. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-24.0.4.json:4581 test path "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256" ],
130. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-9.0.3.json:333 test path "webAuthnPolicySignatureAlgorithms" : [ "ES256" ],
131. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-9.0.3.json:343 test path "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256" ],
132. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-9.0.3.json:2044 test path "webAuthnPolicySignatureAlgorithms" : [ "ES256" ],
133. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-9.0.3.json:2054 test path "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256" ],
134. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-9.0.3.json:4006 test path "webAuthnPolicySignatureAlgorithms" : [ "ES256" ],
135. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-9.0.3.json:4016 test path "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256" ],
136. testsuite/integration-arquillian/tests/base/src/test/resources/model/acr-values-import-bug.json:436 test path "ES256",
137. testsuite/integration-arquillian/tests/base/src/test/resources/model/acr-values-import-bug.json:450 test path "ES256",
138. testsuite/integration-arquillian/tests/base/src/test/resources/token-exchange/testrealm-token-exchange-v2.json:413 test path "webAuthnPolicySignatureAlgorithms" : [ "ES256", "RS256" ],
139. testsuite/integration-arquillian/tests/base/src/test/resources/token-exchange/testrealm-token-exchange-v2.json:424 test path "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256", "RS256" ],
140. testsuite/integration-arquillian/tests/base/src/test/resources/webauthn/testrealm-webauthn.json:14 test path "ES256",
141. testsuite/integration-arquillian/tests/base/src/test/resources/webauthn/testrealm-webauthn.json:26 test path "ES256",

jose.algorithm · CWE-327

RSASSA-PKCS1v15 Quantum-vulnerable Renamed import 133 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. core/src/main/java/org/keycloak/crypto/Algorithm.java:27 String RS256 = "RS256";
2. core/src/main/java/org/keycloak/crypto/Algorithm.java:28 String RS384 = "RS384";
3. core/src/main/java/org/keycloak/crypto/Algorithm.java:29 String RS512 = "RS512";
4. core/src/main/java/org/keycloak/jose/jwk/RSAPublicJWK.java:33 public static final String RS256 = "RS256";
5. core/src/test/java/org/keycloak/jose/jwk/JWKTest.java:69 test path JWK jwk = JWKBuilder.create().kid(KeyUtils.createKeyId(publicKey)).algorithm("RS256").rsa(publicKey, certificate);
6. core/src/test/java/org/keycloak/jose/jwk/JWKTest.java:73 test path assertEquals("RS256", jwk.getAlgorithm());
7. core/src/test/java/org/keycloak/jose/jwk/JWKTest.java:104 test path JWK jwk = JWKBuilder.create().kid(KeyUtils.createKeyId(publicKey)).algorithm("RS256").rsa(publicKey, certificates);
8. core/src/test/java/org/keycloak/jose/jwk/JWKTest.java:108 test path assertEquals("RS256", jwk.getAlgorithm());
9. core/src/test/java/org/keycloak/util/JWKSUtilsTest.java:132 test path KeyWrapper key = keyWrappersForUse.getKeyByKidAndAlg(kidRsa1, "RS256");
10. core/src/test/java/org/keycloak/util/JWKSUtilsTest.java:134 test path assertEquals("RS256", key.getAlgorithmOrDefault());
11. core/src/test/java/org/keycloak/util/JWKSUtilsTest.java:140 test path key = keyWrappersForUse.getKeyByKidAndAlg(kidRsa1, "RS512");
12. core/src/test/java/org/keycloak/util/JWKSUtilsTest.java:142 test path assertEquals("RS512", key.getAlgorithmOrDefault());
13. core/src/test/java/org/keycloak/util/JWKSUtilsTest.java:150 test path assertEquals("RS256", key.getAlgorithmOrDefault());
14. core/src/test/java/org/keycloak/util/JWKSUtilsTest.java:157 test path assertEquals("RS256", key.getAlgorithmOrDefault());
15. js/apps/admin-ui/src/authentication/policies/WebauthnPolicy.tsx:42 "RS256",
16. js/apps/admin-ui/src/authentication/policies/WebauthnPolicy.tsx:43 "RS384",
17. js/apps/admin-ui/src/authentication/policies/WebauthnPolicy.tsx:44 "RS512",
18. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:737 test path "RS384":{
19. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:755 test path "RS256":{
20. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:770 test path "RS512":{
21. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:1504 test path "RS384":{
22. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:1522 test path "RS256":{
23. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:1537 test path "RS512":{
24. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4754 test path "defaultValue":"RS256",
25. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4756 test path "RS256",
26. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4757 test path "RS384",
27. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4758 test path "RS512",
28. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4831 test path "defaultValue":"RS256",
29. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4833 test path "RS256",
30. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4834 test path "RS384",
31. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4835 test path "RS512",
32. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4894 test path "defaultValue":"RS256",
33. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4896 test path "RS256",
34. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4897 test path "RS384",
35. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4898 test path "RS512",
36. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:525 test path "RS384": { "order": 0 },
37. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:531 test path "RS256": { "order": 0 },
38. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:536 test path "RS512": { "order": 0 }
39. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:927 test path "RS384": { "order": 0 },
40. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:933 test path "RS256": { "order": 0 },
41. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:938 test path "RS512": { "order": 0 }
42. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:4647 test path "defaultValue": "RS256",
43. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:4648 test path "options": ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512"],
44. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:4738 test path "defaultValue": "RS256",
45. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:4739 test path "options": ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512"],
46. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:4890 test path "defaultValue": "RS256",
47. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:4891 test path "options": ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512"],
48. js/apps/admin-ui/src/realm-settings/TokensTab.tsx:133 defaultValue={"RS256"}
49. js/apps/admin-ui/src/realm-settings/TokensTab.tsx:721 defaultValue: "RS256",
50. js/apps/admin-ui/test/client-scope/oid4vci-client-scope.spec.ts:757 test path await expect(page.getByRole("option", { name: "RS256" })).toBeVisible();
51. quarkus/tests/integration/src/test/resources/fgap-realm.json:7 test path "defaultSignatureAlgorithm" : "RS256",
52. quarkus/tests/integration/src/test/resources/fgap-realm.json:441 test path "webAuthnPolicySignatureAlgorithms" : [ "ES256", "RS256" ],
53. quarkus/tests/integration/src/test/resources/fgap-realm.json:452 test path "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256", "RS256" ],
54. services/src/test/java/org/keycloak/crypto/CryptoUtilsTest.java:17 test path assertNotNull(CryptoUtils.getSignatureProvider(session, "RS256"));
55. services/src/test/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtProofValidatorTest.java:18 test path assertBlocked("RS256", "RSA", "d", "secret");
56. services/src/test/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtProofValidatorTest.java:24 test path assertBlocked("RS256", "RSA", "p", "secret-p");
57. services/src/test/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtProofValidatorTest.java:33 test path assertAllowed("RS256", jwk);
58. tests/base/src/test/java/org/keycloak/tests/admin/realm/RealmAttributesTest.java:99 test path rep.setDefaultSignatureAlgorithm("RS256");
59. tests/base/src/test/java/org/keycloak/tests/admin/realm/RealmAttributesTest.java:115 test path rep.setWebAuthnPolicySignatureAlgorithms(Collections.singletonList("RS256"));
60. tests/base/src/test/java/org/keycloak/tests/admin/realm/RealmAttributesTest.java:127 test path rep.setWebAuthnPolicyPasswordlessSignatureAlgorithms(Collections.singletonList("RS256"));
61. tests/base/src/test/java/org/keycloak/tests/admin/realm/RealmAttributesTest.java:147 test path assertEquals("RS256", rep.getDefaultSignatureAlgorithm());
62. tests/base/src/test/java/org/keycloak/tests/admin/realm/RealmAttributesTest.java:162 test path assertEquals(Collections.singletonList("RS256"), rep.getWebAuthnPolicySignatureAlgorithms());
63. tests/base/src/test/java/org/keycloak/tests/admin/realm/RealmAttributesTest.java:174 test path assertEquals(Collections.singletonList("RS256"), rep.getWebAuthnPolicyPasswordlessSignatureAlgorithms());
64. tests/base/src/test/java/org/keycloak/tests/broker/SamlIdentityProviderStoreTokenV1Test.java:102 test path String kid = keysMetadata.getActive().get("RS256");
65. tests/base/src/test/java/org/keycloak/tests/broker/SamlIdentityProviderStoreTokenV2Test.java:108 test path String kid = keysMetadata.getActive().get("RS256");
66. tests/base/src/test/java/org/keycloak/tests/client/OIDCJwksClientRegistrationTest.java:109 test path Map<String, String> generatedKeys = jwksProvider.generateKeys("RS256");
67. tests/base/src/test/java/org/keycloak/tests/client/OIDCJwksClientRegistrationTest.java:133 test path Map<String, String> generatedKeys = jwksProvider.generateKeys("RS256");
68. tests/base/src/test/java/org/keycloak/tests/client/OIDCJwksClientRegistrationTest.java:164 test path jwksProvider.generateKeys("RS256");
69. tests/base/src/test/java/org/keycloak/tests/client/OIDCJwksClientRegistrationTest.java:253 test path Map<String, String> generatedKeys = jwksProvider.generateKeys("RS256");
70. tests/base/src/test/java/org/keycloak/tests/client/OIDCJwksClientRegistrationTest.java:275 test path Map<String, String> generatedKeys = jwksProvider.generateKeys("RS256");
71. tests/base/src/test/java/org/keycloak/tests/client/OIDCJwksClientRegistrationTest.java:289 test path Map<String, String> generatedKeys2 = jwksProvider.generateKeys("RS256");
72. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerTestBase.java:462 test path return getRsaKey(KeyUse.SIG, "RS256", null);
73. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerWellKnownProviderTest.java:204 test path assertEquals("RS256", header.getAlgorithm().name());
74. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerWellKnownProviderTest.java:232 test path KeyWrapper keyWrapper = session.keys().getActiveKey(realm, KeyUse.SIG, "RS256");
75. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerWellKnownProviderTest.java:234 test path SignatureProvider signatureProvider = session.getProvider(SignatureProvider.class, "RS256");
76. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerWellKnownProviderTest.java:256 test path SIGNED_METADATA_ALG_ATTR, "RS256",
77. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerWellKnownProviderTest.java:301 test path setRealmAttributes(Map.of(SIGNED_METADATA_ALG_ATTR, "RS256"));
78. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerWellKnownProviderTest.java:311 test path SIGNED_METADATA_ALG_ATTR, "RS256",
79. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCJWTIssuerEndpointTest.java:1368 test path assertTrue(jwtVcConfig.getCredentialSigningAlgValuesSupported().contains("RS256"),
80. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCJWTIssuerEndpointTest.java:1377 test path .contains("RS256"),
81. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/credentialbuilder/CredentialBuilderTest.java:49 test path kw.setAlgorithm("RS256");
82. tests/base/src/test/resources/org/keycloak/tests/model/acr-values-import-bug.json:7 test path "defaultSignatureAlgorithm": "RS256",
83. tests/base/src/test/resources/org/keycloak/tests/model/acr-values-import-bug.json:437 test path "RS256"
84. tests/base/src/test/resources/org/keycloak/tests/model/acr-values-import-bug.json:451 test path "RS256"
85. tests/webauthn/src/test/java/org/keycloak/tests/webauthn/AbstractWebAuthnVirtualTest.java:506 test path builder.webAuthnPolicySignatureAlgorithms(List.of("ES256", "RS256", "RS1"))
86. tests/webauthn/src/test/java/org/keycloak/tests/webauthn/AbstractWebAuthnVirtualTest.java:515 test path builder.webAuthnPolicyPasswordlessSignatureAlgorithms(List.of("ES256", "RS256", "RS1"))
87. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/AuthzClientCredentialsTest.java:87 test path .attribute(OIDCConfigAttributes.TOKEN_ENDPOINT_AUTH_SIGNING_ALG, "RS512")
88. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenTest.java:267 test path assertEquals("RS256", header.getAlgorithm().name());
89. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenTest.java:273 test path assertEquals("RS256", header.getAlgorithm().name());
90. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LogoutTest.java:343 test path TokenSignatureUtil.changeRealmTokenSignatureProvider(adminClient, "RS384");
91. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LogoutTest.java:344 test path TokenSignatureUtil.changeClientAccessTokenSignatureProvider(AdminApiUtil.findClientByClientId(adminClient.realm("test"), "test-app"), "RS512");
92. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LogoutTest.java:345 test path backchannelLogoutRequest(Constants.INTERNAL_SIGNATURE_ALGORITHM, "RS512", "RS384");
93. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LogoutTest.java:347 test path TokenSignatureUtil.changeRealmTokenSignatureProvider(adminClient, "RS256");
94. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LogoutTest.java:348 test path TokenSignatureUtil.changeClientAccessTokenSignatureProvider(AdminApiUtil.findClientByClientId(adminClient.realm("test"), "test-app"), "RS256");
95. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthProofKeyForCodeExchangeTest.java:424 test path assertEquals("RS256", header.getAlgorithm().name());
96. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthProofKeyForCodeExchangeTest.java:430 test path assertEquals("RS256", header.getAlgorithm().name());
97. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/hok/HoKTest.java:250 test path assertEquals("RS256", header.getAlgorithm().name());
98. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/hok/HoKTest.java:256 test path assertEquals("RS256", header.getAlgorithm().name());
99. testsuite/integration-arquillian/tests/base/src/test/resources/authorization-test/keycloak-with-jwt-rs512-authentication.json:12 test path "algorithm": "RS512",
100. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:5 test path "defaultSignatureAlgorithm" : "RS256",
101. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:709 test path "access.token.signed.response.alg" : "RS256",
102. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:772 test path "access.token.signed.response.alg" : "RS256",
103. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:828 test path "request.object.signature.alg" : "RS256",
104. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:835 test path "access.token.signed.response.alg" : "RS256",
105. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:897 test path "access.token.signed.response.alg" : "RS256",
106. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:959 test path "access.token.signed.response.alg" : "RS256",
107. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1015 test path "request.object.signature.alg" : "RS256",
108. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1021 test path "access.token.signed.response.alg" : "RS256",
109. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1084 test path "access.token.signed.response.alg" : "RS256",
110. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1147 test path "access.token.signed.response.alg" : "RS256",
111. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1203 test path "request.object.signature.alg" : "RS256",
112. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1210 test path "access.token.signed.response.alg" : "RS256",
113. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1272 test path "access.token.signed.response.alg" : "RS256",
114. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1334 test path "access.token.signed.response.alg" : "RS256",
115. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1390 test path "request.object.signature.alg" : "RS256",
116. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1396 test path "access.token.signed.response.alg" : "RS256",
117. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-17.0.0.json:5 test path "defaultSignatureAlgorithm" : "RS256",
118. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-17.0.0.json:1889 test path "defaultSignatureAlgorithm" : "RS256",
119. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-17.0.0.json:3624 test path "defaultSignatureAlgorithm" : "RS256",
120. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-19.0.3.json:5 test path "defaultSignatureAlgorithm" : "RS256",
121. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-19.0.3.json:1936 test path "defaultSignatureAlgorithm" : "RS256",
122. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-19.0.3.json:3740 test path "defaultSignatureAlgorithm" : "RS256",
123. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-24.0.4.json:7 test path "defaultSignatureAlgorithm" : "RS256",
124. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-24.0.4.json:2219 test path "defaultSignatureAlgorithm" : "RS256",
125. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-24.0.4.json:4218 test path "defaultSignatureAlgorithm" : "RS256",
126. testsuite/integration-arquillian/tests/base/src/test/resources/model/acr-values-import-bug.json:7 test path "defaultSignatureAlgorithm": "RS256",
127. testsuite/integration-arquillian/tests/base/src/test/resources/model/acr-values-import-bug.json:437 test path "RS256"
128. testsuite/integration-arquillian/tests/base/src/test/resources/model/acr-values-import-bug.json:451 test path "RS256"
129. testsuite/integration-arquillian/tests/base/src/test/resources/token-exchange/testrealm-token-exchange-v2.json:5 test path "defaultSignatureAlgorithm" : "RS256",
130. testsuite/integration-arquillian/tests/base/src/test/resources/token-exchange/testrealm-token-exchange-v2.json:413 test path "webAuthnPolicySignatureAlgorithms" : [ "ES256", "RS256" ],
131. testsuite/integration-arquillian/tests/base/src/test/resources/token-exchange/testrealm-token-exchange-v2.json:424 test path "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256", "RS256" ],
132. testsuite/integration-arquillian/tests/base/src/test/resources/webauthn/testrealm-webauthn.json:15 test path "RS256",
133. testsuite/integration-arquillian/tests/base/src/test/resources/webauthn/testrealm-webauthn.json:27 test path "RS256",

jose.algorithm · CWE-327

RSA-PSS Quantum-vulnerable Renamed import 73 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. core/src/main/java/org/keycloak/crypto/Algorithm.java:30 String PS256 = "PS256";
2. core/src/main/java/org/keycloak/crypto/Algorithm.java:31 String PS384 = "PS384";
3. core/src/main/java/org/keycloak/crypto/Algorithm.java:32 String PS512 = "PS512";
4. crypto/elytron/src/test/java/org/keycloak/crypto/elytron/test/ElytronSignatureAlgTest.java:31 test path key.setAlgorithm("PS256");
5. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:731 test path "PS384":{
6. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:764 test path "PS256":{
7. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:767 test path "PS512":{
8. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:1498 test path "PS384":{
9. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:1531 test path "PS256":{
10. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:1534 test path "PS512":{
11. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4759 test path "PS256",
12. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4760 test path "PS384",
13. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4761 test path "PS512"
14. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4836 test path "PS256",
15. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4837 test path "PS384",
16. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4838 test path "PS512"
17. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4899 test path "PS256",
18. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4900 test path "PS384",
19. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4901 test path "PS512"
20. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:523 test path "PS384": { "order": 0 },
21. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:534 test path "PS256": { "order": 0 },
22. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:535 test path "PS512": { "order": 0 },
23. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:925 test path "PS384": { "order": 0 },
24. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:936 test path "PS256": { "order": 0 },
25. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:937 test path "PS512": { "order": 0 },
26. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:4648 test path "options": ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512"],
27. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:4739 test path "options": ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512"],
28. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:4891 test path "options": ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512"],
29. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:6217 test path "defaultValue": "PS256",
30. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:6218 test path "options": ["PS256", "PS384", "PS512", "ES256", "ES384", "ES512"],
31. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:6369 test path "defaultValue": "PS256",
32. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:6370 test path "options": ["PS256", "PS384", "PS512", "ES256", "ES384", "ES512"],
33. services/src/main/resources/keycloak-default-client-profiles.json:89 "default-algorithm": "PS256"
34. services/src/main/resources/keycloak-default-client-profiles.json:125 "default-algorithm": "PS256"
35. services/src/main/resources/keycloak-default-client-profiles.json:165 "default-algorithm": "PS256"
36. services/src/main/resources/keycloak-default-client-profiles.json:239 "default-algorithm": "PS256"
37. services/src/main/resources/keycloak-default-client-profiles.json:415 "default-algorithm": "PS256"
38. services/src/main/resources/keycloak-default-client-profiles.json:491 "default-algorithm": "PS256"
39. services/src/test/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtProofValidatorTest.java:38 test path assertBlocked("PS256", "RSA", "d", "secret");
40. tests/base/src/test/java/org/keycloak/tests/broker/trust/TrustMaterialIdentityProviderTest.java:75 test path private static final String ALGORITHM = "PS256";
41. tests/base/src/test/java/org/keycloak/tests/broker/trust/TrustMaterialIdentityProviderTest.java:92 test path .algorithm(ALGORITHM)
42. tests/base/src/test/java/org/keycloak/tests/broker/trust/TrustMaterialIdentityProviderTest.java:128 test path assertEquals(ALGORITHM, jwk.getAlgorithm());
43. tests/base/src/test/java/org/keycloak/tests/broker/trust/TrustMaterialIdentityProviderTest.java:151 test path assertEquals(ALGORITHM, jwk.getAlgorithm());
44. tests/base/src/test/java/org/keycloak/tests/broker/trust/TrustMaterialIdentityProviderTest.java:174 test path .algorithm(ALGORITHM)
45. tests/base/src/test/java/org/keycloak/tests/broker/trust/TrustMaterialIdentityProviderTest.java:178 test path assertEquals(ALGORITHM, jwk.getAlgorithm());
46. tests/base/src/test/java/org/keycloak/tests/broker/trust/TrustMaterialIdentityProviderTest.java:199 test path .algorithm(ALGORITHM)
47. tests/base/src/test/java/org/keycloak/tests/broker/trust/TrustMaterialIdentityProviderTest.java:203 test path assertEquals(ALGORITHM, jwk.getAlgorithm());
48. tests/base/src/test/java/org/keycloak/tests/broker/trust/TrustMaterialIdentityProviderTest.java:215 test path assertEquals(ALGORITHM, jwk.get().getAlgorithm());
49. tests/base/src/test/java/org/keycloak/tests/broker/trust/TrustMaterialIdentityProviderTest.java:233 test path .algorithm(ALGORITHM)
50. tests/base/src/test/java/org/keycloak/tests/broker/trust/TrustMaterialIdentityProviderTest.java:238 test path assertEquals(ALGORITHM, jwk.getAlgorithm());
51. tests/base/src/test/java/org/keycloak/tests/broker/trust/TrustMaterialIdentityProviderTest.java:248 test path .algorithm(ALGORITHM)
52. tests/base/src/test/java/org/keycloak/tests/broker/trust/TrustMaterialIdentityProviderTest.java:253 test path assertEquals(ALGORITHM, jwk.getAlgorithm());
53. tests/base/src/test/java/org/keycloak/tests/broker/trust/TrustMaterialIdentityProviderTest.java:264 test path .algorithm(ALGORITHM)
54. tests/base/src/test/java/org/keycloak/tests/broker/trust/TrustMaterialIdentityProviderTest.java:284 test path .algorithm(ALGORITHM)
55. tests/base/src/test/java/org/keycloak/tests/broker/trust/TrustMaterialIdentityProviderTest.java:316 test path .algorithm(ALGORITHM)
56. tests/base/src/test/java/org/keycloak/tests/oid4vc/CredentialSigningAlgorithmResolverTest.java:54 test path List<String> globalSupportedSigningAlgorithms = List.of("PS256", "ES256", key.getAlgorithm());
57. tests/base/src/test/java/org/keycloak/tests/oid4vc/CredentialSigningAlgorithmResolverTest.java:71 test path List<String> globalSupportedSigningAlgorithms = List.of("PS256", "ES256", key.getAlgorithm());
58. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerTestBase.java:896 test path .put("default-algorithm", "PS256")));
59. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCProofTestUtils.java:179 test path kw.setAlgorithm("PS256");
60. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:764 test path "id.token.signed.response.alg" : "PS256",
61. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:765 test path "request.object.signature.alg" : "PS256",
62. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:827 test path "id.token.signed.response.alg" : "PS256",
63. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:952 test path "id.token.signed.response.alg" : "PS256",
64. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:953 test path "request.object.signature.alg" : "PS256",
65. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1014 test path "id.token.signed.response.alg" : "PS256",
66. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1139 test path "id.token.signed.response.alg" : "PS256",
67. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1140 test path "request.object.signature.alg" : "PS256",
68. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1202 test path "id.token.signed.response.alg" : "PS256",
69. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1327 test path "id.token.signed.response.alg" : "PS256",
70. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1328 test path "request.object.signature.alg" : "PS256",
71. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:1389 test path "id.token.signed.response.alg" : "PS256",
72. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:2072 test path "name" : "PS256",
73. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:2082 test path "algorithm" : [ "PS256" ]

jose.algorithm · CWE-327

RSA4096-bit Quantum-vulnerable 23 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. operator/src/test/resources/example-mtls-secret.yaml:7 test path -----BEGIN CERTIFICATE-----
2. operator/src/test/resources/example-mtls-truststore-secret.yaml:7 test path -----BEGIN CERTIFICATE-----
3. services/src/test/resources/truststores/keycloak.pem:1 test path -----BEGIN CERTIFICATE-----
4. tests/base/src/test/resources/keycloak-truststore.pem:6 test path -----BEGIN CERTIFICATE-----
5. tests/base/src/test/resources/keycloak-truststore.pem:79 test path -----BEGIN CERTIFICATE-----
6. testsuite/integration-arquillian/servers/auth-server/common/keystore/ca.crt:1 test path -----BEGIN CERTIFICATE-----
7. testsuite/integration-arquillian/servers/auth-server/common/keystore/ca.crt:35 test path -----BEGIN CERTIFICATE-----
8. testsuite/integration-arquillian/servers/auth-server/common/keystore/client-ca.crt:1 test path -----BEGIN CERTIFICATE-----
9. testsuite/integration-arquillian/servers/auth-server/common/keystore/client.crt:1 test path -----BEGIN CERTIFICATE-----
10. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/certs/ca.cert.pem:1 test path -----BEGIN CERTIFICATE-----
11. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/certs/clients/test-user-ca@localhost.pem:94 test path -----BEGIN CERTIFICATE-----
12. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/certs/clients/test-user-obb@localhost.cert.pem:1 test path -----BEGIN CERTIFICATE-----
13. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/certs/clients/test-user-san@localhost.cert.pem:1 test path -----BEGIN CERTIFICATE-----
14. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/intermediate/certs/ca-chain.cert.pem:1 test path -----BEGIN CERTIFICATE-----
15. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/intermediate/certs/ca-chain.cert.pem:35 test path -----BEGIN CERTIFICATE-----
16. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/intermediate/certs/intermediate.cert.pem:1 test path -----BEGIN CERTIFICATE-----
17. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/intermediate/newcerts/1000.pem:1 test path -----BEGIN CERTIFICATE-----
18. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/intermediate/newcerts/2009.pem:1 test path -----BEGIN CERTIFICATE-----
19. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/intermediate/newcerts/200A.pem:1 test path -----BEGIN CERTIFICATE-----
20. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/intermediate/newcerts/200B.pem:1 test path -----BEGIN CERTIFICATE-----
21. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/newcerts/1000.pem:1 test path -----BEGIN CERTIFICATE-----
22. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/newcerts/1001.pem:94 test path -----BEGIN CERTIFICATE-----
23. testsuite/integration-arquillian/tests/base/src/test/resources/client-auth-test/intermediate-ca.crt:1 test path -----BEGIN CERTIFICATE-----

pem.certificate

Ed25519255-bitother/Ed25519 Quantum-vulnerable Renamed import 19 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. core/src/main/java/org/keycloak/crypto/Algorithm.java:40 String EdDSA = "EdDSA";
2. core/src/main/java/org/keycloak/crypto/Algorithm.java:42 String Ed25519 = "Ed25519";
3. core/src/main/java/org/keycloak/crypto/JavaAlgorithm.java:33 public static final String Ed25519 = "Ed25519";
4. core/src/main/java/org/keycloak/crypto/JavaAlgorithm.java:77 return Ed25519;
5. js/apps/admin-ui/src/authentication/policies/WebauthnPolicy.tsx:45 "Ed25519",
6. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:749 test path "Ed25519":{
7. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:1516 test path "Ed25519":{
8. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:529 test path "Ed25519": { "order": 0 },
9. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:931 test path "Ed25519": { "order": 0 },
10. services/src/main/java/org/keycloak/keys/GeneratedEddsaKeyProvider.java:51 KeyFactory kf = KeyFactory.getInstance("EdDSA");
11. services/src/main/java/org/keycloak/keys/GeneratedEddsaKeyProviderFactory.java:135 KeyFactory kf = KeyFactory.getInstance("EdDSA");
12. services/src/test/java/org/keycloak/jose/jwk/ServerJWKTest.java:59 test path assertEquals("EdDSA", jwk.getAlgorithm());
13. services/src/test/java/org/keycloak/jose/jwk/ServerJWKTest.java:66 test path assertEquals("Ed25519", okpJwk.getCrv());
14. services/src/test/java/org/keycloak/jose/jwk/ServerJWKTest.java:89 test path assertEquals("EdDSA", jwk.getAlgorithm());
15. services/src/test/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtProofValidatorTest.java:57 test path assertBlocked("EdDSA", "OKP", "d", "secret");
16. services/src/test/java/org/keycloak/protocol/oid4vc/issuance/signing/vcdm/Ed255192018SuiteTest.java:126 test path return "EdDSA";
17. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/LDCredentialSignerTest.java:172 test path .setSigningAlgorithm("EdDSA")
18. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/LDCredentialSignerTest.java:214 test path Map.of("eddsaEllipticCurveKey", List.of("Ed25519"))
19. testsuite/integration-arquillian/tests/base/src/test/resources/authorization-test/keycloak-with-jwt-Ed25519-authentication.json:12 test path "algorithm": "EdDSA",

jose.algorithm · CWE-327

RSA-OAEP Quantum-vulnerable Recorded traffic Renamed import 19 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. common/src/main/java/org/keycloak/common/crypto/CryptoConstants.java:11 public static final String RSA_OAEP = "RSA-OAEP";
2. common/src/main/java/org/keycloak/common/crypto/CryptoConstants.java:12 public static final String RSA_OAEP_256 = "RSA-OAEP-256";
3. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:574 test path "RSA-OAEP":{
4. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:411 test path "RSA-OAEP": { "order": 0 },
5. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:412 test path "RSA-OAEP-256": { "order": 0 },
6. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:4792 test path "defaultValue": "RSA-OAEP",
7. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:4793 test path "options": ["RSA1_5", "RSA-OAEP", "RSA-OAEP-256"],
8. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:4841 test path "defaultValue": "RSA-OAEP",
9. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:4842 test path "options": ["RSA1_5", "RSA-OAEP", "RSA-OAEP-256"],
10. js/apps/admin-ui/src/identity-providers/add/DescriptorSettings.tsx:263 defaultValue: "RSA-OAEP",
11. js/apps/admin-ui/src/identity-providers/add/DescriptorSettings.tsx:265 options={["RSA-OAEP", "RSA1_5"]}
12. quarkus/tests/integration/src/test/resources/fgap-realm.json:2018 test path "algorithm" : [ "RSA-OAEP" ]
13. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerEndpointEncryptionTest.java:305 test path jwk.setAlgorithm("RSA-OAEP");
14. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerWellKnownProviderTest.java:511 test path assertTrue(credentialIssuer.getCredentialResponseEncryption().getAlgValuesSupported().contains("RSA-OAEP"),
15. tests/base/src/test/resources/org/keycloak/tests/model/acr-values-import-bug.json:1716 test path "RSA-OAEP"
16. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/servlet/SamlSignatureTest.java:466 test path String kid = keysMetadata.getActive().get("RSA-OAEP");
17. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-24.0.4.json:1615 test path "algorithm" : [ "RSA-OAEP" ]
18. testsuite/integration-arquillian/tests/base/src/test/resources/model/acr-values-import-bug.json:1716 test path "RSA-OAEP"
19. testsuite/integration-arquillian/tests/base/src/test/resources/token-exchange/testrealm-token-exchange-v2.json:2029 test path "algorithm" : [ "RSA-OAEP" ]

jose.algorithm · CWE-327

TLS Quantum-vulnerable Recorded traffic 19 places See details

TLS context created in code

`SSLContext.getInstance()`. The protocol version is reported; the key exchange it negotiates is classical in every TLS 1.2 and 1.3 cipher suite available today.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Every TLS cipher suite in general use negotiates a classical key exchange, so a recorded session is decryptable once that exchange falls.

What to do. Keep TLS 1.3, and track the hybrid key-exchange groups as they reach the JDK. TLS is where harvest-now-decrypt-later exposure is largest.

1. adapters/saml/core/src/main/java/org/keycloak/adapters/cloned/HttpClientBuilder.java:263 theContext = SSLContext.getInstance("SSL");
2. crypto/fips1402/src/test/java/org/keycloak/crypto/fips/test/FIPS1402SslTest.java:133 test path SSLContext context = SSLContext.getInstance("TLS");
3. model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/embedded/JGroupsConfigurator.java:226 var sslContext = SSLContext.getInstance(TLS_PROTOCOL);
4. model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/remote/DefaultCacheRemoteConfigProviderFactory.java:237 var sslContext = SSLContext.getInstance("TLS");
5. operator/src/main/java/org/keycloak/operator/controllers/KeycloakClientBaseController.java:368 SSLContext sslContext = SSLContext.getInstance("TLS");
6. operator/src/test/java/org/keycloak/operator/testsuite/utils/TrustAllSSLContext.java:48 test path sslContext = SSLContext.getInstance("TLS");
7. services/src/main/java/org/keycloak/connections/httpclient/HttpClientBuilder.java:271 theContext = SSLContext.getInstance("TLS");
8. services/src/main/java/org/keycloak/connections/httpclient/HttpClientBuilder.java:282 final SSLContext tlsContext = SSLContext.getInstance("TLS");
9. services/src/main/java/org/keycloak/truststore/JSSETruststoreConfigurator.java:59 SSLContext sslctx = SSLContext.getInstance("TLS");
10. test-framework/conformance-runner/src/main/java/org/keycloak/testframework/conformance/OpenIdConformanceServer.java:190 test path SSLContext context = SSLContext.getInstance("TLS");
11. test-framework/core/src/main/java/org/keycloak/testframework/server/DistributionKeycloakServer.java:296 test path SSLContext sslContext = SSLContext.getInstance("TLS");
12. test-framework/core/src/main/java/org/keycloak/testframework/server/ReadinessProbe.java:88 test path SSLContext ctx = SSLContext.getInstance("TLS");
13. tests/conformance/src/test/java/org/keycloak/tests/conformance/vp/AbstractVpConformanceTest.java:96 test path SSLContext sslContext = SSLContext.getInstance("TLS");
14. testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/containers/AbstractQuarkusDeployableContainer.java:415 test path sslContext = SSLContext.getInstance("TLS");
15. testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/containers/InfinispanServerDeployableContainer.java:175 test path SSLContext sc = SSLContext.getInstance("SSL");
16. testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/MutualTLSUtils.java:103 test path SSLContext sslContext = SSLContext.getInstance("TLS");
17. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/SslMailServer.java:119 test path final SSLContext sslContext = SSLContext.getInstance("TLS");
18. testsuite/integration-arquillian/util/src/main/java/org/keycloak/testsuite/utils/tls/TLSUtils.java:66 test path sslContext = SSLContext.getInstance("TLS");
19. util/embedded-ldap/src/main/java/org/keycloak/util/ldap/TLS13StartTlsHandler.java:68 sslCtx = SSLContext.getInstance("TLS");

java.sslcontext · CWE-757

RSA2048-bit Quantum-vulnerable 17 places See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. core/src/test/resources/certs/ANS-cert.pem:1 test path -----BEGIN CERTIFICATE-----
2. core/src/test/resources/certs/UPN-cert.pem:1 test path -----BEGIN CERTIFICATE-----
3. operator/src/test/resources/example-truststore-secret.yaml:7 test path -----BEGIN CERTIFICATE-----
4. quarkus/tests/integration/src/test/resources/encrypted-test.crt.pem:1 test path -----BEGIN CERTIFICATE-----
5. quarkus/tests/integration/src/test/resources/self-signed.pem:1 test path -----BEGIN CERTIFICATE-----
6. services/src/test/resources/truststores/keycloak.pem:30 test path -----BEGIN CERTIFICATE-----
7. tests/base/src/test/resources/keycloak-truststore.pem:46 test path -----BEGIN CERTIFICATE-----
8. tests/base/src/test/resources/org/keycloak/tests/ssl/smtp-server.pem:1 test path -----BEGIN CERTIFICATE-----
9. testsuite/integration-arquillian/servers/auth-server/common/keystore/ocsp/certs/ca-chain.crt:1 test path -----BEGIN CERTIFICATE-----
10. testsuite/integration-arquillian/servers/auth-server/common/keystore/ocsp/certs/ca-chain.crt:24 test path -----BEGIN CERTIFICATE-----
11. testsuite/integration-arquillian/servers/auth-server/common/keystore/ocsp/certs/intermediate-ca.crt:1 test path -----BEGIN CERTIFICATE-----
12. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/newcerts/intermediate-ca-3.crt:1 test path -----BEGIN CERTIFICATE-----
13. testsuite/integration-arquillian/servers/auth-server/quarkus/src/main/content/conf/ocsp/certs/ca-chain.crt:1 test path -----BEGIN CERTIFICATE-----
14. testsuite/integration-arquillian/servers/auth-server/quarkus/src/main/content/conf/ocsp/certs/ca-chain.crt:24 test path -----BEGIN CERTIFICATE-----
15. testsuite/integration-arquillian/servers/auth-server/quarkus/src/main/content/conf/ocsp/certs/intermediate-ca.crt:1 test path -----BEGIN CERTIFICATE-----
16. testsuite/integration-arquillian/tests/base/src/test/resources/client-auth-test/intermediate-ca-2.crt:1 test path -----BEGIN CERTIFICATE-----
17. testsuite/integration-arquillian/tests/base/src/test/resources/keys/certificate.pem:1 test path -----BEGIN CERTIFICATE-----

pem.certificate

ECDSA Quantum-vulnerable 16 places See details

COSE algorithm identifier

A COSE algorithm named as an identifier or as its IANA registry number - `COSEAlgorithmIdentifier.ES256`, or `alg: -7` in a WebAuthn `pubKeyCredParams`. The names match JOSE's; the numbers are the registry's.

This is the list of signature algorithms a security key or a passkey is allowed to use. Every one available today is broken by a quantum computer, so the value of writing it down now is knowing where to look later.

What to do. No post-quantum COSE algorithm is registered for WebAuthn yet. Record the exposure and keep the list short, so there is less to change when one is.

1. core/src/main/java/org/keycloak/mdoc/MdocAlgorithm.java:39 ES256(Algorithm.ES256, COSEAlgorithmIdentifier.ES256),
2. core/src/main/java/org/keycloak/mdoc/MdocAlgorithm.java:40 ES384(Algorithm.ES384, COSEAlgorithmIdentifier.ES384),
3. core/src/main/java/org/keycloak/mdoc/MdocAlgorithm.java:41 ES512(Algorithm.ES512, COSEAlgorithmIdentifier.ES512),
4. core/src/test/java/org/keycloak/mdoc/MdocKeyBindingTest.java:88 test path coseKey -> assertEcKey(coseKey, Curve.SECP256R1, COSEAlgorithmIdentifier.ES256));
5. core/src/test/java/org/keycloak/mdoc/MdocKeyBindingTest.java:96 test path coseKey -> assertEcKey(coseKey, Curve.SECP384R1, COSEAlgorithmIdentifier.ES384));
6. core/src/test/java/org/keycloak/mdoc/MdocKeyBindingTest.java:104 test path coseKey -> assertEcKey(coseKey, Curve.SECP521R1, COSEAlgorithmIdentifier.ES512));
7. services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegister.java:407 algs.add(COSEAlgorithmIdentifier.ES256.getValue());
8. services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegister.java:413 algs.add(COSEAlgorithmIdentifier.ES384.getValue());
9. services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegister.java:419 algs.add(COSEAlgorithmIdentifier.ES512.getValue());
10. tests/webauthn/src/test/java/org/keycloak/tests/webauthn/WebAuthnPolicyComplianceTest.java:66 test path tamperCreateOptions("opts.publicKey.pubKeyCredParams = [{type: 'public-key', alg: -7}];"),
11. tests/webauthn/src/test/java/org/keycloak/tests/webauthn/registration/WebAuthnOtherSettingsTest.java:116 test path Assertions.assertEquals((long) COSEAlgorithmIdentifier.ES256.getValue(), data.coseAlgorithm);
12. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/PubKeySignRegisterTest.java:59 test path assertPublicKeyAlgorithms(true, COSEAlgorithmIdentifier.ES256, List.of(ES256, ES512));
13. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/PubKeySignRegisterTest.java:64 test path assertPublicKeyAlgorithms(true, COSEAlgorithmIdentifier.ES256, Collections.singletonList(ES256));
14. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/PubKeySignRegisterTest.java:74 test path assertPublicKeyAlgorithms(true, COSEAlgorithmIdentifier.ES256, Collections.emptyList());
15. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/PubKeySignRegisterTest.java:79 test path assertPublicKeyAlgorithms(false, COSEAlgorithmIdentifier.ES256, Collections.singletonList("RSSSS2048"),
16. themes/src/main/resources/theme/base/login/resources/js/webauthnRegister.js:85 pubKeyCredParams.push({type: "public-key", alg: -7});

cose.algorithm

ECDSA Quantum-vulnerable 15 places See details

Elliptic-curve cryptography through BouncyCastle

A BouncyCastle elliptic-curve class. `ECDHBasicAgreement` in particular is key establishment and carries harvest-now-decrypt-later exposure.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 for signatures, ML-KEM-768 for key establishment.

1. crypto/default/src/main/java/org/keycloak/crypto/def/BCEcdhEsAlgorithmProvider.java:59 import org.bouncycastle.jce.ECNamedCurveTable;
2. crypto/default/src/main/java/org/keycloak/crypto/def/BCEcdhEsAlgorithmProvider.java:196 ECNamedCurveParameterSpec spec = ECNamedCurveTable.getParameterSpec(name);
3. crypto/default/src/main/java/org/keycloak/crypto/def/DefaultCryptoProvider.java:36 import org.bouncycastle.jce.ECNamedCurveTable;
4. crypto/default/src/main/java/org/keycloak/crypto/def/DefaultCryptoProvider.java:107 ECNamedCurveParameterSpec spec = ECNamedCurveTable.getParameterSpec(curveName);
5. crypto/default/src/test/java/org/keycloak/crypto/def/test/BCEcdhEsAlgorithmProviderTest.java:44 test path import org.bouncycastle.jce.ECNamedCurveTable;
6. crypto/default/src/test/java/org/keycloak/crypto/def/test/BCEcdhEsAlgorithmProviderTest.java:113 test path ECNamedCurveParameterSpec spec = ECNamedCurveTable.getParameterSpec(name);
7. crypto/default/src/test/java/org/keycloak/crypto/def/test/BCEcdhEsAlgorithmProviderTest.java:124 test path ECNamedCurveParameterSpec spec = ECNamedCurveTable.getParameterSpec(name);
8. crypto/fips1402/src/main/java/org/keycloak/crypto/fips/BCFIPSEcdhEsAlgorithmProvider.java:53 import org.bouncycastle.asn1.x9.X9ECParameters;
9. crypto/fips1402/src/main/java/org/keycloak/crypto/fips/BCFIPSEcdhEsAlgorithmProvider.java:201 X9ECParameters ecParams = NISTNamedCurves.getByName(crv);
10. crypto/fips1402/src/main/java/org/keycloak/crypto/fips/FIPS1402Provider.java:60 import org.bouncycastle.asn1.x9.ECNamedCurveTable;
11. crypto/fips1402/src/main/java/org/keycloak/crypto/fips/FIPS1402Provider.java:61 import org.bouncycastle.asn1.x9.X9ECParameters;
12. crypto/fips1402/src/main/java/org/keycloak/crypto/fips/FIPS1402Provider.java:154 X9ECParameters params = ECNamedCurveTable.getByName(curveName);
13. crypto/fips1402/src/test/java/org/keycloak/crypto/fips/test/BCFIPSEcdhEsAlgorithmProviderTest.java:43 test path import org.bouncycastle.asn1.x9.X9ECParameters;
14. crypto/fips1402/src/test/java/org/keycloak/crypto/fips/test/BCFIPSEcdhEsAlgorithmProviderTest.java:100 test path X9ECParameters ecParams = NISTNamedCurves.getByName(crv);
15. crypto/fips1402/src/test/java/org/keycloak/crypto/fips/test/BCFIPSEcdhEsAlgorithmProviderTest.java:111 test path X9ECParameters ecParams = NISTNamedCurves.getByName(crv);

java.bouncycastle.ec · CWE-327

EC Quantum-vulnerable 14 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. common/src/main/java/org/keycloak/common/util/KeyUtils.java:88 KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
2. crypto/default/src/main/java/org/keycloak/crypto/def/BCEcdhEsAlgorithmProvider.java:132 KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
3. crypto/elytron/src/main/java/org/keycloak/crypto/elytron/ElytronEcdhEsAlgorithmProvider.java:125 KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
4. crypto/fips1402/src/main/java/org/keycloak/crypto/fips/BCFIPSEcdhEsAlgorithmProvider.java:142 KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC", "BCFIPS");
5. services/src/test/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/MdocCredentialBuilderTest.java:99 test path KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");
6. services/src/test/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/MdocCredentialBuilderTest.java:123 test path KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");
7. services/src/test/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/MdocCredentialBuilderTest.java:149 test path KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");
8. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/credentialbuilder/SdJwtCredentialBuilderTest.java:128 test path var holderKeyPair = KeyPairGenerator.getInstance("EC").generateKeyPair();
9. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCKeyAttestationTest.java:159 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
10. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCKeyAttestationTest.java:1354 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
11. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCKeyAttestationTest.java:1605 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
12. tests/base/src/test/java/org/keycloak/tests/oid4vc/presentation/OID4VPTrustMaterialDelegationTest.java:334 test path KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
13. tests/conformance/src/test/java/org/keycloak/tests/conformance/ConformanceSigningKey.java:129 test path KeyPairGenerator keyGenerator = KeyPairGenerator.getInstance("EC");
14. tests/conformance/src/test/java/org/keycloak/tests/conformance/vci/VciTestSigningKey.java:70 test path KeyPairGenerator keyGenerator = KeyPairGenerator.getInstance("EC");

java.keypairgenerator · CWE-327

EC Quantum-vulnerable 14 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. core/src/test/java/org/keycloak/sdjwt/TestSettings.java:166 test path KeyFactory keyFactory = KeyFactory.getInstance("EC");
2. core/src/test/java/org/keycloak/sdjwt/TestSettings.java:192 test path KeyFactory keyFactory = KeyFactory.getInstance("EC");
3. crypto/default/src/main/java/org/keycloak/crypto/def/BCECDSACryptoProvider.java:81 KeyFactory keyFactory = KeyFactory.getInstance("EC");
4. crypto/default/src/test/java/org/keycloak/crypto/def/test/BCEcdhEsAlgorithmProviderTest.java:116 test path KeyFactory keyFactory = KeyFactory.getInstance("EC");
5. crypto/default/src/test/java/org/keycloak/crypto/def/test/BCEcdhEsAlgorithmProviderTest.java:127 test path KeyFactory keyFactory = KeyFactory.getInstance("EC");
6. crypto/fips1402/src/main/java/org/keycloak/crypto/fips/BCFIPSECDSACryptoProvider.java:86 KeyFactory keyFactory = KeyFactory.getInstance("EC");
7. crypto/fips1402/src/main/java/org/keycloak/crypto/fips/BCFIPSEcdhEsAlgorithmProvider.java:205 KeyFactory keyFactory = KeyFactory.getInstance("EC", "BCFIPS");
8. crypto/fips1402/src/test/java/org/keycloak/crypto/fips/test/BCFIPSEcdhEsAlgorithmProviderTest.java:104 test path KeyFactory keyFactory = KeyFactory.getInstance("EC", "BCFIPS");
9. crypto/fips1402/src/test/java/org/keycloak/crypto/fips/test/BCFIPSEcdhEsAlgorithmProviderTest.java:115 test path KeyFactory keyFactory = KeyFactory.getInstance("EC", "BCFIPS");
10. services/src/main/java/org/keycloak/keys/AbstractGeneratedEcKeyProviderFactory.java:117 KeyFactory kf = KeyFactory.getInstance("EC");
11. services/src/main/java/org/keycloak/keys/GeneratedEcdhKeyProvider.java:58 KeyFactory kf = KeyFactory.getInstance("EC");
12. services/src/main/java/org/keycloak/keys/GeneratedEcdsaKeyProvider.java:58 KeyFactory kf = KeyFactory.getInstance("EC");
13. tests/base/src/test/java/org/keycloak/tests/keys/GeneratedEcdhKeyProviderTest.java:311 test path KeyFactory kf = KeyFactory.getInstance("EC");
14. tests/base/src/test/java/org/keycloak/tests/keys/GeneratedEcdsaKeyProviderTest.java:239 test path KeyFactory kf = KeyFactory.getInstance("EC");

java.keyfactory · CWE-327

RSA2048-bit Quantum-vulnerable Recorded traffic 14 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. crypto/elytron/src/test/java/org/keycloak/crypto/elytron/test/ElytronCertificateUtilsProviderTest.java:75 test path KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
2. saml-core/src/test/java/org/keycloak/saml/processing/api/saml/v2/sig/SAML2SignatureTest.java:46 test path KeyPairGenerator gen = KeyPairGenerator.getInstance("RSA");
3. services/src/test/java/org/keycloak/procotol/docker/installation/DockerKeyIdentifierTest.java:27 test path final KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
4. services/src/test/java/org/keycloak/protocol/saml/SamlEncryptionTest.java:67 test path KeyPairGenerator rsa = KeyPairGenerator.getInstance("RSA");
5. services/src/test/java/org/keycloak/protocol/saml/SamlProtocolTest.java:76 test path KeyPairGenerator rsa = KeyPairGenerator.getInstance("RSA");
6. tests/base/src/test/java/org/keycloak/tests/broker/trust/TrustMaterialIdentityProviderTest.java:321 test path KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
7. tests/base/src/test/java/org/keycloak/tests/client/OIDCJwksClientRegistrationTest.java:189 test path KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
8. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerEndpointEncryptionTest.java:294 test path var keyGen = java.security.KeyPairGenerator.getInstance("RSA");
9. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerTestBase.java:434 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
10. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerTestBase.java:675 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
11. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCProofTestUtils.java:152 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA", BouncyIntegration.PROVIDER);
12. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/credentialbuilder/CredentialBuilderTest.java:41 test path var kpg = java.security.KeyPairGenerator.getInstance("RSA");
13. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/SdJwtCredentialSignerTest.java:460 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
14. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/RealmManager.java:82 test path KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");

java.keypairgenerator · CWE-327

RSASSA-PKCS1v15 Quantum-vulnerable 14 places See details

XML signature or encryption algorithm

An XML Signature or XML Encryption algorithm URI - SAML, XAdES or WS-Security. The URI names the algorithm exactly, and a signature URI names its digest as well, so `#rsa-sha1` reports both the key and the broken digest.

Federated login and signed XML documents name their cryptography in a web address. Some of those addresses name algorithms that are already broken.

What to do. Move off `#rsa-sha1` first: that signature is forgeable today, with no quantum computer involved. The key algorithm changes with the wider migration.

1. saml-core-api/src/main/java/org/keycloak/saml/common/constants/JBossSAMLConstants.java:232 SIGNATURE_SHA1_WITH_RSA("http://www.w3.org/2000/09/xmldsig#rsa-sha1"),
2. saml-core-api/src/main/java/org/keycloak/saml/common/constants/JBossSAMLURIConstants.java:87 SIGNATURE_RSA_SHA1("http://www.w3.org/2000/09/xmldsig#rsa-sha1"),
3. saml-core/src/main/java/org/keycloak/saml/SignatureAlgorithm.java:29 RSA_SHA1("http://www.w3.org/2000/09/xmldsig#rsa-sha1", "http://www.w3.org/2000/09/xmldsig#sha1", "SHA1withRSA"),
4. saml-core/src/main/java/org/keycloak/saml/SignatureAlgorithm.java:30 RSA_SHA256("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256", "http://www.w3.org/2001/04/xmlenc#sha256", "SHA256withRSA"),
5. saml-core/src/main/java/org/keycloak/saml/SignatureAlgorithm.java:32 RSA_SHA512("http://www.w3.org/2001/04/xmldsig-more#rsa-sha512", "http://www.w3.org/2001/04/xmlenc#sha512", "SHA512withRSA"),
6. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4040-sharefile-metadata.xml:11 test path <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
7. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:5 test path <dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
8. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-6412-response-with-proxy-restriction.xml:6 test path <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
9. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/saml20-assertion-advice.xml:11 test path <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
10. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/saml20-assertion-example.xml:11 test path <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
11. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/saml20-signed-logout-request.xml:6 test path <dsig:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
12. services/src/test/resources/org/keycloak/test/broker/saml/saml-response-ds-ns-above-signature.xml:23 test path <dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
13. services/src/test/resources/org/keycloak/test/broker/saml/saml-response-ds-ns-in-signature.xml:22 test path <dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
14. tests/base/src/test/resources/org/keycloak/tests/admin/client/KEYCLOAK-4040-sharefile-metadata.xml:11 test path <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />

xmldsig.algorithm · CWE-327

RSA Quantum-vulnerable Recorded traffic 13 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. testsuite/integration-arquillian/servers/auth-server/common/keystore/client.key:1 test path -----BEGIN RSA PRIVATE KEY-----
2. testsuite/integration-arquillian/servers/auth-server/common/keystore/ocsp/private/intermediate-ca.key:1 test path -----BEGIN RSA PRIVATE KEY-----
3. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/certs/clients/test-user-ca@localhost.key.pem:1 test path -----BEGIN RSA PRIVATE KEY-----
4. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/certs/clients/test-user-obb@localhost.key.pem:1 test path -----BEGIN RSA PRIVATE KEY-----
5. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/certs/clients/test-user@localhost.key.pem:1 test path -----BEGIN RSA PRIVATE KEY-----
6. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/intermediate/private/intermediate.key.pem:1 test path -----BEGIN RSA PRIVATE KEY-----
7. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/newcerts/intermediate-ca-3.key:1 test path -----BEGIN RSA PRIVATE KEY-----
8. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/private/ca.key.pem:1 test path -----BEGIN RSA PRIVATE KEY-----
9. testsuite/integration-arquillian/servers/auth-server/quarkus/src/main/content/conf/ocsp/private/intermediate-ca.key:1 test path -----BEGIN RSA PRIVATE KEY-----
10. testsuite/integration-arquillian/tests/base/src/test/resources/client-auth-test/intermediate-ca-2.key:1 test path -----BEGIN RSA PRIVATE KEY-----
11. testsuite/integration-arquillian/tests/base/src/test/resources/client-auth-test/intermediate-ca.key:1 test path -----BEGIN RSA PRIVATE KEY-----
12. testsuite/integration-arquillian/tests/base/src/test/resources/keys/private2048.pem:1 test path -----BEGIN RSA PRIVATE KEY-----
13. testsuite/integration-arquillian/tests/base/src/test/resources/keys/private4096.pem:1 test path -----BEGIN RSA PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

RSA-OAEP Quantum-vulnerable 12 places See details

XML signature or encryption algorithm

An XML Signature or XML Encryption algorithm URI - SAML, XAdES or WS-Security. The URI names the algorithm exactly, and a signature URI names its digest as well, so `#rsa-sha1` reports both the key and the broken digest.

Federated login and signed XML documents name their cryptography in a web address. Some of those addresses name algorithms that are already broken.

What to do. Move off `#rsa-sha1` first: that signature is forgeable today, with no quantum computer involved. The key algorithm changes with the wider migration.

1. js/apps/admin-ui/src/clients/add/SamlEncryption.tsx:11 const ALGORITHM_RSA_OAEP = "http://www.w3.org/2009/xmlenc11#rsa-oaep";
2. js/apps/admin-ui/src/clients/add/SamlEncryption.tsx:13 "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p";
3. js/apps/admin-ui/src/clients/add/SamlEncryption.tsx:23 if (keyEncryptionAlgorithm !== ALGORITHM_RSA_OAEP) {
4. js/apps/admin-ui/src/clients/add/SamlEncryption.tsx:30 if (keyEncryptionAlgorithm !== ALGORITHM_RSA_OAEP_MGF1P) {
5. js/apps/admin-ui/src/clients/add/SamlEncryption.tsx:93 key: ALGORITHM_RSA_OAEP,
6. js/apps/admin-ui/src/clients/add/SamlEncryption.tsx:97 key: ALGORITHM_RSA_OAEP_MGF1P,
7. js/apps/admin-ui/src/clients/add/SamlEncryption.tsx:104 {(keyEncryptionAlgorithm === ALGORITHM_RSA_OAEP ||
8. js/apps/admin-ui/src/clients/add/SamlEncryption.tsx:105 keyEncryptionAlgorithm === ALGORITHM_RSA_OAEP_MGF1P) && (
9. js/apps/admin-ui/src/clients/add/SamlEncryption.tsx:130 {keyEncryptionAlgorithm === ALGORITHM_RSA_OAEP && (
10. model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/custom/JpaUpdate26_4_0_SamlEncryptionAttributes.java:37 statements.add(createInsertQueryForAttribute("saml.encryption.keyAlgorithm", "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"));
11. model/storage-private/src/main/java/org/keycloak/storage/datastore/DefaultExportImportManager.java:588 app.setAttribute("saml.encryption.keyAlgorithm", "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p");
12. tests/base/src/test/resources/org/keycloak/tests/admin/identityprovider/saml-idp-metadata-encryption-methods.xml:26 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#rsa-oaep">

xmldsig.algorithm · CWE-327

EC256-bitsecg/secp256r1 Quantum-vulnerable 10 places See details

Named elliptic curve requested

`ECGenParameterSpec` names a curve explicitly. Every standardised prime curve is broken by Shor regardless of its size, so a larger curve is not a mitigation.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.

What to do. ML-DSA-65 for signatures, ML-KEM-768 for key establishment.

1. core/src/test/java/org/keycloak/jose/jwk/JWKTest.java:190 test path ECGenParameterSpec ecSpec = new ECGenParameterSpec("secp256r1");
2. core/src/test/java/org/keycloak/jose/jwk/JWKTest.java:205 test path ECGenParameterSpec ecSpec = new ECGenParameterSpec("secp256r1");
3. services/src/test/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/MdocCredentialBuilderTest.java:124 test path keyPairGenerator.initialize(new ECGenParameterSpec("secp256r1"));
4. services/src/test/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/MdocCredentialBuilderTest.java:150 test path keyPairGenerator.initialize(new ECGenParameterSpec("secp256r1"));
5. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCKeyAttestationTest.java:160 test path keyGen.initialize(new ECGenParameterSpec("secp256r1"));
6. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCKeyAttestationTest.java:1355 test path keyGen.initialize(new ECGenParameterSpec("secp256r1"));
7. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCKeyAttestationTest.java:1606 test path keyGen.initialize(new ECGenParameterSpec("secp256r1"));
8. tests/base/src/test/java/org/keycloak/tests/oid4vc/presentation/OID4VPTrustMaterialDelegationTest.java:335 test path keyGen.initialize(new ECGenParameterSpec("secp256r1"));
9. tests/conformance/src/test/java/org/keycloak/tests/conformance/ConformanceSigningKey.java:130 test path keyGenerator.initialize(new ECGenParameterSpec("secp256r1"));
10. tests/conformance/src/test/java/org/keycloak/tests/conformance/vci/VciTestSigningKey.java:71 test path keyGenerator.initialize(new ECGenParameterSpec("secp256r1"));

java.eccurve · CWE-327

ECDSA256-bitsecg/secp256r1 Quantum-vulnerable 9 places See details

Public key declared as a JSON Web Key

A `kty` field, with the curve read from the sibling `crv` where the family needs one. A JWKS document declares a key without naming an algorithm anywhere, so it is invisible to a scan that only looks for `alg`.

This file publishes the public keys other systems use to check this system's signatures. Everyone who trusts these keys has to accept the new kind of key before the old ones can be retired.

What to do. A published JWKS is what relying parties trust. It has to accept a post-quantum key type before the keys behind it can change, so put it early in the migration order.

1. core/src/test/resources/sdjwt/s3.3-issuer-claims.json:8 test path "kty": "EC",
2. core/src/test/resources/sdjwt/s3.3-issuer-payload.json:20 test path "kty": "EC",
3. core/src/test/resources/sdjwt/s30.1-jwt-vc-metadata-jwks.json:5 test path "kty": "EC",
4. core/src/test/resources/sdjwt/s30.1-jwt-vc-metadata-jwks.json:12 test path "kty": "EC",
5. core/src/test/resources/sdjwt/s30.1-jwt-vc-metadata-jwks.json:23 test path "kty": "EC",
6. core/src/test/resources/sdjwt/test-settings.json:11 test path "kty": "EC",
7. core/src/test/resources/sdjwt/test-settings.json:19 test path "kty": "EC",
8. testsuite/integration-arquillian/tests/base/src/test/resources/clientreg-test/jwks.json:13 test path "kty":"RSA",
9. testsuite/integration-arquillian/tests/base/src/test/resources/clientreg-test/jwks.json:19 test path "kty": "EC",

jose.jwk · CWE-327

RSA Quantum-vulnerable Recorded traffic 9 places See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. core/src/test/java/org/keycloak/RSAVerifierTest.java:64 test path badPair = KeyPairGenerator.getInstance("RSA").generateKeyPair();
2. core/src/test/java/org/keycloak/RSAVerifierTest.java:65 test path idpPair = KeyPairGenerator.getInstance("RSA").generateKeyPair();
3. core/src/test/java/org/keycloak/RSAVerifierTest.java:91 test path KeyPair caKeyPair = KeyPairGenerator.getInstance("RSA").generateKeyPair();
4. core/src/test/java/org/keycloak/SkeletonKeyTokenTest.java:62 test path KeyPair keyPair = KeyPairGenerator.getInstance("RSA").generateKeyPair();
5. core/src/test/java/org/keycloak/SkeletonKeyTokenTest.java:82 test path KeyPair keyPair = KeyPairGenerator.getInstance("RSA").generateKeyPair();
6. crypto/elytron/src/test/java/org/keycloak/crypto/elytron/test/CRLDistributionPointTest.java:124 test path KeyPair keyPair = KeyPairGenerator.getInstance("RSA").genKeyPair();
7. crypto/elytron/src/test/java/org/keycloak/crypto/elytron/test/ElytronOCSPPoviderTest.java:62 test path KeyPair keyPair = KeyPairGenerator.getInstance("RSA").genKeyPair();
8. tests/base/src/test/java/org/keycloak/tests/oauth/RefreshTokenTest.java:460 test path KeyPair rsaKeyPair = KeyPairGenerator.getInstance("RSA").generateKeyPair();
9. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/credentialbuilder/JwtCredentialBuilderTest.java:125 test path var holderKeyPair = KeyPairGenerator.getInstance("RSA").generateKeyPair();

java.keypairgenerator · CWE-327

RSA Quantum-vulnerable Recorded traffic 8 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. adapters/saml/core/src/main/java/org/keycloak/adapters/saml/config/PemUtils.java:145 KeyFactory kf = KeyFactory.getInstance("RSA", CryptoConstants.BC_PROVIDER_ID);
2. adapters/saml/core/src/main/java/org/keycloak/adapters/saml/config/PemUtils.java:159 KeyFactory kf = KeyFactory.getInstance("RSA", CryptoConstants.BC_PROVIDER_ID);
3. common/src/main/java/org/keycloak/common/util/KeyUtils.java:70 KeyFactory keyFactory = KeyFactory.getInstance("RSA");
4. core/src/main/java/org/keycloak/jose/jwk/JWKParser.java:140 KeyFactory kf = KeyFactory.getInstance("RSA");
5. saml-core-api/src/main/java/org/keycloak/dom/xmlsec/w3/xmldsig/RSAKeyValueType.java:103 KeyFactory rsaKeyFactory = KeyFactory.getInstance("rsa");
6. saml-core-api/src/main/java/org/keycloak/dom/xmlsec/w3/xmldsig/RSAKeyValueType.java:122 KeyFactory rsaKeyFactory = KeyFactory.getInstance("rsa");
7. tests/base/src/test/java/org/keycloak/tests/saml/AbstractSamlTest.java:70 test path KeyFactory kfRsa = KeyFactory.getInstance("RSA");
8. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/saml/AbstractSamlTest.java:81 test path KeyFactory kfRsa = KeyFactory.getInstance("RSA");

java.keyfactory · CWE-327

EdDSA Quantum-vulnerable Renamed import 7 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. core/src/main/java/org/keycloak/crypto/Algorithm.java:43 String Ed448 = "Ed448";
2. core/src/main/java/org/keycloak/crypto/JavaAlgorithm.java:34 public static final String Ed448 = "Ed448";
3. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:752 test path "Ed448":{
4. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:1519 test path "Ed448":{
5. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:530 test path "Ed448": { "order": 0 },
6. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:932 test path "Ed448": { "order": 0 },
7. services/src/test/java/org/keycloak/jose/jwk/ServerJWKTest.java:96 test path assertEquals("Ed448", okpJwk.getCrv());

jose.algorithm · CWE-327

ECDH Quantum-vulnerable Recorded traffic 6 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. common/src/main/java/org/keycloak/common/crypto/CryptoConstants.java:13 public static final String ECDH_ES = "ECDH-ES";
2. common/src/main/java/org/keycloak/common/crypto/CryptoConstants.java:14 public static final String ECDH_ES_A128KW = "ECDH-ES+A128KW";
3. common/src/main/java/org/keycloak/common/crypto/CryptoConstants.java:15 public static final String ECDH_ES_A192KW = "ECDH-ES+A192KW";
4. common/src/main/java/org/keycloak/common/crypto/CryptoConstants.java:16 public static final String ECDH_ES_A256KW = "ECDH-ES+A256KW";
5. tests/base/src/test/java/org/keycloak/tests/oid4vc/presentation/OID4VPDirectPostJwtTest.java:213 test path JWK wrongKey = JWKBuilder.create().kid(kid).algorithm("ECDH-ES")
6. tests/base/src/test/java/org/keycloak/tests/oid4vc/presentation/OID4VPX509HashDirectPostTest.java:239 test path JWK attackerKey = JWKBuilder.create().kid(state).algorithm("ECDH-ES")

jose.algorithm · CWE-327

RSASSA-PKCS1v15 Quantum-vulnerable 6 places See details

COSE algorithm identifier

A COSE algorithm named as an identifier or as its IANA registry number - `COSEAlgorithmIdentifier.ES256`, or `alg: -7` in a WebAuthn `pubKeyCredParams`. The names match JOSE's; the numbers are the registry's.

This is the list of signature algorithms a security key or a passkey is allowed to use. Every one available today is broken by a quantum computer, so the value of writing it down now is knowing where to look later.

What to do. No post-quantum COSE algorithm is registered for WebAuthn yet. Record the exposure and keep the list short, so there is less to change when one is.

1. core/src/main/java/org/keycloak/mdoc/MdocAlgorithm.java:33 RS256(Algorithm.RS256, COSEAlgorithmIdentifier.RS256),
2. core/src/main/java/org/keycloak/mdoc/MdocAlgorithm.java:34 RS384(Algorithm.RS384, COSEAlgorithmIdentifier.RS384),
3. core/src/main/java/org/keycloak/mdoc/MdocAlgorithm.java:35 RS512(Algorithm.RS512, COSEAlgorithmIdentifier.RS512),
4. services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegister.java:410 algs.add(COSEAlgorithmIdentifier.RS256.getValue());
5. services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegister.java:416 algs.add(COSEAlgorithmIdentifier.RS384.getValue());
6. services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegister.java:422 algs.add(COSEAlgorithmIdentifier.RS512.getValue());

cose.algorithm

RSA-PSS Quantum-vulnerable 5 places See details

COSE algorithm identifier

A COSE algorithm named as an identifier or as its IANA registry number - `COSEAlgorithmIdentifier.ES256`, or `alg: -7` in a WebAuthn `pubKeyCredParams`. The names match JOSE's; the numbers are the registry's.

This is the list of signature algorithms a security key or a passkey is allowed to use. Every one available today is broken by a quantum computer, so the value of writing it down now is knowing where to look later.

What to do. No post-quantum COSE algorithm is registered for WebAuthn yet. Record the exposure and keep the list short, so there is less to change when one is.

1. core/src/main/java/org/keycloak/mdoc/MdocAlgorithm.java:36 PS256(Algorithm.PS256, COSEAlgorithmIdentifier.PS256),
2. core/src/main/java/org/keycloak/mdoc/MdocAlgorithm.java:37 PS384(Algorithm.PS384, COSEAlgorithmIdentifier.PS384),
3. core/src/main/java/org/keycloak/mdoc/MdocAlgorithm.java:38 PS512(Algorithm.PS512, COSEAlgorithmIdentifier.PS512),
4. core/src/test/java/org/keycloak/mdoc/MdocKeyBindingTest.java:119 test path coseKey -> assertRsaKey(coseKey, COSEAlgorithmIdentifier.PS256, 2048));
5. core/src/test/java/org/keycloak/mdoc/MdocKeyBindingTest.java:127 test path coseKey -> assertRsaKey(coseKey, COSEAlgorithmIdentifier.PS512, 4096));

cose.algorithm

ECDH Quantum-vulnerable Recorded traffic 4 places See details

TLS cipher suite named in source

A cipher suite written into the code rather than into a configuration file - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, or the OpenSSL spelling `ECDHE-RSA-AES128-GCM-SHA256`. The key exchange is reported, and the bulk cipher separately when it is one of the broken ones.

This code names the exact cryptography its TLS connections may use. Because the list is in the program rather than in a settings file, changing it needs a new release - which is the thing that makes a migration slow.

What to do. A hardcoded suite list ships with the binary and cannot be changed without a release, so move it to configuration first. The key exchange changes when the TLS library offers a hybrid group, not before.

1. tests/conformance/src/test/java/org/keycloak/tests/conformance/vci/VciConformanceRealmUtil.java:98 test path "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
2. tests/conformance/src/test/java/org/keycloak/tests/conformance/vci/VciConformanceRealmUtil.java:99 test path "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
3. tests/conformance/src/test/java/org/keycloak/tests/conformance/vci/VciConformanceRealmUtil.java:100 test path "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
4. tests/conformance/src/test/java/org/keycloak/tests/conformance/vci/VciConformanceRealmUtil.java:101 test path "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384");

config.cipher-suite · CWE-757

DSA Quantum-vulnerable 3 places See details

XML signature or encryption algorithm

An XML Signature or XML Encryption algorithm URI - SAML, XAdES or WS-Security. The URI names the algorithm exactly, and a signature URI names its digest as well, so `#rsa-sha1` reports both the key and the broken digest.

Federated login and signed XML documents name their cryptography in a web address. Some of those addresses name algorithms that are already broken.

What to do. Move off `#rsa-sha1` first: that signature is forgeable today, with no quantum computer involved. The key algorithm changes with the wider migration.

1. saml-core-api/src/main/java/org/keycloak/saml/common/constants/JBossSAMLConstants.java:231 SIGNATURE_SHA1_WITH_DSA("http://www.w3.org/2000/09/xmldsig#dsa-sha1"),
2. saml-core-api/src/main/java/org/keycloak/saml/common/constants/JBossSAMLURIConstants.java:86 SIGNATURE_DSA_SHA1("http://www.w3.org/2000/09/xmldsig#dsa-sha1"),
3. saml-core/src/main/java/org/keycloak/saml/SignatureAlgorithm.java:34 DSA_SHA1("http://www.w3.org/2000/09/xmldsig#dsa-sha1", "http://www.w3.org/2000/09/xmldsig#sha1", "SHA1withDSA")

xmldsig.algorithm · CWE-327

Ed25519255-bitother/Ed25519 Quantum-vulnerable Renamed import 3 places See details

COSE algorithm identifier

A COSE algorithm named as an identifier or as its IANA registry number - `COSEAlgorithmIdentifier.ES256`, or `alg: -7` in a WebAuthn `pubKeyCredParams`. The names match JOSE's; the numbers are the registry's.

This is the list of signature algorithms a security key or a passkey is allowed to use. Every one available today is broken by a quantum computer, so the value of writing it down now is knowing where to look later.

What to do. No post-quantum COSE algorithm is registered for WebAuthn yet. Record the exposure and keep the list short, so there is less to change when one is.

1. core/src/main/java/org/keycloak/mdoc/MdocAlgorithm.java:42 EDDSA(Algorithm.EdDSA, COSEAlgorithmIdentifier.EdDSA);
2. core/src/test/java/org/keycloak/mdoc/MdocKeyBindingTest.java:148 test path assertEquals(COSEAlgorithmIdentifier.EdDSA, coseKey.getAlgorithm());
3. services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegister.java:425 algs.add(COSEAlgorithmIdentifier.EdDSA.getValue());

cose.algorithm

RSA4096-bit Quantum-vulnerable 3 places See details

Certificate signing request

A PKCS#10 certificate signing request. The public key it carries is read from the CertificationRequestInfo, so the algorithm and size are reported even though nothing has been issued yet.

This is an application for a digital identity document, not the document itself. It names the key that will be certified, so it shows what is about to be committed to.

What to do. Decide the key algorithm before the request is signed - a request is the last point at which changing it costs nothing.

1. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/certs/clients/test-user-ca@localhost.csr:1 test path -----BEGIN CERTIFICATE REQUEST-----
2. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/certs/clients/test-user-obb@localhost.csr.pem:1 test path -----BEGIN CERTIFICATE REQUEST-----
3. testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/intermediate/csr/intermediate.csr.pem:1 test path -----BEGIN CERTIFICATE REQUEST-----

pem.certificate-request

DSA Quantum-vulnerable 2 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. saml-core-api/src/main/java/org/keycloak/dom/xmlsec/w3/xmldsig/DSAKeyValueType.java:211 KeyFactory dsaKeyFactory = KeyFactory.getInstance("dsa");
2. saml-core-api/src/main/java/org/keycloak/dom/xmlsec/w3/xmldsig/DSAKeyValueType.java:234 KeyFactory dsaKeyFactory = KeyFactory.getInstance("dsa");

java.keyfactory · CWE-327

ECDH Quantum-vulnerable Recorded traffic 2 places See details

Public key declared as a JSON Web Key

A `kty` field, with the curve read from the sibling `crv` where the family needs one. A JWKS document declares a key without naming an algorithm anywhere, so it is invisible to a scan that only looks for `alg`.

This file publishes the public keys other systems use to check this system's signatures. Everyone who trusts these keys has to accept the new kind of key before the old ones can be retired.

What to do. A published JWKS is what relying parties trust. It has to accept a post-quantum key type before the keys behind it can change, so put it early in the migration order.

1. core/src/test/resources/sdjwt/test-settings.json:8 test path "kty": "EC",
2. testsuite/integration-arquillian/tests/base/src/test/resources/clientreg-test/jwks.json:27 test path "kty": "EC",

jose.jwk · CWE-327

ECDH Quantum-vulnerable Recorded traffic 2 places See details

Classical key agreement through the JCA

`KeyAgreement.getInstance()` with ECDH, DH or XDH. Key agreement is the highest-priority class of finding: traffic recorded today is decrypted once the key exchange is broken.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 (FIPS 203), or a hybrid X25519+ML-KEM-768 construction that keeps the classical guarantee while adding the quantum one.

1. crypto/default/src/main/java/org/keycloak/crypto/def/BCEcdhEsAlgorithmProvider.java:208 KeyAgreement keyAgreement = KeyAgreement.getInstance("ECDH");
2. crypto/elytron/src/main/java/org/keycloak/crypto/elytron/ElytronEcdhEsAlgorithmProvider.java:183 KeyAgreement keyAgreement = KeyAgreement.getInstance("ECDH");

java.keyagreement · CWE-327

EdDSA Quantum-vulnerable 2 places See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. services/src/main/java/org/keycloak/keys/GeneratedEddsaKeyProvider.java:51 KeyFactory kf = KeyFactory.getInstance("EdDSA");
2. services/src/main/java/org/keycloak/keys/GeneratedEddsaKeyProviderFactory.java:135 KeyFactory kf = KeyFactory.getInstance("EdDSA");

java.keyfactory · CWE-327

RSA2048-bit Quantum-vulnerable 2 places See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

1. js/apps/admin-ui/test/utils/files/key.pem:1 test path -----BEGIN PUBLIC KEY-----
2. testsuite/integration-arquillian/tests/base/src/test/resources/keys/public2048.pem:1 test path -----BEGIN PUBLIC KEY-----

pem.public-key

RSA-PSS Quantum-vulnerable 2 places See details

Classical signature algorithm through the JCA

`Signature.getInstance()` with a classical algorithm. The digest and the key algorithm are split out of the JCA name, so `SHA1withRSA` reports both the broken digest and the quantum-vulnerable key.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-DSA-65 (FIPS 204). Where the verifier cannot be changed, sign twice and publish both signatures.

1. crypto/elytron/src/main/java/org/keycloak/crypto/elytron/WildFlyElytronProvider.java:183 var signature = Signature.getInstance("RSASSA-PSS");
2. crypto/elytron/src/test/java/org/keycloak/crypto/elytron/test/ElytronSignatureAlgTest.java:36 test path Signature signature = Signature.getInstance("RSASSA-PSS");

java.signature · CWE-327

EC384-bitsecg/secp384r1 Quantum-vulnerable 1 place See details

Named elliptic curve requested

`ECGenParameterSpec` names a curve explicitly. Every standardised prime curve is broken by Shor regardless of its size, so a larger curve is not a mitigation.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.

What to do. ML-DSA-65 for signatures, ML-KEM-768 for key establishment.

1. services/src/test/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/MdocCredentialBuilderTest.java:100 test path keyPairGenerator.initialize(new ECGenParameterSpec("secp384r1"));

java.eccurve · CWE-327

EC256-bit Quantum-vulnerable 1 place See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. An elliptic-curve key pair. The source does not say whether it signs or agrees a shared secret, and the curve alone cannot: the same curve serves both.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCProofTestUtils.java:133 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance("EC", BouncyIntegration.PROVIDER);

java.keypairgenerator · CWE-327

ECDH Quantum-vulnerable Recorded traffic 1 place See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. crypto/default/src/main/java/org/keycloak/crypto/def/BCEcdhEsAlgorithmProvider.java:199 KeyFactory keyFactory = KeyFactory.getInstance("EC");

java.keyfactory · CWE-327

ECDSA Quantum-vulnerable 1 place See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. authz/client/src/test/java/org/keycloak/authorization/client/test/ECDSAAlgorithmTest.java:43 test path keyPair = KeyPairGenerator.getInstance("EC").genKeyPair();

java.keypairgenerator · CWE-327

RSA4096-bit Quantum-vulnerable Recorded traffic 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. operator/src/test/resources/example-mtls-secret.yaml:41 test path -----BEGIN PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

RSA Quantum-vulnerable Recorded traffic 1 place See details

Public key declared as a JSON Web Key

A `kty` field, with the curve read from the sibling `crv` where the family needs one. A JWKS document declares a key without naming an algorithm anywhere, so it is invisible to a scan that only looks for `alg`.

This file publishes the public keys other systems use to check this system's signatures. Everyone who trusts these keys has to accept the new kind of key before the old ones can be retired.

What to do. A published JWKS is what relying parties trust. It has to accept a post-quantum key type before the keys behind it can change, so put it early in the migration order.

1. testsuite/integration-arquillian/tests/base/src/test/resources/clientreg-test/jwks.json:6 test path "kty": "RSA",

jose.jwk · CWE-327

RSA4096-bit Quantum-vulnerable 1 place See details

Public key file

A PEM public-key block. The algorithm is read from the SubjectPublicKeyInfo.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Inventory only; a public key is not itself a secret.

1. testsuite/integration-arquillian/tests/base/src/test/resources/keys/public4096.pem:1 test path -----BEGIN PUBLIC KEY-----

pem.public-key

RSA-OAEP Quantum-vulnerable Recorded traffic 1 place See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. services/src/test/java/org/keycloak/protocol/saml/SamlEncryptionTest.java:91 test path cipher = Cipher.getInstance("RSA/ECB/OAEPPadding");

java.cipher · CWE-327

RSA-PSS Quantum-vulnerable 1 place See details

Classical key pair generated through the JCA

`KeyPairGenerator.getInstance()` with a classical algorithm. The concrete family and, where an `initialize()` call is close enough to read, the key size are resolved from the source and reported on the finding.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Generate the classical key alongside an ML-KEM or ML-DSA key and carry both until relying parties accept the post-quantum one.

1. crypto/elytron/src/test/java/org/keycloak/crypto/elytron/test/ElytronSignatureAlgTest.java:28 test path KeyPair keyPair = KeyPairGenerator.getInstance("RSASSA-PSS").genKeyPair();

java.keypairgenerator · CWE-327

RSA-PSS Quantum-vulnerable 1 place See details

Classical key material handled through the JCA

`KeyFactory.getInstance()` for a classical algorithm. This indicates the code parses or produces keys of that family, which is a migration surface even where it does no cryptography itself.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. Include this code path in the inventory: it has to accept post-quantum key encodings before the keys themselves can change.

1. crypto/elytron/src/test/java/org/keycloak/crypto/elytron/test/ElytronSignatureAlgTest.java:34 test path key.setPrivateKey(KeyFactory.getInstance("RSASSA-PSS").generatePrivate(kspec));

java.keyfactory · CWE-327

AES Reduced margin 16 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. core/src/main/java/org/keycloak/jose/jwe/enc/AesCbcHmacShaEncryptionProvider.java:168 SecretKeySpec aesKey = new SecretKeySpec(cekAesKey, "AES");
2. core/src/main/java/org/keycloak/jose/jwe/enc/AesGcmEncryptionProvider.java:151 SecretKeySpec aesKey = new SecretKeySpec(cekBytes, "AES");
3. core/src/test/java/org/keycloak/jose/JWETest.java:66 test path SecretKey aesKey = new SecretKeySpec(AES_128_KEY, "AES");
4. core/src/test/java/org/keycloak/jose/JWETest.java:76 test path final SecretKey aesKey = new SecretKeySpec(AES_256_KEY, "AES");
5. core/src/test/java/org/keycloak/jose/JWETest.java:121 test path SecretKey aesKey = new SecretKeySpec(AES_128_KEY, "AES");
6. core/src/test/java/org/keycloak/jose/JWETest.java:140 test path SecretKey aesKey = new SecretKeySpec(AES_128_KEY, "AES");
7. core/src/test/java/org/keycloak/jose/JWETest.java:185 test path final SecretKey aesKey = new SecretKeySpec(AES_128_KEY, "AES");
8. core/src/test/java/org/keycloak/jose/JWETest.java:208 test path final SecretKey aesKey = new SecretKeySpec(AES_256_KEY, "AES");
9. core/src/test/java/org/keycloak/jose/JWETest.java:230 test path SecretKeySpec aesKeySpec = new SecretKeySpec(aesKey, "AES");
10. core/src/test/java/org/keycloak/jose/JWETest.java:307 test path final SecretKey aesKey = new SecretKeySpec(AES_128_KEY, "AES");
11. crypto/elytron/src/main/java/org/keycloak/crypto/elytron/ElytronEcdhEsAlgorithmProvider.java:80 cipher.init(Cipher.UNWRAP_MODE, new SecretKeySpec(derivedKey, "AES"));
12. crypto/elytron/src/main/java/org/keycloak/crypto/elytron/ElytronEcdhEsAlgorithmProvider.java:113 cipher.init(Cipher.WRAP_MODE, new SecretKeySpec(derivedKey, "AES"));
13. crypto/elytron/src/main/java/org/keycloak/crypto/elytron/ElytronEcdhEsAlgorithmProvider.java:115 return cipher.wrap(new SecretKeySpec(cekBytes, "AES"));
14. crypto/elytron/src/test/java/org/keycloak/crypto/elytron/test/ElytronCryptoJWETest.java:31 test path final SecretKey aesKey = new SecretKeySpec(AES_256_KEY, "AES");
15. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcSamlEncryptedAssertionTest.java:69 test path SecretKey secretKey = new SecretKeySpec(secret, "AES");
16. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcSamlEncryptedIdTest.java:55 test path SecretKey secretKey = new SecretKeySpec(secret, "AES");

java.keyspec · CWE-327

SHA-256 Reduced margin From a constant 15 places See details

Hash algorithm through the JCA

`MessageDigest.getInstance()`. MD5 and SHA-1 are reported as already broken; SHA-256 is reported as a reduced margin rather than a defect.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something that must remain verifiable for decades.

1. common/src/main/java/org/keycloak/common/util/KeyUtils.java:100 return Base64Url.encode(MessageDigest.getInstance(DEFAULT_MESSAGE_DIGEST).digest(key.getEncoded()));
2. crypto/elytron/src/test/java/org/keycloak/crypto/elytron/test/ElytronHmacTest.java:41 test path KeyGenerator keygen = KeyGenerator.getInstance("HmacSHA256");
3. crypto/fips1402/src/test/java/org/keycloak/crypto/fips/test/FIPS1402HmacTest.java:33 test path SecretKeyFactory skFact = SecretKeyFactory.getInstance("HmacSHA256", BouncyIntegration.PROVIDER );
4. operator/src/main/java/org/keycloak/operator/Utils.java:120 return MessageDigest.getInstance("SHA-256");
5. server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProvider.java:138 md = MessageDigest.getInstance("SHA-256");
6. services/src/main/java/org/keycloak/protocol/docker/DockerKeyIdentifier.java:37 final MessageDigest sha256 = MessageDigest.getInstance("SHA-256");
7. services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/vcdm/Ed255192018Suite.java:129 MessageDigest md = MessageDigest.getInstance("SHA-256");
8. services/src/main/java/org/keycloak/protocol/oidc/mappers/SHA256PairwiseSubMapper.java:90 sha256 = MessageDigest.getInstance(HASH_ALGORITHM);
9. services/src/main/java/org/keycloak/protocol/oidc/par/endpoints/AbstractParEndpoint.java:88 hash = MessageDigest.getInstance("SHA-256").digest(inputData.getBytes(StandardCharsets.UTF_8));
10. services/src/main/java/org/keycloak/services/clientpolicy/executor/PKCEEnforcerExecutor.java:230 MessageDigest md = MessageDigest.getInstance("SHA-256");
11. services/src/main/java/org/keycloak/services/resources/IdentityBrokerService.java:282 md = MessageDigest.getInstance("SHA-256");
12. services/src/main/java/org/keycloak/services/util/MtlsHoKTokenUtil.java:139 MessageDigest md = MessageDigest.getInstance(DIGEST_ALG);
13. services/src/main/java/org/keycloak/utils/BrokerUtil.java:44 MessageDigest md = MessageDigest.getInstance("SHA-256");
14. testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/MutualTLSUtils.java:143 test path MessageDigest md = MessageDigest.getInstance(digestAlg);
15. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthProofKeyForCodeExchangeTest.java:403 test path MessageDigest md = MessageDigest.getInstance("SHA-256");

java.messagedigest · CWE-328

AES-128 Reduced margin 12 places See details

XML signature or encryption algorithm

An XML Signature or XML Encryption algorithm URI - SAML, XAdES or WS-Security. The URI names the algorithm exactly, and a signature URI names its digest as well, so `#rsa-sha1` reports both the key and the broken digest.

Federated login and signed XML documents name their cryptography in a web address. Some of those addresses name algorithms that are already broken.

What to do. Move off `#rsa-sha1` first: that signature is forgeable today, with no quantum computer involved. The key algorithm changes with the wider migration.

1. js/apps/admin-ui/src/clients/add/SamlEncryption.tsx:63 key: "http://www.w3.org/2009/xmlenc11#aes128-gcm",
2. js/apps/admin-ui/src/clients/add/SamlEncryption.tsx:75 key: "http://www.w3.org/2001/04/xmlenc#aes128-cbc",
3. model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/custom/JpaUpdate26_4_0_SamlEncryptionAttributes.java:36 statements.add(createInsertQueryForAttribute("saml.encryption.algorithm", "http://www.w3.org/2001/04/xmlenc#aes128-cbc"));
4. model/storage-private/src/main/java/org/keycloak/storage/datastore/DefaultExportImportManager.java:587 app.setAttribute("saml.encryption.algorithm", "http://www.w3.org/2001/04/xmlenc#aes128-cbc");
5. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:55 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
6. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:96 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
7. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:135 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
8. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:174 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
9. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4489-encrypted-assertion-with-newlines.xml:14 test path <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
10. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/saml20-assertion-encrypted.xml:3 test path <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
11. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/saml20-encrypted-signed-redirect-response-two-extensions.xml:14 test path <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
12. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/saml20-encrypted-signed-redirect-response.xml:11 test path <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>

xmldsig.algorithm · CWE-327

Kerberos Reduced margin 9 places See details

Kerberos or SPNEGO authentication

`javax.security.auth.kerberos` or a GSS-API call. Kerberos itself is symmetric and survives Shor; its PKINIT certificate flow is public-key and does not. The encryption types configured for the realm decide whether it is also a present-day concern.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Kerberos is symmetric at its core, so Shor does not break it. The surrounding PKINIT certificate flow is public-key and does fall.

What to do. Restrict the realm to AES encryption types, and treat PKINIT certificates as part of the public-key migration.

1. common/src/main/java/org/keycloak/common/util/KerberosJdkProvider.java:32 import javax.security.auth.kerberos.KerberosPrincipal;
2. common/src/main/java/org/keycloak/common/util/KerberosSerializationUtils.java:28 import javax.security.auth.kerberos.KerberosPrincipal;
3. federation/kerberos/src/main/java/org/keycloak/federation/kerberos/KerberosFederationProvider.java:104 return findOrCreateAuthenticatedUser(realm, new KerberosPrincipal(kerberosPrincipal));
4. federation/kerberos/src/main/java/org/keycloak/federation/kerberos/KerberosPrincipal.java:25 public class KerberosPrincipal {
5. federation/kerberos/src/main/java/org/keycloak/federation/kerberos/impl/KerberosUsernamePasswordAuthenticator.java:33 import org.keycloak.federation.kerberos.KerberosPrincipal;
6. federation/kerberos/src/main/java/org/keycloak/federation/kerberos/impl/SPNEGOAuthenticator.java:25 import javax.security.auth.kerberos.KerberosTicket;
7. federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProvider.java:50 import org.keycloak.federation.kerberos.KerberosPrincipal;
8. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosSingleRealmTest.java:46 test path import org.ietf.jgss.GSSContext;
9. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KeycloakSPNegoSchemeFactory.java:28 test path import org.apache.http.impl.auth.SPNegoScheme;

java.kerberos

SHA-256 Reduced margin 7 places See details

XML signature or encryption algorithm

An XML Signature or XML Encryption algorithm URI - SAML, XAdES or WS-Security. The URI names the algorithm exactly, and a signature URI names its digest as well, so `#rsa-sha1` reports both the key and the broken digest.

Federated login and signed XML documents name their cryptography in a web address. Some of those addresses name algorithms that are already broken.

What to do. Move off `#rsa-sha1` first: that signature is forgeable today, with no quantum computer involved. The key algorithm changes with the wider migration.

1. js/apps/admin-ui/src/clients/add/SamlEncryption.tsx:122 key: "http://www.w3.org/2001/04/xmlenc#sha256",
2. saml-core/src/main/java/org/keycloak/saml/SignatureAlgorithm.java:30 RSA_SHA256("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256", "http://www.w3.org/2001/04/xmlenc#sha256", "SHA256withRSA"),
3. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-6412-response-with-proxy-restriction.xml:6 test path <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
4. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-6412-response-with-proxy-restriction.xml:14 test path <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
5. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/saml20-signed-logout-request.xml:6 test path <dsig:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
6. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/saml20-signed-logout-request.xml:12 test path <dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
7. tests/base/src/test/resources/org/keycloak/tests/admin/identityprovider/saml-idp-metadata-encryption-methods.xml:27 test path <dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>

xmldsig.algorithm · CWE-327

AES Reduced margin 6 places See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Grover's algorithm halves the effective strength; the parameter, not the design, is the problem. The key size was not visible at this call site, so the weaker case is assumed.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. crypto/default/src/main/java/org/keycloak/crypto/def/DefaultCryptoProvider.java:142 return Cipher.getInstance("AES/CBC/PKCS7Padding", BouncyIntegration.PROVIDER);
2. crypto/default/src/main/java/org/keycloak/crypto/def/DefaultCryptoProvider.java:147 return Cipher.getInstance("AES/GCM/NoPadding", BouncyIntegration.PROVIDER);
3. crypto/elytron/src/main/java/org/keycloak/crypto/elytron/WildFlyElytronProvider.java:142 return Cipher.getInstance("AES/CBC/PKCS5Padding");
4. crypto/elytron/src/main/java/org/keycloak/crypto/elytron/WildFlyElytronProvider.java:147 return Cipher.getInstance("AES/GCM/NoPadding");
5. crypto/fips1402/src/main/java/org/keycloak/crypto/fips/FIPS1402Provider.java:207 return Cipher.getInstance("AES/CBC/PKCS7Padding", BouncyIntegration.PROVIDER);
6. crypto/fips1402/src/main/java/org/keycloak/crypto/fips/FIPS1402Provider.java:212 return Cipher.getInstance("AES/GCM/NoPadding", BouncyIntegration.PROVIDER);

java.cipher · CWE-327

AES-192 Reduced margin 5 places See details

XML signature or encryption algorithm

An XML Signature or XML Encryption algorithm URI - SAML, XAdES or WS-Security. The URI names the algorithm exactly, and a signature URI names its digest as well, so `#rsa-sha1` reports both the key and the broken digest.

Federated login and signed XML documents name their cryptography in a web address. Some of those addresses name algorithms that are already broken.

What to do. Move off `#rsa-sha1` first: that signature is forgeable today, with no quantum computer involved. The key algorithm changes with the wider migration.

1. js/apps/admin-ui/src/clients/add/SamlEncryption.tsx:71 key: "http://www.w3.org/2001/04/xmlenc#aes192-cbc",
2. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:56 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes192-cbc"/>
3. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:97 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes192-cbc"/>
4. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:136 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes192-cbc"/>
5. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:175 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes192-cbc"/>

xmldsig.algorithm · CWE-327

PBKDF2 Reduced margin 2 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. server-spi-private/src/main/java/org/keycloak/credential/hash/Pbkdf2PasswordHashProvider.java:114 KeySpec spec = new PBEKeySpec(rawPasswordWithPadding.toCharArray(), salt, iterations, derivedKeySize);
2. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/PasswordHashingTest.java:413 test path KeySpec spec = new PBEKeySpec(password.toCharArray(), salt, iterations, keyLength);

java.keyspec · CWE-327

PBKDF2 Reduced margin 17 places See details

Password hashing or key derivation

A `SecretKeyFactory` for PBKDF2, or a BouncyCastle password KDF. Not a quantum exposure, and part of a complete inventory.

This is how passwords are stored. Quantum computers do not meaningfully weaken it.

What to do. PBKDF2 needs a high iteration count. Argon2 through BouncyCastle is stronger.

1. server-spi-private/src/main/java/org/keycloak/credential/hash/Pbkdf2PasswordHashProviderFactory.java:37 public static final String PBKDF2_ALGORITHM = "PBKDF2WithHmacSHA1";
2. server-spi-private/src/main/java/org/keycloak/credential/hash/Pbkdf2PasswordHashProviderFactory.java:52 return new Pbkdf2PasswordHashProvider(ID, PBKDF2_ALGORITHM, DEFAULT_ITERATIONS, getMaxPaddingLength());
3. server-spi-private/src/main/java/org/keycloak/credential/hash/Pbkdf2Sha256PasswordHashProviderFactory.java:14 public static final String PBKDF2_ALGORITHM = "PBKDF2WithHmacSHA256";
4. server-spi-private/src/main/java/org/keycloak/credential/hash/Pbkdf2Sha256PasswordHashProviderFactory.java:23 return new Pbkdf2PasswordHashProvider(ID, PBKDF2_ALGORITHM, DEFAULT_ITERATIONS, getMaxPaddingLength(), 256);
5. server-spi-private/src/main/java/org/keycloak/credential/hash/Pbkdf2Sha512PasswordHashProviderFactory.java:14 public static final String PBKDF2_ALGORITHM = "PBKDF2WithHmacSHA512";
6. server-spi-private/src/main/java/org/keycloak/credential/hash/Pbkdf2Sha512PasswordHashProviderFactory.java:23 return new Pbkdf2PasswordHashProvider(ID, PBKDF2_ALGORITHM, DEFAULT_ITERATIONS, getMaxPaddingLength());
7. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/PasswordHashingTest.java:110 test path assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA256", 1);
8. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/PasswordHashingTest.java:121 test path assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA1", 1);
9. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/PasswordHashingTest.java:135 test path assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA256", 1);
10. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/PasswordHashingTest.java:156 test path assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA1", 1);
11. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/PasswordHashingTest.java:205 test path assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA512", 2);
12. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/PasswordHashingTest.java:283 test path assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA1", Pbkdf2PasswordHashProviderFactory.DEFAULT_ITERATIONS);
13. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/PasswordHashingTest.java:329 test path assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA512", Pbkdf2Sha512PasswordHashProviderFactory.DEFAULT_ITERATIONS);
14. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/PasswordHashingTest.java:340 test path assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA256", Pbkdf2Sha256PasswordHashProviderFactory.DEFAULT_ITERATIONS);
15. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/PasswordHashingTest.java:350 test path assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA512", Pbkdf2Sha512PasswordHashProviderFactory.DEFAULT_ITERATIONS);
16. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/PasswordHashingTest.java:364 test path assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA256", Pbkdf2Sha256PasswordHashProviderFactory.DEFAULT_ITERATIONS);
17. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/PasswordHashingTest.java:372 test path assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA256", Pbkdf2Sha256PasswordHashProviderFactory.DEFAULT_ITERATIONS, false);

java.kdf

AES-128 Reduced margin Renamed import 12 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Grover's algorithm halves the effective strength; the parameter, not the design, is the problem.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. common/src/main/java/org/keycloak/common/crypto/CryptoConstants.java:9 public static final String A128KW = "A128KW";
2. core/src/main/java/org/keycloak/jose/jwe/JWEConstants.java:37 public static final String A128CBC_HS256 = "A128CBC-HS256";
3. core/src/main/java/org/keycloak/jose/jwe/JWEConstants.java:40 public static final String A128GCM = "A128GCM";
4. crypto/default/src/test/java/org/keycloak/crypto/def/test/BCEcdhEsAlgorithmProviderTest.java:82 test path "A128GCM", Base64Url.decode("QWxpY2U"), Base64Url.decode("Qm9i"));
5. crypto/elytron/src/test/java/org/keycloak/crypto/elytron/test/ElytronEcdhEsAlgorithmProviderTest.java:67 test path "A128GCM", Base64Url.decode("QWxpY2U"), Base64Url.decode("Qm9i"));
6. crypto/fips1402/src/test/java/org/keycloak/crypto/fips/test/BCFIPSEcdhEsAlgorithmProviderTest.java:70 test path "A128GCM", Base64Url.decode("QWxpY2U"), Base64Url.decode("Qm9i"));
7. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:854 test path "A128GCM":{
8. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:857 test path "A128CBC-HS256":{
9. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:591 test path "A128GCM": { "order": 0 },
10. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:592 test path "A128CBC-HS256": { "order": 0 },
11. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerEndpointEncryptionTest.java:197 test path .setCredentialResponseEncryption(new CredentialResponseEncryption().setEnc("A128GCM").setJwk(responseJwk));
12. tests/base/src/test/java/org/keycloak/tests/oid4vc/presentation/OID4VPDirectPostJwtTest.java:75 test path assertEquals(List.of("A128GCM", "A256GCM"), JsonSerialization.mapper.convertValue(

jose.algorithm · CWE-327

AES-192 Reduced margin 7 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

A quantum computer weakens this but does not break it. Increasing the key or digest size restores the margin. Grover's algorithm halves the effective strength; the parameter, not the design, is the problem.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. core/src/main/java/org/keycloak/jose/jwe/JWEConstants.java:38 public static final String A192CBC_HS384 = "A192CBC-HS384";
2. core/src/main/java/org/keycloak/jose/jwe/JWEConstants.java:41 public static final String A192GCM = "A192GCM";
3. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:851 test path "A192GCM":{
4. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:860 test path "A192CBC-HS384":{
5. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:590 test path "A192GCM": { "order": 0 },
6. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:593 test path "A192CBC-HS384": { "order": 0 },
7. tests/base/src/test/java/org/keycloak/tests/oid4vc/presentation/OID4VPDirectPostJwtTest.java:230 test path request.path("state").asText(), jwk, jwk.path("kid").asText(), "A192GCM");

jose.algorithm · CWE-327

unknown Could not be determined 22 places See details

Key pair algorithm chosen at runtime

`KeyPairGenerator.getInstance(x)` where the argument is an identifier. The algorithm cannot be resolved without running the program, so this is reported as an unknown rather than assumed to be classical.

This code picks its encryption method while it runs, so a scan cannot tell which one it ends up using. Somebody has to check the configuration.

What to do. Trace the value to its configuration source and record the concrete algorithm in the cryptographic inventory by hand.

1. common/src/main/java/org/keycloak/common/util/KeyUtils.java:79 KeyPairGenerator keyGen = KeyPairGenerator.getInstance(curveName);
2. core/src/main/java/org/keycloak/jose/jwk/AKPUtils.java:32 KeyFactory keyFactory = KeyFactory.getInstance(algorithm);
3. core/src/main/java/org/keycloak/jose/jwk/EdECUtilsImpl.java:108 publicKey = KeyFactory.getInstance(crv).generatePublic(keySpec);
4. core/src/test/java/org/keycloak/jose/jwk/AKPJWKTest.java:80 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance(algorithm);
5. core/src/test/java/org/keycloak/jose/jwk/JWKTest.java:285 test path Signature signature = Signature.getInstance(javaAlgorithm);
6. core/src/test/java/org/keycloak/jose/jwk/JWKTest.java:292 test path Signature verifier = Signature.getInstance(javaAlgorithm);
7. crypto/default/src/main/java/org/keycloak/crypto/def/DefaultCryptoProvider.java:130 return KeyPairGenerator.getInstance(algorithm, BouncyIntegration.PROVIDER);
8. crypto/default/src/main/java/org/keycloak/crypto/def/DefaultCryptoProvider.java:136 return KeyFactory.getInstance(algorithm, BouncyIntegration.PROVIDER);
9. crypto/default/src/main/java/org/keycloak/crypto/def/DefaultRsaKeyEncryptionJWEAlgorithmProvider.java:36 return Cipher.getInstance(jcaAlgorithmName);
10. crypto/elytron/src/main/java/org/keycloak/crypto/elytron/ElytronRsaKeyEncryptionJWEAlgorithmProvider.java:55 return Cipher.getInstance(jcaAlgorithmName);
11. crypto/elytron/src/main/java/org/keycloak/crypto/elytron/WildFlyElytronProvider.java:127 return KeyPairGenerator.getInstance(algorithm);
12. crypto/elytron/src/main/java/org/keycloak/crypto/elytron/WildFlyElytronProvider.java:137 return KeyFactory.getInstance(algorithm);
13. crypto/elytron/src/main/java/org/keycloak/crypto/elytron/WildFlyElytronProvider.java:199 return Signature.getInstance(javaAlgorithm);
14. crypto/fips1402/src/main/java/org/keycloak/crypto/fips/FIPS1402Provider.java:197 return KeyPairGenerator.getInstance(algorithm, BouncyIntegration.PROVIDER);
15. crypto/fips1402/src/main/java/org/keycloak/crypto/fips/FIPS1402Provider.java:202 return KeyFactory.getInstance(algorithm , BouncyIntegration.PROVIDER);
16. saml-core/src/main/java/org/keycloak/saml/SignatureAlgorithm.java:87 return Signature.getInstance(javaSignatureAlgorithm);
17. saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/util/SignatureUtil.java:212 sig = Signature.getInstance(PicketLinkFederationConstants.DSA_SIGNATURE_ALGORITHM);
18. saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/util/SignatureUtil.java:214 sig = Signature.getInstance(PicketLinkFederationConstants.RSA_SIGNATURE_ALGORITHM);
19. services/src/test/java/org/keycloak/jose/jwk/ServerJWKTest.java:112 test path Signature signature = Signature.getInstance(javaAlgorithm);
20. services/src/test/java/org/keycloak/jose/jwk/ServerJWKTest.java:119 test path Signature verifier = Signature.getInstance(javaAlgorithm);
21. tests/base/src/test/java/org/keycloak/tests/oid4vc/presentation/OID4VPVerifierTestBase.java:123 test path KeyPairGenerator kpg = KeyPairGenerator.getInstance(KeyType.EC);
22. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/LogoutTokenUtil.java:46 test path Signature signature = Signature.getInstance(JavaAlgorithm.RS256);

java.keypairgenerator.variable · CWE-327

unknown Could not be determined 5 places See details

Key store holding classical key material

`KeyStore.getInstance("JKS"|"PKCS12"|"BCFKS")`. The store format itself is not the issue; it is the inventory point where the classical private keys of this application live.

This is the application's key cupboard. It is worth knowing what is in it before planning any replacement.

What to do. Record which keys this store holds. A key store is where a migration either happens or silently does not.

1. rest/admin-v2/tests/src/test/java/org/keycloak/tests/admin/cli/v2/KcAdmV2KeystoreCLITest.java:158 test path KeyStore ks = KeyStore.getInstance("JKS");
2. tests/conformance/src/test/java/org/keycloak/tests/conformance/ConformanceSigningKey.java:177 test path KeyStore keyStore = KeyStore.getInstance("PKCS12");
3. tests/conformance/src/test/java/org/keycloak/tests/conformance/vci/VciTestSigningKey.java:78 test path KeyStore keyStore = KeyStore.getInstance("PKCS12");
4. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/SslMailServer.java:102 test path ksKeys = KeyStore.getInstance("JKS");
5. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/SslMailServer.java:112 test path KeyStore ksTrust = KeyStore.getInstance("JKS");

java.keystore

unknown Could not be determined 3 places See details

Non-cryptographic randomness near key material

`new Random()` or `Math.random()` in a file that also imports `java.security`, `javax.crypto` or BouncyCastle. `java.util.Random` is a linear congruential generator and its output is predictable from a handful of samples. The import check is what keeps this from firing on every retry jitter and test fixture in the tree.

Part of this code uses a predictable source of random numbers. If any key comes from it, that key can be guessed today, with no quantum computer needed.

What to do. `java.security.SecureRandom`. This is a classical defect, not a quantum one, and it is worth fixing first.

1. services/src/main/java/org/keycloak/connections/httpclient/DefaultHttpClientFactory.java:297 (Math.random() * jitterFactor * 2.0);
2. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPI2DPoPTest.java:101 test path private final Random rand = new Random(System.currentTimeMillis());
3. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java:969 test path private Random rand = new Random(System.currentTimeMillis());

java.random.insecure · CWE-338

unknown Could not be determined 2 places See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

1. quarkus/tests/integration/src/test/resources/encrypted-test.key.pem:1 test path -----BEGIN ENCRYPTED PRIVATE KEY-----
2. testsuite/integration-arquillian/servers/auth-server/common/keystore/client-ca.key:1 test path -----BEGIN ENCRYPTED PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

unknown Could not be determined 1 place See details

X.509 certificate

A PEM certificate. The subject public-key algorithm and key size are read from the SubjectPublicKeyInfo structure, and the not-after date is reported so certificates that outlive the migration window are visible.

This is a digital identity document. Its expiry date matters: one valid for many years locks in today's algorithms for that long.

What to do. Shorten certificate lifetimes so re-issuing with a post-quantum key is routine.

1. rest/admin-v2/tests/src/test/java/org/keycloak/tests/admin/client/v2/AdminEventV2Test.java:270 test path -----BEGIN CERTIFICATE-----

pem.certificate

unknown Could not be determined 1 place See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. server-spi/src/main/java/org/keycloak/models/utils/HmacOTP.java:161 SecretKeySpec macKey = new SecretKeySpec(keyBytes, "RAW");

java.keyspec · CWE-327

unknown Could not be determined 8 places See details

Cryptographic library in the dependency manifest

A dependency known to implement classical asymmetric cryptography. Its presence is inventory, not a finding about this codebase: the library may never be called with a quantum-vulnerable algorithm.

The project depends on a cryptography library. Listed so the inventory is complete; it is not by itself a problem.

What to do. Check the version. Several of these libraries have shipped ML-KEM and ML-DSA support since 2024, so the migration may need an upgrade rather than a replacement.

1. adapters/saml/core/pom.xml:66 <artifactId>bcprov-jdk18on</artifactId>
2. adapters/spi/adapter-spi/pom.xml:41 <artifactId>bcprov-jdk18on</artifactId>
3. adapters/spi/jboss-adapter-core/pom.xml:58 <artifactId>bcprov-jdk18on</artifactId>
4. crypto/default/pom.xml:59 <artifactId>bcprov-jdk18on</artifactId>
5. dependencies/server-min/pom.xml:44 <artifactId>bcprov-jdk18on</artifactId>
6. integration/client-cli/client-cli-dist/pom.xml:59 <artifactId>bcprov-jdk18on</artifactId>
7. testsuite/integration-arquillian/tests/pom.xml:1645 test path <artifactId>bcprov-jdk18on</artifactId>
8. testsuite/utils/pom.xml:48 test path <artifactId>bcprov-jdk18on</artifactId>

dep.crypto-library

HMAC Quantum-safe 49 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. A keyed MAC is not affected by Shor and only marginally by Grover.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. core/src/main/java/org/keycloak/crypto/Algorithm.java:24 String HS256 = "HS256";
2. core/src/main/java/org/keycloak/crypto/Algorithm.java:25 String HS384 = "HS384";
3. core/src/main/java/org/keycloak/crypto/Algorithm.java:26 String HS512 = "HS512";
4. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:740 test path "HS256":{
5. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:743 test path "HS512":{
6. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:758 test path "HS384":{
7. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:1507 test path "HS256":{
8. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:1510 test path "HS512":{
9. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:1525 test path "HS384":{
10. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4708 test path "defaultValue":"HS256",
11. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4710 test path "HS256",
12. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4711 test path "HS384",
13. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:4712 test path "HS512"
14. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:526 test path "HS256": { "order": 0 },
15. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:527 test path "HS512": { "order": 0 },
16. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:532 test path "HS384": { "order": 0 },
17. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:928 test path "HS256": { "order": 0 },
18. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:929 test path "HS512": { "order": 0 },
19. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:934 test path "HS384": { "order": 0 },
20. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:4607 test path "defaultValue": "HS256",
21. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:4608 test path "options": ["HS256", "HS384", "HS512"],
22. js/apps/admin-ui/test/clients/advanced.spec.ts:73 test path await selectAccessTokenSignatureAlgorithm(page, "HS384");
23. quarkus/tests/integration/src/test/resources/fgap-realm.json:1995 test path "algorithm" : [ "HS512" ]
24. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCJWTIssuerEndpointTest.java:862 test path String hs256JwtProof = withModifiedHeaderClaim(validJwtProof, "alg", "HS256");
25. tests/base/src/test/resources/org/keycloak/tests/admin/user/testrealm-user-null-attr.json:1072 test path "algorithm" : [ "HS256" ]
26. tests/base/src/test/resources/org/keycloak/tests/model/acr-values-import-bug.json:1730 test path "HS512"
27. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/AuthzClientCredentialsTest.java:96 test path .attribute(OIDCConfigAttributes.TOKEN_ENDPOINT_AUTH_SIGNING_ALG, "HS512")
28. testsuite/integration-arquillian/tests/base/src/test/resources/authorization-test/keycloak-with-jwt-hs512-authentication.json:8 test path "algorithm": "HS512"
29. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-13.0.1-client-policies.json:2106 test path "algorithm" : [ "HS256" ]
30. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-17.0.0.json:1257 test path "algorithm" : [ "HS256" ]
31. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-17.0.0.json:2990 test path "algorithm" : [ "HS256" ]
32. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-17.0.0.json:5220 test path "algorithm" : [ "HS256" ]
33. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-19.0.3.json:1304 test path "algorithm" : [ "HS256" ]
34. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-19.0.3.json:3105 test path "algorithm" : [ "HS256" ]
35. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-19.0.3.json:5338 test path "algorithm" : [ "HS256" ]
36. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-24.0.4.json:1647 test path "algorithm" : [ "HS256" ]
37. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-24.0.4.json:1658 test path "algorithm" : [ "HS512" ]
38. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-24.0.4.json:3634 test path "algorithm" : [ "HS512" ]
39. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-24.0.4.json:3645 test path "algorithm" : [ "HS256" ]
40. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-24.0.4.json:5460 test path "algorithm" : [ "HS256" ]
41. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-24.0.4.json:5482 test path "algorithm" : [ "HS512" ]
42. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-4.8.3.Final.json:1116 test path "algorithm" : [ "HS256" ]
43. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-4.8.3.Final.json:2507 test path "algorithm" : [ "HS256" ]
44. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-4.8.3.Final.json:4326 test path "algorithm" : [ "HS256" ]
45. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-9.0.3.json:1184 test path "algorithm" : [ "HS256" ]
46. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-9.0.3.json:2808 test path "algorithm" : [ "HS256" ]
47. testsuite/integration-arquillian/tests/base/src/test/resources/migration-test/migration-realm-9.0.3.json:4897 test path "algorithm" : [ "HS256" ]
48. testsuite/integration-arquillian/tests/base/src/test/resources/model/acr-values-import-bug.json:1730 test path "HS512"
49. testsuite/integration-arquillian/tests/base/src/test/resources/token-exchange/testrealm-token-exchange-v2.json:2017 test path "algorithm" : [ "HS512" ]

jose.algorithm · CWE-327

CSPRNG Quantum-safe 38 places See details

Random number generation

`SecureRandom`. A platform CSPRNG is not a quantum exposure; it is recorded because an inventory that omits the randomness source is incomplete. `SHA1PRNG` is named explicitly where it appears, since it is a legacy algorithm even though its output is adequate.

This is where the software gets its random numbers. Quantum computers do not weaken it.

What to do. No action. Prefer the platform default over naming an algorithm.

1. adapters/saml/core/src/main/java/org/keycloak/adapters/cloned/HttpClientBuilder.java:265 new SecureRandom());
2. common/src/main/java/org/keycloak/common/util/KeyUtils.java:89 SecureRandom randomGen = new SecureRandom();
3. common/src/main/java/org/keycloak/common/util/SecretGenerator.java:34 private static final SecureRandom SECURE_RANDOM = new SecureRandom();
4. core/src/main/java/org/keycloak/jose/jwe/JWEUtils.java:32 new SecureRandom().nextBytes(buf);
5. core/src/main/java/org/keycloak/mdoc/MdocCredential.java:45 private static final SecureRandom RANDOM = new SecureRandom();
6. core/src/main/java/org/keycloak/sdjwt/SdJwtUtils.java:43 private static final SecureRandom RANDOM = new SecureRandom();
7. core/src/test/java/org/keycloak/jose/jwk/JWKTest.java:141 test path SecureRandom randomGen = new SecureRandom();
8. crypto/default/src/main/java/org/keycloak/crypto/def/BCCertificateUtilsProvider.java:97 SecureRandom random = new SecureRandom();
9. crypto/default/src/main/java/org/keycloak/crypto/def/BCEcdhEsAlgorithmProvider.java:133 SecureRandom randomGen = new SecureRandom();
10. crypto/default/src/test/java/org/keycloak/crypto/def/test/DefaultSecureRandomTest.java:36 test path SecureRandom sc1 = new SecureRandom();
11. crypto/elytron/src/main/java/org/keycloak/crypto/elytron/ElytronCertificateUtilsProvider.java:99 SecureRandom random = SecureRandom.getInstance("SHA1PRNG");
12. crypto/elytron/src/main/java/org/keycloak/crypto/elytron/ElytronEcdhEsAlgorithmProvider.java:126 SecureRandom randomGen = SecureRandom.getInstance("SHA1PRNG");
13. crypto/elytron/src/test/java/org/keycloak/crypto/elytron/test/ElytronHmacTest.java:42 test path SecureRandom random = isWindows() ? SecureRandom.getInstance("Windows-PRNG") : SecureRandom.getInstance("NativePRNG");
14. crypto/elytron/src/test/java/org/keycloak/crypto/elytron/test/ElytronSecureRandomTest.java:43 test path SecureRandom sc1 = new SecureRandom();
15. crypto/fips1402/src/main/java/org/keycloak/crypto/fips/BCFIPSCertificateUtilsProvider.java:98 SecureRandom random = new SecureRandom();
16. crypto/fips1402/src/main/java/org/keycloak/crypto/fips/BCFIPSEcdhEsAlgorithmProvider.java:143 SecureRandom randomGen = SecureRandom.getInstance("DEFAULT", "BCFIPS");
17. crypto/fips1402/src/main/java/org/keycloak/crypto/fips/FIPS1402Provider.java:347 SecureRandom secRandom = new SecureRandom();
18. crypto/fips1402/src/main/java/org/keycloak/crypto/fips/FIPSRsaKeyEncryptionJWEAlgorithmProvider.java:41 .withSecureRandom(SecureRandom.getInstance("DEFAULT"));
19. crypto/fips1402/src/test/java/org/keycloak/crypto/fips/test/FIPS1402SecureRandomTest.java:40 test path SecureRandom sc1 = new SecureRandom();
20. federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/HardcodedLDAPAttributeMapper.java:94 SecureRandom r = new SecureRandom();
21. model/infinispan/src/main/java/org/keycloak/connections/infinispan/TopologyInfo.java:85 return InfinispanConnectionProvider.NODE_PREFIX + new SecureRandom().nextInt(1000000);
22. model/jpa/src/main/java/org/keycloak/models/jpa/MigrationModelAdapter.java:90 sb.append(RESOURCE_TAG_CHARSET[new SecureRandom().nextInt(RESOURCE_TAG_CHARSET.length)]);
23. operator/src/test/java/org/keycloak/operator/testsuite/utils/TrustAllSSLContext.java:49 test path sslContext.init(null, trustAllCerts, new SecureRandom());
24. saml-core/src/main/java/org/keycloak/saml/RandomSecret.java:37 SecureRandom random = new SecureRandom();
25. server-spi-private/src/main/java/org/keycloak/credential/hash/Pbkdf2PasswordHashProvider.java:128 SecureRandom secureRandom = new SecureRandom();
26. server-spi-private/src/main/java/org/keycloak/credential/hash/Salt.java:8 SecureRandom secureRandom = new SecureRandom();
27. server-spi/src/main/java/org/keycloak/models/utils/HmacOTP.java:51 SecureRandom r = new SecureRandom();
28. services/src/main/java/org/keycloak/connections/httpclient/HttpClientBuilder.java:273 new SecureRandom());
29. services/src/main/java/org/keycloak/protocol/docker/installation/compose/DockerComposeCertsDirectory.java:30 keyGen.initialize(2048, new SecureRandom());
30. services/src/main/java/org/keycloak/protocol/saml/DefaultSamlArtifactResolver.java:104 SecureRandom handleGenerator = new SecureRandom();
31. services/src/test/java/org/keycloak/procotol/docker/installation/DockerComposeYamlInstallationProviderTest.java:56 test path keyGen.initialize(2048, new SecureRandom());
32. services/src/test/java/org/keycloak/procotol/docker/installation/DockerKeyIdentifierTest.java:28 test path keyGen.initialize(2048, new SecureRandom());
33. test-framework/core/src/main/java/org/keycloak/testframework/server/DistributionKeycloakServer.java:297 test path sslContext.init(null, new TrustManager[] { new NullTrustManager() }, new SecureRandom());
34. tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCKeyAttestationTest.java:129 test path private static final SecureRandom RANDOM = new SecureRandom();
35. tests/base/src/test/java/org/keycloak/tests/oid4vc/presentation/OID4VPTrustMaterialDelegationTest.java:326 test path private static final SecureRandom RANDOM = new SecureRandom();
36. tests/conformance/src/test/java/org/keycloak/tests/conformance/ConformanceSigningKey.java:75 test path private static final SecureRandom RANDOM = new SecureRandom();
37. tests/conformance/src/test/java/org/keycloak/tests/conformance/vci/VciTestSigningKey.java:62 test path private static final SecureRandom RANDOM = new SecureRandom();
38. util/embedded-ldap/src/main/java/org/keycloak/util/ldap/TLS13StartTlsHandler.java:72 new SecureRandom());

java.rng

HMAC Quantum-safe 13 places See details

Key material constructed for a named algorithm

`new SecretKeySpec(bytes, "AES")` and the other key-spec constructors name the algorithm as an argument rather than through `getInstance()`. Code that wraps raw bytes into a key this way often never calls `getInstance()` at all, so the algorithm is invisible to a scan that only looks at the factories.

This wraps raw bytes into a key for a named algorithm. It is part of the same migration as whatever uses that key.

What to do. Wherever this key is used, the same migration applies as to the call that consumes it. Trace it to the operation and treat the two together.

1. common/src/test/java/org/keycloak/common/util/KeyUtilsTest.java:18 test path SecretKeySpec expected = new SecretKeySpec(secretBytes, "HmacSHA256");
2. core/src/main/java/org/keycloak/jose/jwe/enc/AesCbcHmacShaEncryptionProvider.java:169 SecretKeySpec hmacKey = new SecretKeySpec(cekMacKey, "HMACSHA2");
3. core/src/test/java/org/keycloak/jose/HmacTest.java:47 test path SecretKey secretKey = new SecretKeySpec(UUID.randomUUID().toString().getBytes(), "HmacSHA256");
4. core/src/test/java/org/keycloak/jose/HmacTest.java:53 test path SecretKey secretKey = new SecretKeySpec("secret".getBytes(), "HmacSHA256");
5. core/src/test/java/org/keycloak/jose/JWETest.java:67 test path SecretKey hmacKey = new SecretKeySpec(HMAC_SHA256_KEY, "HMACSHA2");
6. core/src/test/java/org/keycloak/jose/JWETest.java:77 test path final SecretKey hmacKey = new SecretKeySpec(HMAC_SHA512_KEY, "HMACSHA2");
7. core/src/test/java/org/keycloak/jose/JWETest.java:122 test path SecretKey hmacKey = new SecretKeySpec(HMAC_SHA256_KEY, "HMACSHA2");
8. core/src/test/java/org/keycloak/jose/JWETest.java:186 test path final SecretKey hmacKey = new SecretKeySpec(HMAC_SHA256_KEY, "HMACSHA2");
9. core/src/test/java/org/keycloak/jose/JWETest.java:209 test path final SecretKey hmacKey = new SecretKeySpec(HMAC_SHA512_KEY, "HMACSHA2");
10. core/src/test/java/org/keycloak/jose/JWETest.java:308 test path final SecretKey hmacKey = new SecretKeySpec(HMAC_SHA256_KEY, "HMACSHA2");
11. crypto/elytron/src/test/java/org/keycloak/crypto/elytron/test/ElytronCryptoJWETest.java:32 test path final SecretKey hmacKey = new SecretKeySpec(HMAC_SHA512_KEY, "HMACSHA2");
12. crypto/fips1402/src/test/java/org/keycloak/crypto/fips/test/FIPS1402HmacTest.java:34 test path SecretKey secretKey = skFact.generateSecret(new SecretKeySpec(UUID.randomUUID().toString().getBytes(), "HmacSHA256"));
13. server-spi-private/src/main/java/org/keycloak/models/utils/KeycloakModelUtils.java:228 return secret != null ? new SecretKeySpec(secret.getBytes(), "HmacSHA256") : null;

java.keyspec · CWE-327

AES-256 Quantum-safe Renamed import 11 places See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. core/src/main/java/org/keycloak/jose/jwe/JWEConstants.java:39 public static final String A256CBC_HS512 = "A256CBC-HS512";
2. core/src/main/java/org/keycloak/jose/jwe/JWEConstants.java:42 public static final String A256GCM = "A256GCM";
3. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:848 test path "A256GCM":{
4. js/apps/admin-ui/src/clients/add/__tests__/mock-serverinfo.json:863 test path "A256CBC-HS512":{
5. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:589 test path "A256GCM": { "order": 0 },
6. js/apps/admin-ui/src/context/server-info/__tests__/mock.json:594 test path "A256CBC-HS512": { "order": 0 }
7. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerWellKnownProviderTest.java:513 test path assertTrue(credentialIssuer.getCredentialResponseEncryption().getEncValuesSupported().contains("A256GCM"),
8. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerWellKnownProviderTest.java:521 test path assertTrue(credentialIssuer.getCredentialRequestEncryption().getEncValuesSupported().contains("A256GCM"),
9. tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCJWTIssuerEndpointTest.java:362 test path .setEnc("A256GCM")
10. tests/base/src/test/java/org/keycloak/tests/oid4vc/presentation/OID4VPDirectPostJwtTest.java:75 test path assertEquals(List.of("A128GCM", "A256GCM"), JsonSerialization.mapper.convertValue(
11. tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/oid4vc/Oid4vcCredentialRequest.java:120 test path .encryptionAlgorithm("A256GCM")

jose.algorithm · CWE-327

AES-256 Quantum-safe 6 places See details

XML signature or encryption algorithm

An XML Signature or XML Encryption algorithm URI - SAML, XAdES or WS-Security. The URI names the algorithm exactly, and a signature URI names its digest as well, so `#rsa-sha1` reports both the key and the broken digest.

Federated login and signed XML documents name their cryptography in a web address. Some of those addresses name algorithms that are already broken.

What to do. Move off `#rsa-sha1` first: that signature is forgeable today, with no quantum computer involved. The key algorithm changes with the wider migration.

1. js/apps/admin-ui/src/clients/add/SamlEncryption.tsx:55 key: "http://www.w3.org/2009/xmlenc11#aes256-gcm",
2. js/apps/admin-ui/src/clients/add/SamlEncryption.tsx:67 key: "http://www.w3.org/2001/04/xmlenc#aes256-cbc",
3. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:57 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
4. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:98 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
5. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:137 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
6. saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-4236-AttributeProfile-element.xml:176 test path <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>

xmldsig.algorithm · CWE-327

CSPRNG Quantum-safe 6 places See details

Random number generation

`crypto.randomBytes()`, `randomUUID()` or `getRandomValues()`. A platform CSPRNG is not a quantum exposure; it is recorded because an inventory that omits the randomness source is incomplete. `Math.random()` is a separate, present-day defect.

This is where the software gets its random numbers. Quantum computers do not weaken it.

What to do. No action.

1. js/apps/account-ui/test/support/testbed.ts:16 test path realm: crypto.randomUUID(),
2. js/apps/admin-ui/src/components/dynamic/ClaimDisplayComponent.tsx:29 const generateId = () => crypto.randomUUID();
3. js/apps/admin-ui/test/clients/authorization.spec.ts:48 test path const clientId = `client-authentication-${crypto.randomUUID()}`;
4. js/apps/admin-ui/test/realm-settings/events.spec.ts:21 test path const realmName = `events-realm-settings-${crypto.randomUUID()}`;
5. js/apps/admin-ui/test/support/testbed.ts:12 test path crypto.randomUUID(),
6. js/themes-vendor/src/main/js/web-crypto-shim.js:44 crypto.getRandomValues(arr);

js.rng

Argon2 Quantum-safe 4 places See details

Password hashing or key derivation

A `SecretKeyFactory` for PBKDF2, or a BouncyCastle password KDF. Not a quantum exposure, and part of a complete inventory.

This is how passwords are stored. Quantum computers do not meaningfully weaken it.

What to do. PBKDF2 needs a high iteration count. Argon2 through BouncyCastle is stronger.

1. crypto/default/src/main/java/org/keycloak/crypto/hash/Argon2PasswordHashProvider.java:19 import org.bouncycastle.crypto.generators.Argon2BytesGenerator;
2. crypto/default/src/main/java/org/keycloak/crypto/hash/Argon2PasswordHashProvider.java:124 Argon2BytesGenerator generator = new Argon2BytesGenerator();
3. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/PasswordHashingTest.java:65 test path import org.bouncycastle.crypto.generators.Argon2BytesGenerator;
4. testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/PasswordHashingTest.java:428 test path Argon2BytesGenerator generator = new Argon2BytesGenerator();

java.kdf

HMAC Quantum-safe 2 places See details

Classical public-key cipher through the JCA

`Cipher.getInstance()` with a transformation whose algorithm component is a public-key or legacy symmetric cipher. The transformation string is parsed into algorithm, mode and padding, so `RSA/ECB/PKCS1Padding` is separated from `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`.

No known quantum attack changes how strong this is. A keyed MAC is not affected by Shor and only marginally by Grover.

What to do. For RSA encryption, move to ML-KEM-768 and keep RSA-OAEP only as the classical half of a hybrid during transition.

1. crypto/elytron/src/test/java/org/keycloak/crypto/elytron/test/ElytronHmacTest.java:41 test path KeyGenerator keygen = KeyGenerator.getInstance("HmacSHA256");
2. crypto/fips1402/src/test/java/org/keycloak/crypto/fips/test/FIPS1402HmacTest.java:33 test path SecretKeyFactory skFact = SecretKeyFactory.getInstance("HmacSHA256", BouncyIntegration.PROVIDER );

java.cipher · CWE-327

SHA-512 Quantum-safe 2 places See details

XML signature or encryption algorithm

An XML Signature or XML Encryption algorithm URI - SAML, XAdES or WS-Security. The URI names the algorithm exactly, and a signature URI names its digest as well, so `#rsa-sha1` reports both the key and the broken digest.

Federated login and signed XML documents name their cryptography in a web address. Some of those addresses name algorithms that are already broken.

What to do. Move off `#rsa-sha1` first: that signature is forgeable today, with no quantum computer involved. The key algorithm changes with the wider migration.

1. js/apps/admin-ui/src/clients/add/SamlEncryption.tsx:118 key: "http://www.w3.org/2001/04/xmlenc#sha512",
2. saml-core/src/main/java/org/keycloak/saml/SignatureAlgorithm.java:32 RSA_SHA512("http://www.w3.org/2001/04/xmldsig-more#rsa-sha512", "http://www.w3.org/2001/04/xmlenc#sha512", "SHA512withRSA"),

xmldsig.algorithm · CWE-327

ML-DSA-44 Quantum-safe 1 place See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. core/src/main/java/org/keycloak/crypto/Algorithm.java:58 String ML_DSA_44 = "ML-DSA-44";

jose.algorithm · CWE-327

ML-DSA-65 Quantum-safe 1 place See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. core/src/main/java/org/keycloak/crypto/Algorithm.java:59 String ML_DSA_65 = "ML-DSA-65";

jose.algorithm · CWE-327

ML-DSA-87 Quantum-safe 1 place See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

1. core/src/main/java/org/keycloak/crypto/Algorithm.java:60 String ML_DSA_87 = "ML-DSA-87";

jose.algorithm · CWE-327