{ "artifacts": { "inventory": { "cbom": { "bomFormat": "CycloneDX", "components": [ { "bom-ref": "8f083273ced1cb84", "cryptoProperties": { "algorithmProperties": { "primitive": "hash" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "config.py:449" } ] }, "name": "SHA1", "properties": [ { "name": "mcr:quantum_risk", "value": "BROKEN" }, { "name": "mcr:risk_rationale", "value": "weak against collisions without a quantum computer (SHAttered, 2017); whether that matters depends on the use (signatures and certificates: yes; fingerprints, file names, HMAC: much less)" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "dcb66e27f0ed4f82", "cryptoProperties": { "algorithmProperties": { "primitive": "hash" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "pkey.py:390" } ] }, "name": "MD5", "properties": [ { "name": "mcr:quantum_risk", "value": "BROKEN" }, { "name": "mcr:risk_rationale", "value": "weak against collisions without a quantum computer; whether that matters depends on the use (signatures and certificates: yes; fingerprints, file names, HMAC: much less)" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "31d0c02cd44c7dfc", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "agent.py:53" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "6a299e2ccce775a0", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "agent.py:54" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "d0b45e653bbbed2a", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "client.py:430" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "57bb7f95731b94b0", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "client.py:431" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "a6014fb758a3b3ce", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "client.py:432" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "a9118afad8850563", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "client.py:433" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "c59a0b7648d5e7ea", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "client.py:434" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "03bf553b6ee4ad5f", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ecdsakey.py:167" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "1cd043c106e65fd3", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ecdsakey.py:224" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "978032285fc9ebde", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ecdsakey.py:242" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "18d9679f039891e7", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ecdsakey.py:254" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "24f81ddd2d679f1b", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ecdsakey.py:268" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "65a2bdf3a47e2fcb", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ecdsakey.py:305" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "f204806ede58fb7b", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ed25519key.py:42" } ] }, "name": "ED25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EdDSA; Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "2952ba9c74ae802e", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_curve25519.py:109" } ] }, "name": "X25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EC Diffie-Hellman; broken by Shor's algorithm" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "678e9a7114c14486", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_curve25519.py:30" } ] }, "name": "X25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EC Diffie-Hellman; broken by Shor's algorithm" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "38a66427b03c4223", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_curve25519.py:45" } ] }, "name": "X25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EC Diffie-Hellman; broken by Shor's algorithm" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "c017e478905e3c4c", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_curve25519.py:71" } ] }, "name": "X25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EC Diffie-Hellman; broken by Shor's algorithm" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "10f8eb6672d3b7f1", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:113" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "b1fb80518b7523c1", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:117" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "04ed476de2475d60", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-384", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:143" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "aab2d23360b2d8c0", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:145" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "d865eee6f06bef35", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-521", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:149" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "8daef9e3f374dfc7", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:151" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "559161719afc8330", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-256", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:21" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "bafdf1dd0f03fb4b", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:23" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "d180ea92efdcae01", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:59" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "93e5494400330294", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:67" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "9fa28b3b854efba2", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:71" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "cf31125467acfdff", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_gex.py:51" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "316a95ebccd2d2e6", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_group14.py:45" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "30ee6b55d7b1d060", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_group16.py:30" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "2ccf7aa25c086076", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_group16.py:35" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "f0bd45532432673d", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:184" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "3277315cc6d8bf38", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:210" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "2c8df9ba83e76d01", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:211" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "5b85ecdfa2f4562d", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:41" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "00b5575fa92fe493", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:43" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "b8ac49ecdbca5a8c", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:45" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "7c9349441db4566d", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:78" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "fe4f03aab0a26cf4", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:89" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "5dbf0be978a38a9b", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:1317" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "7637e1684f7e91e5", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:1318" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "876fcde880f7bba0", "cryptoProperties": { "algorithmProperties": { "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:182" } ] }, "name": "3DES", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "64-bit block + Grover; already deprecated (SP 800-131A)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "6fa80958f8b4752f", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:198" } ] }, "name": "ED25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EdDSA; Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "b4ee5a8eaa13afac", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-256", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:199" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "de94231c23c82697", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-384", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:200" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "3b877dea7c7cc52f", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-521", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:201" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "cab9021735f35a67", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:202" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "46221a635c96e929", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:203" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "bb275c07392f0599", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:207" } ] }, "name": "ED25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EdDSA; Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "599b1755bf3aae8c", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-256", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:208" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "e6c93846392e07da", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-384", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:209" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "c241f2fa8c88648f", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-521", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:210" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "87dd8ea66a65ff36", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:211" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "b0367f0c560dbf23", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:212" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "71134e3d2023ed29", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-256", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:215" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "5f3bc4641b1445d5", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-384", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:216" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "fa19272e01fc9153", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-521", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:217" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "8f42a157930da077", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:218" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "72da4fcd50509ec9", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:219" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "b8d41fa2e17580e5", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:220" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "079a638d7957db78", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:223" } ] }, "name": "X25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EC Diffie-Hellman; broken by Shor's algorithm" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "58e4363efea02da7", "cryptoProperties": { "algorithmProperties": { "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:263" } ] }, "name": "3DES", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "64-bit block + Grover; already deprecated (SP 800-131A)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "c4cd716d0ff68307", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:309" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "ae7cda36dc275580", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:311" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "649003fb428bc948", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-256", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:313" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "d26ef1558c7307e2", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-384", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:315" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "d8590580836cbd39", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-521", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:317" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "ffce5280049914e8", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:319" } ] }, "name": "ED25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EdDSA; Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "1562f915751bac1b", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:324" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "5d9e7c7a634de435", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:325" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "e3acb560a29234fe", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:326" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "2fd73eafb21846c4", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-256", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:327" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "a823358a48292cdb", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-384", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:328" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "592a0cf749dc9e5c", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-521", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:329" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "6f0dca8e23c81737", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:332" } ] }, "name": "X25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EC Diffie-Hellman; broken by Shor's algorithm" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "938aad0bd952ed1e", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:790" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "41228ef336c16fba", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:791" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "6f56df010fd77722", "cryptoProperties": { "algorithmProperties": { "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "pkey.py:727" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "MODERATE" }, { "name": "mcr:risk_rationale", "value": "key size not determined from the source; confirm it (AES-256 for long-lived secrets); Grover gives at most a square-root speedup in theory, not a practical break" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "a078ce0d0f87caae", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "128", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:176" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "MODERATE" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory, and its serial iterations parallelise poorly; NIST treats AES-128 as secure against known quantum attacks. Prefer AES-256 for long-lived secrets or where a policy you follow requires it" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "33df796db83020be", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "128", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:179" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "MODERATE" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory, and its serial iterations parallelise poorly; NIST treats AES-128 as secure against known quantum attacks. Prefer AES-256 for long-lived secrets or where a policy you follow requires it" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "4052662ae8422d5e", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "128", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:227" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "MODERATE" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory, and its serial iterations parallelise poorly; NIST treats AES-128 as secure against known quantum attacks. Prefer AES-256 for long-lived secrets or where a policy you follow requires it" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "edca17798b17d12f", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "128", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:245" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "MODERATE" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory, and its serial iterations parallelise poorly; NIST treats AES-128 as secure against known quantum attacks. Prefer AES-256 for long-lived secrets or where a policy you follow requires it" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "d8bf6502216f415b", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "hostkeys.py:300" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "77d9b122edd68ae2", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "packet.py:47" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "eb93ce26fd1ae334", "cryptoProperties": { "algorithmProperties": { "primitive": "hash" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "pkey.py:401" } ] }, "name": "SHA256", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; not a practical break" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "724c5e9e32074f0f", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "256", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "pkey.py:691" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; the recommended size for long-lived secrets" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "d25c174dd8f786d3", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "256", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "pkey.py:693" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; the recommended size for long-lived secrets" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "15afe14173d3e5fe", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "192", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:177" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; not a practical break" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "1db788a572dc6435", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "256", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:178" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; the recommended size for long-lived secrets" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "f052c2d76a000280", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "192", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:180" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; not a practical break" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "dd98194141e0e7f2", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "256", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:181" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; the recommended size for long-lived secrets" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "de8a13586c1ef9b1", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:187" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "267483fdbfe48bcb", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:188" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "ae7c91f603ea85e2", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:191" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "4c40e529451283bd", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:192" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "cabe0563ddf9427c", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:193" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "a765e8e5881a72ad", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:194" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "81638332bcd0782c", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "192", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:233" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; not a practical break" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "cd30821eb79ff408", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "256", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:239" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; the recommended size for long-lived secrets" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "1a65e2f6f95b29bc", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "192", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:251" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; not a practical break" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "49de2066d60147d4", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "256", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:257" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; the recommended size for long-lived secrets" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "ca176faf7e5b1db1", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:286" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "5cde8a8916cc4628", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:287" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "b3848d0bbcedeb4a", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:288" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "c4ac5085714de8f4", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:290" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "9ccdbe5567af9c9e", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:292" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "c4ad8854e3aede88", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:293" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" } ], "metadata": { "component": { "name": "paramiko 5.0.0", "type": "application" }, "properties": [ { "name": "mcr:files_scanned", "value": "41" }, { "name": "mcr:manifests_scanned", "value": "0" }, { "name": "mcr:scope", "value": "source-ast+manifest+regex" }, { "name": "mcr:known_gaps", "value": "transitive-dependency crypto, binary/compiled deps, dynamically-loaded crypto, and obfuscated/minified code are NOT fully covered in v0; a CBOM is an inventory, not a correctness proof." } ], "timestamp": "2026-09-30T17:39:07.194232+00:00", "tools": [ { "name": "CBOM Generator", "vendor": "Matrix CR Studio", "version": "0.1.0" } ] }, "serialNumber": "urn:uuid:14405ccf-709a-5555-96ea-4720a1f98834", "specVersion": "1.7", "version": 1 }, "coherent": true, "files_read": [ { "path": "__init__.py", "sha3_256": "d9ed63b78eed66ea8fc2a6514fe8916a89c1f39dc88e43d3932e22ae7a42371c" }, { "path": "_winapi.py", "sha3_256": "02d9110a88935243cf490a5d585f41fb1738f9719ed547a12fd5accef6b476d7" }, { "path": "agent.py", "sha3_256": "871a0d05daf66c4080966efc937a06ee81f60710a0bfab11cac5f4482b21f132" }, { "path": "auth_handler.py", "sha3_256": "ed414ba174ada8789324fb61fdbb6bc5b40050e6904be9c63ece714b4afafa89" }, { "path": "auth_strategy.py", "sha3_256": "cd31d362021018497008bff57ff7ce8f8ec40a1294c582a70ba814c30aac787b" }, { "path": "ber.py", "sha3_256": "5843d88e8c1faa3fee602e5ca9d06eaec91b61c53c093b4f5d6acebc4f210abf" }, { "path": "buffered_pipe.py", "sha3_256": "0b9e01140bb0527cf433e256b3df2a053a5a2a43a6086d7a1ff0409352cf1330" }, { "path": "channel.py", "sha3_256": "6b5b71428730560c61d0bf4f7b2ee6269f418890a817ad97a160f45dc19dd5f3" }, { "path": "client.py", "sha3_256": "764e2b08a1b0d0bc14f1609e811a2a1a1bbe30a5fcb3d51d310093344b7b1396" }, { "path": "common.py", "sha3_256": "a17f2ab8194836bf0e0731121ae2bd782f3b088d3efa80212ba4c88f112fd450" }, { "path": "compress.py", "sha3_256": "f9d68da3455236398313df05a36f633a94a4a65d6e29fce55c0f15cf8845947a" }, { "path": "config.py", "sha3_256": "936442dd2782c10b000c5800732734d22457561ce44d6844197fa0f3e08c8e94" }, { "path": "ecdsakey.py", "sha3_256": "6ddb438a4085ff15f840308bb9299b5ad19b0082c556ab7f730873aabefd14ab" }, { "path": "ed25519key.py", "sha3_256": "70555dd89175df1664bff497efc689134fa38859814542a83549fddf263a9c26" }, { "path": "file.py", "sha3_256": "8014dea10054193c12f479b73aea9dde08d374b654c86b6ef113535c9b553c9f" }, { "path": "hostkeys.py", "sha3_256": "9809ebbfa10b54342991cc732d0f456523fd9976eddb99133332920789004641" }, { "path": "kex_curve25519.py", "sha3_256": "d074e80283473cf61bc349b57e9b974b1c9bfa02a9d7bd4b8896053868806727" }, { "path": "kex_ecdh_nist.py", "sha3_256": "4dae6dde650ab1bae499030c86bbe642dddd9b3f77405483fb4800482f809fa1" }, { "path": "kex_gex.py", "sha3_256": "9358f2fe3c49571b717b5e77157b57b0404b91337f03424a8ef0a171ba447bcf" }, { "path": "kex_group14.py", "sha3_256": "70d1e13099b20190f38034f9df484dcd06a9553a9ec0bbc2c1c98e59d2b2d4a6" }, { "path": "kex_group16.py", "sha3_256": "d364931437e12cab7c81ba5be2fe708c4a8fcef8e0e4c426909625662ef38624" }, { "path": "message.py", "sha3_256": "e7d7b06a035e9b37ecec1485102976518102af1636443e7eabe17ab7ba08d210" }, { "path": "packet.py", "sha3_256": "340381de84eba3e28701b92671c73911a0fe0b5a194fbc811cb3ca09ef89cde2" }, { "path": "pipe.py", "sha3_256": "2f74293bb0a6cb32dd2a1dace113ef7c9860489428afb0166380a0521f0e33c5" }, { "path": "pkey.py", "sha3_256": "daeb22e398a808b48e73c43aa2a859b44f2ab700d9d0f769d985b354c7bb4d00" }, { "path": "primes.py", "sha3_256": "05116e85554842605794d79a902881983b0b907a435b10c558c8d1055b73e9e4" }, { "path": "proxy.py", "sha3_256": "adb20a3d4178005a97f4d882996e280988f0b27994a3c7157c1e3334e8836814" }, { "path": "rsakey.py", "sha3_256": "1b83e03d7c3dc81722824bb52985072208c524cf4e8c45e6fd8995deff994ce3" }, { "path": "server.py", "sha3_256": "a677480b9506f3267f1b6aa2b2bf5f4276bc47c106dd6424fe7d22b25cce6fa9" }, { "path": "sftp.py", "sha3_256": "c1221ca69bc4edae00910a29ec3eca757ec6ba70a2486f5710504f1b4c01ec75" }, { "path": "sftp_attr.py", "sha3_256": "e56be9b2facd2953a539c5fa2d4ad7f9203ed865b5bae7a7723e79eef444b112" }, { "path": "sftp_client.py", "sha3_256": "fb655aa2f76db599cd058821528360b245ad4c6ff10e98a9e0393a348ff171bf" }, { "path": "sftp_file.py", "sha3_256": "b5a7d6d367ca2f4b1c2b83e27abe3cf77cc4fc787a525753a52ac7b0aa2cd1da" }, { "path": "sftp_handle.py", "sha3_256": "77e23a2ef2ca6c397b401963f8cd523cd99364da33922f1fe7c88d308fd7b781" }, { "path": "sftp_server.py", "sha3_256": "a899cad01bc14ff4b636a889208676dc7a1196fb2eb91a0ee4c88aa05d117145" }, { "path": "sftp_si.py", "sha3_256": "66795e5cdb15d246bb77f94e741b2177d9da647851a4fe51128675c54abd549f" }, { "path": "ssh_exception.py", "sha3_256": "c910b3b155ecc26d8060674c522f83fbaa2ba8c057474e582e687f07751452c7" }, { "path": "transport.py", "sha3_256": "0dc623a6b0427476a2174322f1a1c51238f87bac8071045632a3ad1950078738" }, { "path": "util.py", "sha3_256": "829cc04e59634b6a0d10f0fd9a6f34fe450022e28fcaee058e3fe1a309c1daef" }, { "path": "win_openssh.py", "sha3_256": "39d40aac5c9a7ee3628d8f3b34f947c54b3079e84f4e49a562c003930eebc95e" }, { "path": "win_pageant.py", "sha3_256": "2d82b063ca41220aac65568224397d08bfc3eecce038cc947272098996b02aa1" } ], "status": "ok", "summary": { "blind_rsa": 0, "by_confidence": { "high": 28, "medium": 83 }, "by_quantum_risk": { "BROKEN": 2, "CRITICAL": 79, "LOW": 25, "MODERATE": 5 }, "quantum_vulnerable": 86, "total": 111, "unpadded_rsa": 0 } }, "plan": { "coherent": true, "honesty": { "complete_only_at_pqc_only": true, "execution_scope": "This plan is a document; on its own it changes nothing. Applying a step is a separate fix a named person approves, recorded step by step: approve, back up, apply, check, then keep or roll back.", "incomplete_assets": [ "DH", "ECDH", "ECDSA", "ED25519", "X25519" ], "incomplete_note": "DH, ECDH, ECDSA, ED25519, X25519: not fully migrated until the last phase, post-quantum only. During the hybrid phases the classical algorithm is still accepted, so traffic recorded then could be read later.", "requires_maintenance_window": [], "window_note": null }, "migration_plan": { "already_safe": 0, "atomic_groups": [], "migrating": 5, "sequenced_steps": [ { "action": "replace_classical", "asset": "3DES", "atomic_group": null, "complete": false, "current_phase": "classical", "downtime_automatable": true, "downtime_budget": "none for a code or config change; anything stored with the old algorithm (hashes, fingerprints, encrypted data) must be recomputed or re-encrypted, and every consumer must switch first", "downtime_class": "config", "phases_completed": [], "phases_planned": [], "rollback": "keep the old algorithm readable until every consumer has switched", "scc_id": 0, "source_primitive": "3DES", "target_algorithm": "AES-256" }, { "action": "confirm_key_size", "asset": "AES", "atomic_group": null, "complete": false, "current_phase": "classical", "downtime_automatable": true, "downtime_budget": "none yet: confirm the key size before planning a change", "downtime_class": "config", "phases_completed": [], "phases_planned": [], "rollback": null, "scc_id": 1, "source_primitive": "AES", "target_algorithm": "AES-256, if the key is smaller" }, { "action": "hybridize_then_replace", "asset": "DH", "atomic_group": null, "complete": false, "current_phase": "classical", "downtime_automatable": true, "downtime_budget": "none if clients support hybrid; the classical algorithm stays available until the post-quantum only phase", "downtime_class": "config", "phases_completed": [], "phases_planned": [ "hybrid_accept", "hybrid_prefer", "pqc_only" ], "rollback": "go back to the previous phase; the classical algorithm is accepted again", "scc_id": 2, "source_primitive": "DH", "target_algorithm": "ML-KEM-768" }, { "action": "confirm_use", "asset": "EC", "atomic_group": null, "complete": false, "current_phase": "classical", "downtime_automatable": true, "downtime_budget": "none yet: confirm how the key is used before choosing the target", "downtime_class": "config", "phases_completed": [], "phases_planned": [], "rollback": null, "scc_id": 3, "source_primitive": "EC", "target_algorithm": "ML-KEM-768 if used for key exchange or encryption; ML-DSA-65 if used for signatures" }, { "action": "hybridize_then_replace", "asset": "ECDH", "atomic_group": null, "complete": false, "current_phase": "classical", "downtime_automatable": true, "downtime_budget": "none if clients support hybrid; the classical algorithm stays available until the post-quantum only phase", "downtime_class": "config", "phases_completed": [], "phases_planned": [ "hybrid_accept", "hybrid_prefer", "pqc_only" ], "rollback": "go back to the previous phase; the classical algorithm is accepted again", "scc_id": 4, "source_primitive": "ECDH", "target_algorithm": "ML-KEM-768" }, { "action": "hybridize_then_replace", "asset": "ECDSA", "atomic_group": null, "complete": false, "current_phase": "classical", "downtime_automatable": true, "downtime_budget": "none if clients support hybrid; the classical algorithm stays available until the post-quantum only phase", "downtime_class": "config", "phases_completed": [], "phases_planned": [ "hybrid_accept", "hybrid_prefer", "pqc_only" ], "rollback": "go back to the previous phase; the classical algorithm is accepted again", "scc_id": 5, "source_primitive": "ECDSA", "target_algorithm": "ML-DSA-65" }, { "action": "hybridize_then_replace", "asset": "ED25519", "atomic_group": null, "complete": false, "current_phase": "classical", "downtime_automatable": true, "downtime_budget": "none if clients support hybrid; the classical algorithm stays available until the post-quantum only phase", "downtime_class": "config", "phases_completed": [], "phases_planned": [ "hybrid_accept", "hybrid_prefer", "pqc_only" ], "rollback": "go back to the previous phase; the classical algorithm is accepted again", "scc_id": 6, "source_primitive": "ED25519", "target_algorithm": "ML-DSA-65" }, { "action": "review", "asset": "HMAC", "atomic_group": null, "complete": false, "current_phase": "classical", "downtime_automatable": true, "downtime_budget": "none: review only; nothing changes", "downtime_class": "config", "phases_completed": [], "phases_planned": [], "rollback": null, "scc_id": 7, "source_primitive": "HMAC", "target_algorithm": null }, { "action": "replace_classical", "asset": "MD5", "atomic_group": null, "complete": false, "current_phase": "classical", "downtime_automatable": true, "downtime_budget": "none for a code or config change; anything stored with the old algorithm (hashes, fingerprints, encrypted data) must be recomputed or re-encrypted, and every consumer must switch first", "downtime_class": "config", "phases_completed": [], "phases_planned": [], "rollback": "keep the old algorithm readable until every consumer has switched", "scc_id": 8, "source_primitive": "MD5", "target_algorithm": "SHA-256 or SHA3-256" }, { "action": "confirm_use", "asset": "RSA", "atomic_group": null, "complete": false, "current_phase": "classical", "downtime_automatable": true, "downtime_budget": "none yet: confirm how the key is used before choosing the target", "downtime_class": "config", "phases_completed": [], "phases_planned": [], "rollback": null, "scc_id": 9, "source_primitive": "RSA", "target_algorithm": "ML-KEM-768 if used for key exchange or encryption; ML-DSA-65 if used for signatures" }, { "action": "replace_classical", "asset": "SHA1", "atomic_group": null, "complete": false, "current_phase": "classical", "downtime_automatable": true, "downtime_budget": "none for a code or config change; anything stored with the old algorithm (hashes, fingerprints, encrypted data) must be recomputed or re-encrypted, and every consumer must switch first", "downtime_class": "config", "phases_completed": [], "phases_planned": [], "rollback": "keep the old algorithm readable until every consumer has switched", "scc_id": 10, "source_primitive": "SHA1", "target_algorithm": "SHA-256 or SHA3-256" }, { "action": "review", "asset": "SHA256", "atomic_group": null, "complete": false, "current_phase": "classical", "downtime_automatable": true, "downtime_budget": "none: review only; nothing changes", "downtime_class": "config", "phases_completed": [], "phases_planned": [], "rollback": null, "scc_id": 11, "source_primitive": "SHA256", "target_algorithm": null }, { "action": "hybridize_then_replace", "asset": "X25519", "atomic_group": null, "complete": false, "current_phase": "classical", "downtime_automatable": true, "downtime_budget": "none if clients support hybrid; the classical algorithm stays available until the post-quantum only phase", "downtime_class": "config", "phases_completed": [], "phases_planned": [ "hybrid_accept", "hybrid_prefer", "pqc_only" ], "rollback": "go back to the previous phase; the classical algorithm is accepted again", "scc_id": 12, "source_primitive": "X25519", "target_algorithm": "ML-KEM-768" } ], "target_phase": "pqc_only", "total_assets": 13 }, "project": "paramiko 5.0.0", "status": "ok" }, "rank": { "assets": [ { "bom_ref": "58e4363efea02da7", "class": "broken", "locations": [ "transport.py:263" ], "margin": 5, "name": "3DES", "sum": 15, "tier": "BROKEN", "why": "Weak without a quantum computer (MD5 and SHA-1 against collisions, 3DES, DES and other 64-bit-block ciphers by their block size, RC4 outright). Whether that matters depends on the use; replace it where the format allows, whatever the horizon.", "x": 12, "y": 3 }, { "bom_ref": "876fcde880f7bba0", "class": "broken", "locations": [ "transport.py:182" ], "margin": 5, "name": "3DES", "sum": 15, "tier": "BROKEN", "why": "Weak without a quantum computer (MD5 and SHA-1 against collisions, 3DES, DES and other 64-bit-block ciphers by their block size, RC4 outright). Whether that matters depends on the use; replace it where the format allows, whatever the horizon.", "x": 12, "y": 3 }, { "bom_ref": "dcb66e27f0ed4f82", "class": "broken", "locations": [ "pkey.py:390" ], "margin": 5, "name": "MD5", "sum": 15, "tier": "BROKEN", "why": "Weak without a quantum computer (MD5 and SHA-1 against collisions, 3DES, DES and other 64-bit-block ciphers by their block size, RC4 outright). Whether that matters depends on the use; replace it where the format allows, whatever the horizon.", "x": 12, "y": 3 }, { "bom_ref": "8f083273ced1cb84", "class": "broken", "locations": [ "config.py:449" ], "margin": 5, "name": "SHA1", "sum": 15, "tier": "BROKEN", "why": "Weak without a quantum computer (MD5 and SHA-1 against collisions, 3DES, DES and other 64-bit-block ciphers by their block size, RC4 outright). Whether that matters depends on the use; replace it where the format allows, whatever the horizon.", "x": 12, "y": 3 }, { "bom_ref": "1562f915751bac1b", "class": "kex", "locations": [ "transport.py:324" ], "margin": 5, "name": "DH", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "2ccf7aa25c086076", "class": "kex", "locations": [ "kex_group16.py:35" ], "margin": 5, "name": "DH", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "30ee6b55d7b1d060", "class": "kex", "locations": [ "kex_group16.py:30" ], "margin": 5, "name": "DH", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "316a95ebccd2d2e6", "class": "kex", "locations": [ "kex_group14.py:45" ], "margin": 5, "name": "DH", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "5d9e7c7a634de435", "class": "kex", "locations": [ "transport.py:325" ], "margin": 5, "name": "DH", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "72da4fcd50509ec9", "class": "kex", "locations": [ "transport.py:219" ], "margin": 5, "name": "DH", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "8f42a157930da077", "class": "kex", "locations": [ "transport.py:218" ], "margin": 5, "name": "DH", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "b8d41fa2e17580e5", "class": "kex", "locations": [ "transport.py:220" ], "margin": 5, "name": "DH", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "cf31125467acfdff", "class": "kex", "locations": [ "kex_gex.py:51" ], "margin": 5, "name": "DH", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "e3acb560a29234fe", "class": "kex", "locations": [ "transport.py:326" ], "margin": 5, "name": "DH", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "03bf553b6ee4ad5f", "class": "unknown", "locations": [ "ecdsakey.py:167" ], "margin": 5, "name": "EC", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "10f8eb6672d3b7f1", "class": "unknown", "locations": [ "kex_ecdh_nist.py:113" ], "margin": 5, "name": "EC", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "18d9679f039891e7", "class": "unknown", "locations": [ "ecdsakey.py:254" ], "margin": 5, "name": "EC", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "1cd043c106e65fd3", "class": "unknown", "locations": [ "ecdsakey.py:224" ], "margin": 5, "name": "EC", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "24f81ddd2d679f1b", "class": "unknown", "locations": [ "ecdsakey.py:268" ], "margin": 5, "name": "EC", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "65a2bdf3a47e2fcb", "class": "unknown", "locations": [ "ecdsakey.py:305" ], "margin": 5, "name": "EC", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "8daef9e3f374dfc7", "class": "unknown", "locations": [ "kex_ecdh_nist.py:151" ], "margin": 5, "name": "EC", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "93e5494400330294", "class": "unknown", "locations": [ "kex_ecdh_nist.py:67" ], "margin": 5, "name": "EC", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "978032285fc9ebde", "class": "unknown", "locations": [ "ecdsakey.py:242" ], "margin": 5, "name": "EC", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "9fa28b3b854efba2", "class": "unknown", "locations": [ "kex_ecdh_nist.py:71" ], "margin": 5, "name": "EC", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "aab2d23360b2d8c0", "class": "unknown", "locations": [ "kex_ecdh_nist.py:145" ], "margin": 5, "name": "EC", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "b1fb80518b7523c1", "class": "unknown", "locations": [ "kex_ecdh_nist.py:117" ], "margin": 5, "name": "EC", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "bafdf1dd0f03fb4b", "class": "unknown", "locations": [ "kex_ecdh_nist.py:23" ], "margin": 5, "name": "EC", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "d180ea92efdcae01", "class": "unknown", "locations": [ "kex_ecdh_nist.py:59" ], "margin": 5, "name": "EC", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "04ed476de2475d60", "class": "kex", "locations": [ "kex_ecdh_nist.py:143" ], "margin": 5, "name": "ECDH", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "2fd73eafb21846c4", "class": "kex", "locations": [ "transport.py:327" ], "margin": 5, "name": "ECDH", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "559161719afc8330", "class": "kex", "locations": [ "kex_ecdh_nist.py:21" ], "margin": 5, "name": "ECDH", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "592a0cf749dc9e5c", "class": "kex", "locations": [ "transport.py:329" ], "margin": 5, "name": "ECDH", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "5f3bc4641b1445d5", "class": "kex", "locations": [ "transport.py:216" ], "margin": 5, "name": "ECDH", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "71134e3d2023ed29", "class": "kex", "locations": [ "transport.py:215" ], "margin": 5, "name": "ECDH", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "a823358a48292cdb", "class": "kex", "locations": [ "transport.py:328" ], "margin": 5, "name": "ECDH", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "d865eee6f06bef35", "class": "kex", "locations": [ "kex_ecdh_nist.py:149" ], "margin": 5, "name": "ECDH", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "fa19272e01fc9153", "class": "kex", "locations": [ "transport.py:217" ], "margin": 5, "name": "ECDH", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "3b877dea7c7cc52f", "class": "sig", "locations": [ "transport.py:201" ], "margin": 5, "name": "ECDSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "599b1755bf3aae8c", "class": "sig", "locations": [ "transport.py:208" ], "margin": 5, "name": "ECDSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "649003fb428bc948", "class": "sig", "locations": [ "transport.py:313" ], "margin": 5, "name": "ECDSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "b4ee5a8eaa13afac", "class": "sig", "locations": [ "transport.py:199" ], "margin": 5, "name": "ECDSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "c241f2fa8c88648f", "class": "sig", "locations": [ "transport.py:210" ], "margin": 5, "name": "ECDSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "d26ef1558c7307e2", "class": "sig", "locations": [ "transport.py:315" ], "margin": 5, "name": "ECDSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "d8590580836cbd39", "class": "sig", "locations": [ "transport.py:317" ], "margin": 5, "name": "ECDSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "de94231c23c82697", "class": "sig", "locations": [ "transport.py:200" ], "margin": 5, "name": "ECDSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "e6c93846392e07da", "class": "sig", "locations": [ "transport.py:209" ], "margin": 5, "name": "ECDSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "6fa80958f8b4752f", "class": "sig", "locations": [ "transport.py:198" ], "margin": 5, "name": "ED25519", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "bb275c07392f0599", "class": "sig", "locations": [ "transport.py:207" ], "margin": 5, "name": "ED25519", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "f204806ede58fb7b", "class": "sig", "locations": [ "ed25519key.py:42" ], "margin": 5, "name": "ED25519", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "ffce5280049914e8", "class": "sig", "locations": [ "transport.py:319" ], "margin": 5, "name": "ED25519", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "00b5575fa92fe493", "class": "sig", "locations": [ "rsakey.py:43" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "2c8df9ba83e76d01", "class": "sig", "locations": [ "rsakey.py:211" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "31d0c02cd44c7dfc", "class": "unknown", "locations": [ "agent.py:53" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "3277315cc6d8bf38", "class": "sig", "locations": [ "rsakey.py:210" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "41228ef336c16fba", "class": "unknown", "locations": [ "transport.py:791" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "46221a635c96e929", "class": "unknown", "locations": [ "transport.py:203" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "57bb7f95731b94b0", "class": "unknown", "locations": [ "client.py:431" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "5b85ecdfa2f4562d", "class": "sig", "locations": [ "rsakey.py:41" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "5dbf0be978a38a9b", "class": "unknown", "locations": [ "transport.py:1317" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "6a299e2ccce775a0", "class": "unknown", "locations": [ "agent.py:54" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "7637e1684f7e91e5", "class": "unknown", "locations": [ "transport.py:1318" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "7c9349441db4566d", "class": "sig", "locations": [ "rsakey.py:78" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "87dd8ea66a65ff36", "class": "unknown", "locations": [ "transport.py:211" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "938aad0bd952ed1e", "class": "unknown", "locations": [ "transport.py:790" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "a6014fb758a3b3ce", "class": "unknown", "locations": [ "client.py:432" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "a9118afad8850563", "class": "unknown", "locations": [ "client.py:433" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "ae7cda36dc275580", "class": "unknown", "locations": [ "transport.py:311" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "b0367f0c560dbf23", "class": "unknown", "locations": [ "transport.py:212" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "b8ac49ecdbca5a8c", "class": "sig", "locations": [ "rsakey.py:45" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "c4cd716d0ff68307", "class": "unknown", "locations": [ "transport.py:309" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "c59a0b7648d5e7ea", "class": "unknown", "locations": [ "client.py:434" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "cab9021735f35a67", "class": "unknown", "locations": [ "transport.py:202" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "d0b45e653bbbed2a", "class": "unknown", "locations": [ "client.py:430" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.", "x": 12, "y": 3 }, { "bom_ref": "f0bd45532432673d", "class": "sig", "locations": [ "rsakey.py:184" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "fe4f03aab0a26cf4", "class": "sig", "locations": [ "rsakey.py:89" ], "margin": 5, "name": "RSA", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.", "x": 12, "y": 3 }, { "bom_ref": "079a638d7957db78", "class": "kex", "locations": [ "transport.py:223" ], "margin": 5, "name": "X25519", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "2952ba9c74ae802e", "class": "kex", "locations": [ "kex_curve25519.py:109" ], "margin": 5, "name": "X25519", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "38a66427b03c4223", "class": "kex", "locations": [ "kex_curve25519.py:45" ], "margin": 5, "name": "X25519", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "678e9a7114c14486", "class": "kex", "locations": [ "kex_curve25519.py:30" ], "margin": 5, "name": "X25519", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "6f0dca8e23c81737", "class": "kex", "locations": [ "transport.py:332" ], "margin": 5, "name": "X25519", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "c017e478905e3c4c", "class": "kex", "locations": [ "kex_curve25519.py:71" ], "margin": 5, "name": "X25519", "sum": 15, "tier": "CRITICAL", "why": "X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.", "x": 12, "y": 3 }, { "bom_ref": "15afe14173d3e5fe", "class": "sym", "locations": [ "transport.py:177" ], "margin": 5, "name": "AES", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "1a65e2f6f95b29bc", "class": "sym", "locations": [ "transport.py:251" ], "margin": 5, "name": "AES", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "1db788a572dc6435", "class": "sym", "locations": [ "transport.py:178" ], "margin": 5, "name": "AES", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "33df796db83020be", "class": "sym", "locations": [ "transport.py:179" ], "margin": 5, "name": "AES", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "4052662ae8422d5e", "class": "sym", "locations": [ "transport.py:227" ], "margin": 5, "name": "AES", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "49de2066d60147d4", "class": "sym", "locations": [ "transport.py:257" ], "margin": 5, "name": "AES", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "6f56df010fd77722", "class": "sym", "locations": [ "pkey.py:727" ], "margin": 5, "name": "AES", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "724c5e9e32074f0f", "class": "sym", "locations": [ "pkey.py:691" ], "margin": 5, "name": "AES", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "81638332bcd0782c", "class": "sym", "locations": [ "transport.py:233" ], "margin": 5, "name": "AES", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "a078ce0d0f87caae", "class": "sym", "locations": [ "transport.py:176" ], "margin": 5, "name": "AES", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "cd30821eb79ff408", "class": "sym", "locations": [ "transport.py:239" ], "margin": 5, "name": "AES", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "d25c174dd8f786d3", "class": "sym", "locations": [ "pkey.py:693" ], "margin": 5, "name": "AES", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "dd98194141e0e7f2", "class": "sym", "locations": [ "transport.py:181" ], "margin": 5, "name": "AES", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "edca17798b17d12f", "class": "sym", "locations": [ "transport.py:245" ], "margin": 5, "name": "AES", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "f052c2d76a000280", "class": "sym", "locations": [ "transport.py:180" ], "margin": 5, "name": "AES", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "267483fdbfe48bcb", "class": "sym", "locations": [ "transport.py:188" ], "margin": 5, "name": "HMAC", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "4c40e529451283bd", "class": "sym", "locations": [ "transport.py:192" ], "margin": 5, "name": "HMAC", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "5cde8a8916cc4628", "class": "sym", "locations": [ "transport.py:287" ], "margin": 5, "name": "HMAC", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "77d9b122edd68ae2", "class": "sym", "locations": [ "packet.py:47" ], "margin": 5, "name": "HMAC", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "9ccdbe5567af9c9e", "class": "sym", "locations": [ "transport.py:292" ], "margin": 5, "name": "HMAC", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "a765e8e5881a72ad", "class": "sym", "locations": [ "transport.py:194" ], "margin": 5, "name": "HMAC", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "ae7c91f603ea85e2", "class": "sym", "locations": [ "transport.py:191" ], "margin": 5, "name": "HMAC", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "b3848d0bbcedeb4a", "class": "sym", "locations": [ "transport.py:288" ], "margin": 5, "name": "HMAC", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "c4ac5085714de8f4", "class": "sym", "locations": [ "transport.py:290" ], "margin": 5, "name": "HMAC", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "c4ad8854e3aede88", "class": "sym", "locations": [ "transport.py:293" ], "margin": 5, "name": "HMAC", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "ca176faf7e5b1db1", "class": "sym", "locations": [ "transport.py:286" ], "margin": 5, "name": "HMAC", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "cabe0563ddf9427c", "class": "sym", "locations": [ "transport.py:193" ], "margin": 5, "name": "HMAC", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "d8bf6502216f415b", "class": "sym", "locations": [ "hostkeys.py:300" ], "margin": 5, "name": "HMAC", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "de8a13586c1ef9b1", "class": "sym", "locations": [ "transport.py:187" ], "margin": 5, "name": "HMAC", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 }, { "bom_ref": "eb93ce26fd1ae334", "class": "sym", "locations": [ "pkey.py:401" ], "margin": 5, "name": "SHA256", "sum": 15, "tier": "SAFE", "why": "Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.", "x": 12, "y": 3 } ], "counts": { "BROKEN": 4, "CRITICAL": 77, "HIGH": 0, "MIGRATED": 0, "MONITOR": 0, "SAFE": 30 }, "horizon_years": 10, "rule": "X + Y > Z (Mosca); tiers by margin X + Y - Z: >=5 CRITICAL, >0 HIGH, >=-3 MONITOR, else SAFE", "status": "ok" } }, "ceiling": "Proves this file is the unaltered record of what these tools produced, in this order, sealed by the key named in each receipt. It does not prove the tools are correct, that the scan saw every file that matters, that the ranking's X, Y and Z assumptions are right, or that the plan is the right one.", "engagement": "sample-paramiko-5.0.0", "evidence_version": 1, "inputs": { "inventory": { "include_tests": false, "project_name": "paramiko 5.0.0", "root": "paramiko" }, "plan": { "cbom": { "bomFormat": "CycloneDX", "components": [ { "bom-ref": "8f083273ced1cb84", "cryptoProperties": { "algorithmProperties": { "primitive": "hash" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "config.py:449" } ] }, "name": "SHA1", "properties": [ { "name": "mcr:quantum_risk", "value": "BROKEN" }, { "name": "mcr:risk_rationale", "value": "weak against collisions without a quantum computer (SHAttered, 2017); whether that matters depends on the use (signatures and certificates: yes; fingerprints, file names, HMAC: much less)" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "dcb66e27f0ed4f82", "cryptoProperties": { "algorithmProperties": { "primitive": "hash" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "pkey.py:390" } ] }, "name": "MD5", "properties": [ { "name": "mcr:quantum_risk", "value": "BROKEN" }, { "name": "mcr:risk_rationale", "value": "weak against collisions without a quantum computer; whether that matters depends on the use (signatures and certificates: yes; fingerprints, file names, HMAC: much less)" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "31d0c02cd44c7dfc", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "agent.py:53" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "6a299e2ccce775a0", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "agent.py:54" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "d0b45e653bbbed2a", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "client.py:430" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "57bb7f95731b94b0", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "client.py:431" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "a6014fb758a3b3ce", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "client.py:432" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "a9118afad8850563", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "client.py:433" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "c59a0b7648d5e7ea", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "client.py:434" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "03bf553b6ee4ad5f", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ecdsakey.py:167" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "1cd043c106e65fd3", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ecdsakey.py:224" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "978032285fc9ebde", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ecdsakey.py:242" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "18d9679f039891e7", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ecdsakey.py:254" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "24f81ddd2d679f1b", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ecdsakey.py:268" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "65a2bdf3a47e2fcb", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ecdsakey.py:305" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "f204806ede58fb7b", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ed25519key.py:42" } ] }, "name": "ED25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EdDSA; Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "2952ba9c74ae802e", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_curve25519.py:109" } ] }, "name": "X25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EC Diffie-Hellman; broken by Shor's algorithm" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "678e9a7114c14486", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_curve25519.py:30" } ] }, "name": "X25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EC Diffie-Hellman; broken by Shor's algorithm" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "38a66427b03c4223", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_curve25519.py:45" } ] }, "name": "X25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EC Diffie-Hellman; broken by Shor's algorithm" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "c017e478905e3c4c", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_curve25519.py:71" } ] }, "name": "X25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EC Diffie-Hellman; broken by Shor's algorithm" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "10f8eb6672d3b7f1", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:113" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "b1fb80518b7523c1", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:117" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "04ed476de2475d60", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-384", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:143" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "aab2d23360b2d8c0", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:145" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "d865eee6f06bef35", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-521", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:149" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "8daef9e3f374dfc7", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:151" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "559161719afc8330", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-256", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:21" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "bafdf1dd0f03fb4b", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:23" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "d180ea92efdcae01", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:59" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "93e5494400330294", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:67" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "9fa28b3b854efba2", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:71" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "cf31125467acfdff", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_gex.py:51" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "316a95ebccd2d2e6", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_group14.py:45" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "30ee6b55d7b1d060", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_group16.py:30" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "2ccf7aa25c086076", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_group16.py:35" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "f0bd45532432673d", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:184" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "3277315cc6d8bf38", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:210" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "2c8df9ba83e76d01", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:211" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "5b85ecdfa2f4562d", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:41" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "00b5575fa92fe493", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:43" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "b8ac49ecdbca5a8c", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:45" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "7c9349441db4566d", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:78" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "fe4f03aab0a26cf4", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:89" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "5dbf0be978a38a9b", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:1317" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "7637e1684f7e91e5", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:1318" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "876fcde880f7bba0", "cryptoProperties": { "algorithmProperties": { "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:182" } ] }, "name": "3DES", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "64-bit block + Grover; already deprecated (SP 800-131A)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "6fa80958f8b4752f", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:198" } ] }, "name": "ED25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EdDSA; Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "b4ee5a8eaa13afac", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-256", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:199" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "de94231c23c82697", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-384", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:200" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "3b877dea7c7cc52f", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-521", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:201" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "cab9021735f35a67", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:202" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "46221a635c96e929", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:203" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "bb275c07392f0599", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:207" } ] }, "name": "ED25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EdDSA; Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "599b1755bf3aae8c", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-256", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:208" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "e6c93846392e07da", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-384", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:209" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "c241f2fa8c88648f", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-521", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:210" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "87dd8ea66a65ff36", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:211" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "b0367f0c560dbf23", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:212" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "71134e3d2023ed29", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-256", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:215" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "5f3bc4641b1445d5", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-384", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:216" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "fa19272e01fc9153", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-521", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:217" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "8f42a157930da077", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:218" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "72da4fcd50509ec9", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:219" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "b8d41fa2e17580e5", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:220" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "079a638d7957db78", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:223" } ] }, "name": "X25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EC Diffie-Hellman; broken by Shor's algorithm" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "58e4363efea02da7", "cryptoProperties": { "algorithmProperties": { "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:263" } ] }, "name": "3DES", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "64-bit block + Grover; already deprecated (SP 800-131A)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "c4cd716d0ff68307", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:309" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "ae7cda36dc275580", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:311" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "649003fb428bc948", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-256", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:313" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "d26ef1558c7307e2", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-384", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:315" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "d8590580836cbd39", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-521", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:317" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "ffce5280049914e8", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:319" } ] }, "name": "ED25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EdDSA; Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "1562f915751bac1b", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:324" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "5d9e7c7a634de435", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:325" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "e3acb560a29234fe", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:326" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "2fd73eafb21846c4", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-256", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:327" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "a823358a48292cdb", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-384", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:328" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "592a0cf749dc9e5c", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-521", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:329" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "6f0dca8e23c81737", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:332" } ] }, "name": "X25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EC Diffie-Hellman; broken by Shor's algorithm" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "938aad0bd952ed1e", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:790" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "41228ef336c16fba", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:791" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "6f56df010fd77722", "cryptoProperties": { "algorithmProperties": { "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "pkey.py:727" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "MODERATE" }, { "name": "mcr:risk_rationale", "value": "key size not determined from the source; confirm it (AES-256 for long-lived secrets); Grover gives at most a square-root speedup in theory, not a practical break" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "a078ce0d0f87caae", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "128", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:176" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "MODERATE" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory, and its serial iterations parallelise poorly; NIST treats AES-128 as secure against known quantum attacks. Prefer AES-256 for long-lived secrets or where a policy you follow requires it" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "33df796db83020be", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "128", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:179" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "MODERATE" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory, and its serial iterations parallelise poorly; NIST treats AES-128 as secure against known quantum attacks. Prefer AES-256 for long-lived secrets or where a policy you follow requires it" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "4052662ae8422d5e", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "128", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:227" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "MODERATE" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory, and its serial iterations parallelise poorly; NIST treats AES-128 as secure against known quantum attacks. Prefer AES-256 for long-lived secrets or where a policy you follow requires it" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "edca17798b17d12f", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "128", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:245" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "MODERATE" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory, and its serial iterations parallelise poorly; NIST treats AES-128 as secure against known quantum attacks. Prefer AES-256 for long-lived secrets or where a policy you follow requires it" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "d8bf6502216f415b", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "hostkeys.py:300" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "77d9b122edd68ae2", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "packet.py:47" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "eb93ce26fd1ae334", "cryptoProperties": { "algorithmProperties": { "primitive": "hash" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "pkey.py:401" } ] }, "name": "SHA256", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; not a practical break" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "724c5e9e32074f0f", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "256", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "pkey.py:691" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; the recommended size for long-lived secrets" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "d25c174dd8f786d3", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "256", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "pkey.py:693" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; the recommended size for long-lived secrets" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "15afe14173d3e5fe", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "192", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:177" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; not a practical break" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "1db788a572dc6435", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "256", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:178" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; the recommended size for long-lived secrets" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "f052c2d76a000280", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "192", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:180" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; not a practical break" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "dd98194141e0e7f2", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "256", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:181" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; the recommended size for long-lived secrets" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "de8a13586c1ef9b1", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:187" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "267483fdbfe48bcb", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:188" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "ae7c91f603ea85e2", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:191" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "4c40e529451283bd", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:192" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "cabe0563ddf9427c", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:193" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "a765e8e5881a72ad", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:194" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "81638332bcd0782c", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "192", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:233" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; not a practical break" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "cd30821eb79ff408", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "256", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:239" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; the recommended size for long-lived secrets" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "1a65e2f6f95b29bc", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "192", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:251" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; not a practical break" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "49de2066d60147d4", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "256", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:257" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; the recommended size for long-lived secrets" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "ca176faf7e5b1db1", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:286" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "5cde8a8916cc4628", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:287" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "b3848d0bbcedeb4a", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:288" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "c4ac5085714de8f4", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:290" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "9ccdbe5567af9c9e", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:292" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "c4ad8854e3aede88", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:293" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" } ], "metadata": { "component": { "name": "paramiko 5.0.0", "type": "application" }, "properties": [ { "name": "mcr:files_scanned", "value": "41" }, { "name": "mcr:manifests_scanned", "value": "0" }, { "name": "mcr:scope", "value": "source-ast+manifest+regex" }, { "name": "mcr:known_gaps", "value": "transitive-dependency crypto, binary/compiled deps, dynamically-loaded crypto, and obfuscated/minified code are NOT fully covered in v0; a CBOM is an inventory, not a correctness proof." } ], "timestamp": "2026-09-30T17:39:07.194232+00:00", "tools": [ { "name": "CBOM Generator", "vendor": "Matrix CR Studio", "version": "0.1.0" } ] }, "serialNumber": "urn:uuid:14405ccf-709a-5555-96ea-4720a1f98834", "specVersion": "1.7", "version": 1 }, "longevity_years": 12, "project_name": "paramiko 5.0.0", "simulate_rollout": false, "target_phase": "pqc_only" }, "rank": { "cbom": { "bomFormat": "CycloneDX", "components": [ { "bom-ref": "8f083273ced1cb84", "cryptoProperties": { "algorithmProperties": { "primitive": "hash" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "config.py:449" } ] }, "name": "SHA1", "properties": [ { "name": "mcr:quantum_risk", "value": "BROKEN" }, { "name": "mcr:risk_rationale", "value": "weak against collisions without a quantum computer (SHAttered, 2017); whether that matters depends on the use (signatures and certificates: yes; fingerprints, file names, HMAC: much less)" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "dcb66e27f0ed4f82", "cryptoProperties": { "algorithmProperties": { "primitive": "hash" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "pkey.py:390" } ] }, "name": "MD5", "properties": [ { "name": "mcr:quantum_risk", "value": "BROKEN" }, { "name": "mcr:risk_rationale", "value": "weak against collisions without a quantum computer; whether that matters depends on the use (signatures and certificates: yes; fingerprints, file names, HMAC: much less)" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "31d0c02cd44c7dfc", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "agent.py:53" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "6a299e2ccce775a0", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "agent.py:54" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "d0b45e653bbbed2a", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "client.py:430" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "57bb7f95731b94b0", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "client.py:431" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "a6014fb758a3b3ce", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "client.py:432" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "a9118afad8850563", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "client.py:433" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "c59a0b7648d5e7ea", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "client.py:434" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "03bf553b6ee4ad5f", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ecdsakey.py:167" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "1cd043c106e65fd3", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ecdsakey.py:224" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "978032285fc9ebde", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ecdsakey.py:242" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "18d9679f039891e7", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ecdsakey.py:254" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "24f81ddd2d679f1b", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ecdsakey.py:268" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "65a2bdf3a47e2fcb", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ecdsakey.py:305" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "f204806ede58fb7b", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "ed25519key.py:42" } ] }, "name": "ED25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EdDSA; Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "2952ba9c74ae802e", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_curve25519.py:109" } ] }, "name": "X25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EC Diffie-Hellman; broken by Shor's algorithm" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "678e9a7114c14486", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_curve25519.py:30" } ] }, "name": "X25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EC Diffie-Hellman; broken by Shor's algorithm" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "38a66427b03c4223", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_curve25519.py:45" } ] }, "name": "X25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EC Diffie-Hellman; broken by Shor's algorithm" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "c017e478905e3c4c", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_curve25519.py:71" } ] }, "name": "X25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EC Diffie-Hellman; broken by Shor's algorithm" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "10f8eb6672d3b7f1", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:113" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "b1fb80518b7523c1", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:117" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "04ed476de2475d60", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-384", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:143" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "aab2d23360b2d8c0", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:145" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "d865eee6f06bef35", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-521", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:149" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "8daef9e3f374dfc7", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:151" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "559161719afc8330", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-256", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:21" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "bafdf1dd0f03fb4b", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:23" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "d180ea92efdcae01", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:59" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "93e5494400330294", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:67" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "9fa28b3b854efba2", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_ecdh_nist.py:71" } ] }, "name": "EC", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "cf31125467acfdff", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_gex.py:51" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "316a95ebccd2d2e6", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_group14.py:45" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "30ee6b55d7b1d060", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_group16.py:30" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "2ccf7aa25c086076", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "kex_group16.py:35" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "f0bd45532432673d", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:184" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "3277315cc6d8bf38", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:210" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "2c8df9ba83e76d01", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:211" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "5b85ecdfa2f4562d", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:41" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "00b5575fa92fe493", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:43" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "b8ac49ecdbca5a8c", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:45" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "7c9349441db4566d", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:78" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "fe4f03aab0a26cf4", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "rsakey.py:89" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" }, { "name": "mcr:key_use", "value": "signature" }, { "name": "mcr:key_use_evidence", "value": ".sign(padding)@L137, .verify(padding)@L166" } ], "type": "cryptographic-asset" }, { "bom-ref": "5dbf0be978a38a9b", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:1317" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "7637e1684f7e91e5", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:1318" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "876fcde880f7bba0", "cryptoProperties": { "algorithmProperties": { "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:182" } ] }, "name": "3DES", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "64-bit block + Grover; already deprecated (SP 800-131A)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "6fa80958f8b4752f", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:198" } ] }, "name": "ED25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EdDSA; Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "b4ee5a8eaa13afac", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-256", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:199" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "de94231c23c82697", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-384", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:200" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "3b877dea7c7cc52f", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-521", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:201" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "cab9021735f35a67", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:202" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "46221a635c96e929", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:203" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "bb275c07392f0599", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:207" } ] }, "name": "ED25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EdDSA; Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "599b1755bf3aae8c", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-256", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:208" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "e6c93846392e07da", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-384", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:209" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "c241f2fa8c88648f", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-521", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:210" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "87dd8ea66a65ff36", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:211" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "b0367f0c560dbf23", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:212" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "71134e3d2023ed29", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-256", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:215" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "5f3bc4641b1445d5", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-384", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:216" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "fa19272e01fc9153", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-521", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:217" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "8f42a157930da077", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:218" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "72da4fcd50509ec9", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:219" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "b8d41fa2e17580e5", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:220" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "079a638d7957db78", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:223" } ] }, "name": "X25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EC Diffie-Hellman; broken by Shor's algorithm" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "58e4363efea02da7", "cryptoProperties": { "algorithmProperties": { "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:263" } ] }, "name": "3DES", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "64-bit block + Grover; already deprecated (SP 800-131A)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "c4cd716d0ff68307", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:309" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "ae7cda36dc275580", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:311" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "649003fb428bc948", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-256", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:313" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "d26ef1558c7307e2", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-384", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:315" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "d8590580836cbd39", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-521", "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:317" } ] }, "name": "ECDSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log (the likely first target)" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "ffce5280049914e8", "cryptoProperties": { "algorithmProperties": { "primitive": "signature" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:319" } ] }, "name": "ED25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EdDSA; Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "1562f915751bac1b", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:324" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "5d9e7c7a634de435", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:325" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "e3acb560a29234fe", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:326" } ] }, "name": "DH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the finite-field discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "2fd73eafb21846c4", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-256", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:327" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "a823358a48292cdb", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-384", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:328" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "592a0cf749dc9e5c", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "P-521", "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:329" } ] }, "name": "ECDH", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks the EC discrete log" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "6f0dca8e23c81737", "cryptoProperties": { "algorithmProperties": { "primitive": "key-agree" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:332" } ] }, "name": "X25519", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "EC Diffie-Hellman; broken by Shor's algorithm" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "938aad0bd952ed1e", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:790" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "41228ef336c16fba", "cryptoProperties": { "algorithmProperties": { "primitive": "other" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:791" } ] }, "name": "RSA", "properties": [ { "name": "mcr:quantum_risk", "value": "CRITICAL" }, { "name": "mcr:risk_rationale", "value": "Shor's algorithm breaks integer factorization" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "6f56df010fd77722", "cryptoProperties": { "algorithmProperties": { "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "pkey.py:727" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "MODERATE" }, { "name": "mcr:risk_rationale", "value": "key size not determined from the source; confirm it (AES-256 for long-lived secrets); Grover gives at most a square-root speedup in theory, not a practical break" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "a078ce0d0f87caae", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "128", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:176" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "MODERATE" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory, and its serial iterations parallelise poorly; NIST treats AES-128 as secure against known quantum attacks. Prefer AES-256 for long-lived secrets or where a policy you follow requires it" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "33df796db83020be", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "128", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:179" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "MODERATE" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory, and its serial iterations parallelise poorly; NIST treats AES-128 as secure against known quantum attacks. Prefer AES-256 for long-lived secrets or where a policy you follow requires it" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "4052662ae8422d5e", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "128", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:227" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "MODERATE" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory, and its serial iterations parallelise poorly; NIST treats AES-128 as secure against known quantum attacks. Prefer AES-256 for long-lived secrets or where a policy you follow requires it" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "edca17798b17d12f", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "128", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:245" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "MODERATE" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory, and its serial iterations parallelise poorly; NIST treats AES-128 as secure against known quantum attacks. Prefer AES-256 for long-lived secrets or where a policy you follow requires it" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "d8bf6502216f415b", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "hostkeys.py:300" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "77d9b122edd68ae2", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "packet.py:47" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "eb93ce26fd1ae334", "cryptoProperties": { "algorithmProperties": { "primitive": "hash" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "pkey.py:401" } ] }, "name": "SHA256", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; not a practical break" }, { "name": "mcr:confidence", "value": "high" }, { "name": "mcr:detection_source", "value": "ast" } ], "type": "cryptographic-asset" }, { "bom-ref": "724c5e9e32074f0f", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "256", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "pkey.py:691" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; the recommended size for long-lived secrets" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "d25c174dd8f786d3", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "256", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "pkey.py:693" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; the recommended size for long-lived secrets" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "15afe14173d3e5fe", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "192", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:177" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; not a practical break" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "1db788a572dc6435", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "256", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:178" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; the recommended size for long-lived secrets" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "f052c2d76a000280", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "192", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:180" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; not a practical break" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "dd98194141e0e7f2", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "256", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:181" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; the recommended size for long-lived secrets" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "de8a13586c1ef9b1", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:187" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "267483fdbfe48bcb", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:188" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "ae7c91f603ea85e2", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:191" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "4c40e529451283bd", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:192" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "cabe0563ddf9427c", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:193" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "a765e8e5881a72ad", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:194" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "81638332bcd0782c", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "192", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:233" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; not a practical break" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "cd30821eb79ff408", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "256", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:239" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; the recommended size for long-lived secrets" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "1a65e2f6f95b29bc", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "192", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:251" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; not a practical break" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "49de2066d60147d4", "cryptoProperties": { "algorithmProperties": { "parameterSetIdentifier": "256", "primitive": "block-cipher" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:257" } ] }, "name": "AES", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "Grover gives at most a square-root speedup in theory; the recommended size for long-lived secrets" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "ca176faf7e5b1db1", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:286" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "5cde8a8916cc4628", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:287" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "b3848d0bbcedeb4a", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:288" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "c4ac5085714de8f4", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:290" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "9ccdbe5567af9c9e", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:292" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" }, { "bom-ref": "c4ad8854e3aede88", "cryptoProperties": { "algorithmProperties": { "primitive": "mac" }, "assetType": "algorithm" }, "evidence": { "occurrences": [ { "location": "transport.py:293" } ] }, "name": "HMAC", "properties": [ { "name": "mcr:quantum_risk", "value": "LOW" }, { "name": "mcr:risk_rationale", "value": "keyed hash; inherits underlying hash Grover risk" }, { "name": "mcr:confidence", "value": "medium" }, { "name": "mcr:detection_source", "value": "ast-string" } ], "type": "cryptographic-asset" } ], "metadata": { "component": { "name": "paramiko 5.0.0", "type": "application" }, "properties": [ { "name": "mcr:files_scanned", "value": "41" }, { "name": "mcr:manifests_scanned", "value": "0" }, { "name": "mcr:scope", "value": "source-ast+manifest+regex" }, { "name": "mcr:known_gaps", "value": "transitive-dependency crypto, binary/compiled deps, dynamically-loaded crypto, and obfuscated/minified code are NOT fully covered in v0; a CBOM is an inventory, not a correctness proof." } ], "timestamp": "2026-09-30T17:39:07.194232+00:00", "tools": [ { "name": "CBOM Generator", "vendor": "Matrix CR Studio", "version": "0.1.0" } ] }, "serialNumber": "urn:uuid:14405ccf-709a-5555-96ea-4720a1f98834", "specVersion": "1.7", "version": 1 }, "horizon_years": 10, "migrate_years": 3, "per_asset": {}, "protect_years": 12 } }, "receipts": [ { "chain": [ { "payload_hash": "d3fca47551ce28460bea0718cd17c6a853717787131ff79650c75e370b94e6ff", "prev_hash": "", "record_hash": "d41af405d32bd2b2043887c04b28a607125846c94a5216f3d1cfafb76c64d490", "sator_hmac": null, "seq": 0, "stage": "SEED", "ts_ms": 1790789947265 }, { "payload_hash": "fd49af84483589f54e56e65dc42e720239da221eeabbabc0fab3152a0fdffe28", "prev_hash": "d41af405d32bd2b2043887c04b28a607125846c94a5216f3d1cfafb76c64d490", "record_hash": "98f4e6a387a6db6441594e72b0bf24c389f8d01aeec64c785073c1fd8b8eaa21", "sator_hmac": null, "seq": 1, "stage": "LOG", "ts_ms": 1790789947265 } ], "claim": { "confidence": 1.0, "inference_ts": null, "input_fingerprint": "sha3-256:5a832ef6a498a4a2500fe0f89641d35dcd584155af1028e2c2bff86a66dbf17b", "meta": { "engagement": "sample-paramiko-5.0.0", "evidence_version": 1, "planned_steps": [ "inventory", "rank", "plan" ], "prev_receipt": null, "seq": 0, "step": "inventory", "tool_source": "sha3-256:9350ac9b0675a9b21784efc60ad41369175e1f6eba20469737b9caee9fd45880" }, "model_id": "tool:counterfoil.assess.inventory", "output_label": "inventory", "tool_calls": [ { "args_fingerprint": "sha3-256:5a832ef6a498a4a2500fe0f89641d35dcd584155af1028e2c2bff86a66dbf17b", "metadata_fingerprint": "sha3-256:3ea445410f608e6453cdcb7dbe42d57a89aca018993d7e87da85993cbccc6308", "name": "counterfoil.assess.inventory", "ok": true, "output_fingerprint": "sha3-256:c9a771c47c2f19a770f1e6a6d4a699d20f5491895344bc9441ec8a065ccf9f27", "seq": 0, "server": "" } ] }, "counterfoil_receipt_version": "1", "guarantees": { "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.", "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails.", "tool_integrity": "1 tool call(s) bound by args+output fingerprint into the sealed claim; any tampered tool output fails claim-binding on verify. Proves what the tools returned, not only that the model emitted text." }, "issued_ns": "2026-09-30T20:39:07.267568532+03:00", "kind": "ai-inference-attestation", "seal": { "alg": "ed25519", "key_fingerprint": "be19cba981ce0e02", "public_key": "98f18cac17f6e1899daee286838abd5efe8694830c1501c875b4af423f1ce802", "sealed_field": "chain[-1].record_hash", "sealed_value": "98f4e6a387a6db6441594e72b0bf24c389f8d01aeec64c785073c1fd8b8eaa21", "signature": "fccea8f9ed9ef3a1220edc30856c3778fb56684a99c361c0d58668cb68e6a82498b2371813911534d1bb337506c547e1c4909389f623ca687f61c4682cbc6103" }, "seed_anchor": "d3fca47551ce28460bea0718cd17c6a853717787131ff79650c75e370b94e6ff", "verify_cmd": "python verify_counterfoil.py " }, { "chain": [ { "payload_hash": "c2a49e2b7b22091bbf22927b95ea7bd704f145ab438242de5f4fe9d473717973", "prev_hash": "", "record_hash": "1d51f8204983401cc99288ff0643edf0b599447c0d92966c3358dc9177790a45", "sator_hmac": null, "seq": 0, "stage": "SEED", "ts_ms": 1790789947275 }, { "payload_hash": "36ba9592e79f74eba5ed6efd15462b70ed095c9d3c58caaf41daa2369e86364c", "prev_hash": "1d51f8204983401cc99288ff0643edf0b599447c0d92966c3358dc9177790a45", "record_hash": "b9637d0c5fd5ca26f66519f1e307c8f9eb20e643d6b3b2c99c407dbe87d967c4", "sator_hmac": null, "seq": 1, "stage": "LOG", "ts_ms": 1790789947275 } ], "claim": { "confidence": 1.0, "inference_ts": null, "input_fingerprint": "sha3-256:d5eeab5b290656b06e1270bb3ff1866c5238b25d8446e6fda5653fdeabd56549", "meta": { "engagement": "sample-paramiko-5.0.0", "evidence_version": 1, "planned_steps": [ "inventory", "rank", "plan" ], "prev_receipt": "98f4e6a387a6db6441594e72b0bf24c389f8d01aeec64c785073c1fd8b8eaa21", "seq": 1, "step": "rank", "tool_source": "sha3-256:49d862f6940ab34d75127c75177f1326818c49f71e6bb726d3b6fc6c258f053a" }, "model_id": "tool:counterfoil.assess.rank", "output_label": "rank", "tool_calls": [ { "args_fingerprint": "sha3-256:d5eeab5b290656b06e1270bb3ff1866c5238b25d8446e6fda5653fdeabd56549", "metadata_fingerprint": "sha3-256:3ea445410f608e6453cdcb7dbe42d57a89aca018993d7e87da85993cbccc6308", "name": "counterfoil.assess.rank", "ok": true, "output_fingerprint": "sha3-256:5abb952b4549398d99ac09eb9de2a42e2bc168a39a3eb6afb6988f6d017630bc", "seq": 0, "server": "" } ] }, "counterfoil_receipt_version": "1", "guarantees": { "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.", "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails.", "tool_integrity": "1 tool call(s) bound by args+output fingerprint into the sealed claim; any tampered tool output fails claim-binding on verify. Proves what the tools returned, not only that the model emitted text." }, "issued_ns": "2026-09-30T20:39:07.275422490+03:00", "kind": "ai-inference-attestation", "seal": { "alg": "ed25519", "key_fingerprint": "be19cba981ce0e02", "public_key": "98f18cac17f6e1899daee286838abd5efe8694830c1501c875b4af423f1ce802", "sealed_field": "chain[-1].record_hash", "sealed_value": "b9637d0c5fd5ca26f66519f1e307c8f9eb20e643d6b3b2c99c407dbe87d967c4", "signature": "3754ed0cf2f8b1531f0eb2489f1779471d2a67027d44d5201a75d15be6fcad5df64e4e2ddfc78682959fe22547446910b297e1d9edc6676a6a2785f30c532e0b" }, "seed_anchor": "c2a49e2b7b22091bbf22927b95ea7bd704f145ab438242de5f4fe9d473717973", "verify_cmd": "python verify_counterfoil.py " }, { "chain": [ { "payload_hash": "1724d4e51dce8acbb8b053c3c783ee01ab8d9d18bfe5a7bcc8cadbb4217994a1", "prev_hash": "", "record_hash": "4e6523b472fbc56a833879c24705cfe725792d5a0e11304c09e22aeb2c6e165a", "sator_hmac": null, "seq": 0, "stage": "SEED", "ts_ms": 1790789947463 }, { "payload_hash": "9430b8db407d26fe8af0cb4f227c5c7f7eecd4b2b33a8a2b21f926fa7f81ef8b", "prev_hash": "4e6523b472fbc56a833879c24705cfe725792d5a0e11304c09e22aeb2c6e165a", "record_hash": "128d515e87984c54feb4e61f397887d5c0dbfdb46f415eb8ad99cf66996efc58", "sator_hmac": null, "seq": 1, "stage": "LOG", "ts_ms": 1790789947463 } ], "claim": { "confidence": 1.0, "inference_ts": null, "input_fingerprint": "sha3-256:9b73d32bdad64c859c6a07fbe59c6438c27fc6e31aabd2a38ef1affc219aecbb", "meta": { "engagement": "sample-paramiko-5.0.0", "evidence_version": 1, "planned_steps": [ "inventory", "rank", "plan" ], "prev_receipt": "b9637d0c5fd5ca26f66519f1e307c8f9eb20e643d6b3b2c99c407dbe87d967c4", "seq": 2, "step": "plan", "tool_source": "sha3-256:7274741b52f3f79e5bb4786ad8fc7a8f7a015d18e50ccc4bfc2077f21ce79dde" }, "model_id": "tool:counterfoil.assess.plan", "output_label": "plan", "tool_calls": [ { "args_fingerprint": "sha3-256:9b73d32bdad64c859c6a07fbe59c6438c27fc6e31aabd2a38ef1affc219aecbb", "metadata_fingerprint": "sha3-256:3ea445410f608e6453cdcb7dbe42d57a89aca018993d7e87da85993cbccc6308", "name": "counterfoil.assess.plan", "ok": true, "output_fingerprint": "sha3-256:e2c38c947bf0472c9d3a2d0ee2fc01f90e22d81f13df35bbe304d93376db7abd", "seq": 0, "server": "" } ] }, "counterfoil_receipt_version": "1", "guarantees": { "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.", "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails.", "tool_integrity": "1 tool call(s) bound by args+output fingerprint into the sealed claim; any tampered tool output fails claim-binding on verify. Proves what the tools returned, not only that the model emitted text." }, "issued_ns": "2026-09-30T20:39:07.463889577+03:00", "kind": "ai-inference-attestation", "seal": { "alg": "ed25519", "key_fingerprint": "be19cba981ce0e02", "public_key": "98f18cac17f6e1899daee286838abd5efe8694830c1501c875b4af423f1ce802", "sealed_field": "chain[-1].record_hash", "sealed_value": "128d515e87984c54feb4e61f397887d5c0dbfdb46f415eb8ad99cf66996efc58", "signature": "a13c7bda6d7c19161fb12e600f0a6d6e333b482ce747e7a17ec7d905e208bdbcb0d73bda4b82d8bb36cc4779da86bf5a562b7d63962a4c04660c4009eec27703" }, "seed_anchor": "1724d4e51dce8acbb8b053c3c783ee01ab8d9d18bfe5a7bcc8cadbb4217994a1", "verify_cmd": "python verify_counterfoil.py " } ], "steps": [ "inventory", "rank", "plan" ] }