Public scan · 2026-05-01
panva/jose
JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes
- browser
- bun
- cloudflare-workers
- deno
- jose
- jsonwebtoken
- jwa
- jwe
- jwk
- jwks
- jws
- jwt
- node
Files scanned
143
Shor-vulnerable
30
RSA / ECC / Ed* / X25519
Grover-weakened
3
AES-128 / SHA-1 / MD5
Total occurrences
33
Breakdown by primitive
- RSA 13
- ECDSA/ECDH 11
- ECC 6
- SHA-1 (broken, replace with SHA-256) 3
Findings
download CycloneDX 1.6 CBOM → src/key/generate_key_pair.ts open ↗
-
name: 'RSA-PSS', -
name: 'RSASSA-PKCS1-v1_5', -
name: 'RSA-OAEP', -
algorithm = { name: 'ECDSA', namedCurve: 'P-256' } -
algorithm = { name: 'ECDSA', namedCurve: 'P-256' } -
algorithm = { name: 'ECDSA', namedCurve: 'P-384' } -
algorithm = { name: 'ECDSA', namedCurve: 'P-384' } -
algorithm = { name: 'ECDSA', namedCurve: 'P-521' } -
algorithm = { name: 'ECDSA', namedCurve: 'P-521' } -
algorithm = { name: 'ECDH', namedCurve: crv }
src/lib/asn1.ts open ↗
-
algorithm = { name: 'RSA-PSS', hash: `SHA-${alg.slice(-3)}` } -
algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${alg.slice(-3)}` } -
name: 'RSA-OAEP', -
algorithm = { name: 'ECDSA', namedCurve: curveMap[alg] } -
algorithm = namedCurve === 'X25519' ? { name: 'X25519' } : { name: 'ECDH', namedCurve }
src/lib/jwk_to_key.ts open ↗
-
algorithm = { name: 'RSA-PSS', hash: `SHA-${jwk.alg.slice(-3)}` } -
algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${jwk.alg.slice(-3)}` } -
name: 'RSA-OAEP', -
name: 'ECDSA', -
algorithm = { name: 'ECDH', namedCurve: jwk.crv! }
src/lib/normalize_key.ts open ↗
-
name: 'RSA-OAEP', -
name: 'ECDSA', -
name: 'ECDH', -
hash = 'SHA-1'
src/lib/signing.ts open ↗
-
return { hash, name: 'RSA-PSS', saltLength: parseInt(alg.slice(-3), 10) >> 3 } -
return { hash, name: 'RSASSA-PKCS1-v1_5' } -
return { hash, name: 'ECDSA', namedCurve: (algorithm as EcKeyAlgorithm).namedCurve }
tap/keyobject-stub.ts open ↗
-
return generate('ec', { namedCurve: 'P-256' }) -
return generate('ec', { namedCurve: 'P-384' }) -
return generate('ec', { namedCurve: 'P-521' })
test/jwe/zip.test.ts open ↗
-
const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', { modulusLength: 2048 })