PQC Weak Key Length (Symmetric/Hash Strength Below the Post-Quantum Baseline)

java.pqc_weak_keylength

Severity

info

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Cryptography

Language

Java

Description

Flags symmetric ciphers and hash functions whose key or digest size is below the post-quantum baseline. This is the Grover axis of post-quantum readiness, distinct from pqc_readiness (the Shor axis — public-key algorithms that no key-size increase can save).

Most findings are keys that are adequate against a classical attacker today and short only in the face of Grover’s algorithm. A key that is also brute-forceable today — a 56-bit DES key — is reported as well, and said so explicitly, because the remediation is the same one and no other rule states it: for a symmetric cipher, a longer key really is the fix.

Rationale

Grover’s algorithm gives a quadratic speed-up to brute-force search, halving the effective security of a symmetric key: AES-128 drops to ~64-bit effective strength, and a hash’s preimage resistance is similarly reduced. Such algorithms are perfectly safe against today’s classical computers but are not post-quantum ready. NSA’s CNSA 2.0 suite and NIST guidance therefore require AES-256 for symmetric encryption and SHA-384 / SHA-512 (or SHA3-384+) for hashing.

Two cases are told apart, since they call for the same action but a different explanation:

Grover-weakened only — the key is classically fine (AES-128, SHA-256). Reported when the source states the size explicitly, so a bare family reference sized elsewhere is not falsely flagged.
Classically brute-forceable as well — the key is under 112 bits, the minimum security strength NIST SP 800-131A accepts. No explicit size is needed there, as long as the catalogued key size is the algorithm’s own: DES is 56 bits and nothing else. A reference that states another size than the row it resolves to — SAFER-SK128, whose row covers SAFER-SK40/64/128 and carries 64 — is left to the weak-cipher detectors instead of being reported with a size the code never wrote. The finding says the key is brute-forceable and Grover-weakened, and recommends AES-256.

A classically broken hash (MD5, SHA-1) is not reported here, and neither is a classically broken cipher whose key is long enough that only Grover threatens it (RC4, Blowfish, 3DES at 168 bits): their security is broken rather than short, "use a longer key" is not the remediation, and the weak-cipher / weak-hash detectors already report them.

The post-quantum baselines are configurable via the minPqcStrength property (e.g. symmetric/256, hash/384) so the thresholds can be adapted to an organization’s own standard.

In Java, the algorithm is named at the JCA factory; a SHA-256 digest is fine today but not post-quantum ready, whereas SHA-384/512 are. For symmetric ciphers the key size is often set at a separate init() call rather than in the algorithm string, so it is read from there:

MessageDigest.getInstance("SHA-256");         // below the PQC baseline (Grover) — use SHA-384/512
MessageDigest.getInstance("SHA-384");         // post-quantum ready

KeyGenerator kg = KeyGenerator.getInstance("AES");
kg.init(128);                                 // AES-128 below the PQC baseline (Grover) — use init(256)

KeyGenerator kg256 = KeyGenerator.getInstance("AES");
kg256.init(256);                              // post-quantum ready

Cipher.getInstance("DES/ECB/PKCS5Padding");   // 56-bit: brute-forceable today AND Grover-weakened

Where the algorithm name states the key size on its own, the factory line is the finding and an init() beside it adds nothing — one key, one issue.

Remediation

Raise the parameter to the post-quantum baseline: use AES-256 for symmetric encryption and SHA-384 / SHA-512 (or SHA3-384+) for hashing. Unlike public-key algorithms on the Shor axis, no migration to a new algorithm family is required — the existing primitive is hardened in place by doubling its size.

Where the key is already brute-forceable classically (DES), replacing the algorithm with AES-256 does both jobs at once: it removes a weakness that is exploitable today and lands on the post-quantum baseline. 256 bits keeps a 128-bit margin once Grover halves it.

References

CWE-326 : Inadequate Encryption Strength.
NSA CNSA 2.0 : Commercial National Security Algorithm Suite 2.0.
NIST IR 8547 : Transition to Post-Quantum Cryptography Standards.
NISTIR 8105 : Report on Post-Quantum Cryptography.