libp2p/go-libp2p

Scanned on Jun 5, 2026

Risk score/ 100

High risk

Summary

The libp2p/go-libp2p repository has critical quantum vulnerability exposure with 276 high-severity findings and 9 critical issues involving broken cryptographic configurations. RSA keys of 2048 bits are used extensively in production code and examples, which are already considered weak and will be trivially breakable by quantum computers. All cryptographic primitives (RSA, Ed25519, ECDSA, secp256k1) lack quantum resistance and require migration to NIST-approved post-quantum algorithms.

Critical

High

191

Medium

Low

Top findings

CriticalRSA key ≤ 2048 bits
examples/chat-with-mdns/main.go:92
Raw evidence
```
prvKey, _, err := crypto.GenerateKeyPairWithReader(crypto.RSA, 2048, r)
```

CriticalRSA key ≤ 2048 bits

examples/chat/chat.go:153

Raw evidence

prvKey, _, err := crypto.GenerateKeyPairWithReader(crypto.RSA, 2048, randomness)

CriticalRSA key ≤ 2048 bits

examples/echo/main.go:71

Raw evidence

priv, _, err := crypto.GenerateKeyPairWithReader(crypto.RSA, 2048, r)

CriticalRSA key ≤ 2048 bits
core/peer/peer_test.go:50
Raw evidence
```
ks.sk, ks.pk, err = test.RandTestKeyPair(ic.RSA, 2048)
```
CriticalRSA key ≤ 2048 bits
core/peer/peer_test.go:235
Raw evidence
```
_, rsaPub, err := ic.GenerateKeyPair(ic.RSA, 2048)
```

+ 195 more findings in the full report

Scan your own repository

Free. Results in ~90 seconds. CBOM + DORA/NIS2 PDF included.

Start a free scan