NTPsec/ntpsec

Scanned on May 22, 2026

Risk score/ 100

Moderate risk

Summary

NTPsec repository contains 29 instances of quantum-vulnerable cryptographic primitives, primarily concentrated in legacy 'attic' code. While most critical findings (DES, MD5, SHA-1) exist in deprecated testing utilities rather than production code, the presence of DSA and Ed25519 in timing tests indicates awareness of algorithms that will fail against quantum attacks. The codebase shows reliance on older OpenSSL versions lacking post-quantum readiness.

Critical

High

Medium

Low

Top findings

CriticalSHA-1
contrib/make-leap-seconds.py:76
SHA-256 or SHA3-256
Raw evidence
```
sha1.update(expire)
```
CriticalSHA-1
contrib/make-leap-seconds.py:79
SHA-256 or SHA3-256
Raw evidence
```
digest = sha1.hexdigest()
```
CriticalSHA-1
attic/digest-find.c:41
SHA-256 or SHA3-256
Raw evidence
```
"SHA1",
```
CriticalSHA-1
attic/digest-find.c:42
SHA-256 or SHA3-256
Raw evidence
```
"sha1",
```
CriticalDES
attic/digest-find.c:51
Raw evidence
```
"DES", "DES3",
```

+ 24 more findings in the full report

Scan your own repository

Free. Results in ~90 seconds. CBOM + DORA/NIS2 PDF included.

Start a free scan