square/okhttp

Scanned on Jun 4, 2026

Risk score/ 100

High risk

Summary

The OkHttp repository contains quantum-vulnerable cryptographic implementations in its TLS certificate management module. RSA and Elliptic Curve Cryptography are extensively used for certificate generation and key handling, which will become insecure against quantum computing attacks. While these appear to be primarily in testing and utility code rather than core TLS handshake logic, migration planning is essential for long-term security.

Critical

High

Medium

Low

Top findings

HighPKCS#1 (RSA-based)
okhttp-tls/src/test/java/okhttp3/tls/HeldCertificateTest.kt:186
Raw evidence
```
|-----BEGIN RSA PRIVATE KEY-----
```
HighRSA
okhttp-tls/src/main/kotlin/okhttp3/tls/HeldCertificate.kt:30
ML-KEM (CRYSTALS-Kyber) for key encapsulation
Raw evidence
```
import java.security.interfaces.RSAPrivateKey
```
HighRSA
okhttp-tls/src/main/kotlin/okhttp3/tls/HeldCertificate.kt:31
ML-KEM (CRYSTALS-Kyber) for key encapsulation
Raw evidence
```
import java.security.interfaces.RSAPublicKey
```
HighElliptic Curve Cryptography
okhttp-tls/src/main/kotlin/okhttp3/tls/HeldCertificate.kt:29
Raw evidence
```
import java.security.interfaces.ECPublicKey
```
HighRSA
okhttp-tls/src/main/kotlin/okhttp3/tls/HeldCertificate.kt:176
ML-KEM (CRYSTALS-Kyber) for key encapsulation
Raw evidence
```
check(keyPair.private is RSAPrivateKey) { "PKCS1 only supports RSA keys" }
```

+ 2 more findings in the full report

Scan your own repository

Free. Results in ~90 seconds. CBOM + DORA/NIS2 PDF included.

Start a free scan