PQC-003CRITICALFIPS 140-3 · RFC 9106

Deprecated Cryptographic Hash & Block Primitives

Severity: CRITICAL

Identifies legacy ciphers (3DES, Blowfish, AES-128) and weak key derivation functions (PBKDF2, bcrypt, scrypt) which do not meet quantum entropy bounds.

Remediation checklist

Upgrade symmetric block ciphers to AES-256-GCM.
Migrate weak KDFs to Argon2id (RFC 9106) with minimum memory/iteration parameters.

Remediation snippets

Vulnerable — AES-128 + PBKDF2

// FLAGGED: 128-bit key + weak KDF
key := pbkdf2.Key(pw, salt, 10000, 16, sha1.New)
block, _ := aes.NewCipher(key) // AES-128

Remediated — AES-256-GCM + Argon2id

// Argon2id (RFC 9106) derives a 256-bit key
key := argon2.IDKey(pw, salt, 3, 64*1024, 4, 32)
block, _ := aes.NewCipher(key) // AES-256
aead, _ := cipher.NewGCM(block)

Automate this remediation

DevSecOps Enterprise licenses run ciphermap fix to apply these patches inline and open a pull request automatically.

View DevSecOps pricing

Other compliance rules

PQC-001

Quantum-Vulnerable Public Key (RSA)

PQC-002

Quantum-Vulnerable Elliptic Curves (ECC)