Sanity check: a PQC readiness scan finds no asymmetric crypto in Shiro core. Is that right?

[Arpan0995]

I maintain a static auditor that estimates what a post-quantum migration would touch in a Java codebase (https://github.com/Arpan0995/pqc-migration-readiness, Apache-2.0). Apache Shiro 2.2.1 is one of the four pinned public codebases I use as case studies, chosen as the framework-style, indirection-heavy code shape, and it came back as the negative control: 0 findings across 790 files. Re-running on shiro-root-3.0.1 gives the same, 0 across 780.

Before I quote that as "Shiro core has no quantum-vulnerable asymmetric crypto surface", I would like the people who know the code to say whether it is true or an artefact.

What I checked by hand after the scan:

• No KeyPairGenerator, KeyFactory, KeyAgreement or java.security.Signature use anywhere under src/main in the repository. The JCA surface is JcaCipherService (symmetric ciphers, transformation string assembled at runtime) plus the hash and password-hashing modules.
• The runtime-assembled transformation string in JcaCipherService.newCipherInstance is exactly the kind of call my scanner cannot resolve, so if an asymmetric cipher were ever routed through it the scan would not notice. As far as I can tell nothing is.

Two questions:

1. Are there asymmetric paths I am missing, in this repository or in modules maintained elsewhere: JWT or SAML integrations, remember-me or session encryption schemes, anything that signs or wraps keys?
2. From the project's point of view, where does post-quantum actually touch Shiro? My working assumption is nowhere in Shiro's own code and everywhere in what it sits on top of: TLS termination, identity providers, token formats. If you see it differently I would like to know.

Happy to share the report files, though for Shiro they are short.

[lprimak]

Hi,

You are correct. Shiro itself doesn't do anything that would be affected by post-quantum encryption.
There are two main dependencies, the JDK and BouncyCastle libraries.
Also, as you pointed out already, integrations may touch this topic, but Shiro itself is not in control of that.