Skip to content

CipherHorizon v0.1.0

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Oct 10:53
· 49 commits to main since this release
v0.1.0
83928e9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Post-quantum readiness for the protocols your organisation runs on: TLS, SSH and, next, VPN. A deep scan of
each, a readiness level from L0 to L4, and one CycloneDX CBOM, self-hosted. The first public release, a 0.x
pre-release.

Highlights

  • TLS endpoints. CipherHorizon has its own TLS implementation for scanning. It checks:

    • every protocol from SSLv2 to TLS 1.3;
    • every cipher suite and key-exchange group (hybrids such as X25519MLKEM768 included);
    • the TLS 1.3 signature schemes (ML-DSA included);
    • the certificate chain against the Mozilla and Chrome root stores, or your own CA;
    • OCSP stapling, Certificate Transparency and HSTS.

    STARTTLS works for SMTP, IMAP, POP3, FTP, XMPP, LDAP and PostgreSQL. There are 55 cited checks and a TLS hygiene
    score with its arithmetic shown.

  • SSH servers.

    • Reads what a server offers and negotiates as OpenSSH 10.6 would, the ML-KEM hybrid included.
    • Fetches and verifies every host key: Ed25519, ECDSA, RSA, ML-DSA and the composite ssh-mldsa44-ed25519.
    • Judges the server against the cited CipherHorizon SSH baseline 2026, and writes the sshd_config lines
      that would make it meet the baseline.
    • Never logs in.
    • Checked against real OpenSSH 9.2 and 10.0.

  • Post-quantum readiness. L0 to L4 for every TLS endpoint and SSH server, each protocol by its own stated rules,
    with harvest-now-decrypt-later exposure.

  • Machines and inventory.

    • Two readable inventory scripts (PowerShell, shell) list a machine's cryptographic software and certificates.
    • CBOMs from other tools can be imported.
    • Everything merges into one CycloneDX 1.7 (or 1.6) CBOM.

  • The web app.

    • A page per protocol, Findings across everything with triage, and Systems ranked for migration.
    • PDF reports, schedules and history.
    • Sign-in when you want it: administrator, analyst and viewer roles, and an exportable activity log.

  • Command line and CI. tls scan and ssh scan, with --fail-on gates (exit 3), JSON and CBOM output, and a
    REST API described at /api/v1/openapi.json.

Install

Platform How
Container ghcr.io/offsetsecurity/cipherhorizon:0.1.0 (amd64, arm64), with docker-compose.yml or the Podman Quadlet unit in deploy/
Debian, Ubuntu sudo apt install ./cipherhorizon_0.1.0_amd64.deb
RHEL, Fedora sudo dnf install ./cipherhorizon-0.1.0-1.x86_64.rpm
Windows Unzip cipherhorizon_0.1.0_windows_amd64.zip, then run cipherhorizon.exe service install as administrator
Any OS Run cipherhorizon serve from the archive

Then open http://127.0.0.1:8080.

More: INSTALL.md.

Known limitations

  • Machines. The host collector has run on Windows (standard user) and in fixture tests for Linux, but not on a
    live Linux host or with administrator rights. macOS machines are not inventoried.
  • TLS. Validated against test servers and, for trust, against OpenSSL. A matrix of real TLS stacks (nginx,
    Apache, Postfix) is not yet recorded. There are no active vulnerability probes, by design.
  • SSH. Servers that offer only diffie-hellman-group18-sha512, group exchange or sntrup761 are judged on their
    algorithm lists, and their host keys are not fetched. BSI TR-02102-4 is planned as a second baseline.
  • Storage. SQLite only.

Everything in this release, in detail: CHANGELOG.md.

Verify what you downloaded

sha256sum --check --ignore-missing checksums.txt
cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/offsetsecurity/cipherhorizon/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify ghcr.io/offsetsecurity/cipherhorizon:0.1.0 \
  --certificate-identity-regexp '^https://github.com/offsetsecurity/cipherhorizon/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The inventory scripts a server of this version hands out are attached too, with inventory-scripts.sha256.
cipherhorizon scripts list prints the same hashes offline. Build provenance: gh attestation verify <file> --repo offsetsecurity/cipherhorizon. Full instructions:
DISTRIBUTION.md.

Assets 39
Loading