CryptoCensus: Cryptographic Posture and Post-Quantum Readiness of Docker Hub

Abstract

Under a draft schedule from the National Institute of Standards and Technology (NIST), affected systems would stop using Rivest–Shamir–Adleman (RSA) and elliptic-curve cryptography after 2035. Traffic recorded today can be decrypted once a sufficiently large quantum computer exists. How far published container images have moved toward standardized post-quantum algorithms has not been openly measured. CryptoCensus gives every repository in a 12,716,568-repository crawl the same chance of selection. We scan 11,962 images and catalog 4,211,380 certificates and key files. 100% are quantum-vulnerable and 0 are post-quantum. Although 801 images (about one in fifteen) include a library that supports post-quantum algorithms, none contains a post-quantum key or certificate. The images also contain weak cryptography. 43% of certificates outside trust-store paths use Secure Hash Algorithm 1 (SHA-1) or Message-Digest Algorithm 5 (MD5) signatures, 512-bit RSA keys remain, and 36 private keys in operational paths recur across distinct images. Docker Hub images have yet to begin their post-quantum transition, even where supporting libraries are installed.