@quantakrypto/core 0.3.0 → 0.4.0

package/src/detect-utils.ts

@@ -19,29 +19,63 @@ export interface LineCol {
   column: number;
 }
 
+/**
+ * Memoized line-start offsets for the CURRENT content string. A scan processes
+ * all of one file's findings consecutively against the same `content` reference,
+ * so a single-entry cache turns the previously O(offset)-per-finding line/column
+ * math into O(log n) — the whole file is O(n log n) instead of O(n²). Without
+ * this, a large file with many findings scaled quadratically (a real perf cliff,
+ * caught by the ReDoS/time-budget test).
+ */
+let cachedContent: string | null = null;
+let cachedLineStarts: number[] = [];
+function lineStartsFor(content: string): number[] {
+  if (content === cachedContent) return cachedLineStarts;
+  const starts = [0];
+  for (let i = 0; i < content.length; i++) {
+    if (content.charCodeAt(i) === 10 /* \n */) starts.push(i + 1);
+  }
+  cachedContent = content;
+  cachedLineStarts = starts;
+  return starts;
+}
+
+/** Index of the line containing `offset` (0-based into the line-starts array). */
+function lineIndexFor(starts: readonly number[], offset: number): number {
+  let lo = 0;
+  let hi = starts.length - 1;
+  let best = 0;
+  while (lo <= hi) {
+    const mid = (lo + hi) >>> 1;
+    if (starts[mid] <= offset) {
+      best = mid;
+      lo = mid + 1;
+    } else {
+      hi = mid - 1;
+    }
+  }
+  return best;
+}
+
 /**
  * Convert a 0-based character offset within `content` into a 1-based
  * line/column. Newlines are LF; CR is treated as an ordinary character, so on
  * CRLF files the column includes the trailing CR offset harmlessly.
  */
 export function offsetToLineCol(content: string, offset: number): LineCol {
-  let line = 1;
-  let lastNewline = -1;
-  for (let i = 0; i < offset && i < content.length; i++) {
-    if (content.charCodeAt(i) === 10 /* \n */) {
-      line++;
-      lastNewline = i;
-    }
-  }
-  return { line, column: offset - lastNewline };
+  const starts = lineStartsFor(content);
+  const idx = lineIndexFor(starts, offset);
+  return { line: idx + 1, column: offset - starts[idx] + 1 };
 }
 
 /** Extract the (trimmed) single source line containing `offset`. */
 export function lineAt(content: string, offset: number): string {
-  let start = offset;
-  while (start > 0 && content.charCodeAt(start - 1) !== 10) start--;
-  let end = offset;
-  while (end < content.length && content.charCodeAt(end) !== 10) end++;
+  const starts = lineStartsFor(content);
+  const idx = lineIndexFor(starts, offset);
+  const start = starts[idx];
+  const nextStart = idx + 1 < starts.length ? starts[idx + 1] : content.length + 1;
+  // nextStart points just past the '\n'; the line content ends before it.
+  const end = Math.min(nextStart - 1, content.length);
   return content.slice(start, end).replace(/\r$/, "").trim();
 }
 
@@ -166,8 +200,82 @@ export function hasExtension(filePath: string, exts: readonly string[]): boolean
   return exts.some((e) => lower.endsWith(e));
 }
 
-/** JavaScript / TypeScript source extensions handled by the source detectors. */
-export const JS_TS_EXTENSIONS: readonly string[] = [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs"];
+/**
+ * JavaScript / TypeScript source extensions handled by the source detectors.
+ * `.vue` / `.svelte` single-file components embed a `<script>` block, so the
+ * lexical detectors catch crypto usage inside them.
+ */
+export const JS_TS_EXTENSIONS: readonly string[] = [
+  ".js",
+  ".jsx",
+  ".ts",
+  ".tsx",
+  ".mjs",
+  ".cjs",
+  ".vue",
+  ".svelte",
+];
+
+/** Python source extensions handled by the Python detector. */
+export const PYTHON_EXTENSIONS: readonly string[] = [".py", ".pyi", ".pyw"];
+
+/** Go source extensions handled by the Go detector. */
+export const GO_EXTENSIONS: readonly string[] = [".go"];
+
+/** Java / Kotlin source extensions handled by the JCA detector. */
+export const JAVA_EXTENSIONS: readonly string[] = [".java", ".kt", ".kts"];
+
+/** C# source extensions handled by the .NET detector. */
+export const CSHARP_EXTENSIONS: readonly string[] = [".cs"];
+
+/** Rust source extensions handled by the Rust detector. */
+export const RUST_EXTENSIONS: readonly string[] = [".rs"];
+
+/** Ruby source extensions handled by the Ruby detector. */
+export const RUBY_EXTENSIONS: readonly string[] = [".rb"];
+
+/** C / C++ source extensions handled by the OpenSSL detector. */
+export const C_EXTENSIONS: readonly string[] = [".c", ".h", ".cc", ".cpp", ".cxx", ".hpp", ".hh"];
+
+/**
+ * File-literal surfaces where a JWT/JOSE algorithm string (`"RS256"`, `"ES256"`)
+ * is the same evidence regardless of language. Used to un-gate the JWT detector
+ * from JS-only. Kept to JS/TS + Python for now (both quote the alg token, so the
+ * regex stays precise); YAML/JSON config carry unquoted tokens and higher FP
+ * risk, so they wait for a config-aware pass.
+ */
+export const JWT_HOST_EXTENSIONS: readonly string[] = [...JS_TS_EXTENSIONS, ...PYTHON_EXTENSIONS];
+
+/**
+ * Extensions the scanner can actually analyze for inline crypto usage today
+ * (the language-specific source detectors). A scan that walked files but found
+ * none of these has NOT meaningfully assessed the codebase — reporters surface
+ * that ({@link CryptoInventory}/coverage), so a bare 100/100 can't masquerade as
+ * "safe" on, say, a Go or Rust repo. PEM / SSH / dependency detectors run on any
+ * file and are intentionally excluded here.
+ */
+export const ANALYZABLE_SOURCE_EXTENSIONS: readonly string[] = [
+  ...JS_TS_EXTENSIONS,
+  ...PYTHON_EXTENSIONS,
+  ...GO_EXTENSIONS,
+  ...JAVA_EXTENSIONS,
+  ...CSHARP_EXTENSIONS,
+  ...RUST_EXTENSIONS,
+  ...RUBY_EXTENSIONS,
+  ...C_EXTENSIONS,
+];
+
+/**
+ * Human label for the source languages the scanner can analyze for inline
+ * crypto, shown in coverage output. Kept next to {@link
+ * ANALYZABLE_SOURCE_EXTENSIONS} so a new language pack updates one place.
+ */
+export const ANALYZABLE_LANGUAGES_LABEL = "JS/TS, Python, Go, Java, C#, Rust, Ruby, C/C++";
+
+/** True when a path is in a source language the scanner can analyze for crypto. */
+export function isAnalyzableSource(filePath: string): boolean {
+  return hasExtension(filePath, ANALYZABLE_SOURCE_EXTENSIONS);
+}
 
 /**
  * Given a SORTED ascending array of call offsets, return true when `idx` is at

package/src/detectors/c.ts

@@ -0,0 +1,132 @@
+/**
+ * Source-code detector for classical asymmetric cryptography in C / C++ using
+ * OpenSSL (the dominant crypto library for the ecosystem). Lexical, same
+ * strategy as the other packs; the OpenSSL function names are distinctive.
+ *
+ * NOTE: scanning OpenSSL's OWN source/headers will naturally light up (the
+ * library declares these symbols) — that is inherent to lexical scanning of a
+ * crypto library, not a false positive in application code. Matches the classic
+ * `*_generate_key` / `ECDSA_sign` / `ECDH_compute_key` call forms plus the
+ * `EVP_RSA_gen` helper.
+ *
+ * HNDL: RSA encryption and (EC)DH key agreement are harvest-now-decrypt-later
+ * exposed (hndl:true); ECDSA / DSA signatures are hndl:false but forgeable.
+ * `EC_KEY_generate_key` is ambiguous (feeds ECDSA + ECDH), classified
+ * conservatively as key-exchange-capable (hndl:true).
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { C_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+const RE_C_RSA = /\bRSA_generate_key(?:_ex)?\s*\(|\bEVP_RSA_gen\s*\(/g;
+const RE_C_EC = /\bEC_KEY_generate_key\s*\(|\bEC_KEY_new_by_curve_name\s*\(/g;
+const RE_C_ECDSA = /\bECDSA_do_sign\s*\(|\bECDSA_sign\s*\(/g;
+const RE_C_ECDH = /\bECDH_compute_key\s*\(/g;
+const RE_C_DSA = /\bDSA_generate_key\s*\(|\bDSA_generate_parameters(?:_ex)?\s*\(/g;
+const RE_C_DH = /\bDH_generate_key\s*\(|\bDH_generate_parameters(?:_ex)?\s*\(/g;
+
+const RULE_C_RSA: RuleMeta = {
+  id: "c-rsa-keygen",
+  title: "C/OpenSSL RSA key generation",
+  description: "OpenSSL RSA_generate_key(_ex) / EVP_RSA_gen",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Generates a classical RSA key pair (C/OpenSSL), which is not quantum-safe.",
+};
+const RULE_C_EC: RuleMeta = {
+  id: "c-ec-keygen",
+  title: "C/OpenSSL EC key generation",
+  description: "OpenSSL EC_KEY_generate_key / EC_KEY_new_by_curve_name",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Generates a classical EC key pair (C/OpenSSL). EC keys feed BOTH ECDSA signatures and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+const RULE_C_ECDSA: RuleMeta = {
+  id: "c-ecdsa",
+  title: "C/OpenSSL ECDSA signature",
+  description: "OpenSSL ECDSA_sign / ECDSA_do_sign",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical ECDSA signing (C/OpenSSL) is forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_C_ECDH: RuleMeta = {
+  id: "c-ecdh",
+  title: "C/OpenSSL ECDH key agreement",
+  description: "OpenSSL ECDH_compute_key",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Elliptic-curve Diffie-Hellman (C/OpenSSL) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_C_DSA: RuleMeta = {
+  id: "c-dsa",
+  title: "C/OpenSSL DSA key/usage",
+  description: "OpenSSL DSA_generate_key / DSA_generate_parameters",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "DSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical DSA (C/OpenSSL) is deprecated and forgeable by a quantum attacker.",
+  remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
+};
+const RULE_C_DH: RuleMeta = {
+  id: "c-dh",
+  title: "C/OpenSSL Diffie-Hellman key exchange",
+  description: "OpenSSL DH_generate_key / DH_generate_parameters",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "DH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Finite-field Diffie-Hellman (C/OpenSSL) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+
+/** Detects classical asymmetric crypto in C/C++ (OpenSSL). */
+export const cDetector: Detector = {
+  id: "c-crypto",
+  description: "Classical asymmetric crypto in C/C++ (OpenSSL)",
+  scope: "source",
+  language: "c",
+  rules: [RULE_C_RSA, RULE_C_EC, RULE_C_ECDSA, RULE_C_ECDH, RULE_C_DSA, RULE_C_DH],
+  appliesTo: (f) => hasExtension(f, C_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, content, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    add(RE_C_RSA, RULE_C_RSA);
+    add(RE_C_EC, RULE_C_EC);
+    add(RE_C_ECDSA, RULE_C_ECDSA);
+    add(RE_C_ECDH, RULE_C_ECDH);
+    add(RE_C_DSA, RULE_C_DSA);
+    add(RE_C_DH, RULE_C_DH);
+    return findings;
+  },
+};

package/src/detectors/csharp.ts

@@ -0,0 +1,98 @@
+/**
+ * Source-code detector for classical asymmetric cryptography in C# / .NET
+ * (`System.Security.Cryptography`). Same lexical strategy as the other packs.
+ * .NET exposes each algorithm through a factory (`RSA.Create()`,
+ * `ECDsa.Create()`, `ECDiffieHellman.Create()`) or a concrete CSP/CNG class
+ * (`RSACryptoServiceProvider`, `ECDsaCng`, …), all of which are precise signals.
+ *
+ * HNDL: RSA (keygen/encryption) and (EC)DH key agreement are harvest-now-
+ * decrypt-later exposed (hndl:true); ECDSA/DSA signatures are hndl:false but
+ * forgeable by a quantum attacker.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { CSHARP_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+const RE_CS_RSA =
+  /\bRSA\.Create\s*\(|\bnew\s+RSACryptoServiceProvider\s*\(|\bnew\s+RSACng\s*\(|\bnew\s+RSAOpenSsl\s*\(/g;
+const RE_CS_ECDSA = /\bECDsa\.Create\s*\(|\bnew\s+ECDsaCng\s*\(|\bnew\s+ECDsaOpenSsl\s*\(/g;
+const RE_CS_ECDH =
+  /\bECDiffieHellman\.Create\s*\(|\bnew\s+ECDiffieHellmanCng\s*\(|\bnew\s+ECDiffieHellmanOpenSsl\s*\(/g;
+const RE_CS_DSA = /\bDSA\.Create\s*\(|\bnew\s+DSACryptoServiceProvider\s*\(|\bnew\s+DSACng\s*\(/g;
+
+const RULE_CS_RSA: RuleMeta = {
+  id: "csharp-rsa",
+  title: "C# RSA key/usage",
+  description: "System.Security.Cryptography RSA.Create / RSACryptoServiceProvider / RSACng",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical RSA (.NET) is not quantum-safe and RSA encryption is HNDL-exposed.",
+};
+const RULE_CS_ECDSA: RuleMeta = {
+  id: "csharp-ecdsa",
+  title: "C# ECDSA signature",
+  description: "System.Security.Cryptography ECDsa.Create / ECDsaCng",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical ECDSA signing (.NET) is forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_CS_ECDH: RuleMeta = {
+  id: "csharp-ecdh",
+  title: "C# ECDH key agreement",
+  description: "System.Security.Cryptography ECDiffieHellman.Create / ECDiffieHellmanCng",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Elliptic-curve Diffie-Hellman (.NET) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_CS_DSA: RuleMeta = {
+  id: "csharp-dsa",
+  title: "C# DSA key/signature",
+  description: "System.Security.Cryptography DSA.Create / DSACryptoServiceProvider",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "DSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical DSA (.NET) is deprecated and forgeable by a quantum attacker.",
+  remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
+};
+
+/** Detects classical asymmetric crypto in C# (System.Security.Cryptography). */
+export const csharpDetector: Detector = {
+  id: "csharp-crypto",
+  description: "Classical asymmetric crypto in C#/.NET (System.Security.Cryptography)",
+  scope: "source",
+  language: "csharp",
+  rules: [RULE_CS_RSA, RULE_CS_ECDSA, RULE_CS_ECDH, RULE_CS_DSA],
+  appliesTo: (f) => hasExtension(f, CSHARP_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, content, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    // ECDSA / ECDH before RSA/DSA so the specific EC factories win.
+    add(RE_CS_ECDSA, RULE_CS_ECDSA);
+    add(RE_CS_ECDH, RULE_CS_ECDH);
+    add(RE_CS_RSA, RULE_CS_RSA);
+    add(RE_CS_DSA, RULE_CS_DSA);
+    return findings;
+  },
+};

package/src/detectors/go.ts

@@ -0,0 +1,167 @@
+/**
+ * Source-code detector for classical, non-quantum-safe asymmetric cryptography
+ * in Go. Same lexical (regex-over-source) strategy as the JS/TS and Python
+ * detectors. Go's crypto lives almost entirely in the highly-standardized
+ * `crypto/*` standard library, so package-qualified calls (`rsa.GenerateKey`,
+ * `ecdsa.SignASN1`, `ecdh.X25519`, …) are precise, low-false-positive signals.
+ *
+ * Covered:
+ *   - crypto/rsa   — GenerateKey, EncryptOAEP/PKCS1v15, SignPKCS1v15/PSS
+ *   - crypto/ecdsa — GenerateKey, Sign/SignASN1
+ *   - crypto/ecdh  — P256/P384/P521/X25519 curve construction (key agreement)
+ *   - crypto/ed25519 — GenerateKey, Sign
+ *   - crypto/dsa   — GenerateKey, GenerateParameters (deprecated)
+ *
+ * HNDL policy mirrors the other detectors: KEM / key agreement (RSA encryption,
+ * ECDH) is harvest-now-decrypt-later exposed (hndl:true); signatures (RSA-sign,
+ * ECDSA, Ed25519, DSA) are hndl:false but still forgeable by a quantum attacker.
+ * Unlike Node's ambiguous `'ec'` keygen, Go's `ecdsa.GenerateKey` is
+ * signature-specific and Go's key agreement lives in the separate `crypto/ecdh`
+ * package, so the two are classified precisely rather than conservatively merged.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { GO_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+/* -------------------------------------------------------------------------- */
+/* Precompiled regexes (module scope)                                         */
+/* -------------------------------------------------------------------------- */
+
+const RE_GO_RSA_KEYGEN = /\brsa\.GenerateKey\s*\(|\brsa\.GenerateMultiPrimeKey\s*\(/g;
+const RE_GO_RSA_ENCRYPT = /\brsa\.EncryptOAEP\s*\(|\brsa\.EncryptPKCS1v15\s*\(/g;
+const RE_GO_RSA_SIGN = /\brsa\.SignPKCS1v15\s*\(|\brsa\.SignPSS\s*\(/g;
+const RE_GO_ECDSA = /\becdsa\.GenerateKey\s*\(|\becdsa\.SignASN1\s*\(|\becdsa\.Sign\s*\(/g;
+const RE_GO_ECDH = /\becdh\.(?:P256|P384|P521|X25519)\s*\(/g;
+const RE_GO_ED25519 = /\bed25519\.GenerateKey\s*\(|\bed25519\.Sign\s*\(/g;
+const RE_GO_DSA = /\bdsa\.GenerateKey\s*\(|\bdsa\.GenerateParameters\s*\(/g;
+
+/* -------------------------------------------------------------------------- */
+/* Rule catalog                                                               */
+/* -------------------------------------------------------------------------- */
+
+const RULE_GO_RSA_KEYGEN: RuleMeta = {
+  id: "go-rsa-keygen",
+  title: "Go RSA key generation",
+  description: "crypto/rsa GenerateKey / GenerateMultiPrimeKey",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Generates a classical RSA key pair (Go), which is not quantum-safe.",
+};
+const RULE_GO_RSA_ENCRYPT: RuleMeta = {
+  id: "go-rsa-encrypt",
+  title: "Go RSA public-key encryption",
+  description: "crypto/rsa EncryptOAEP / EncryptPKCS1v15",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "RSA public-key encryption (Go) is broken by Shor's algorithm and exposed to harvest-now-decrypt-later.",
+};
+const RULE_GO_RSA_SIGN: RuleMeta = {
+  id: "go-rsa-sign",
+  title: "Go RSA signature",
+  description: "crypto/rsa SignPKCS1v15 / SignPSS",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical RSA signing (Go) is forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_GO_ECDSA: RuleMeta = {
+  id: "go-ecdsa",
+  title: "Go ECDSA key/signature",
+  description: "crypto/ecdsa GenerateKey / Sign / SignASN1",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical ECDSA (Go) is forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_GO_ECDH: RuleMeta = {
+  id: "go-ecdh",
+  title: "Go ECDH key exchange",
+  description: "crypto/ecdh P256/P384/P521/X25519 key agreement",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Elliptic-curve Diffie-Hellman (Go crypto/ecdh) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_GO_ED25519: RuleMeta = {
+  id: "go-ed25519",
+  title: "Go Ed25519 signature",
+  description: "crypto/ed25519 GenerateKey / Sign",
+  category: "signature",
+  severity: "low",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Ed25519 (Go) is a modern but still classical signature scheme.",
+};
+const RULE_GO_DSA: RuleMeta = {
+  id: "go-dsa",
+  title: "Go DSA key/usage",
+  description: "crypto/dsa GenerateKey / GenerateParameters",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "DSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical DSA (Go) is deprecated and forgeable by a quantum attacker.",
+  remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
+};
+
+/** Detects classical asymmetric crypto in Go source (crypto/* standard library). */
+export const goDetector: Detector = {
+  id: "go-crypto",
+  description: "Classical asymmetric crypto in Go (crypto/rsa, ecdsa, ecdh, ed25519, dsa)",
+  scope: "source",
+  language: "go",
+  rules: [
+    RULE_GO_RSA_KEYGEN,
+    RULE_GO_RSA_ENCRYPT,
+    RULE_GO_RSA_SIGN,
+    RULE_GO_ECDSA,
+    RULE_GO_ECDH,
+    RULE_GO_ED25519,
+    RULE_GO_DSA,
+  ],
+  appliesTo: (f) => hasExtension(f, GO_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, content, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+
+    add(RE_GO_RSA_KEYGEN, RULE_GO_RSA_KEYGEN);
+    add(RE_GO_RSA_ENCRYPT, RULE_GO_RSA_ENCRYPT);
+    add(RE_GO_RSA_SIGN, RULE_GO_RSA_SIGN);
+    add(RE_GO_ECDSA, RULE_GO_ECDSA);
+    add(RE_GO_ECDH, RULE_GO_ECDH);
+    add(RE_GO_ED25519, RULE_GO_ED25519);
+    add(RE_GO_DSA, RULE_GO_DSA);
+
+    return findings;
+  },
+};