@quantakrypto/core 0.3.0 → 0.4.0

package/src/detectors/java.ts

@@ -0,0 +1,235 @@
+/**
+ * Source-code detector for classical, non-quantum-safe asymmetric cryptography
+ * in Java / Kotlin (the JCA — Java Cryptography Architecture). Same lexical
+ * strategy as the other language packs.
+ *
+ * The JCA funnels almost everything through a handful of factory methods keyed
+ * by an ALGORITHM STRING: `KeyPairGenerator.getInstance("RSA")`,
+ * `Signature.getInstance("SHA256withECDSA")`, `Cipher.getInstance("RSA/ECB/…")`,
+ * `KeyAgreement.getInstance("ECDH")`. So detection here is two steps: match the
+ * `<Factory>.getInstance("<alg>")` call, then classify the (factory, alg) pair
+ * into a rule. Symmetric / hashing algorithms ("AES", "HmacSHA256", …) classify
+ * to nothing and are ignored. A small set of BouncyCastle lightweight-API class
+ * names (`new ECDSASigner()`, `new X25519Agreement()`, …) is matched directly.
+ *
+ * HNDL policy mirrors the other detectors: KEM / key agreement (RSA encryption,
+ * (EC)DH, X25519/X448) is harvest-now-decrypt-later exposed (hndl:true);
+ * signatures (RSA/ECDSA/DSA/EdDSA) are hndl:false but forgeable by a quantum
+ * attacker. `KeyPairGenerator.getInstance("EC")` is ambiguous (an EC key feeds
+ * both ECDSA and ECDH), so it is classified conservatively as
+ * key-exchange-capable (hndl:true), exactly as the Node/Python EC keygen rules.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { JAVA_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+/* -------------------------------------------------------------------------- */
+/* Regexes                                                                    */
+/* -------------------------------------------------------------------------- */
+
+// <Factory>.getInstance("<alg>") — the JCA entry points that carry asymmetric
+// algorithms. KeyGenerator/MessageDigest/Mac are intentionally excluded (they
+// are symmetric / hashing only).
+const RE_JAVA_GETINSTANCE =
+  /\b(KeyPairGenerator|Signature|Cipher|KeyAgreement|KeyFactory)\s*\.\s*getInstance\s*\(\s*"([^"]+)"/g;
+
+// BouncyCastle lightweight-API class instantiations.
+const RE_JAVA_BC =
+  /\bnew\s+(RSAKeyPairGenerator|DSAKeyPairGenerator|ECKeyPairGenerator|ECDSASigner|Ed25519Signer|Ed448Signer|X25519Agreement|X448Agreement)\s*\(/g;
+
+/* -------------------------------------------------------------------------- */
+/* Rule catalog                                                               */
+/* -------------------------------------------------------------------------- */
+
+const RULE_JAVA_RSA: RuleMeta = {
+  id: "java-rsa",
+  title: "Java RSA key/encryption",
+  description: "JCA RSA KeyPairGenerator / Cipher / KeyFactory",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical RSA (Java/JCA) is not quantum-safe and RSA encryption is HNDL-exposed.",
+};
+const RULE_JAVA_RSA_SIGN: RuleMeta = {
+  id: "java-rsa-sign",
+  title: "Java RSA signature",
+  description: 'JCA Signature.getInstance("…withRSA")',
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical RSA signing (Java/JCA) is forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_JAVA_EC_KEYGEN: RuleMeta = {
+  id: "java-ec-keygen",
+  title: "Java EC key generation",
+  description: 'JCA KeyPairGenerator.getInstance("EC")',
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Generates a classical EC key pair (Java/JCA). EC keys feed BOTH ECDSA signatures and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+const RULE_JAVA_ECDSA_SIGN: RuleMeta = {
+  id: "java-ecdsa-sign",
+  title: "Java ECDSA signature",
+  description: 'JCA Signature.getInstance("…withECDSA")',
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical ECDSA signing (Java/JCA) is forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_JAVA_ECDH: RuleMeta = {
+  id: "java-ecdh",
+  title: "Java ECDH key agreement",
+  description: 'JCA KeyAgreement.getInstance("ECDH")',
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Elliptic-curve Diffie-Hellman (Java/JCA) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_JAVA_DSA: RuleMeta = {
+  id: "java-dsa",
+  title: "Java DSA key/signature",
+  description: "JCA DSA KeyPairGenerator / Signature",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "DSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical DSA (Java/JCA) is deprecated and forgeable by a quantum attacker.",
+  remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
+};
+const RULE_JAVA_DH: RuleMeta = {
+  id: "java-dh",
+  title: "Java Diffie-Hellman key exchange",
+  description: "JCA DiffieHellman KeyPairGenerator / KeyAgreement",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "DH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Finite-field Diffie-Hellman (Java/JCA) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_JAVA_XDH: RuleMeta = {
+  id: "java-xdh",
+  title: "Java X25519/X448 key agreement",
+  description: "JCA XDH / X25519 / X448 (KeyPairGenerator / KeyAgreement)",
+  category: "key-exchange",
+  severity: "low",
+  confidence: "high",
+  algorithm: "X25519",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "X25519/X448 (Java/JCA) is modern but still classical key agreement — harvest-now-decrypt-later.",
+};
+const RULE_JAVA_EDDSA: RuleMeta = {
+  id: "java-eddsa",
+  title: "Java Ed25519/Ed448 signature",
+  description: "JCA EdDSA / Ed25519 / Ed448",
+  category: "signature",
+  severity: "low",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Ed25519/Ed448 (Java/JCA) is a modern but still classical signature scheme.",
+};
+
+/**
+ * Classify a `<factory>.getInstance("<alg>")` pair into a rule, or null when the
+ * algorithm is not classical asymmetric crypto (AES, HMAC, PBKDF2, hashes, …).
+ * `alg` is normalised to upper-case with any Cipher transformation suffix
+ * (`RSA/ECB/OAEPPadding` → `RSA`) stripped.
+ */
+function classifyGetInstance(factory: string, rawAlg: string): RuleMeta | null {
+  const alg = rawAlg.split("/")[0].trim().toUpperCase();
+  const isSignature = factory === "Signature";
+
+  if (alg.includes("ECDSA")) return RULE_JAVA_ECDSA_SIGN;
+  if (alg.includes("ECDH")) return RULE_JAVA_ECDH;
+  if (alg === "EC") return isSignature ? RULE_JAVA_ECDSA_SIGN : RULE_JAVA_EC_KEYGEN;
+  if (alg.includes("ED25519") || alg.includes("ED448") || alg.includes("EDDSA"))
+    return RULE_JAVA_EDDSA;
+  if (alg.includes("X25519") || alg.includes("X448") || alg === "XDH") return RULE_JAVA_XDH;
+  if (alg.includes("RSA")) return isSignature ? RULE_JAVA_RSA_SIGN : RULE_JAVA_RSA;
+  if (alg.includes("DSA")) return RULE_JAVA_DSA; // ECDSA already handled above
+  if (alg.includes("DH") || alg.includes("DIFFIEHELLMAN")) return RULE_JAVA_DH;
+  return null;
+}
+
+/** BouncyCastle lightweight-API class name → rule. */
+const BC_CLASS_RULES: Record<string, RuleMeta> = {
+  RSAKeyPairGenerator: RULE_JAVA_RSA,
+  DSAKeyPairGenerator: RULE_JAVA_DSA,
+  ECKeyPairGenerator: RULE_JAVA_EC_KEYGEN,
+  ECDSASigner: RULE_JAVA_ECDSA_SIGN,
+  Ed25519Signer: RULE_JAVA_EDDSA,
+  Ed448Signer: RULE_JAVA_EDDSA,
+  X25519Agreement: RULE_JAVA_XDH,
+  X448Agreement: RULE_JAVA_XDH,
+};
+
+/** Detects classical asymmetric crypto in Java / Kotlin (JCA + BouncyCastle). */
+export const javaDetector: Detector = {
+  id: "java-crypto",
+  description: "Classical asymmetric crypto in Java/Kotlin (JCA getInstance + BouncyCastle)",
+  scope: "source",
+  language: "java",
+  rules: [
+    RULE_JAVA_RSA,
+    RULE_JAVA_RSA_SIGN,
+    RULE_JAVA_EC_KEYGEN,
+    RULE_JAVA_ECDSA_SIGN,
+    RULE_JAVA_ECDH,
+    RULE_JAVA_DSA,
+    RULE_JAVA_DH,
+    RULE_JAVA_XDH,
+    RULE_JAVA_EDDSA,
+  ],
+  appliesTo: (f) => hasExtension(f, JAVA_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+
+    eachMatch(RE_JAVA_GETINSTANCE, content, (m) => {
+      const rule = classifyGetInstance(m[1], m[2]);
+      if (!rule) return; // symmetric / hashing algorithm — not our concern.
+      findings.push(
+        findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+      );
+    });
+
+    eachMatch(RE_JAVA_BC, content, (m) => {
+      const rule = BC_CLASS_RULES[m[1]];
+      if (!rule) return;
+      findings.push(
+        findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+      );
+    });
+
+    return findings;
+  },
+};

package/src/detectors/python.ts

@@ -0,0 +1,212 @@
+/**
+ * Source-code detector for classical, non-quantum-safe asymmetric cryptography
+ * in Python. Same lexical (regex-over-source) strategy as the JS/TS detectors:
+ * robust to formatting, dependency-free, and confidence-tagged per pattern.
+ *
+ * Covers the three libraries that carry ~all real-world Python asymmetric
+ * crypto:
+ *   - `cryptography` (hazmat): rsa/ec/dh/x25519/x448/ed25519/ed448 + OAEP padding
+ *   - PyCryptodome (`Crypto.PublicKey`): RSA/ECC/DSA generate + PKCS1_OAEP
+ *   - paramiko (SSH): RSAKey / ECDSAKey / Ed25519Key / DSSKey
+ *
+ * JWT/JOSE algorithm strings (`algorithm="RS256"`) are NOT handled here — the
+ * language-agnostic `jwt-jose` detector now applies to Python too (a quoted
+ * `"RS256"` is the same evidence in any language).
+ *
+ * HNDL policy mirrors the JS detectors: key agreement / KEM (RSA-OAEP, ECDH, DH,
+ * X25519/X448) is harvest-now-decrypt-later exposed (hndl:true); signatures
+ * (ECDSA, DSA, Ed25519/Ed448) are hndl:false but still high/low severity because
+ * a quantum attacker can forge them. EC key generation is ambiguous (an EC key
+ * feeds both ECDSA and ECDH), so it is classified conservatively as
+ * key-exchange-capable (hndl:true), exactly as the Node `ec` keygen rule is.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { PYTHON_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+/* -------------------------------------------------------------------------- */
+/* Precompiled regexes (module scope)                                         */
+/* -------------------------------------------------------------------------- */
+
+// RSA key generation: cryptography `rsa.generate_private_key(`, PyCryptodome
+// `RSA.generate(`, paramiko `paramiko.RSAKey` / `RSAKey.generate(`.
+const RE_PY_RSA_KEYGEN =
+  /\brsa\.generate_private_key\s*\(|\bRSA\.generate\s*\(|\bparamiko\.RSAKey\b|\bRSAKey\.generate\s*\(/g;
+// RSA public-key encryption padding (RSA-OAEP): confidentiality → HNDL.
+const RE_PY_RSA_ENCRYPT = /\bpadding\.OAEP\s*\(|\bPKCS1_OAEP\.new\s*\(/g;
+// EC key generation (ambiguous ECDSA/ECDH): cryptography + PyCryptodome.
+const RE_PY_EC_KEYGEN = /\bec\.generate_private_key\s*\(|\bECC\.generate\s*\(/g;
+// ECDSA signatures: cryptography `ec.ECDSA(`, paramiko ECDSAKey.
+const RE_PY_ECDSA = /\bec\.ECDSA\s*\(|\bparamiko\.ECDSAKey\b|\bECDSAKey\.generate\s*\(/g;
+// DSA: PyCryptodome `DSA.generate(`, paramiko DSSKey.
+const RE_PY_DSA = /\bDSA\.generate\s*\(|\bparamiko\.DSSKey\b|\bDSSKey\.generate\s*\(/g;
+// Finite-field Diffie-Hellman (cryptography `dh`).
+const RE_PY_DH = /\bdh\.generate_parameters\s*\(|\bdh\.DHParameterNumbers\s*\(/g;
+// Modern-but-classical curve primitives (cryptography). `.generate(` anchors so
+// a bare import of the class name does not fire.
+const RE_PY_X25519 = /\bX25519PrivateKey\.generate\s*\(/g;
+const RE_PY_X448 = /\bX448PrivateKey\.generate\s*\(/g;
+const RE_PY_EDDSA = /\b(?:Ed25519|Ed448)PrivateKey\.generate\s*\(|\bparamiko\.Ed25519Key\b/g;
+
+/* -------------------------------------------------------------------------- */
+/* Rule catalog                                                               */
+/* -------------------------------------------------------------------------- */
+
+const RULE_PY_RSA_KEYGEN: RuleMeta = {
+  id: "python-rsa-keygen",
+  title: "Python RSA key generation",
+  description:
+    "cryptography rsa.generate_private_key / PyCryptodome RSA.generate / paramiko RSAKey",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Generates a classical RSA key pair (Python), which is not quantum-safe.",
+};
+const RULE_PY_RSA_ENCRYPT: RuleMeta = {
+  id: "python-rsa-encrypt",
+  title: "Python RSA public-key encryption",
+  description: "RSA-OAEP / PKCS1_OAEP encryption padding",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "RSA public-key encryption (OAEP) is broken by Shor's algorithm and exposed to harvest-now-decrypt-later.",
+};
+const RULE_PY_EC_KEYGEN: RuleMeta = {
+  id: "python-ec-keygen",
+  title: "Python EC key generation",
+  description: "cryptography ec.generate_private_key / PyCryptodome ECC.generate",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Generates a classical EC key pair (Python). EC keys feed BOTH ECDSA signatures and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+const RULE_PY_ECDSA: RuleMeta = {
+  id: "python-ecdsa",
+  title: "Python ECDSA signature",
+  description: "cryptography ec.ECDSA / paramiko ECDSAKey",
+  category: "signature",
+  severity: "high",
+  confidence: "medium",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical ECDSA signing (Python) is forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_PY_DSA: RuleMeta = {
+  id: "python-dsa",
+  title: "Python DSA key/usage",
+  description: "PyCryptodome DSA.generate / paramiko DSSKey",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "DSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical DSA (Python) is deprecated and forgeable by a quantum attacker.",
+  remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
+};
+const RULE_PY_DH: RuleMeta = {
+  id: "python-dh",
+  title: "Python Diffie-Hellman key exchange",
+  description: "cryptography dh.generate_parameters / DHParameterNumbers",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "DH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Finite-field Diffie-Hellman (Python) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_PY_X25519: RuleMeta = {
+  id: "python-x25519",
+  title: "Python X25519 key exchange",
+  description: "cryptography X25519PrivateKey.generate",
+  category: "key-exchange",
+  severity: "low",
+  confidence: "high",
+  algorithm: "X25519",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "X25519 (Python) is modern but still classical key agreement — harvest-now-decrypt-later.",
+};
+const RULE_PY_X448: RuleMeta = {
+  id: "python-x448",
+  title: "Python X448 key exchange",
+  description: "cryptography X448PrivateKey.generate",
+  category: "key-exchange",
+  severity: "low",
+  confidence: "high",
+  algorithm: "X448",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "X448 (Python) is modern but still classical key agreement — harvest-now-decrypt-later.",
+};
+const RULE_PY_EDDSA: RuleMeta = {
+  id: "python-eddsa",
+  title: "Python Ed25519/Ed448 signature",
+  description: "cryptography Ed25519/Ed448 PrivateKey.generate / paramiko Ed25519Key",
+  category: "signature",
+  severity: "low",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Ed25519/Ed448 (Python) is a modern but still classical signature scheme.",
+};
+
+/** Detects classical asymmetric crypto in Python source. */
+export const pythonDetector: Detector = {
+  id: "python-crypto",
+  description: "Classical asymmetric crypto in Python (cryptography, PyCryptodome, paramiko)",
+  scope: "source",
+  language: "python",
+  rules: [
+    RULE_PY_RSA_KEYGEN,
+    RULE_PY_RSA_ENCRYPT,
+    RULE_PY_EC_KEYGEN,
+    RULE_PY_ECDSA,
+    RULE_PY_DSA,
+    RULE_PY_DH,
+    RULE_PY_X25519,
+    RULE_PY_X448,
+    RULE_PY_EDDSA,
+  ],
+  appliesTo: (f) => hasExtension(f, PYTHON_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, content, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+
+    add(RE_PY_RSA_KEYGEN, RULE_PY_RSA_KEYGEN);
+    add(RE_PY_RSA_ENCRYPT, RULE_PY_RSA_ENCRYPT);
+    add(RE_PY_EC_KEYGEN, RULE_PY_EC_KEYGEN);
+    add(RE_PY_ECDSA, RULE_PY_ECDSA);
+    add(RE_PY_DSA, RULE_PY_DSA);
+    add(RE_PY_DH, RULE_PY_DH);
+    add(RE_PY_X25519, RULE_PY_X25519);
+    add(RE_PY_X448, RULE_PY_X448);
+    add(RE_PY_EDDSA, RULE_PY_EDDSA);
+
+    return findings;
+  },
+};

package/src/detectors/ruby.ts

@@ -0,0 +1,97 @@
+/**
+ * Source-code detector for classical asymmetric cryptography in Ruby. Ruby's
+ * asymmetric crypto is almost entirely `OpenSSL::PKey::{RSA,EC,DSA,DH}`, which
+ * makes the signals precise. Lexical, same strategy as the other packs.
+ *
+ * HNDL: RSA (keygen/encryption) and (EC)DH key agreement are harvest-now-
+ * decrypt-later exposed (hndl:true); DSA signatures are hndl:false but forgeable.
+ * `OpenSSL::PKey::EC` is ambiguous (feeds ECDSA + ECDH), so it is classified
+ * conservatively as key-exchange-capable (hndl:true), like the other EC keygen
+ * rules.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { RUBY_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+const RE_RB_RSA = /\bOpenSSL::PKey::RSA\.(?:new|generate)\s*\(/g;
+const RE_RB_EC = /\bOpenSSL::PKey::EC\.(?:new|generate)\s*\(/g;
+const RE_RB_DSA = /\bOpenSSL::PKey::DSA\.(?:new|generate)\s*\(/g;
+const RE_RB_DH = /\bOpenSSL::PKey::DH\.new\s*\(/g;
+
+const RULE_RB_RSA: RuleMeta = {
+  id: "ruby-rsa",
+  title: "Ruby RSA key/usage",
+  description: "OpenSSL::PKey::RSA.new / .generate",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical RSA (Ruby/OpenSSL) is not quantum-safe and RSA encryption is HNDL-exposed.",
+};
+const RULE_RB_EC: RuleMeta = {
+  id: "ruby-ec",
+  title: "Ruby EC key generation",
+  description: "OpenSSL::PKey::EC.new / .generate",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Generates a classical EC key pair (Ruby/OpenSSL). EC keys feed BOTH ECDSA signatures and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+const RULE_RB_DSA: RuleMeta = {
+  id: "ruby-dsa",
+  title: "Ruby DSA key/signature",
+  description: "OpenSSL::PKey::DSA.new / .generate",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "DSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical DSA (Ruby/OpenSSL) is deprecated and forgeable by a quantum attacker.",
+  remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
+};
+const RULE_RB_DH: RuleMeta = {
+  id: "ruby-dh",
+  title: "Ruby Diffie-Hellman key exchange",
+  description: "OpenSSL::PKey::DH.new",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "DH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Finite-field Diffie-Hellman (Ruby/OpenSSL) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+
+/** Detects classical asymmetric crypto in Ruby (OpenSSL::PKey). */
+export const rubyDetector: Detector = {
+  id: "ruby-crypto",
+  description: "Classical asymmetric crypto in Ruby (OpenSSL::PKey::{RSA,EC,DSA,DH})",
+  scope: "source",
+  language: "ruby",
+  rules: [RULE_RB_RSA, RULE_RB_EC, RULE_RB_DSA, RULE_RB_DH],
+  appliesTo: (f) => hasExtension(f, RUBY_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, content, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    add(RE_RB_RSA, RULE_RB_RSA);
+    add(RE_RB_EC, RULE_RB_EC);
+    add(RE_RB_DSA, RULE_RB_DSA);
+    add(RE_RB_DH, RULE_RB_DH);
+    return findings;
+  },
+};

package/src/detectors/rust.ts

@@ -0,0 +1,112 @@
+/**
+ * Source-code detector for classical asymmetric cryptography in Rust. Covers the
+ * common crypto crates: `rsa`, `ring`, the `*-dalek` family (ed25519/x25519),
+ * and the RustCrypto elliptic-curve crates (`p256`/`p384`/`k256`). Lexical, same
+ * strategy as the other packs; the `::` path syntax makes the signals precise.
+ *
+ * HNDL: RSA encryption and (EC/X)DH key agreement are harvest-now-decrypt-later
+ * exposed (hndl:true); ECDSA / Ed25519 signatures are hndl:false but forgeable.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { RUST_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+// `rsa` crate + ring RsaKeyPair. `::` after the type marks an associated-fn call.
+const RE_RUST_RSA = /\b(?:RsaPrivateKey|RsaPublicKey|RsaKeyPair)::/g;
+// ECDSA: RustCrypto `p256::ecdsa::SigningKey` (contains `ecdsa::SigningKey`),
+// ring `EcdsaKeyPair::`, or a bare `ecdsa::SigningKey`.
+const RE_RUST_ECDSA = /\becdsa::SigningKey\b|\bEcdsaKeyPair::/g;
+// ECDH: RustCrypto `p256::ecdh::EphemeralSecret`, ring agreement / ECDH_P*.
+const RE_RUST_ECDH = /\becdh::EphemeralSecret\b|\bagreement::ECDH_P(?:256|384)\b/g;
+// Ed25519 signatures (dalek + ring).
+const RE_RUST_ED25519 = /\bed25519_dalek::(?:SigningKey|Keypair|SecretKey)\b|\bEd25519KeyPair::/g;
+// X25519 key agreement (dalek).
+const RE_RUST_X25519 = /\bx25519_dalek::(?:EphemeralSecret|StaticSecret)\b/g;
+
+const RULE_RUST_RSA: RuleMeta = {
+  id: "rust-rsa",
+  title: "Rust RSA key/usage",
+  description: "the `rsa` crate / ring RsaKeyPair",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical RSA (Rust) is not quantum-safe and RSA encryption is HNDL-exposed.",
+};
+const RULE_RUST_ECDSA: RuleMeta = {
+  id: "rust-ecdsa",
+  title: "Rust ECDSA signature",
+  description: "p256/p384/k256 ecdsa::SigningKey / ring EcdsaKeyPair",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical ECDSA signing (Rust) is forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_RUST_ECDH: RuleMeta = {
+  id: "rust-ecdh",
+  title: "Rust ECDH key agreement",
+  description: "p256/p384 ecdh::EphemeralSecret / ring agreement",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Elliptic-curve Diffie-Hellman (Rust) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_RUST_ED25519: RuleMeta = {
+  id: "rust-ed25519",
+  title: "Rust Ed25519 signature",
+  description: "ed25519-dalek SigningKey/Keypair / ring Ed25519KeyPair",
+  category: "signature",
+  severity: "low",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Ed25519 (Rust) is a modern but still classical signature scheme.",
+};
+const RULE_RUST_X25519: RuleMeta = {
+  id: "rust-x25519",
+  title: "Rust X25519 key agreement",
+  description: "x25519-dalek EphemeralSecret/StaticSecret",
+  category: "key-exchange",
+  severity: "low",
+  confidence: "high",
+  algorithm: "X25519",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "X25519 (Rust) is modern but still classical key agreement — harvest-now-decrypt-later.",
+};
+
+/** Detects classical asymmetric crypto in Rust (rsa, ring, dalek, p256/k256). */
+export const rustDetector: Detector = {
+  id: "rust-crypto",
+  description: "Classical asymmetric crypto in Rust (rsa, ring, *-dalek, p256/k256)",
+  scope: "source",
+  language: "rust",
+  rules: [RULE_RUST_RSA, RULE_RUST_ECDSA, RULE_RUST_ECDH, RULE_RUST_ED25519, RULE_RUST_X25519],
+  appliesTo: (f) => hasExtension(f, RUST_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, content, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    add(RE_RUST_RSA, RULE_RUST_RSA);
+    add(RE_RUST_ECDSA, RULE_RUST_ECDSA);
+    add(RE_RUST_ECDH, RULE_RUST_ECDH);
+    add(RE_RUST_ED25519, RULE_RUST_ED25519);
+    add(RE_RUST_X25519, RULE_RUST_X25519);
+    return findings;
+  },
+};