@quantakrypto/core 0.4.1 → 0.4.3

package/src/detectors/java.ts

@@ -21,7 +21,7 @@
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
 import { JAVA_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
-import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cwe.js";
 
 /* -------------------------------------------------------------------------- */
 /* Regexes                                                                    */
@@ -35,7 +35,34 @@ const RE_JAVA_GETINSTANCE =
 
 // BouncyCastle lightweight-API class instantiations.
 const RE_JAVA_BC =
-  /\bnew\s+(RSAKeyPairGenerator|DSAKeyPairGenerator|ECKeyPairGenerator|ECDSASigner|Ed25519Signer|Ed448Signer|X25519Agreement|X448Agreement)\s*\(/g;
+  /\bnew\s+(RSAKeyPairGenerator|DSAKeyPairGenerator|ECKeyPairGenerator|ECDSASigner|Ed25519Signer|Ed448Signer|X25519Agreement|X448Agreement|ECDHBasicAgreement|DHBasicAgreement|X25519KeyPairGenerator|Ed25519KeyPairGenerator|RSAEngine|OAEPEncoding)\s*\(/g;
+
+// BouncyCastle lightweight-API curve/EdDSA classes as a BARE constructor call —
+// the Kotlin form (`X448KeyPairGenerator()`, no `new` keyword). RE_JAVA_BC above
+// only matches the Java `new <Class>(` form, so Kotlin sources that drive the
+// lightweight API directly are missed. The negative lookbehind `(?<!\bnew\s+)`
+// keeps this additive: `new X448Agreement(` stays with RE_JAVA_BC (java-xdh),
+// while bare `X448Agreement(` routes to the family-specific rules below. Scoped
+// to the exact X448/X25519/Ed448/Ed25519 class names to stay precise.
+const RE_JAVA_BC_CURVE =
+  /(?<!\bnew\s+)\b(X448KeyPairGenerator|X448Agreement|X448PrivateKeyParameters|X25519KeyPairGenerator|X25519Agreement|Ed448KeyPairGenerator|Ed448Signer|Ed25519KeyPairGenerator|Ed25519Signer)\s*\(/g;
+
+// Insecure JSSE / TLS configuration expressed in Java source. Mirrors the JS
+// tlsDetector in source.ts (category "tls"): a legacy SSL/TLS protocol version
+// requested from SSLContext, and TLS hostname verification neutered via an
+// all-trusting verifier (Apache HttpClient's NoopHostnameVerifier /
+// ALLOW_ALL_HOSTNAME_VERIFIER).
+const RE_JAVA_TLS_LEGACY = /\bSSLContext\s*\.\s*getInstance\s*\(\s*"(SSL|SSLv3|TLSv1)"/g;
+const RE_JAVA_TLS_NOVERIFY = /\b(NoopHostnameVerifier|ALLOW_ALL_HOSTNAME_VERIFIER)\b/g;
+
+// Identifier-form JWT/JOSE signature algorithms (audit F7). The quoted-string
+// alg token ("RS256") is caught by the language-agnostic jwt-jose detector, but
+// the Java JWT libraries pass the alg as an IDENTIFIER, not a string literal:
+// jjwt's `SignatureAlgorithm.RS256` and auth0 java-jwt's `Algorithm.RSA256` /
+// `Algorithm.ECDSA256`. ("SignatureAlgorithm" has no word boundary before its
+// "Algorithm", so the auth0 branch cannot re-match the jjwt form.)
+const RE_JAVA_JWT_ALG =
+  /\bSignatureAlgorithm\.(?:RS|PS|ES)(?:256|384|512)\b|\bAlgorithm\.(?:RSA|ECDSA)(?:256|384|512)\b/g;
 
 /* -------------------------------------------------------------------------- */
 /* Rule catalog                                                               */
@@ -138,7 +165,7 @@ const RULE_JAVA_XDH: RuleMeta = {
   title: "Java X25519/X448 key agreement",
   description: "JCA XDH / X25519 / X448 (KeyPairGenerator / KeyAgreement)",
   category: "key-exchange",
-  severity: "low",
+  severity: "medium",
   confidence: "high",
   algorithm: "X25519",
   hndl: true,
@@ -158,6 +185,87 @@ const RULE_JAVA_EDDSA: RuleMeta = {
   cwe: CWE_BROKEN_CRYPTO,
   message: "Ed25519/Ed448 (Java/JCA) is a modern but still classical signature scheme.",
 };
+// BouncyCastle lightweight-API rules for bare (Kotlin-form) constructor calls.
+// Split by family so X448 and X25519 report their own algorithm string (java-xdh
+// lumps both under "X25519"). Severity/CWE copied from the JCA siblings above.
+const RULE_JAVA_BC_X448: RuleMeta = {
+  id: "java-bc-x448",
+  title: "Java/Kotlin X448 key agreement (BouncyCastle lightweight API)",
+  description: "BouncyCastle X448KeyPairGenerator / X448Agreement / X448PrivateKeyParameters",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "X448",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "X448 (Java/Kotlin, BouncyCastle lightweight API) is modern but still classical key agreement — harvest-now-decrypt-later.",
+};
+const RULE_JAVA_BC_X25519: RuleMeta = {
+  id: "java-bc-x25519",
+  title: "Java/Kotlin X25519 key agreement (BouncyCastle lightweight API)",
+  description: "BouncyCastle X25519KeyPairGenerator / X25519Agreement",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "X25519",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "X25519 (Java/Kotlin, BouncyCastle lightweight API) is modern but still classical key agreement — harvest-now-decrypt-later.",
+};
+const RULE_JAVA_BC_EDDSA: RuleMeta = {
+  id: "java-bc-eddsa",
+  title: "Java/Kotlin Ed25519/Ed448 signature (BouncyCastle lightweight API)",
+  description:
+    "BouncyCastle Ed448KeyPairGenerator / Ed448Signer / Ed25519KeyPairGenerator / Ed25519Signer",
+  category: "signature",
+  severity: "low",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Ed25519/Ed448 (Java/Kotlin, BouncyCastle lightweight API) is a modern but still classical signature scheme.",
+};
+const RULE_JAVA_TLS_LEGACY: RuleMeta = {
+  id: "java-tls-legacy-version",
+  title: "Legacy SSL/TLS version requested",
+  description: 'SSLContext.getInstance("SSL" | "SSLv3" | "TLSv1")',
+  category: "tls",
+  severity: "medium",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_WEAK_STRENGTH,
+  message: "SSL/SSLv3/TLS 1.0 are deprecated and insecure (Java/JSSE); require TLS 1.3.",
+  remediation: 'Use SSLContext.getInstance("TLSv1.3") and prefer PQC-hybrid key exchange.',
+};
+const RULE_JAVA_TLS_NOVERIFY: RuleMeta = {
+  id: "java-tls-hostname-verification-disabled",
+  title: "TLS hostname verification disabled",
+  description: "NoopHostnameVerifier / ALLOW_ALL_HOSTNAME_VERIFIER",
+  category: "tls",
+  severity: "high",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_CERT_VALIDATION,
+  message: "An all-trusting hostname verifier (Java) disables TLS hostname checking (MITM risk).",
+  remediation: "Remove the all-trusting verifier; rely on the default hostname verifier.",
+};
+const RULE_JAVA_JWT_ALG: RuleMeta = {
+  id: "java-jwt-alg",
+  title: "Java identifier-form JWT/JOSE algorithm",
+  description: "jjwt SignatureAlgorithm.RS/PS/ES* / auth0 Algorithm.RSA*/ECDSA*",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "unknown",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "A classical JWT/JOSE signature algorithm (Java, identifier form) is used, forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204); track IETF PQC JOSE/COSE algorithms",
+};
 
 /**
  * Classify a `<factory>.getInstance("<alg>")` pair into a rule, or null when the
@@ -175,6 +283,11 @@ function classifyGetInstance(factory: string, rawAlg: string): RuleMeta | null {
   if (alg.includes("ED25519") || alg.includes("ED448") || alg.includes("EDDSA"))
     return RULE_JAVA_EDDSA;
   if (alg.includes("X25519") || alg.includes("X448") || alg === "XDH") return RULE_JAVA_XDH;
+  // RSASSA-PSS is an RSA *signature* scheme, not encryption/KEM. The string
+  // contains "RSA", so it must be caught here — BEFORE the generic RSA branch
+  // below, which would otherwise (mis)classify it as HNDL-exposed RSA
+  // encryption (java-rsa / hndl:true). Signatures are hndl:false. (Fixes F8.)
+  if (alg.includes("PSS")) return RULE_JAVA_RSA_SIGN;
   if (alg.includes("RSA")) return isSignature ? RULE_JAVA_RSA_SIGN : RULE_JAVA_RSA;
   if (alg.includes("DSA")) return RULE_JAVA_DSA; // ECDSA already handled above
   if (alg.includes("DH") || alg.includes("DIFFIEHELLMAN")) return RULE_JAVA_DH;
@@ -191,6 +304,25 @@ const BC_CLASS_RULES: Record<string, RuleMeta> = {
   Ed448Signer: RULE_JAVA_EDDSA,
   X25519Agreement: RULE_JAVA_XDH,
   X448Agreement: RULE_JAVA_XDH,
+  ECDHBasicAgreement: RULE_JAVA_ECDH,
+  DHBasicAgreement: RULE_JAVA_DH,
+  X25519KeyPairGenerator: RULE_JAVA_XDH,
+  Ed25519KeyPairGenerator: RULE_JAVA_EDDSA,
+  RSAEngine: RULE_JAVA_RSA,
+  OAEPEncoding: RULE_JAVA_RSA,
+};
+
+/** BouncyCastle lightweight-API bare-constructor class name → family rule. */
+const BC_CURVE_CLASS_RULES: Record<string, RuleMeta> = {
+  X448KeyPairGenerator: RULE_JAVA_BC_X448,
+  X448Agreement: RULE_JAVA_BC_X448,
+  X448PrivateKeyParameters: RULE_JAVA_BC_X448,
+  X25519KeyPairGenerator: RULE_JAVA_BC_X25519,
+  X25519Agreement: RULE_JAVA_BC_X25519,
+  Ed448KeyPairGenerator: RULE_JAVA_BC_EDDSA,
+  Ed448Signer: RULE_JAVA_BC_EDDSA,
+  Ed25519KeyPairGenerator: RULE_JAVA_BC_EDDSA,
+  Ed25519Signer: RULE_JAVA_BC_EDDSA,
 };
 
 /** Detects classical asymmetric crypto in Java / Kotlin (JCA + BouncyCastle). */
@@ -209,6 +341,12 @@ export const javaDetector: Detector = {
     RULE_JAVA_DH,
     RULE_JAVA_XDH,
     RULE_JAVA_EDDSA,
+    RULE_JAVA_BC_X448,
+    RULE_JAVA_BC_X25519,
+    RULE_JAVA_BC_EDDSA,
+    RULE_JAVA_TLS_LEGACY,
+    RULE_JAVA_TLS_NOVERIFY,
+    RULE_JAVA_JWT_ALG,
   ],
   appliesTo: (f) => hasExtension(f, JAVA_EXTENSIONS),
   detect({ file, content }): Finding[] {
@@ -230,6 +368,54 @@ export const javaDetector: Detector = {
       );
     });
 
+    // BouncyCastle lightweight-API classes as a bare constructor call (Kotlin
+    // form, no `new`). RE_JAVA_BC_CURVE's negative lookbehind excludes the
+    // `new <Class>(` form already handled above, so this only adds the missed
+    // 448/25519 Kotlin-style matches — no double-counting.
+    eachMatch(RE_JAVA_BC_CURVE, content, (m) => {
+      const rule = BC_CURVE_CLASS_RULES[m[1]];
+      if (!rule) return;
+      findings.push(
+        findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+      );
+    });
+
+    // Legacy SSL/TLS protocol version requested from SSLContext.
+    eachMatch(RE_JAVA_TLS_LEGACY, content, (m) => {
+      findings.push(
+        findingFromRule(RULE_JAVA_TLS_LEGACY, {
+          file,
+          content,
+          index: m.index,
+          matchLength: m[0].length,
+        }),
+      );
+    });
+
+    // All-trusting hostname verifier — disables TLS hostname verification.
+    eachMatch(RE_JAVA_TLS_NOVERIFY, content, (m) => {
+      findings.push(
+        findingFromRule(RULE_JAVA_TLS_NOVERIFY, {
+          file,
+          content,
+          index: m.index,
+          matchLength: m[0].length,
+        }),
+      );
+    });
+
+    // Identifier-form JWT/JOSE signature algorithms (jjwt / auth0).
+    eachMatch(RE_JAVA_JWT_ALG, content, (m) => {
+      findings.push(
+        findingFromRule(RULE_JAVA_JWT_ALG, {
+          file,
+          content,
+          index: m.index,
+          matchLength: m[0].length,
+        }),
+      );
+    });
+
     return findings;
   },
 };

package/src/detectors/pem.ts

@@ -86,7 +86,8 @@ const PEM_RULES: PemRule[] = [
       cwe: CWE_HARDCODED_KEY,
       sensitive: true,
       message: "Embedded OpenSSH private key (RSA/ECDSA/Ed25519); classical and not quantum-safe.",
-      remediation: "Rotate the key; plan migration to PQC-capable SSH (e.g. sntrup761x25519).",
+      remediation:
+        "Rotate the key; plan migration to PQC-capable SSH (prefer the mlkem768x25519-sha256 KEX, OpenSSH 10's default since Apr 2025).",
     },
   },
   {
@@ -157,6 +158,57 @@ const PEM_RULES: PemRule[] = [
       remediation: "Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.",
     },
   },
+  {
+    re: /-----BEGIN (?:RSA )?PUBLIC KEY-----/g,
+    meta: {
+      id: "pem-public-key",
+      title: "Classical public key (PEM)",
+      description: "SubjectPublicKeyInfo / PKCS#1 RSA public key block",
+      category: "certificate",
+      severity: "low",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: false,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "Embedded classical public key (RSA/EC/DSA); its key pair is not quantum-safe — forgeable signatures or classical key exchange.",
+      remediation: "Re-issue with PQC keys (ML-DSA / ML-KEM) as the ecosystem adopts them.",
+    },
+  },
+  {
+    re: /-----BEGIN DH PARAMETERS-----/g,
+    meta: {
+      id: "pem-dh-parameters",
+      title: "Diffie-Hellman parameters (PEM)",
+      description: "Finite-field DH group parameters block",
+      category: "key-exchange",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "DH",
+      hndl: true,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "Embedded finite-field Diffie-Hellman parameters; classical DH key exchange is harvest-now-decrypt-later exposed.",
+      remediation: "Migrate key exchange to hybrid X25519MLKEM768 (ML-KEM-768).",
+    },
+  },
+  {
+    re: /-----BEGIN (?:NEW )?CERTIFICATE REQUEST-----/g,
+    meta: {
+      id: "pem-cert-request",
+      title: "Certificate signing request (PEM)",
+      description: "PKCS#10 certificate request block",
+      category: "certificate",
+      severity: "low",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: false,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "Embedded PKCS#10 CSR; carries a classical public key and will be signed with classical crypto.",
+      remediation: "Re-generate with PQC keys as PQC-capable CAs mature.",
+    },
+  },
 ];
 
 /** Detects PEM key/certificate material in arbitrary files. */

package/src/detectors/python.ts

@@ -22,7 +22,7 @@
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
 import { PYTHON_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
-import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cwe.js";
 
 /* -------------------------------------------------------------------------- */
 /* Precompiled regexes (module scope)                                         */
@@ -38,8 +38,15 @@ const RE_PY_RSA_ENCRYPT = /\bpadding\.OAEP\s*\(|\bPKCS1_OAEP\.new\s*\(/g;
 const RE_PY_EC_KEYGEN = /\bec\.generate_private_key\s*\(|\bECC\.generate\s*\(/g;
 // ECDSA signatures: cryptography `ec.ECDSA(`, paramiko ECDSAKey.
 const RE_PY_ECDSA = /\bec\.ECDSA\s*\(|\bparamiko\.ECDSAKey\b|\bECDSAKey\.generate\s*\(/g;
+// ECDH key agreement: cryptography `ec.ECDH(` — the actual harvest-now event in
+// `private_key.exchange(ec.ECDH(), peer)`; previously missed entirely (audit F3).
+const RE_PY_ECDH = /\bec\.ECDH\s*\(/g;
 // DSA: PyCryptodome `DSA.generate(`, paramiko DSSKey.
 const RE_PY_DSA = /\bDSA\.generate\s*\(|\bparamiko\.DSSKey\b|\bDSSKey\.generate\s*\(/g;
+// hazmat DSA: cryptography `dsa.generate_private_key(` — the `cryptography` DSA
+// keygen path (lowercase module) that RE_PY_DSA's uppercase `DSA.generate` misses
+// (audit F9-python).
+const RE_PY_HAZMAT_DSA = /\bdsa\.generate_private_key\s*\(/g;
 // Finite-field Diffie-Hellman (cryptography `dh`).
 const RE_PY_DH = /\bdh\.generate_parameters\s*\(|\bdh\.DHParameterNumbers\s*\(/g;
 // Modern-but-classical curve primitives (cryptography). `.generate(` anchors so
@@ -48,6 +55,15 @@ const RE_PY_X25519 = /\bX25519PrivateKey\.generate\s*\(/g;
 const RE_PY_X448 = /\bX448PrivateKey\.generate\s*\(/g;
 const RE_PY_EDDSA = /\b(?:Ed25519|Ed448)PrivateKey\.generate\s*\(|\bparamiko\.Ed25519Key\b/g;
 
+// Python TLS misconfiguration. Mirrors the JS `tlsDetector` split of source.ts:
+// certificate-verification bypass (requests `verify=False`, `ssl.CERT_NONE`,
+// `check_hostname=False`, `ssl._create_unverified_context(`) is the high-severity
+// MITM surface (CWE-295); a pinned legacy protocol (`ssl.PROTOCOL_TLSv1`) is the
+// medium-severity weak-strength surface (CWE-326).
+const RE_PY_TLS_REJECT =
+  /\bverify\s*=\s*False\b|\bssl\.CERT_NONE\b|\bcheck_hostname\s*=\s*False\b|\bssl\._create_unverified_context\s*\(/g;
+const RE_PY_TLS_LEGACY = /\bPROTOCOL_TLSv1\b/g;
+
 /* -------------------------------------------------------------------------- */
 /* Rule catalog                                                               */
 /* -------------------------------------------------------------------------- */
@@ -106,6 +122,19 @@ const RULE_PY_ECDSA: RuleMeta = {
   message: "Classical ECDSA signing (Python) is forgeable by a quantum attacker.",
   remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
 };
+const RULE_PY_ECDH: RuleMeta = {
+  id: "python-ecdh",
+  title: "Python ECDH key agreement",
+  description: "cryptography ec.ECDH() exchange",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Elliptic-curve Diffie-Hellman key agreement (Python) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
 const RULE_PY_DSA: RuleMeta = {
   id: "python-dsa",
   title: "Python DSA key/usage",
@@ -119,6 +148,20 @@ const RULE_PY_DSA: RuleMeta = {
   message: "Classical DSA (Python) is deprecated and forgeable by a quantum attacker.",
   remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
 };
+const RULE_PY_HAZMAT_DSA: RuleMeta = {
+  id: "python-hazmat-dsa",
+  title: "Python DSA key generation (cryptography)",
+  description: "cryptography dsa.generate_private_key",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "DSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "cryptography dsa.generate_private_key (Python) creates a classical DSA key; DSA is deprecated and forgeable by a quantum attacker.",
+  remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
+};
 const RULE_PY_DH: RuleMeta = {
   id: "python-dh",
   title: "Python Diffie-Hellman key exchange",
@@ -137,7 +180,7 @@ const RULE_PY_X25519: RuleMeta = {
   title: "Python X25519 key exchange",
   description: "cryptography X25519PrivateKey.generate",
   category: "key-exchange",
-  severity: "low",
+  severity: "medium",
   confidence: "high",
   algorithm: "X25519",
   hndl: true,
@@ -150,7 +193,7 @@ const RULE_PY_X448: RuleMeta = {
   title: "Python X448 key exchange",
   description: "cryptography X448PrivateKey.generate",
   category: "key-exchange",
-  severity: "low",
+  severity: "medium",
   confidence: "high",
   algorithm: "X448",
   hndl: true,
@@ -169,6 +212,34 @@ const RULE_PY_EDDSA: RuleMeta = {
   cwe: CWE_BROKEN_CRYPTO,
   message: "Ed25519/Ed448 (Python) is a modern but still classical signature scheme.",
 };
+const RULE_PY_TLS_REJECT: RuleMeta = {
+  id: "python-tls-reject",
+  title: "Python TLS certificate verification disabled",
+  description:
+    "requests verify=False / ssl.CERT_NONE / check_hostname=False / _create_unverified_context",
+  category: "tls",
+  severity: "high",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_CERT_VALIDATION,
+  message:
+    "TLS certificate verification is disabled (verify=False / CERT_NONE / check_hostname=False / _create_unverified_context), which allows man-in-the-middle attacks.",
+  remediation:
+    "Enable certificate verification (verify=True, ssl.CERT_REQUIRED, check_hostname=True) and verify certificates properly.",
+};
+const RULE_PY_TLS_LEGACY: RuleMeta = {
+  id: "python-tls-legacy-version",
+  title: "Python legacy TLS version pinned",
+  description: "ssl.PROTOCOL_TLSv1 (TLS 1.0)",
+  category: "tls",
+  severity: "medium",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_WEAK_STRENGTH,
+  message: "TLS 1.0 (ssl.PROTOCOL_TLSv1) is deprecated and insecure; require TLS 1.3.",
+  remediation:
+    "Use ssl.PROTOCOL_TLS_CLIENT with minimum_version = ssl.TLSVersion.TLSv1_3 and prefer PQC-hybrid key exchange.",
+};
 
 /** Detects classical asymmetric crypto in Python source. */
 export const pythonDetector: Detector = {
@@ -181,11 +252,15 @@ export const pythonDetector: Detector = {
     RULE_PY_RSA_ENCRYPT,
     RULE_PY_EC_KEYGEN,
     RULE_PY_ECDSA,
+    RULE_PY_ECDH,
     RULE_PY_DSA,
+    RULE_PY_HAZMAT_DSA,
     RULE_PY_DH,
     RULE_PY_X25519,
     RULE_PY_X448,
     RULE_PY_EDDSA,
+    RULE_PY_TLS_REJECT,
+    RULE_PY_TLS_LEGACY,
   ],
   appliesTo: (f) => hasExtension(f, PYTHON_EXTENSIONS),
   detect({ file, content }): Finding[] {
@@ -201,11 +276,15 @@ export const pythonDetector: Detector = {
     add(RE_PY_RSA_ENCRYPT, RULE_PY_RSA_ENCRYPT);
     add(RE_PY_EC_KEYGEN, RULE_PY_EC_KEYGEN);
     add(RE_PY_ECDSA, RULE_PY_ECDSA);
+    add(RE_PY_ECDH, RULE_PY_ECDH);
     add(RE_PY_DSA, RULE_PY_DSA);
+    add(RE_PY_HAZMAT_DSA, RULE_PY_HAZMAT_DSA);
     add(RE_PY_DH, RULE_PY_DH);
     add(RE_PY_X25519, RULE_PY_X25519);
     add(RE_PY_X448, RULE_PY_X448);
     add(RE_PY_EDDSA, RULE_PY_EDDSA);
+    add(RE_PY_TLS_REJECT, RULE_PY_TLS_REJECT);
+    add(RE_PY_TLS_LEGACY, RULE_PY_TLS_LEGACY);
 
     return findings;
   },

package/src/detectors/ruby.ts

@@ -1,22 +1,40 @@
 /**
  * Source-code detector for classical asymmetric cryptography in Ruby. Ruby's
  * asymmetric crypto is almost entirely `OpenSSL::PKey::{RSA,EC,DSA,DH}`, which
- * makes the signals precise. Lexical, same strategy as the other packs.
+ * makes the signals precise. Lexical, same strategy as the other packs. Beyond
+ * keygen it also covers RSA public-key encryption on a loaded key, DH key
+ * agreement, the type-agnostic `OpenSSL::PKey.read` loader, Ed25519 key
+ * generation, and disabled TLS peer verification (`VERIFY_NONE`).
  *
  * HNDL: RSA (keygen/encryption) and (EC)DH key agreement are harvest-now-
- * decrypt-later exposed (hndl:true); DSA signatures are hndl:false but forgeable.
- * `OpenSSL::PKey::EC` is ambiguous (feeds ECDSA + ECDH), so it is classified
- * conservatively as key-exchange-capable (hndl:true), like the other EC keygen
- * rules.
+ * decrypt-later exposed (hndl:true); DSA / Ed25519 signatures are hndl:false but
+ * forgeable. `OpenSSL::PKey::EC` is ambiguous (feeds ECDSA + ECDH), so it is
+ * classified conservatively as key-exchange-capable (hndl:true), like the other
+ * EC keygen rules; `OpenSSL::PKey.read` loads a key of unknown type and is
+ * likewise treated conservatively.
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
 import { RUBY_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
-import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION } from "../cwe.js";
 
 const RE_RB_RSA = /\bOpenSSL::PKey::RSA\.(?:new|generate)\s*\(/g;
 const RE_RB_EC = /\bOpenSSL::PKey::EC\.(?:new|generate)\s*\(/g;
 const RE_RB_DSA = /\bOpenSSL::PKey::DSA\.(?:new|generate)\s*\(/g;
 const RE_RB_DH = /\bOpenSSL::PKey::DH\.new\s*\(/g;
+// RSA public-key encryption on an already-loaded key (audit F4-ruby / F9).
+const RE_RB_RSA_CRYPT = /\.public_encrypt\b|\.private_decrypt\b/g;
+// Finite-field DH shared-secret agreement.
+const RE_RB_DH_AGREE = /\bdh_compute_key\s*\(/g;
+// Type-agnostic key loader — could be RSA/EC/DSA/DH (conservative).
+const RE_RB_PKEY_READ = /\bOpenSSL::PKey\.read\s*\(/g;
+// Ed25519 signing key via the generic generate_key factory.
+const RE_RB_ED25519 = /\bOpenSSL::PKey\.generate_key\s*\(\s*["']ED25519["']/g;
+// `ed25519` gem — Ed25519::SigningKey / VerifyKey (signature keys).
+const RE_RB_ED25519_GEM = /\bEd25519::(?:SigningKey|VerifyKey)\b/g;
+// `rbnacl` (libsodium) — Curve25519/X25519 key agreement: PrivateKey, Box, GroupElement.
+const RE_RB_RBNACL = /\bRbNaCl::(?:PrivateKey|Box|GroupElement)\b/g;
+// TLS peer verification disabled (mirrors the JS tlsDetector rejectUnauthorized rule).
+const RE_RB_TLS_VERIFY_NONE = /\bOpenSSL::SSL::VERIFY_NONE\b/g;
 
 const RULE_RB_RSA: RuleMeta = {
   id: "ruby-rsa",
@@ -71,6 +89,100 @@ const RULE_RB_DH: RuleMeta = {
   message:
     "Finite-field Diffie-Hellman (Ruby/OpenSSL) is broken by Shor's algorithm (harvest-now-decrypt-later).",
 };
+const RULE_RB_RSA_CRYPT: RuleMeta = {
+  id: "ruby-rsa-crypt",
+  title: "Ruby RSA public-key encryption",
+  description: "OpenSSL::PKey::RSA#public_encrypt / #private_decrypt",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "RSA public-key encryption/decryption (Ruby/OpenSSL) is harvest-now-decrypt-later exposed.",
+};
+const RULE_RB_DH_AGREE: RuleMeta = {
+  id: "ruby-dh-agree",
+  title: "Ruby Diffie-Hellman key agreement",
+  description: "OpenSSL DH compute_key shared-secret agreement",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "DH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Finite-field Diffie-Hellman key agreement (Ruby/OpenSSL) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_RB_PKEY_READ: RuleMeta = {
+  id: "ruby-pkey-read",
+  title: "Ruby PKey loaded from serialized key",
+  description: "OpenSSL::PKey.read (type-agnostic key loader)",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "medium",
+  algorithm: "unknown",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Loads a classical asymmetric key of unknown type (RSA/EC/DSA/DH) via OpenSSL::PKey.read. Treated conservatively as key-exchange-capable (harvest-now-decrypt-later).",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+const RULE_RB_ED25519: RuleMeta = {
+  id: "ruby-ed25519",
+  title: "Ruby Ed25519 key generation",
+  description: 'OpenSSL::PKey.generate_key("ED25519")',
+  category: "signature",
+  severity: "low",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Generates an Ed25519 signing key (Ruby/OpenSSL) — modern but classical, and forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_RB_ED25519_GEM: RuleMeta = {
+  id: "ruby-ed25519-gem",
+  title: "Ruby Ed25519 signature (ed25519 gem)",
+  description: "ed25519 gem Ed25519::SigningKey / Ed25519::VerifyKey",
+  category: "signature",
+  severity: "low",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Ed25519 signing/verification via the `ed25519` gem — modern but classical, and forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_RB_RBNACL: RuleMeta = {
+  id: "ruby-rbnacl",
+  title: "Ruby X25519 key agreement (rbnacl)",
+  description: "rbnacl (libsodium) RbNaCl::PrivateKey / Box / GroupElement",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "X25519",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Curve25519/X25519 key agreement via the `rbnacl` gem (libsodium) — modern but classical key agreement, harvest-now-decrypt-later exposed.",
+};
+const RULE_RB_TLS_VERIFY_NONE: RuleMeta = {
+  id: "ruby-tls-verify-none",
+  title: "Ruby TLS certificate verification disabled",
+  description: "OpenSSL::SSL::VERIFY_NONE",
+  category: "tls",
+  severity: "high",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_CERT_VALIDATION,
+  message: "OpenSSL::SSL::VERIFY_NONE disables TLS peer certificate verification (MITM risk).",
+  remediation: "Use OpenSSL::SSL::VERIFY_PEER and verify the certificate chain.",
+};
 
 /** Detects classical asymmetric crypto in Ruby (OpenSSL::PKey). */
 export const rubyDetector: Detector = {
@@ -78,7 +190,19 @@ export const rubyDetector: Detector = {
   description: "Classical asymmetric crypto in Ruby (OpenSSL::PKey::{RSA,EC,DSA,DH})",
   scope: "source",
   language: "ruby",
-  rules: [RULE_RB_RSA, RULE_RB_EC, RULE_RB_DSA, RULE_RB_DH],
+  rules: [
+    RULE_RB_RSA,
+    RULE_RB_EC,
+    RULE_RB_DSA,
+    RULE_RB_DH,
+    RULE_RB_RSA_CRYPT,
+    RULE_RB_DH_AGREE,
+    RULE_RB_PKEY_READ,
+    RULE_RB_ED25519,
+    RULE_RB_ED25519_GEM,
+    RULE_RB_RBNACL,
+    RULE_RB_TLS_VERIFY_NONE,
+  ],
   appliesTo: (f) => hasExtension(f, RUBY_EXTENSIONS),
   detect({ file, content }): Finding[] {
     const findings: Finding[] = [];
@@ -92,6 +216,13 @@ export const rubyDetector: Detector = {
     add(RE_RB_EC, RULE_RB_EC);
     add(RE_RB_DSA, RULE_RB_DSA);
     add(RE_RB_DH, RULE_RB_DH);
+    add(RE_RB_RSA_CRYPT, RULE_RB_RSA_CRYPT);
+    add(RE_RB_DH_AGREE, RULE_RB_DH_AGREE);
+    add(RE_RB_PKEY_READ, RULE_RB_PKEY_READ);
+    add(RE_RB_ED25519, RULE_RB_ED25519);
+    add(RE_RB_ED25519_GEM, RULE_RB_ED25519_GEM);
+    add(RE_RB_RBNACL, RULE_RB_RBNACL);
+    add(RE_RB_TLS_VERIFY_NONE, RULE_RB_TLS_VERIFY_NONE);
     return findings;
   },
 };