@quantakrypto/core 0.4.2 → 0.4.3

package/src/detectors/rust.ts

@@ -1,15 +1,20 @@
 /**
  * Source-code detector for classical asymmetric cryptography in Rust. Covers the
  * common crypto crates: `rsa`, `ring`, the `*-dalek` family (ed25519/x25519),
- * and the RustCrypto elliptic-curve crates (`p256`/`p384`/`k256`). Lexical, same
- * strategy as the other packs; the `::` path syntax makes the signals precise.
+ * the RustCrypto elliptic-curve crates (`p256`/`p384`/`k256`), and the `openssl`
+ * crate bindings. Lexical, same strategy as the other packs; the `::` path
+ * syntax makes the signals precise.
  *
  * HNDL: RSA encryption and (EC/X)DH key agreement are harvest-now-decrypt-later
- * exposed (hndl:true); ECDSA / Ed25519 signatures are hndl:false but forgeable.
+ * exposed (hndl:true); ECDSA / DSA / Ed25519 signatures are hndl:false but
+ * forgeable. `openssl::EcKey` keygen is ambiguous (feeds ECDSA + ECDH),
+ * classified conservatively as key-exchange-capable (hndl:true). Also flags
+ * Rust TLS certificate-validation bypasses (reqwest / rustls) — not quantum but
+ * mirrors the JS tlsDetector's cert-validation category.
  */
-import type { Detector, Finding, RuleMeta } from "../types.js";
+import type { AlgorithmFamily, Detector, Finding, RuleMeta } from "../types.js";
 import { RUST_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
-import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION } from "../cwe.js";
 
 // `rsa` crate + ring RsaKeyPair. `::` after the type marks an associated-fn call.
 const RE_RUST_RSA = /\b(?:RsaPrivateKey|RsaPublicKey|RsaKeyPair)::/g;
@@ -22,6 +27,31 @@ const RE_RUST_ECDH = /\becdh::EphemeralSecret\b|\bagreement::ECDH_P(?:256|384)\b
 const RE_RUST_ED25519 = /\bed25519_dalek::(?:SigningKey|Keypair|SecretKey)\b|\bEd25519KeyPair::/g;
 // X25519 key agreement (dalek).
 const RE_RUST_X25519 = /\bx25519_dalek::(?:EphemeralSecret|StaticSecret)\b/g;
+// openssl crate bindings — the `Type::generate(` / `Dh::` call forms, distinct
+// from the ring / RustCrypto path syntax above (audit F5/F9 false-negatives).
+const RE_RUST_OPENSSL_RSA = /\bRsa::generate\s*\(/g;
+const RE_RUST_OPENSSL_EC = /\bEcKey::generate\s*\(/g;
+const RE_RUST_OPENSSL_DSA = /\bDsa::generate\s*\(/g;
+const RE_RUST_OPENSSL_DH = /\bDh::/g;
+// ring X25519 agreement (the ECDH_P* forms are handled by RE_RUST_ECDH above).
+const RE_RUST_RING_X25519 = /\bagreement::X25519\b/g;
+// Bare (unqualified) constructors: a braced `use x25519_dalek::{EphemeralSecret}`
+// / `use ed25519_dalek::{SigningKey}` strips the `::` path prefix, defeating the
+// path-qualified rules above. The `(?<![:\w])` lookbehind keeps these from
+// double-matching the qualified forms (e.g. `p256::ecdsa::SigningKey::random`).
+const RE_RUST_BARE_X25519 = /(?<![:\w])EphemeralSecret::new\s*\(/g;
+const RE_RUST_BARE_SIGNINGKEY = /(?<![:\w])SigningKey::(?:generate|random)\s*\(/g;
+// jsonwebtoken crate `Algorithm` enum variants selecting a classical JWT signer:
+// RSASSA-PKCS1 (RS*), RSASSA-PSS (PS*), ECDSA (ES*), and Ed25519 (EdDSA). The
+// `\s*` between `Algorithm` and `::` catches the variant split across lines /
+// routed through a helper (audit token_policy false-negative); the required
+// suffix keeps it off unrelated `Algorithm::` uses (e.g. `HS256` HMAC, which is
+// symmetric and not quantum-vulnerable, or `Algorithm::new`).
+const RE_RUST_JWT_ALG = /\bAlgorithm\s*::(RS|PS|ES)(?:256|384|512)\b|\bAlgorithm\s*::EdDSA\b/g;
+// Rust TLS certificate-validation bypass: reqwest `danger_accept_invalid_certs`
+// and the rustls `.dangerous()` escape hatch. Mirrors the JS tlsDetector.
+const RE_RUST_TLS_ACCEPT_INVALID = /\bdanger_accept_invalid_certs\s*\(\s*true/g;
+const RE_RUST_TLS_DANGEROUS = /\.dangerous\s*\(\s*\)/g;
 
 const RULE_RUST_RSA: RuleMeta = {
   id: "rust-rsa",
@@ -78,13 +108,148 @@ const RULE_RUST_X25519: RuleMeta = {
   title: "Rust X25519 key agreement",
   description: "x25519-dalek EphemeralSecret/StaticSecret",
   category: "key-exchange",
-  severity: "low",
+  severity: "medium",
   confidence: "high",
   algorithm: "X25519",
   hndl: true,
   cwe: CWE_BROKEN_CRYPTO,
   message: "X25519 (Rust) is modern but still classical key agreement — harvest-now-decrypt-later.",
 };
+const RULE_RUST_OPENSSL_RSA: RuleMeta = {
+  id: "rust-openssl-rsa",
+  title: "Rust openssl RSA key generation",
+  description: "openssl crate Rsa::generate",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Generates a classical RSA key pair via the Rust `openssl` crate — not quantum-safe and RSA encryption is HNDL-exposed.",
+};
+const RULE_RUST_OPENSSL_EC: RuleMeta = {
+  id: "rust-openssl-ec",
+  title: "Rust openssl EC key generation",
+  description: "openssl crate EcKey::generate",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Generates a classical EC key pair via the Rust `openssl` crate. EC keys feed BOTH ECDSA signatures and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+const RULE_RUST_OPENSSL_DSA: RuleMeta = {
+  id: "rust-openssl-dsa",
+  title: "Rust openssl DSA key/usage",
+  description: "openssl crate Dsa::generate",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "DSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Classical DSA via the Rust `openssl` crate is deprecated and forgeable by a quantum attacker.",
+  remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
+};
+const RULE_RUST_OPENSSL_DH: RuleMeta = {
+  id: "rust-openssl-dh",
+  title: "Rust openssl Diffie-Hellman key exchange",
+  description: "openssl crate Dh params / key generation",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "DH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Finite-field Diffie-Hellman via the Rust `openssl` crate is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_RUST_RING_X25519: RuleMeta = {
+  id: "rust-ring-x25519",
+  title: "Rust ring X25519 key agreement",
+  description: "ring agreement::X25519",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "X25519",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "X25519 key agreement via ring (Rust) is modern but still classical — harvest-now-decrypt-later.",
+};
+const RULE_RUST_BARE_X25519: RuleMeta = {
+  id: "rust-x25519-bare",
+  title: "Rust X25519 key agreement (unqualified)",
+  description: "bare EphemeralSecret::new (x25519-dalek imported via `use`)",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "medium",
+  algorithm: "X25519",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "X25519 key agreement (x25519-dalek, imported unqualified) is modern but still classical — harvest-now-decrypt-later.",
+};
+const RULE_RUST_BARE_SIGNINGKEY: RuleMeta = {
+  id: "rust-signingkey-bare",
+  title: "Rust signature key (unqualified)",
+  description: "bare SigningKey::generate/random (ed25519-dalek / k256 via `use`)",
+  category: "signature",
+  severity: "medium",
+  confidence: "medium",
+  algorithm: "unknown",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Classical signature key from an unqualified `SigningKey` (ed25519-dalek Ed25519 / k256 ECDSA) — forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_RUST_JWT_ALGORITHM: RuleMeta = {
+  id: "rust-jwt-algorithm",
+  title: "Rust jsonwebtoken classical signature algorithm",
+  description: "jsonwebtoken Algorithm::{RS,PS,ES}* / Algorithm::EdDSA enum variant",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  // Representative family; refined per-finding (RS*/PS* → RSA, ES* → ECDSA, EdDSA).
+  algorithm: "RSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Selects a classical JWT signature algorithm (jsonwebtoken RS*/PS*/ES*/EdDSA), forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_RUST_TLS_ACCEPT_INVALID: RuleMeta = {
+  id: "rust-tls-accept-invalid-certs",
+  title: "Rust TLS certificate verification disabled",
+  description: "reqwest danger_accept_invalid_certs(true)",
+  category: "tls",
+  severity: "high",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_CERT_VALIDATION,
+  message:
+    "danger_accept_invalid_certs(true) disables TLS certificate verification in reqwest (MITM risk).",
+  remediation: "Remove danger_accept_invalid_certs(true); verify certificates properly.",
+};
+const RULE_RUST_TLS_DANGEROUS: RuleMeta = {
+  id: "rust-tls-rustls-dangerous",
+  title: "Rust rustls dangerous certificate config",
+  description: "rustls ClientConfig .dangerous() escape hatch",
+  category: "tls",
+  severity: "high",
+  confidence: "medium",
+  hndl: false,
+  cwe: CWE_CERT_VALIDATION,
+  message: "rustls `.dangerous()` opts into disabling certificate verification (MITM risk).",
+  remediation: "Avoid the dangerous() escape hatch; keep the default certificate verifier.",
+};
 
 /** Detects classical asymmetric crypto in Rust (rsa, ring, dalek, p256/k256). */
 export const rustDetector: Detector = {
@@ -92,7 +257,23 @@ export const rustDetector: Detector = {
   description: "Classical asymmetric crypto in Rust (rsa, ring, *-dalek, p256/k256)",
   scope: "source",
   language: "rust",
-  rules: [RULE_RUST_RSA, RULE_RUST_ECDSA, RULE_RUST_ECDH, RULE_RUST_ED25519, RULE_RUST_X25519],
+  rules: [
+    RULE_RUST_RSA,
+    RULE_RUST_ECDSA,
+    RULE_RUST_ECDH,
+    RULE_RUST_ED25519,
+    RULE_RUST_X25519,
+    RULE_RUST_OPENSSL_RSA,
+    RULE_RUST_OPENSSL_EC,
+    RULE_RUST_OPENSSL_DSA,
+    RULE_RUST_OPENSSL_DH,
+    RULE_RUST_RING_X25519,
+    RULE_RUST_BARE_X25519,
+    RULE_RUST_BARE_SIGNINGKEY,
+    RULE_RUST_JWT_ALGORITHM,
+    RULE_RUST_TLS_ACCEPT_INVALID,
+    RULE_RUST_TLS_DANGEROUS,
+  ],
   appliesTo: (f) => hasExtension(f, RUST_EXTENSIONS),
   detect({ file, content }): Finding[] {
     const findings: Finding[] = [];
@@ -107,6 +288,29 @@ export const rustDetector: Detector = {
     add(RE_RUST_ECDH, RULE_RUST_ECDH);
     add(RE_RUST_ED25519, RULE_RUST_ED25519);
     add(RE_RUST_X25519, RULE_RUST_X25519);
+    add(RE_RUST_OPENSSL_RSA, RULE_RUST_OPENSSL_RSA);
+    add(RE_RUST_OPENSSL_EC, RULE_RUST_OPENSSL_EC);
+    add(RE_RUST_OPENSSL_DSA, RULE_RUST_OPENSSL_DSA);
+    add(RE_RUST_OPENSSL_DH, RULE_RUST_OPENSSL_DH);
+    add(RE_RUST_RING_X25519, RULE_RUST_RING_X25519);
+    add(RE_RUST_BARE_X25519, RULE_RUST_BARE_X25519);
+    add(RE_RUST_BARE_SIGNINGKEY, RULE_RUST_BARE_SIGNINGKEY);
+    // jsonwebtoken Algorithm enum variants — resolve the family per match: the
+    // RS*/PS* variants are RSASSA (RSA), ES* is ECDSA, EdDSA is Ed25519.
+    eachMatch(RE_RUST_JWT_ALG, content, (m) => {
+      const prefix = m[1];
+      const algorithm: AlgorithmFamily =
+        prefix === undefined ? "EdDSA" : prefix === "ES" ? "ECDSA" : "RSA";
+      findings.push(
+        findingFromRule(
+          RULE_RUST_JWT_ALGORITHM,
+          { file, content, index: m.index, matchLength: m[0].length },
+          { algorithm },
+        ),
+      );
+    });
+    add(RE_RUST_TLS_ACCEPT_INVALID, RULE_RUST_TLS_ACCEPT_INVALID);
+    add(RE_RUST_TLS_DANGEROUS, RULE_RUST_TLS_DANGEROUS);
     return findings;
   },
 };

package/src/detectors/source.ts

@@ -29,6 +29,7 @@
 import type { Detector, Finding, RuleMeta } from "../types.js";
 import {
   JS_TS_EXTENSIONS,
+  DOC_EXTENSIONS,
   JWT_HOST_EXTENSIONS,
   eachMatch,
   findingFromRule,
@@ -280,8 +281,8 @@ const nodeCryptoDetector: Detector = {
         },
         dsa: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
         dh: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
-        x25519: { algo: "X25519", cat: "key-exchange", sev: "low", hndl: true, label: "X25519" },
-        x448: { algo: "X448", cat: "key-exchange", sev: "low", hndl: true, label: "X448" },
+        x25519: { algo: "X25519", cat: "key-exchange", sev: "medium", hndl: true, label: "X25519" },
+        x448: { algo: "X448", cat: "key-exchange", sev: "medium", hndl: true, label: "X448" },
         ed25519: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed25519" },
         ed448: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed448" },
       };
@@ -623,6 +624,11 @@ const libraryDetector: Detector = {
 /* JWT / JOSE / COSE algorithm strings                                         */
 /* -------------------------------------------------------------------------- */
 
+// JOSE RSA key-transport algorithms (JWE `alg`): quoted RSA-OAEP / RSA-OAEP-256
+// /384/512 / RSA1_5. Classical RSA *encryption* (key transport) — distinct from
+// the RS*/PS* *signature* tokens above, and a harvest-now-decrypt-later surface.
+const RE_JOSE_KEM = /['"`](RSA-OAEP(?:-(?:256|384|512))?|RSA1_5)['"`]/g;
+
 const RULE_JWT_ALG: RuleMeta = {
   id: "jwt-classical-alg",
   title: "Classical JWT/JOSE algorithm",
@@ -650,6 +656,20 @@ const RULE_JOSE_ECDH: RuleMeta = {
     "JOSE ECDH-ES performs classical ECDH key agreement — harvest-now-decrypt-later exposed.",
   remediation: "Track IETF PQC JOSE/COSE; adopt hybrid X25519MLKEM768 KEM-based encryption.",
 };
+const RULE_JOSE_RSA_OAEP: RuleMeta = {
+  id: "jose-rsa-oaep",
+  title: "JOSE RSA key-transport algorithm",
+  description: "JWE RSA-OAEP / RSA-OAEP-256/384/512 / RSA1_5 key encryption",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "medium",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "JOSE RSA key transport (RSA-OAEP / RSA1_5) is classical RSA encryption — harvest-now-decrypt-later exposed.",
+  remediation: "Track IETF PQC JOSE/COSE; adopt hybrid X25519MLKEM768 KEM-based encryption.",
+};
 
 /**
  * Detects classical signature algorithm identifiers used by JWT/JOSE, plus
@@ -664,7 +684,7 @@ const jwtDetector: Detector = {
   // signal in JS/TS or Python (e.g. PyJWT `algorithm="RS256"`), so this detector
   // is un-gated from JS-only to the JWT host surfaces.
   language: "any",
-  rules: [RULE_JWT_ALG, RULE_JOSE_ECDH],
+  rules: [RULE_JWT_ALG, RULE_JOSE_ECDH, RULE_JOSE_RSA_OAEP],
   appliesTo: (f) => hasExtension(f, JWT_HOST_EXTENSIONS),
   detect({ file, content }): Finding[] {
     const findings: Finding[] = [];
@@ -703,6 +723,20 @@ const jwtDetector: Detector = {
       );
     });
 
+    // JOSE RSA key transport (RSA-OAEP / RSA1_5) — classical RSA encryption, HNDL.
+    eachMatch(RE_JOSE_KEM, content, (m) => {
+      findings.push(
+        findingFromRule(
+          RULE_JOSE_RSA_OAEP,
+          { file, content, index: m.index, matchLength: m[0].length },
+          {
+            title: `JOSE RSA key transport ${m[1]}`,
+            message: `JOSE "${m[1]}" is classical RSA key transport — harvest-now-decrypt-later exposed.`,
+          },
+        ),
+      );
+    });
+
     return findings;
   },
 };
@@ -810,6 +844,13 @@ const tlsDetector: Detector = {
 const RE_SSH_PUBKEY = /\b(ssh-rsa|ssh-ed25519|ssh-dss|ecdsa-sha2-nistp(?:256|384|521))\b/g;
 const RE_CERT_SIG_ALG =
   /\b(sha(?:1|256|384|512)WithRSAEncryption|ecdsa-with-SHA(?:1|256|384|512)|rsassaPss|dsaWithSHA(?:1|256))\b/g;
+// Classical SSH key-exchange algorithm identifiers: finite-field DH groups
+// (diffie-hellman-group{1,14,15,16,17,18} + group-exchange), ECDH over NIST
+// curves (ecdh-sha2-nistp*), and Curve25519 (curve25519-sha256). All are
+// Shor-broken key agreement — the harvest-now-decrypt-later surface a lexical
+// scan misses when only the `crypto/*` API is matched, not the negotiated kex.
+const RE_SSH_KEX =
+  /\b(diffie-hellman-group(?:1|14|15|16|17|18)(?:-sha1|-sha256|-sha512)?|diffie-hellman-group-exchange-sha(?:1|256)|ecdh-sha2-nistp(?:256|384|521)|curve25519-sha256)\b/g;
 
 const RULE_SSH_PUBKEY: RuleMeta = {
   id: "ssh-public-key",
@@ -823,7 +864,8 @@ const RULE_SSH_PUBKEY: RuleMeta = {
   cwe: CWE_BROKEN_CRYPTO,
   sensitive: true,
   message: "A classical SSH public key is forgeable by a quantum attacker.",
-  remediation: "Plan migration to PQC-capable SSH (e.g. sntrup761x25519 KEX, PQC host keys).",
+  remediation:
+    "Plan migration to PQC-capable SSH: prefer the mlkem768x25519-sha256 KEX (ML-KEM-768 hybrid, OpenSSH 10's default since Apr 2025); sntrup761x25519 is an acceptable interim. Rotate to PQC host keys as they land.",
 };
 const RULE_CERT_SIG_ALG: RuleMeta = {
   id: "cert-signature-algorithm",
@@ -839,6 +881,21 @@ const RULE_CERT_SIG_ALG: RuleMeta = {
     "A classical certificate signature algorithm (RSA/ECDSA/DSA) is a quantum forgery surface.",
   remediation: "Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.",
 };
+const RULE_SSH_KEX: RuleMeta = {
+  id: "ssh-kex-classical",
+  title: "Classical SSH key exchange",
+  description: "diffie-hellman-group* / group-exchange / ecdh-sha2-* / curve25519-sha256 kex",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "medium",
+  algorithm: "unknown",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "A classical SSH key-exchange algorithm (finite-field DH / ECDH / X25519) is harvest-now-decrypt-later exposed.",
+  remediation:
+    "Prefer the mlkem768x25519-sha256 KEX (ML-KEM-768 hybrid, OpenSSH 10 default); sntrup761x25519 is an acceptable interim.",
+};
 
 /**
  * Detects classical SSH public keys (`authorized_keys` / `known_hosts` lines)
@@ -851,8 +908,10 @@ const sshCertDetector: Detector = {
   description: "SSH public keys and TLS/X.509 certificate signature algorithms in config",
   scope: "config",
   language: "any",
-  rules: [RULE_SSH_PUBKEY, RULE_CERT_SIG_ALG],
-  appliesTo: () => true,
+  rules: [RULE_SSH_PUBKEY, RULE_CERT_SIG_ALG, RULE_SSH_KEX],
+  // Skip prose/docs: a changelog or README that merely mentions `ssh-rsa` in a
+  // sentence is not crypto config. PEM material is caught by its own detector.
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
   detect({ file, content }): Finding[] {
     const findings: Finding[] = [];
 
@@ -900,6 +959,89 @@ const sshCertDetector: Detector = {
       );
     });
 
+    // SSH key-exchange algorithm identifiers (finite-field DH / ECDH / X25519).
+    eachMatch(RE_SSH_KEX, content, (m) => {
+      const tok = m[1];
+      const algorithm: Finding["algorithm"] = tok.startsWith("diffie-hellman")
+        ? "DH"
+        : tok.startsWith("ecdh")
+          ? "ECDH"
+          : "X25519";
+      findings.push(
+        findingFromRule(
+          RULE_SSH_KEX,
+          { file, content, index: m.index, matchLength: m[0].length },
+          {
+            title: `Classical SSH key exchange (${tok})`,
+            algorithm,
+            message: `SSH key-exchange "${tok}" is classical (${algorithm}) — harvest-now-decrypt-later exposed.`,
+          },
+        ),
+      );
+    });
+
+    return findings;
+  },
+};
+
+/* -------------------------------------------------------------------------- */
+/* Classical TLS key-exchange cipher suites (language-agnostic config)         */
+/* -------------------------------------------------------------------------- */
+
+// Classical KEX cipher-suite identifiers, in both the OpenSSL (`ECDHE-RSA-…`) and
+// IANA (`TLS_ECDHE_RSA_WITH_…`) spellings, with `-` or `_` separators. These name
+// a Shor-broken key exchange (ECDHE/DHE), so they are the harvest-now surface a
+// PQC scanner should flag — distinct from the legacy-*version* / weak-cipher rules
+// above. Case-sensitive on purpose: cipher-suite tokens are upper-case constants,
+// so prose like "ecdhe rsa" does not misfire. No trailing \b so the IANA
+// `TLS_ECDHE_RSA_WITH_…` form (a `_` follows `RSA`) still matches.
+const RE_TLS_CLASSICAL_KEX = /\b(?:TLS_)?(?:ECDHE|ECDH|DHE)[-_](?:RSA|ECDSA|DSS)/g;
+
+const RULE_TLS_CLASSICAL_KEX: RuleMeta = {
+  id: "tls-classical-kex",
+  title: "Classical TLS key-exchange cipher suite",
+  description: "ECDHE / DHE cipher suites negotiate Shor-broken key exchange",
+  category: "tls",
+  severity: "medium",
+  confidence: "medium",
+  algorithm: "unknown",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Classical TLS key exchange (ECDHE/DHE) is harvest-now-decrypt-later exposed — the session key can be recorded now and recovered by a quantum attacker.",
+  remediation:
+    "Adopt a PQC-hybrid TLS 1.3 key exchange (e.g. X25519MLKEM768) as your stack and peers support it; keep classical suites only as a transitional fallback.",
+};
+
+/**
+ * Detects classical TLS key-exchange cipher suites in any text/config file
+ * (OpenSSL cipher lists, IANA suite constants in Go/Java/C#/Rust, `.properties`,
+ * etc.). Language-agnostic because the suite identifiers are the same tokens
+ * everywhere — this is the cross-language TLS gap the legacy-version rule misses.
+ */
+const tlsClassicalKexDetector: Detector = {
+  id: "tls-cipher-suite",
+  description: "Classical TLS key-exchange cipher suites (ECDHE/DHE) in any config",
+  scope: "config",
+  language: "any",
+  rules: [RULE_TLS_CLASSICAL_KEX],
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    eachMatch(RE_TLS_CLASSICAL_KEX, content, (m) => {
+      const tok = m[0];
+      const algorithm: Finding["algorithm"] = tok.includes("ECDH") ? "ECDH" : "DH";
+      findings.push(
+        findingFromRule(
+          RULE_TLS_CLASSICAL_KEX,
+          { file, content, index: m.index, matchLength: m[0].length },
+          {
+            algorithm,
+            message: `Classical TLS key-exchange suite "${tok}…" (${algorithm}) is harvest-now-decrypt-later exposed.`,
+          },
+        ),
+      );
+    });
     return findings;
   },
 };
@@ -912,4 +1054,5 @@ export const sourceDetectors: Detector[] = [
   jwtDetector,
   tlsDetector,
   sshCertDetector,
+  tlsClassicalKexDetector,
 ];

package/src/detectors/stateful-hbs.ts

@@ -0,0 +1,177 @@
+/**
+ * Config / source-agnostic detector: stateful hash-based signatures
+ * (NIST SP 800-208) — LMS, HSS, XMSS and XMSSMT.
+ *
+ * These schemes ARE quantum-safe and NIST-approved (SP 800-208, for firmware /
+ * secure-boot signing), so this is NOT a "broken crypto" finding. The hazard it
+ * flags is STATE MANAGEMENT: each private key holds a bounded set of one-time
+ * key indices, and reusing an index is catastrophic (it enables signature
+ * forgery). The detector therefore surfaces the usage so a reviewer can confirm
+ * rigorous state handling exists — or migrate to a stateless scheme.
+ *
+ * Like {@link pemDetector}, this is a `scope: "config"`, `language: "any"`
+ * detector that runs on every text file, because the distinctive LMS/XMSS
+ * parameter strings and library tokens (`LMS_SHA256_M32_H10`, `pyhsslms`,
+ * `XMSS-SHA2_10_256`, …) appear identically across languages, config, and docs.
+ * Every rule's metadata lives in the {@link RuleMeta} declaration below; the
+ * regexes are tightly bounded and `\b`-anchored to stay high-signal.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule } from "../detect-utils.js";
+import { CWE_RISKY_PRIMITIVE } from "../cwe.js";
+
+/**
+ * Shared remediation for every stateful-HBS finding: these are approved but
+ * STATEFUL, so the reviewer must confirm state management before trusting them.
+ */
+const STATEFUL_HBS_REMEDIATION =
+  "LMS/HSS/XMSS/XMSSMT are NIST-approved (SP 800-208) but STATEFUL: the signer " +
+  "must NEVER reuse a one-time key index (reuse enables signature forgery). Use " +
+  "only with rigorous, crash-safe state management; otherwise prefer the " +
+  "stateless ML-DSA (FIPS 204) or SLH-DSA (FIPS 205).";
+
+/** A stateful-HBS rule: its catalog metadata plus the token regex that triggers it. */
+interface HbsRule {
+  /** Global regex matching the distinctive token. */
+  re: RegExp;
+  meta: RuleMeta;
+}
+
+const HBS_RULES: HbsRule[] = [
+  {
+    // LMS parameter set, e.g. LMS_SHA256_M32_H10 (RFC 8554 / SP 800-208).
+    re: /\bLMS_SHA256_[MN]\d+_[HW]\d+\b/g,
+    meta: {
+      id: "stateful-hbs-lms-param",
+      title: "LMS parameter set (stateful hash-based signature)",
+      description: "LMS/HSS one-time-signature parameter string (SP 800-208)",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: false,
+      cwe: CWE_RISKY_PRIMITIVE,
+      message:
+        "LMS parameter set — NIST-approved (SP 800-208) but STATEFUL: reusing a one-time key index is catastrophic.",
+      remediation: STATEFUL_HBS_REMEDIATION,
+    },
+  },
+  {
+    // HSS keygen (hierarchical LMS), e.g. pyhsslms.hss_generate_private_key(...).
+    re: /\bhss_generate_private_key\b/g,
+    meta: {
+      id: "stateful-hbs-hss-keygen",
+      title: "HSS private-key generation (stateful hash-based signature)",
+      description: "HSS (hierarchical LMS) private-key generation call (SP 800-208)",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: false,
+      cwe: CWE_RISKY_PRIMITIVE,
+      message:
+        "HSS private-key generation — NIST-approved (SP 800-208) but STATEFUL: never reuse a one-time key index.",
+      remediation: STATEFUL_HBS_REMEDIATION,
+    },
+  },
+  {
+    // pyhsslms — the Python LMS/HSS library import token.
+    re: /\bpyhsslms\b/g,
+    meta: {
+      id: "stateful-hbs-pyhsslms",
+      title: "pyhsslms library (stateful LMS/HSS signatures)",
+      description: "Reference to the pyhsslms LMS/HSS library (SP 800-208)",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: false,
+      cwe: CWE_RISKY_PRIMITIVE,
+      message:
+        "pyhsslms (LMS/HSS) — NIST-approved (SP 800-208) but STATEFUL: the signer must never reuse a one-time key index.",
+      remediation: STATEFUL_HBS_REMEDIATION,
+    },
+  },
+  {
+    // XMSS parameter set, e.g. XMSS-SHA2_10_256 (RFC 8391 / SP 800-208).
+    re: /\bXMSS-SHA2_\d+_256\b/g,
+    meta: {
+      id: "stateful-hbs-xmss-param",
+      title: "XMSS parameter set (stateful hash-based signature)",
+      description: "XMSS one-time-signature parameter string (SP 800-208)",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: false,
+      cwe: CWE_RISKY_PRIMITIVE,
+      message:
+        "XMSS parameter set — NIST-approved (SP 800-208) but STATEFUL: reusing a one-time key index is catastrophic.",
+      remediation: STATEFUL_HBS_REMEDIATION,
+    },
+  },
+  {
+    // XMSSMT (multi-tree XMSS) parameter set, e.g. XMSSMT-SHA2_20/2_256.
+    re: /\bXMSSMT-SHA2_\d+\b/g,
+    meta: {
+      id: "stateful-hbs-xmssmt-param",
+      title: "XMSSMT parameter set (stateful hash-based signature)",
+      description: "XMSSMT (multi-tree XMSS) parameter string (SP 800-208)",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: false,
+      cwe: CWE_RISKY_PRIMITIVE,
+      message:
+        "XMSSMT parameter set — NIST-approved (SP 800-208) but STATEFUL: never reuse a one-time key index.",
+      remediation: STATEFUL_HBS_REMEDIATION,
+    },
+  },
+  {
+    // XMSS keypair generation, e.g. xmss_keypair(...) (liboqs / xmss reference).
+    re: /\bxmss_keypair\b/g,
+    meta: {
+      id: "stateful-hbs-xmss-keypair",
+      title: "XMSS keypair generation (stateful hash-based signature)",
+      description: "XMSS keypair-generation call (SP 800-208)",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: false,
+      cwe: CWE_RISKY_PRIMITIVE,
+      message:
+        "XMSS keypair generation — NIST-approved (SP 800-208) but STATEFUL: the signer must never reuse a one-time key index.",
+      remediation: STATEFUL_HBS_REMEDIATION,
+    },
+  },
+];
+
+/** Detects stateful hash-based signature (SP 800-208) usage in arbitrary files. */
+export const statefulHbsDetector: Detector = {
+  id: "stateful-hbs",
+  description:
+    "Stateful hash-based signatures (NIST SP 800-208: LMS / HSS / XMSS / XMSSMT) in any file",
+  scope: "config",
+  language: "any",
+  rules: HBS_RULES.map((r) => r.meta),
+  // Applies to every text file; the walker already filters out binaries.
+  appliesTo: () => true,
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    for (const rule of HBS_RULES) {
+      eachMatch(rule.re, content, (m) => {
+        findings.push(
+          findingFromRule(rule.meta, {
+            file,
+            content,
+            index: m.index,
+            matchLength: m[0].length,
+          }),
+        );
+      });
+    }
+    return findings;
+  },
+};