@quantakrypto/core 0.4.2 → 0.4.4

package/dist/detectors/source.js

@@ -1,4 +1,4 @@
-import { JS_TS_EXTENSIONS, JWT_HOST_EXTENSIONS, eachMatch, findingFromRule, hasExtension, nearSortedCall, } from "../detect-utils.js";
+import { JS_TS_EXTENSIONS, DOC_EXTENSIONS, JWT_HOST_EXTENSIONS, eachMatch, findingFromRule, hasExtension, nearSortedCall, } from "../detect-utils.js";
 import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cwe.js";
 /* -------------------------------------------------------------------------- */
 /* Precompiled regexes (module scope — never recreated per file)              */
@@ -6,6 +6,107 @@ import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cw
 // `rsa-pss` is listed before `rsa` so the alternation consumes the full token
 // (ordered alternation would otherwise match `rsa` and reject the `-pss` tail).
 const RE_GENERATE_KEYPAIR = /generateKeyPair(?:Sync)?\s*\(\s*['"`](rsa-pss|rsa|ec|dsa|dh|x25519|x448|ed25519|ed448)['"`]/g;
+const KEYGEN_INFO = {
+    rsa: { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" },
+    // RSA-PSS is signature-only, so classify it as a (forgeable) signature
+    // rather than a KEM — no HNDL confidentiality exposure.
+    "rsa-pss": {
+        algo: "RSA",
+        cat: "signature",
+        sev: "high",
+        hndl: false,
+        label: "RSA-PSS",
+        message: "Generates a classical RSA-PSS signing key, which is forgeable by a quantum attacker.",
+        remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+    },
+    // EC keys feed BOTH ECDSA (sign) and ECDH (key agreement). ECDH is
+    // HNDL-exposed, so classify conservatively as key-exchange-capable and
+    // surface both concerns rather than asserting signature-only (P0-4).
+    ec: {
+        algo: "ECDH",
+        cat: "key-exchange",
+        sev: "high",
+        hndl: true,
+        label: "EC (ECDSA/ECDH)",
+        message: "Generates a classical EC key pair. EC keys feed BOTH ECDSA signatures " +
+            "and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
+        remediation: "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+    },
+    dsa: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
+    dh: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
+    x25519: { algo: "X25519", cat: "key-exchange", sev: "medium", hndl: true, label: "X25519" },
+    x448: { algo: "X448", cat: "key-exchange", sev: "medium", hndl: true, label: "X448" },
+    ed25519: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed25519" },
+    ed448: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed448" },
+};
+/** Emit a keygen finding for `generateKeyPair(Sync)('<type>')` at [index]. Shared
+ * by the direct matcher and the import-alias pass so both classify identically. */
+function pushKeygenFinding(findings, rawType, file, content, index, matchLength) {
+    const info = KEYGEN_INFO[rawType.toLowerCase()];
+    if (!info)
+        return;
+    findings.push(findingFromRule(RULE_NODE_KEYGEN, { file, content, index, matchLength }, {
+        title: `${info.label} key generation`,
+        category: info.cat,
+        severity: info.sev,
+        algorithm: info.algo,
+        hndl: info.hndl,
+        message: info.message ??
+            `Generates a classical ${info.label} key pair, which is not quantum-safe.`,
+        ...(info.remediation ? { remediation: info.remediation } : {}),
+    }));
+}
+/** Canonical Node-crypto call names whose import-aliases we resolve. */
+const ALIASABLE = [
+    "generateKeyPairSync",
+    "generateKeyPair",
+    "createECDH",
+    "createDiffieHellman",
+    "createDiffieHellmanGroup",
+];
+/**
+ * Collect import-aliases for the canonical crypto calls we resolve, so
+ * `import { generateKeyPairSync as gk } from 'node:crypto'` (or the CommonJS
+ * `const { generateKeyPairSync: gk } = require('crypto')`) is followed when `gk`
+ * is called later. Returns Map<canonical, alias[]>. An alias equal to its own
+ * canonical name is skipped (already matched directly). Precision-safe: the
+ * alias is only ever bound to a known crypto symbol, so a later `gk(` call is
+ * unambiguously that symbol.
+ */
+function collectCryptoAliases(content) {
+    const out = new Map();
+    const add = (canonical, alias) => {
+        if (!alias || alias === canonical)
+            return;
+        const list = out.get(canonical) ?? [];
+        if (!list.includes(alias))
+            list.push(alias);
+        out.set(canonical, list);
+    };
+    // ESM named imports: `import { A as B, C as D } from '...'`.
+    const esm = /import\s*(?:type\s+)?\{([^}]*)\}\s*from\s*['"][^'"]*['"]/g;
+    for (let m = esm.exec(content); m; m = esm.exec(content)) {
+        const spec = /([A-Za-z_$][\w$]*)\s+as\s+([A-Za-z_$][\w$]*)/g;
+        for (let s = spec.exec(m[1]); s; s = spec.exec(m[1])) {
+            if (ALIASABLE.includes(s[1]))
+                add(s[1], s[2]);
+        }
+    }
+    // CommonJS destructure-rename: `const { A: B } = require('...')`.
+    const cjs = /(?:const|let|var)\s*\{([^}]*)\}\s*=\s*require\s*\(\s*['"][^'"]*['"]\s*\)/g;
+    for (let m = cjs.exec(content); m; m = cjs.exec(content)) {
+        const spec = /([A-Za-z_$][\w$]*)\s*:\s*([A-Za-z_$][\w$]*)/g;
+        for (let s = spec.exec(m[1]); s; s = spec.exec(m[1])) {
+            if (ALIASABLE.includes(s[1]))
+                add(s[1], s[2]);
+        }
+    }
+    return out;
+}
+/** Escape a string for safe interpolation into a dynamically-built RegExp. */
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 const RE_CREATE_SIGN_VERIFY = /create(?:Sign|Verify)\s*\(/g;
 // One-shot crypto.sign/verify(algorithm, data, key). A LOOKBEHIND (not a
 // consumed char) anchors it so it doesn't fire inside identifiers like `assign(`
@@ -35,7 +136,7 @@ const RE_JSRSASIGN_KEYGEN = /KEYUTIL\.generateKeypair\s*\(/g;
 const RE_JSRSASIGN_SIGN = /KJUR\.crypto\.(?:Signature|ECDSA)\b/g;
 const RE_NODE_RSA = /new\s+NodeRSA\s*\(/g;
 // secp256k1 — direct @noble/secp256k1 / secp256k1-style API usage in source.
-const RE_SECP256K1 = /\b(?:secp(?:256k1)?|secp)\s*\.\s*(?:sign|verify|getPublicKey|getSharedSecret|ecdh|recoverPublicKey)\s*\(/g;
+const RE_SECP256K1 = /\b(?:secp(?:256k1)?|secp)\s*\.\s*(sign|verify|getPublicKey|getSharedSecret|ecdh|recoverPublicKey)\s*\(/g;
 // JWT/JOSE.
 const RE_JWT_ALG = /['"`](RS(?:256|384|512)|PS(?:256|384|512)|ES(?:256|384|512|256K)|EdDSA)['"`]/g;
 // JOSE ECDH-ES key agreement (HNDL) and COSE algorithm identifiers.
@@ -177,52 +278,41 @@ const nodeCryptoDetector = {
         const findings = [];
         // generateKeyPair(Sync)('rsa' | 'ec' | 'dsa' | 'dh' | 'x25519' | 'ed25519', ...)
         eachMatch(RE_GENERATE_KEYPAIR, content, (m) => {
-            const type = m[1].toLowerCase();
-            const map = {
-                rsa: { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" },
-                // RSA-PSS is signature-only, so classify it as a (forgeable) signature
-                // rather than a KEM — no HNDL confidentiality exposure.
-                "rsa-pss": {
-                    algo: "RSA",
-                    cat: "signature",
-                    sev: "high",
-                    hndl: false,
-                    label: "RSA-PSS",
-                    message: "Generates a classical RSA-PSS signing key, which is forgeable by a quantum attacker.",
-                    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
-                },
-                // EC keys feed BOTH ECDSA (sign) and ECDH (key agreement). ECDH is
-                // HNDL-exposed, so classify conservatively as key-exchange-capable and
-                // surface both concerns rather than asserting signature-only (P0-4).
-                ec: {
-                    algo: "ECDH",
-                    cat: "key-exchange",
-                    sev: "high",
-                    hndl: true,
-                    label: "EC (ECDSA/ECDH)",
-                    message: "Generates a classical EC key pair. EC keys feed BOTH ECDSA signatures " +
-                        "and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
-                    remediation: "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
-                },
-                dsa: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
-                dh: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
-                x25519: { algo: "X25519", cat: "key-exchange", sev: "low", hndl: true, label: "X25519" },
-                x448: { algo: "X448", cat: "key-exchange", sev: "low", hndl: true, label: "X448" },
-                ed25519: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed25519" },
-                ed448: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed448" },
-            };
-            const info = map[type];
-            findings.push(findingFromRule(RULE_NODE_KEYGEN, { file, content, index: m.index, matchLength: m[0].length }, {
-                title: `${info.label} key generation`,
-                category: info.cat,
-                severity: info.sev,
-                algorithm: info.algo,
-                hndl: info.hndl,
-                message: info.message ??
-                    `Generates a classical ${info.label} key pair, which is not quantum-safe.`,
-                ...(info.remediation ? { remediation: info.remediation } : {}),
-            }));
+            pushKeygenFinding(findings, m[1], file, content, m.index, m[0].length);
         });
+        // Import-alias resolution: follow `import { generateKeyPairSync as gk }` (and
+        // the CommonJS destructure-rename) so an aliased call still detects. Only the
+        // keygen / ECDH / DH constructors are resolved — their classification is
+        // unambiguous. The alias regexes run on the ORIGINAL content, so locations
+        // stay exact; it fires only when the alias was explicitly bound to a known
+        // crypto symbol, so precision is unaffected.
+        const aliases = collectCryptoAliases(content);
+        for (const [canonical, names] of aliases) {
+            for (const alias of names) {
+                const a = escapeRe(alias);
+                if (canonical === "generateKeyPairSync" || canonical === "generateKeyPair") {
+                    const re = new RegExp(`\\b${a}\\s*\\(\\s*['"\`](rsa-pss|rsa|ec|dsa|dh|x25519|x448|ed25519|ed448)['"\`]`, "g");
+                    eachMatch(re, content, (m) => pushKeygenFinding(findings, m[1], file, content, m.index, m[0].length));
+                }
+                else if (canonical === "createECDH") {
+                    eachMatch(new RegExp(`\\b${a}\\s*\\(`, "g"), content, (m) => findings.push(findingFromRule(RULE_NODE_ECDH, {
+                        file,
+                        content,
+                        index: m.index,
+                        matchLength: m[0].length,
+                    })));
+                }
+                else {
+                    // createDiffieHellman / createDiffieHellmanGroup.
+                    eachMatch(new RegExp(`\\b${a}\\s*\\(`, "g"), content, (m) => findings.push(findingFromRule(RULE_NODE_DH, {
+                        file,
+                        content,
+                        index: m.index,
+                        matchLength: m[0].length,
+                    })));
+                }
+            }
+        }
         // createSign / createVerify — RSA / ECDSA / DSA signatures.
         eachMatch(RE_CREATE_SIGN_VERIFY, content, (m) => {
             findings.push(findingFromRule(RULE_NODE_SIGN, {
@@ -485,7 +575,21 @@ const libraryDetector = {
         add(RE_FORGE_RSA, RULE_FORGE_RSA); // node-forge: pki.rsa.generateKeyPair(...)
         add(RE_FORGE_ED25519, RULE_FORGE_ED25519); // node-forge: forge.ed25519.*
         add(RE_ELLIPTIC_EC, RULE_ELLIPTIC_EC); // elliptic: new EC('secp256k1')
-        add(RE_SECP256K1, RULE_SECP256K1); // secp.sign / getPublicKey / getSharedSecret
+        // secp256k1: classify per method — getSharedSecret/ecdh are key AGREEMENT
+        // (ECDH, harvest-now-decrypt-later); sign/verify/getPublicKey/recover are
+        // ECDSA signatures (not HNDL). The old rule flagged everything as ECDSA.
+        eachMatch(RE_SECP256K1, content, (m) => {
+            const kex = m[1] === "getSharedSecret" || m[1] === "ecdh";
+            findings.push(findingFromRule(RULE_SECP256K1, { file, content, index: m.index, matchLength: m[0].length }, kex
+                ? {
+                    title: "secp256k1 ECDH key agreement",
+                    category: "key-exchange",
+                    algorithm: "ECDH",
+                    hndl: true,
+                    message: `secp256k1 ECDH key agreement (.${m[1]}()) is classical and harvest-now-decrypt-later exposed.`,
+                }
+                : undefined));
+        });
         add(RE_JSRSASIGN_KEYGEN, RULE_JSRSASIGN_KEYGEN); // jsrsasign: KEYUTIL.generateKeypair(...)
         add(RE_JSRSASIGN_SIGN, RULE_JSRSASIGN_SIGN); // jsrsasign: KJUR.crypto.*
         add(RE_NODE_RSA, RULE_NODE_RSA_LIB); // node-rsa: new NodeRSA(...)
@@ -495,6 +599,10 @@ const libraryDetector = {
 /* -------------------------------------------------------------------------- */
 /* JWT / JOSE / COSE algorithm strings                                         */
 /* -------------------------------------------------------------------------- */
+// JOSE RSA key-transport algorithms (JWE `alg`): quoted RSA-OAEP / RSA-OAEP-256
+// /384/512 / RSA1_5. Classical RSA *encryption* (key transport) — distinct from
+// the RS*/PS* *signature* tokens above, and a harvest-now-decrypt-later surface.
+const RE_JOSE_KEM = /['"`](RSA-OAEP(?:-(?:256|384|512))?|RSA1_5)['"`]/g;
 const RULE_JWT_ALG = {
     id: "jwt-classical-alg",
     title: "Classical JWT/JOSE algorithm",
@@ -521,6 +629,19 @@ const RULE_JOSE_ECDH = {
     message: "JOSE ECDH-ES performs classical ECDH key agreement — harvest-now-decrypt-later exposed.",
     remediation: "Track IETF PQC JOSE/COSE; adopt hybrid X25519MLKEM768 KEM-based encryption.",
 };
+const RULE_JOSE_RSA_OAEP = {
+    id: "jose-rsa-oaep",
+    title: "JOSE RSA key-transport algorithm",
+    description: "JWE RSA-OAEP / RSA-OAEP-256/384/512 / RSA1_5 key encryption",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "medium",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "JOSE RSA key transport (RSA-OAEP / RSA1_5) is classical RSA encryption — harvest-now-decrypt-later exposed.",
+    remediation: "Track IETF PQC JOSE/COSE; adopt hybrid X25519MLKEM768 KEM-based encryption.",
+};
 /**
  * Detects classical signature algorithm identifiers used by JWT/JOSE, plus
  * ECDH-ES key-agreement identifiers (HNDL-exposed). These appear as string
@@ -534,7 +655,7 @@ const jwtDetector = {
     // signal in JS/TS or Python (e.g. PyJWT `algorithm="RS256"`), so this detector
     // is un-gated from JS-only to the JWT host surfaces.
     language: "any",
-    rules: [RULE_JWT_ALG, RULE_JOSE_ECDH],
+    rules: [RULE_JWT_ALG, RULE_JOSE_ECDH, RULE_JOSE_RSA_OAEP],
     appliesTo: (f) => hasExtension(f, JWT_HOST_EXTENSIONS),
     detect({ file, content }) {
         const findings = [];
@@ -561,6 +682,13 @@ const jwtDetector = {
                 message: `JOSE "${m[1]}" performs classical ECDH key agreement — harvest-now-decrypt-later exposed.`,
             }));
         });
+        // JOSE RSA key transport (RSA-OAEP / RSA1_5) — classical RSA encryption, HNDL.
+        eachMatch(RE_JOSE_KEM, content, (m) => {
+            findings.push(findingFromRule(RULE_JOSE_RSA_OAEP, { file, content, index: m.index, matchLength: m[0].length }, {
+                title: `JOSE RSA key transport ${m[1]}`,
+                message: `JOSE "${m[1]}" is classical RSA key transport — harvest-now-decrypt-later exposed.`,
+            }));
+        });
         return findings;
     },
 };
@@ -648,6 +776,47 @@ const tlsDetector = {
 /* -------------------------------------------------------------------------- */
 const RE_SSH_PUBKEY = /\b(ssh-rsa|ssh-ed25519|ssh-dss|ecdsa-sha2-nistp(?:256|384|521))\b/g;
 const RE_CERT_SIG_ALG = /\b(sha(?:1|256|384|512)WithRSAEncryption|ecdsa-with-SHA(?:1|256|384|512)|rsassaPss|dsaWithSHA(?:1|256))\b/g;
+// Classical SSH key-exchange algorithm identifiers: finite-field DH groups
+// (diffie-hellman-group{1,14,15,16,17,18} + group-exchange), ECDH over NIST
+// curves (ecdh-sha2-nistp*), and Curve25519 (curve25519-sha256). All are
+// Shor-broken key agreement — the harvest-now-decrypt-later surface a lexical
+// scan misses when only the `crypto/*` API is matched, not the negotiated kex.
+const RE_SSH_KEX = /\b(diffie-hellman-group(?:1|14|15|16|17|18)(?:-sha1|-sha256|-sha512)?|diffie-hellman-group-exchange-sha(?:1|256)|ecdh-sha2-nistp(?:256|384|521)|curve25519-sha256)\b/g;
+// A bare key-type token (`ssh-rsa`, `ssh-ed25519`, …) is real SSH crypto only
+// when it is EITHER (a) followed by base64 key material — an actual
+// authorized_keys / known_hosts entry — OR (b) one of ≥2 DISTINCT ssh key/host-key
+// algorithm tokens on the same line — an algorithm-preference list
+// (`HostKeyAlgorithms ssh-ed25519,ecdsa-sha2-nistp256,ssh-rsa`, `%w[…]`, …). A
+// lone token, e.g. a UI label / i18n value like `"ssh-rsa": "ssh-rsa"`, is
+// neither, so it must NOT be flagged. `RE_SSH_ALGO_TOKEN` is a separate (cloned-
+// on-use) copy so counting per line never disturbs the outer `eachMatch` state.
+const RE_SSH_ALGO_TOKEN = /\b(ssh-rsa|ssh-ed25519|ssh-dss|ecdsa-sha2-nistp(?:256|384|521))\b/g;
+/** How far around a token we look for a sibling algorithm on the same line. A
+ * real `HostKeyAlgorithms` list is short; bounding the window keeps the per-token
+ * work O(1) so a pathological single huge line can't make detection quadratic. */
+const SSH_LINE_WINDOW = 512;
+function isRealSshKeyOrAlgoList(content, index, matchLen) {
+    // (a) base64 key material immediately after the token → a real SSH public key.
+    if (/^\s+[A-Za-z0-9+/]{20,}/.test(content.slice(index + matchLen, index + matchLen + 80))) {
+        return true;
+    }
+    // (b) ≥2 distinct ssh key/host-key algorithm tokens on the same line → a list.
+    // Bound both the back-scan for the line start and the window itself so the work
+    // is constant per token and never crosses a line boundary (i18n entries live on
+    // separate lines, so a lone repeated token stays a single distinct token).
+    const from = Math.max(0, index - SSH_LINE_WINDOW);
+    const pre = content.slice(from, index);
+    const preNl = pre.lastIndexOf("\n");
+    const lineStart = preNl === -1 ? from : from + preNl + 1;
+    const to = Math.min(content.length, index + matchLen + SSH_LINE_WINDOW);
+    const post = content.slice(index, to);
+    const postNl = post.indexOf("\n");
+    const lineEnd = postNl === -1 ? to : index + postNl;
+    const distinct = new Set();
+    for (const t of content.slice(lineStart, lineEnd).matchAll(RE_SSH_ALGO_TOKEN))
+        distinct.add(t[1]);
+    return distinct.size >= 2;
+}
 const RULE_SSH_PUBKEY = {
     id: "ssh-public-key",
     title: "Classical SSH public key",
@@ -660,7 +829,7 @@ const RULE_SSH_PUBKEY = {
     cwe: CWE_BROKEN_CRYPTO,
     sensitive: true,
     message: "A classical SSH public key is forgeable by a quantum attacker.",
-    remediation: "Plan migration to PQC-capable SSH (e.g. sntrup761x25519 KEX, PQC host keys).",
+    remediation: "Plan migration to PQC-capable SSH: prefer the mlkem768x25519-sha256 KEX (ML-KEM-768 hybrid, OpenSSH 10's default since Apr 2025); sntrup761x25519 is an acceptable interim. Rotate to PQC host keys as they land.",
 };
 const RULE_CERT_SIG_ALG = {
     id: "cert-signature-algorithm",
@@ -675,6 +844,19 @@ const RULE_CERT_SIG_ALG = {
     message: "A classical certificate signature algorithm (RSA/ECDSA/DSA) is a quantum forgery surface.",
     remediation: "Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.",
 };
+const RULE_SSH_KEX = {
+    id: "ssh-kex-classical",
+    title: "Classical SSH key exchange",
+    description: "diffie-hellman-group* / group-exchange / ecdh-sha2-* / curve25519-sha256 kex",
+    category: "key-exchange",
+    severity: "medium",
+    confidence: "medium",
+    algorithm: "unknown",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "A classical SSH key-exchange algorithm (finite-field DH / ECDH / X25519) is harvest-now-decrypt-later exposed.",
+    remediation: "Prefer the mlkem768x25519-sha256 KEX (ML-KEM-768 hybrid, OpenSSH 10 default); sntrup761x25519 is an acceptable interim.",
+};
 /**
  * Detects classical SSH public keys (`authorized_keys` / `known_hosts` lines)
  * and X.509 certificate signature-algorithm identifiers in any text file. These
@@ -686,12 +868,18 @@ const sshCertDetector = {
     description: "SSH public keys and TLS/X.509 certificate signature algorithms in config",
     scope: "config",
     language: "any",
-    rules: [RULE_SSH_PUBKEY, RULE_CERT_SIG_ALG],
-    appliesTo: () => true,
+    rules: [RULE_SSH_PUBKEY, RULE_CERT_SIG_ALG, RULE_SSH_KEX],
+    // Skip prose/docs: a changelog or README that merely mentions `ssh-rsa` in a
+    // sentence is not crypto config. PEM material is caught by its own detector.
+    appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
     detect({ file, content }) {
         const findings = [];
         // SSH public keys: ssh-rsa AAAA…, ecdsa-sha2-nistp256 …, ssh-ed25519 …
         eachMatch(RE_SSH_PUBKEY, content, (m) => {
+            // Skip a bare token that is neither a real key nor an algorithm list (e.g.
+            // a `"ssh-rsa": "ssh-rsa"` i18n label) — see `isRealSshKeyOrAlgoList`.
+            if (!isRealSshKeyOrAlgoList(content, m.index, m[0].length))
+                return;
             const tok = m[1];
             const algorithm = tok.startsWith("ssh-rsa")
                 ? "RSA"
@@ -720,6 +908,70 @@ const sshCertDetector = {
                 message: `Certificate signature algorithm "${tok}" is classical (RSA/ECDSA/DSA) — a quantum forgery surface.`,
             }));
         });
+        // SSH key-exchange algorithm identifiers (finite-field DH / ECDH / X25519).
+        eachMatch(RE_SSH_KEX, content, (m) => {
+            const tok = m[1];
+            const algorithm = tok.startsWith("diffie-hellman")
+                ? "DH"
+                : tok.startsWith("ecdh")
+                    ? "ECDH"
+                    : "X25519";
+            findings.push(findingFromRule(RULE_SSH_KEX, { file, content, index: m.index, matchLength: m[0].length }, {
+                title: `Classical SSH key exchange (${tok})`,
+                algorithm,
+                message: `SSH key-exchange "${tok}" is classical (${algorithm}) — harvest-now-decrypt-later exposed.`,
+            }));
+        });
+        return findings;
+    },
+};
+/* -------------------------------------------------------------------------- */
+/* Classical TLS key-exchange cipher suites (language-agnostic config)         */
+/* -------------------------------------------------------------------------- */
+// Classical KEX cipher-suite identifiers, in both the OpenSSL (`ECDHE-RSA-…`) and
+// IANA (`TLS_ECDHE_RSA_WITH_…`) spellings, with `-` or `_` separators. These name
+// a Shor-broken key exchange (ECDHE/DHE), so they are the harvest-now surface a
+// PQC scanner should flag — distinct from the legacy-*version* / weak-cipher rules
+// above. Case-sensitive on purpose: cipher-suite tokens are upper-case constants,
+// so prose like "ecdhe rsa" does not misfire. No trailing \b so the IANA
+// `TLS_ECDHE_RSA_WITH_…` form (a `_` follows `RSA`) still matches.
+const RE_TLS_CLASSICAL_KEX = /\b(?:TLS_)?(?:ECDHE|ECDH|DHE)[-_](?:RSA|ECDSA|DSS)/g;
+const RULE_TLS_CLASSICAL_KEX = {
+    id: "tls-classical-kex",
+    title: "Classical TLS key-exchange cipher suite",
+    description: "ECDHE / DHE cipher suites negotiate Shor-broken key exchange",
+    category: "tls",
+    severity: "medium",
+    confidence: "medium",
+    algorithm: "unknown",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical TLS key exchange (ECDHE/DHE) is harvest-now-decrypt-later exposed — the session key can be recorded now and recovered by a quantum attacker.",
+    remediation: "Adopt a PQC-hybrid TLS 1.3 key exchange (e.g. X25519MLKEM768) as your stack and peers support it; keep classical suites only as a transitional fallback.",
+};
+/**
+ * Detects classical TLS key-exchange cipher suites in any text/config file
+ * (OpenSSL cipher lists, IANA suite constants in Go/Java/C#/Rust, `.properties`,
+ * etc.). Language-agnostic because the suite identifiers are the same tokens
+ * everywhere — this is the cross-language TLS gap the legacy-version rule misses.
+ */
+const tlsClassicalKexDetector = {
+    id: "tls-cipher-suite",
+    description: "Classical TLS key-exchange cipher suites (ECDHE/DHE) in any config",
+    scope: "config",
+    language: "any",
+    rules: [RULE_TLS_CLASSICAL_KEX],
+    appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+    detect({ file, content }) {
+        const findings = [];
+        eachMatch(RE_TLS_CLASSICAL_KEX, content, (m) => {
+            const tok = m[0];
+            const algorithm = tok.includes("ECDH") ? "ECDH" : "DH";
+            findings.push(findingFromRule(RULE_TLS_CLASSICAL_KEX, { file, content, index: m.index, matchLength: m[0].length }, {
+                algorithm,
+                message: `Classical TLS key-exchange suite "${tok}…" (${algorithm}) is harvest-now-decrypt-later exposed.`,
+            }));
+        });
         return findings;
     },
 };
@@ -731,5 +983,6 @@ export const sourceDetectors = [
     jwtDetector,
     tlsDetector,
     sshCertDetector,
+    tlsClassicalKexDetector,
 ];
 //# sourceMappingURL=source.js.map