@quantakrypto/core 0.4.2 → 0.4.4

package/src/detectors/cloud-kms.ts

@@ -0,0 +1,87 @@
+/**
+ * Cloud-KMS SDK detector: classical asymmetric keys minted at RUNTIME through a
+ * cloud KMS SDK call — the application-code counterpart to the Terraform detector
+ * (which covers the infrastructure-as-code path). AWS KMS `CreateKey` /
+ * `GenerateDataKeyPair` select the key type with a `KeySpec` / `KeyPairSpec`
+ * (legacy `CustomerMasterKeySpec`) field whose value is `RSA_*` or `ECC_*`.
+ *
+ * These PascalCase field names + `RSA_2048` / `ECC_NIST_P256` values are specific
+ * to the AWS KMS API across every SDK language (JS/TS, Python/boto3, Java, Go,
+ * the CLI, JSON policies), so a single lexical rule catches them all with a very
+ * low false-positive rate. Terraform uses the snake_case `customer_master_key_spec`
+ * instead, so this never double-counts with the IaC detector.
+ *
+ * HNDL: an RSA KMS key (encryption/KEM) and an EC KMS key (which AWS KMS can use
+ * for ECDH key agreement as well as ECDSA signing) are both harvest-now-decrypt-
+ * later exposed → hndl:true.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+// The AWS KMS key-spec fields (CreateKey / GenerateDataKeyPair / legacy CMK). The
+// optional `"?` after the field name accepts both the JS/HCL form (`KeySpec:`) and
+// the JSON form where the key is quoted (`"KeySpec":`).
+const SPEC_KEYS = "KeySpec|KeyPairSpec|CustomerMasterKeySpec";
+const RE_KMS_RSA = new RegExp(`\\b(?:${SPEC_KEYS})"?\\s*[:=]\\s*['"]RSA_\\d+['"]`, "g");
+const RE_KMS_EC = new RegExp(`\\b(?:${SPEC_KEYS})"?\\s*[:=]\\s*['"]ECC_[A-Z0-9_]+['"]`, "g");
+
+const RULE_KMS_RSA: RuleMeta = {
+  id: "cloud-kms-rsa",
+  title: "AWS KMS RSA key",
+  description: "AWS KMS CreateKey / GenerateDataKeyPair with an RSA_* key spec",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Mints a classical RSA key via the AWS KMS SDK (harvest-now-decrypt-later exposed for encryption).",
+  remediation: "Plan migration to PQC as cloud KMS adds ML-KEM / ML-DSA key specs.",
+};
+const RULE_KMS_EC: RuleMeta = {
+  id: "cloud-kms-ec",
+  title: "AWS KMS EC key",
+  description: "AWS KMS CreateKey / GenerateDataKeyPair with an ECC_* key spec",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Mints a classical EC key via the AWS KMS SDK; EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+
+/** Detects classical asymmetric keys provisioned via a cloud KMS SDK call. */
+export const cloudKmsDetector: Detector = {
+  id: "cloud-kms",
+  description: "Classical asymmetric keys minted via a cloud KMS SDK (AWS KMS)",
+  scope: "config",
+  language: "any",
+  rules: [RULE_KMS_RSA, RULE_KMS_EC],
+  appliesTo: () => true,
+  detect({ file, content }): Finding[] {
+    // Fast reject: only proceed if a KMS key-spec field name is present.
+    if (
+      !content.includes("KeySpec") &&
+      !content.includes("KeyPairSpec") &&
+      !content.includes("CustomerMasterKeySpec")
+    ) {
+      return [];
+    }
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta): void =>
+      eachMatch(re, content, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    add(RE_KMS_RSA, RULE_KMS_RSA);
+    add(RE_KMS_EC, RULE_KMS_EC);
+    return findings;
+  },
+};

package/src/detectors/cloudformation.ts

@@ -0,0 +1,215 @@
+/**
+ * IaC detector: classical asymmetric cryptography (and legacy TLS config)
+ * declared in AWS CloudFormation / Azure ARM (incl. Bicep-compiled JSON)
+ * templates — plus CDK `cdk synth` output, which is plain CloudFormation
+ * JSON. This is a distinct surface from `terraform.ts`: CloudFormation/ARM
+ * use PascalCase JSON/YAML property names, never Terraform's snake_case HCL
+ * attributes, so the two detectors never collide on the same file.
+ *
+ * Covered:
+ *  - AWS::KMS::Key `KeySpec`:                    `"RSA_…"` (kem) / `"ECC_…"` (key-exchange)
+ *  - AWS::CertificateManager::Certificate
+ *    `KeyAlgorithm`:                             `"RSA_…"` / `"EC_…"` (certificate)
+ *  - CloudFront distribution `MinimumProtocolVersion`: legacy `TLSv1` / `TLSv1.1` (tls)
+ *  - ELB/ALB listener `SslPolicy`:                legacy `ELBSecurityPolicy-2016-08` /
+ *                                                 `-TLS-1-0-…` / `-TLS-1-1-…` (tls)
+ *  - Azure ARM `Microsoft.KeyVault` key `kty`:    `"RSA"` (kem) / `"EC"` (key-exchange)
+ *
+ * `KeySpec` is PascalCase and case-sensitive, so it never matches Terraform's
+ * snake_case `customer_master_key_spec` (same underlying AWS API, different
+ * authoring surface). A fast-reject on a CFN/ARM marker keeps this detector
+ * from ever firing on arbitrary JSON/YAML that happens to contain one of
+ * these property names in an unrelated context.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO, CWE_WEAK_STRENGTH } from "../cwe.js";
+
+const CFN_EXTENSIONS: readonly string[] = [".json", ".yaml", ".yml"];
+
+// Fast-reject markers: at least one must appear before any rule regex runs, so
+// this detector never scans arbitrary JSON/YAML that merely happens to share
+// an attribute name (`KeySpec`, `kty`, …) with an unrelated schema.
+const CFN_MARKERS: readonly string[] = [
+  "AWS::KMS",
+  "AWS::CertificateManager",
+  "AWSTemplateFormatVersion",
+  "MinimumProtocolVersion",
+  "Microsoft.KeyVault",
+  '"SslPolicy"',
+];
+
+// Each attribute is matched with an optional quote around the key and `:` as
+// the separator (both plain-JSON and YAML-block-scalar forms use `:`). The
+// `(?<![\w"-])` lookbehind stops a longer/prefixed attribute name from
+// matching on its suffix.
+const RE_CFN_KMS_RSA = /(?<![\w"-])"?KeySpec"?\s*:\s*"?RSA_\d+"?/g;
+const RE_CFN_KMS_EC = /(?<![\w"-])"?KeySpec"?\s*:\s*"?ECC_[A-Z0-9_]+"?/g;
+const RE_CFN_ACM_RSA = /(?<![\w"-])"?KeyAlgorithm"?\s*:\s*"?RSA_\d+"?/g;
+const RE_CFN_ACM_EC = /(?<![\w"-])"?KeyAlgorithm"?\s*:\s*"?EC_[A-Za-z0-9]+"?/g;
+// CloudFront: only the pre-2018 "TLSv1" / "TLSv1_2016" / "TLSv1.1_2016"
+// values are legacy; the lookahead delimiter stops this from matching a
+// "TLSv1.2_2018"-style value that merely starts with the same prefix.
+const RE_CFN_CLOUDFRONT_TLS =
+  /(?<![\w"-])"?MinimumProtocolVersion"?\s*:\s*"?(?:TLSv1(?:\.1)?_2016|TLSv1)(?=["'\s,}]|$)/gm;
+// ELB/ALB legacy SSL negotiation policies (named, dated policy strings).
+const RE_CFN_ELB_TLS =
+  /(?<![\w"-])"?SslPolicy"?\s*:\s*"ELBSecurityPolicy-(?:2016-08|TLS-1-0-\d{4}-\d{2}|TLS-1-1-\d{4}-\d{2})"/g;
+// Azure ARM Microsoft.KeyVault key resource `properties.kty`.
+const RE_CFN_ARM_KV_RSA = /(?<![\w"-])"?kty"?\s*:\s*"?RSA"?(?!\w)/g;
+const RE_CFN_ARM_KV_EC = /(?<![\w"-])"?kty"?\s*:\s*"?EC"?(?!\w)/g;
+
+const RULE_CFN_KMS_RSA: RuleMeta = {
+  id: "cfn-kms-rsa",
+  title: "CloudFormation KMS RSA key",
+  description: 'AWS::KMS::Key KeySpec = "RSA_*"',
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "CloudFormation provisions a classical RSA KMS key (harvest-now-decrypt-later exposed for encryption CMKs).",
+  remediation: "Plan migration to PQC as cloud KMS adds ML-KEM / ML-DSA key specs.",
+};
+const RULE_CFN_KMS_EC: RuleMeta = {
+  id: "cfn-kms-ec",
+  title: "CloudFormation KMS EC key",
+  description: 'AWS::KMS::Key KeySpec = "ECC_*"',
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "CloudFormation provisions a classical EC KMS key; EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+const RULE_CFN_ACM_RSA: RuleMeta = {
+  id: "cfn-acm-rsa",
+  title: "CloudFormation ACM RSA certificate",
+  description: 'AWS::CertificateManager::Certificate KeyAlgorithm = "RSA_*"',
+  category: "certificate",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "CloudFormation provisions an ACM certificate with a classical RSA key, which is not quantum-safe.",
+  remediation: "Plan migration to PQC (ML-KEM-768 for encryption, ML-DSA-65 for signatures).",
+};
+const RULE_CFN_ACM_EC: RuleMeta = {
+  id: "cfn-acm-ec",
+  title: "CloudFormation ACM EC certificate",
+  description: 'AWS::CertificateManager::Certificate KeyAlgorithm = "EC_*"',
+  category: "certificate",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "CloudFormation provisions an ACM certificate with a classical EC key, forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+};
+const RULE_CFN_CLOUDFRONT_TLS: RuleMeta = {
+  id: "cfn-cloudfront-legacy-tls",
+  title: "CloudFormation CloudFront legacy TLS",
+  description: 'CloudFront Distribution MinimumProtocolVersion = "TLSv1" / "TLSv1.1"',
+  category: "tls",
+  severity: "medium",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_WEAK_STRENGTH,
+  message: "CloudFront distribution permits TLS 1.0/1.1, which are deprecated and insecure.",
+  remediation:
+    "Set MinimumProtocolVersion to TLSv1.2_2021 (or later) and prefer PQC-hybrid key exchange.",
+};
+const RULE_CFN_ELB_TLS: RuleMeta = {
+  id: "cfn-elb-legacy-tls",
+  title: "CloudFormation ELB/ALB legacy TLS policy",
+  description: "Elastic Load Balancer SslPolicy naming a pre-2017 legacy policy",
+  category: "tls",
+  severity: "medium",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_WEAK_STRENGTH,
+  message: "Load balancer listener uses a legacy SSL negotiation policy permitting TLS 1.0/1.1.",
+  remediation: "Use ELBSecurityPolicy-TLS13-1-2-2021-06 (or the latest FS+TLS1.2/1.3 policy).",
+};
+const RULE_CFN_ARM_KV_RSA: RuleMeta = {
+  id: "cfn-arm-keyvault-rsa",
+  title: "ARM template Key Vault RSA key",
+  description: 'Microsoft.KeyVault key resource kty = "RSA"',
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "ARM template provisions a classical RSA Azure Key Vault key, which is not quantum-safe.",
+  remediation: "Plan migration to PQC (ML-KEM-768 / ML-DSA-65).",
+};
+const RULE_CFN_ARM_KV_EC: RuleMeta = {
+  id: "cfn-arm-keyvault-ec",
+  title: "ARM template Key Vault EC key",
+  description: 'Microsoft.KeyVault key resource kty = "EC"',
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "ARM template provisions a classical EC Azure Key Vault key; EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+
+/**
+ * Detects classical asymmetric crypto and legacy TLS config declared in
+ * AWS CloudFormation / Azure ARM (incl. Bicep-compiled JSON) templates.
+ */
+export const cloudformationDetector: Detector = {
+  id: "cloudformation-crypto",
+  description:
+    "Classical asymmetric crypto and legacy TLS config declared in CloudFormation / ARM templates (IaC)",
+  scope: "config",
+  language: "any",
+  rules: [
+    RULE_CFN_KMS_RSA,
+    RULE_CFN_KMS_EC,
+    RULE_CFN_ACM_RSA,
+    RULE_CFN_ACM_EC,
+    RULE_CFN_CLOUDFRONT_TLS,
+    RULE_CFN_ELB_TLS,
+    RULE_CFN_ARM_KV_RSA,
+    RULE_CFN_ARM_KV_EC,
+  ],
+  appliesTo: (f) => hasExtension(f, CFN_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    if (!CFN_MARKERS.some((marker) => content.includes(marker))) return [];
+
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, content, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    add(RE_CFN_KMS_RSA, RULE_CFN_KMS_RSA);
+    add(RE_CFN_KMS_EC, RULE_CFN_KMS_EC);
+    add(RE_CFN_ACM_RSA, RULE_CFN_ACM_RSA);
+    add(RE_CFN_ACM_EC, RULE_CFN_ACM_EC);
+    add(RE_CFN_CLOUDFRONT_TLS, RULE_CFN_CLOUDFRONT_TLS);
+    add(RE_CFN_ELB_TLS, RULE_CFN_ELB_TLS);
+    add(RE_CFN_ARM_KV_RSA, RULE_CFN_ARM_KV_RSA);
+    add(RE_CFN_ARM_KV_EC, RULE_CFN_ARM_KV_EC);
+    return findings;
+  },
+};

package/src/detectors/csharp.ts

@@ -11,7 +11,7 @@
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
 import { CSHARP_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
-import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cwe.js";
 
 const RE_CS_RSA =
   /\bRSA\.Create\s*\(|\bnew\s+RSACryptoServiceProvider\s*\(|\bnew\s+RSACng\s*\(|\bnew\s+RSAOpenSsl\s*\(/g;
@@ -19,6 +19,37 @@ const RE_CS_ECDSA = /\bECDsa\.Create\s*\(|\bnew\s+ECDsaCng\s*\(|\bnew\s+ECDsaOpe
 const RE_CS_ECDH =
   /\bECDiffieHellman\.Create\s*\(|\bnew\s+ECDiffieHellmanCng\s*\(|\bnew\s+ECDiffieHellmanOpenSsl\s*\(/g;
 const RE_CS_DSA = /\bDSA\.Create\s*\(|\bnew\s+DSACryptoServiceProvider\s*\(|\bnew\s+DSACng\s*\(/g;
+// Insecure TLS configuration (.NET). Mirrors source.ts's tlsDetector split of a
+// cert-verification-disabled rule (tls-reject-unauthorized) and a legacy-version
+// rule (tls-legacy-version) for the equivalent C# idioms:
+//   - DangerousAcceptAnyServerCertificateValidator / a custom
+//     ServerCertificateCustomValidationCallback → accepts any cert (MITM).
+//   - SslProtocols.Ssl3 / .Tls / .Tls11 → deprecated SSL 3.0 / TLS 1.0 / 1.1.
+// `SslProtocols.Tls` (no suffix) is the legacy TLS 1.0 constant; `Tls12`/`Tls13`
+// are excluded by the trailing \b (the following digit is a word char).
+const RE_CS_TLS_CERT_VALIDATION =
+  /\bDangerousAcceptAnyServerCertificateValidator\b|ServerCertificateCustomValidationCallback\s*=/g;
+const RE_CS_TLS_LEGACY_VERSION = /\bSslProtocols\.(?:Tls|Tls11|Ssl3)\b/g;
+// Identifier-form JWT/JOSE signature algorithms (audit F7). The quoted-string
+// alg token ("RS256") is caught by the language-agnostic jwt-jose detector, but
+// Microsoft.IdentityModel passes the alg as an IDENTIFIER, not a string literal:
+// SecurityAlgorithms.RsaSha256 / SecurityAlgorithms.EcdsaSha256.
+const RE_CS_JWT_ALG = /\bSecurityAlgorithms\.(?:Rsa|Ecdsa)Sha(?:256|384|512)\b/g;
+// BouncyCastle (Org.BouncyCastle) modern-curve and finite-field DH primitives,
+// which System.Security.Cryptography does not expose directly. Each regex is
+// anchored to the distinctive BouncyCastle class names for one family so it
+// can't misfire on unrelated identifiers:
+//   - Ed25519KeyPairGenerator / Ed25519Signer / Ed25519PrivateKeyParameters → EdDSA
+//   - X25519KeyPairGenerator / X25519Agreement / X25519PrivateKeyParameters → X25519
+//   - X448KeyPairGenerator / X448Agreement / X448PrivateKeyParameters → X448
+//   - DHParametersGenerator / DHBasicAgreement / DH(Basic)KeyPairGenerator / DHParameters → DH
+// The trailing \b keeps each token whole (e.g. Ed25519KeyGenerationParameters,
+// X25519PublicKeyParameters and DHKeyGenerationParameters are NOT matched).
+const RE_CS_BC_EDDSA = /\bEd25519(?:KeyPairGenerator|Signer|PrivateKeyParameters)\b/g;
+const RE_CS_BC_X25519 = /\bX25519(?:KeyPairGenerator|Agreement|PrivateKeyParameters)\b/g;
+const RE_CS_BC_X448 = /\bX448(?:KeyPairGenerator|Agreement|PrivateKeyParameters)\b/g;
+const RE_CS_BC_DH =
+  /\bDH(?:ParametersGenerator|BasicAgreement|BasicKeyPairGenerator|KeyPairGenerator|Parameters)\b/g;
 
 const RULE_CS_RSA: RuleMeta = {
   id: "csharp-rsa",
@@ -71,14 +102,123 @@ const RULE_CS_DSA: RuleMeta = {
   message: "Classical DSA (.NET) is deprecated and forgeable by a quantum attacker.",
   remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
 };
+const RULE_CS_TLS_CERT: RuleMeta = {
+  id: "csharp-tls-cert-validation",
+  title: "C# TLS certificate verification disabled",
+  description:
+    "DangerousAcceptAnyServerCertificateValidator / ServerCertificateCustomValidationCallback override",
+  category: "tls",
+  severity: "high",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_CERT_VALIDATION,
+  message: "Accepting any server certificate disables TLS certificate verification (MITM risk).",
+  remediation:
+    "Remove the custom validator and verify certificates properly; prefer PQC-hybrid key exchange.",
+};
+const RULE_CS_TLS_LEGACY: RuleMeta = {
+  id: "csharp-tls-legacy-version",
+  title: "C# legacy TLS/SSL version pinned",
+  description: "SslProtocols pinned to Ssl3 / TLS 1.0 / TLS 1.1",
+  category: "tls",
+  severity: "medium",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_WEAK_STRENGTH,
+  message:
+    "SSL 3.0 / TLS 1.0 / TLS 1.1 are deprecated and insecure; require TLS 1.2+ (prefer 1.3).",
+  remediation: "Use SslProtocols.Tls13 (or Tls12) and prefer PQC-hybrid key exchange.",
+};
+const RULE_CS_JWT_ALG: RuleMeta = {
+  id: "csharp-jwt-alg",
+  title: "C# identifier-form JWT/JOSE algorithm",
+  description: "Microsoft.IdentityModel SecurityAlgorithms.RsaSha* / EcdsaSha*",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "unknown",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "A classical JWT/JOSE signature algorithm (.NET, identifier form) is used, forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204); track IETF PQC JOSE/COSE algorithms",
+};
+const RULE_CS_BC_EDDSA: RuleMeta = {
+  id: "csharp-bouncycastle-eddsa",
+  title: "C# Ed25519 signature (BouncyCastle)",
+  description:
+    "Org.BouncyCastle Ed25519KeyPairGenerator / Ed25519Signer / Ed25519PrivateKeyParameters",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical Ed25519 signing (BouncyCastle) is forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_CS_BC_X25519: RuleMeta = {
+  id: "csharp-bouncycastle-x25519",
+  title: "C# X25519 key agreement (BouncyCastle)",
+  description:
+    "Org.BouncyCastle X25519KeyPairGenerator / X25519Agreement / X25519PrivateKeyParameters",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "X25519",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "X25519 Diffie-Hellman key agreement (BouncyCastle) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_CS_BC_X448: RuleMeta = {
+  id: "csharp-bouncycastle-x448",
+  title: "C# X448 key agreement (BouncyCastle)",
+  description: "Org.BouncyCastle X448KeyPairGenerator / X448Agreement / X448PrivateKeyParameters",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "X448",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "X448 Diffie-Hellman key agreement (BouncyCastle) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_CS_BC_DH: RuleMeta = {
+  id: "csharp-bouncycastle-dh",
+  title: "C# finite-field Diffie-Hellman (BouncyCastle)",
+  description:
+    "Org.BouncyCastle DHParametersGenerator / DHBasicAgreement / DHKeyPairGenerator / DHParameters",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "DH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Finite-field Diffie-Hellman (BouncyCastle) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
 
 /** Detects classical asymmetric crypto in C# (System.Security.Cryptography). */
 export const csharpDetector: Detector = {
   id: "csharp-crypto",
-  description: "Classical asymmetric crypto in C#/.NET (System.Security.Cryptography)",
+  description:
+    "Classical asymmetric crypto (System.Security.Cryptography) and insecure TLS config in C#/.NET",
   scope: "source",
   language: "csharp",
-  rules: [RULE_CS_RSA, RULE_CS_ECDSA, RULE_CS_ECDH, RULE_CS_DSA],
+  rules: [
+    RULE_CS_RSA,
+    RULE_CS_ECDSA,
+    RULE_CS_ECDH,
+    RULE_CS_DSA,
+    RULE_CS_TLS_CERT,
+    RULE_CS_TLS_LEGACY,
+    RULE_CS_JWT_ALG,
+    RULE_CS_BC_EDDSA,
+    RULE_CS_BC_X25519,
+    RULE_CS_BC_X448,
+    RULE_CS_BC_DH,
+  ],
   appliesTo: (f) => hasExtension(f, CSHARP_EXTENSIONS),
   detect({ file, content }): Finding[] {
     const findings: Finding[] = [];
@@ -93,6 +233,17 @@ export const csharpDetector: Detector = {
     add(RE_CS_ECDH, RULE_CS_ECDH);
     add(RE_CS_RSA, RULE_CS_RSA);
     add(RE_CS_DSA, RULE_CS_DSA);
+    // Insecure TLS configuration (disjoint from the crypto factories above).
+    add(RE_CS_TLS_CERT_VALIDATION, RULE_CS_TLS_CERT);
+    add(RE_CS_TLS_LEGACY_VERSION, RULE_CS_TLS_LEGACY);
+    // Identifier-form JWT/JOSE signature algorithms (Microsoft.IdentityModel).
+    add(RE_CS_JWT_ALG, RULE_CS_JWT_ALG);
+    // BouncyCastle (Org.BouncyCastle) curve / finite-field DH primitives that
+    // System.Security.Cryptography does not expose directly.
+    add(RE_CS_BC_EDDSA, RULE_CS_BC_EDDSA);
+    add(RE_CS_BC_X25519, RULE_CS_BC_X25519);
+    add(RE_CS_BC_X448, RULE_CS_BC_X448);
+    add(RE_CS_BC_DH, RULE_CS_BC_DH);
     return findings;
   },
 };

package/src/detectors/database.ts

@@ -0,0 +1,88 @@
+/**
+ * Config detector: classical crypto in database usage — public-key encryption of
+ * stored data (pgcrypto) and weak client TLS posture. Data-at-rest is the sharpest
+ * harvest-now-decrypt-later target: a column encrypted to an RSA key today is a
+ * time capsule an adversary can hold until key recovery is cheap.
+ *
+ * Covered:
+ *  - pgcrypto `pgp_pub_encrypt` / `pgp_pub_decrypt` in `.sql` (RSA/ElGamal public-key
+ *    encryption of column data) → `hndl:true`.
+ *  - libpq `sslmode = disable | allow | prefer | require` in any config/connection
+ *    file — a mode that does NOT verify the server certificate, so the classical
+ *    TLS session it does (or doesn't) negotiate is both MITM-able and harvestable.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION } from "../cwe.js";
+
+const RE_PGCRYPTO = /\bpgp_pub_(?:encrypt|decrypt)\b/g;
+const RE_WEAK_SSLMODE = /\bsslmode\s*=\s*["']?(?:disable|allow|prefer|require)\b/gi;
+
+const RULE_PGCRYPTO: RuleMeta = {
+  id: "db-pgcrypto-pubkey",
+  title: "pgcrypto public-key encryption",
+  description: "Postgres pgcrypto pgp_pub_encrypt / pgp_pub_decrypt (RSA/ElGamal) on stored data",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Column data is encrypted with pgcrypto public-key crypto (classical RSA/ElGamal); stored ciphertext is harvest-now-decrypt-later exposed.",
+  remediation:
+    "Plan migration to a post-quantum KEM (ML-KEM-768) envelope for at-rest data; re-encrypt long-lived rows.",
+};
+const RULE_WEAK_SSLMODE: RuleMeta = {
+  id: "db-weak-sslmode",
+  title: "Database sslmode without verification",
+  description: "libpq sslmode is disable/allow/prefer/require (no certificate verification)",
+  category: "tls",
+  severity: "medium",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_CERT_VALIDATION,
+  message:
+    "Database sslmode does not verify the server certificate; the classical TLS session is MITM-able and its key exchange is harvestable.",
+  remediation:
+    "Use sslmode=verify-full and TLS 1.3; track PQC-hybrid KEX (X25519MLKEM768) for database transport.",
+};
+
+/** Detects classical database at-rest / transport crypto. */
+export const databaseDetector: Detector = {
+  id: "database-crypto",
+  description: "Classical crypto in database usage (pgcrypto public-key, weak client sslmode)",
+  scope: "config",
+  language: "any",
+  rules: [RULE_PGCRYPTO, RULE_WEAK_SSLMODE],
+  // Skip prose/docs: a README showing `sslmode=require` is not a live connection string.
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    if (file.toLowerCase().endsWith(".sql") && content.includes("pgp_pub_")) {
+      eachMatch(RE_PGCRYPTO, content, (m) =>
+        findings.push(
+          findingFromRule(RULE_PGCRYPTO, {
+            file,
+            content,
+            index: m.index,
+            matchLength: m[0].length,
+          }),
+        ),
+      );
+    }
+    if (content.includes("sslmode")) {
+      eachMatch(RE_WEAK_SSLMODE, content, (m) =>
+        findings.push(
+          findingFromRule(RULE_WEAK_SSLMODE, {
+            file,
+            content,
+            index: m.index,
+            matchLength: m[0].length,
+          }),
+        ),
+      );
+    }
+    return findings;
+  },
+};