@quantakrypto/core 0.4.2 → 0.4.4

package/src/detectors/go.ts

@@ -6,11 +6,13 @@
  * `ecdsa.SignASN1`, `ecdh.X25519`, …) are precise, low-false-positive signals.
  *
  * Covered:
- *   - crypto/rsa   — GenerateKey, EncryptOAEP/PKCS1v15, SignPKCS1v15/PSS
- *   - crypto/ecdsa — GenerateKey, Sign/SignASN1
+ *   - crypto/rsa   — GenerateKey, EncryptOAEP/PKCS1v15, SignPKCS1v15/PSS, DecryptOAEP, VerifyPKCS1v15/PSS
+ *   - crypto/ecdsa — GenerateKey, Sign/SignASN1, Verify/VerifyASN1
  *   - crypto/ecdh  — P256/P384/P521/X25519 curve construction (key agreement)
- *   - crypto/ed25519 — GenerateKey, Sign
+ *   - crypto/elliptic — GenerateKey / ScalarMult (classic pre-1.20 ECDH)
+ *   - crypto/ed25519 — GenerateKey, Sign, Verify
  *   - crypto/dsa   — GenerateKey, GenerateParameters (deprecated)
+ *   - crypto/tls   — InsecureSkipVerify, legacy MinVersion (transport config hygiene)
  *
  * HNDL policy mirrors the other detectors: KEM / key agreement (RSA encryption,
  * ECDH) is harvest-now-decrypt-later exposed (hndl:true); signatures (RSA-sign,
@@ -21,7 +23,7 @@
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
 import { GO_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
-import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cwe.js";
 
 /* -------------------------------------------------------------------------- */
 /* Precompiled regexes (module scope)                                         */
@@ -31,9 +33,37 @@ const RE_GO_RSA_KEYGEN = /\brsa\.GenerateKey\s*\(|\brsa\.GenerateMultiPrimeKey\s
 const RE_GO_RSA_ENCRYPT = /\brsa\.EncryptOAEP\s*\(|\brsa\.EncryptPKCS1v15\s*\(/g;
 const RE_GO_RSA_SIGN = /\brsa\.SignPKCS1v15\s*\(|\brsa\.SignPSS\s*\(/g;
 const RE_GO_ECDSA = /\becdsa\.GenerateKey\s*\(|\becdsa\.SignASN1\s*\(|\becdsa\.Sign\s*\(/g;
-const RE_GO_ECDH = /\becdh\.(?:P256|P384|P521|X25519)\s*\(/g;
+const RE_GO_ECDH = /\becdh\.(?:P256|P384|P521)\s*\(/g;
+// X25519 gets its own family (algorithm "X25519", lower severity) to match how
+// every other pack classifies it — Go was the lone site reporting it as ECDH/high
+// (audit F9). Still key-exchange + hndl:true.
+const RE_GO_X25519 = /\becdh\.X25519\s*\(/g;
 const RE_GO_ED25519 = /\bed25519\.GenerateKey\s*\(|\bed25519\.Sign\s*\(/g;
 const RE_GO_DSA = /\bdsa\.GenerateKey\s*\(|\bdsa\.GenerateParameters\s*\(/g;
+// Verify / decrypt call sites — the inverse operations the Sign/Encrypt/
+// GenerateKey rules above miss today (audit F4/F6). Deliberately disjoint from
+// those rules to avoid double-counting: DecryptOAEP≠EncryptOAEP, Verify*≠Sign*.
+const RE_GO_RSA_DECRYPT = /\brsa\.DecryptOAEP\s*\(/g;
+const RE_GO_RSA_VERIFY = /\brsa\.VerifyPKCS1v15\s*\(|\brsa\.VerifyPSS\s*\(/g;
+const RE_GO_ECDSA_VERIFY = /\becdsa\.Verify(?:ASN1)?\s*\(/g;
+const RE_GO_ED25519_VERIFY = /\bed25519\.Verify\s*\(/g;
+// Classic pre-1.20 elliptic-curve key agreement (crypto/elliptic), superseded by
+// crypto/ecdh but still widespread. GenerateKey + ScalarMult are the low-level
+// ECDH building blocks the crypto/ecdh rule does not see. `.ScalarMult(` is an
+// unqualified method call, so this rule carries medium confidence.
+const RE_GO_ECDH_CLASSIC = /\belliptic\.GenerateKey\s*\(|\.ScalarMult\s*\(/g;
+// Go TLS misconfiguration (crypto/tls). Mirrors the JS tlsDetector: disabled
+// certificate verification and a legacy TLS/SSL version floor.
+const RE_GO_TLS_SKIP_VERIFY = /InsecureSkipVerify:\s*true/g;
+const RE_GO_TLS_LEGACY_VERSION = /MinVersion:\s*tls\.Version(?:TLS1[01]|SSL30)/g;
+// Identifier-form golang-jwt signing methods (audit gap: the quoted "RS256" alg
+// token is caught by the language-agnostic jwt-jose detector, but golang-jwt
+// passes the alg as an EXPORTED IDENTIFIER — `jwt.SigningMethodRS256`,
+// `jwt.SigningMethodES256`, `jwt.SigningMethodEdDSA` — which the string rule
+// misses. RS*/PS* → RSA, ES* → ECDSA, EdDSA → EdDSA. The `\b`s keep it precise:
+// HS* HMAC methods and longer look-alikes (`SigningMethodRS2560`) do not match.
+const RE_GO_JWT_SIGNINGMETHOD =
+  /\bSigningMethod(RS|PS|ES)(?:256|384|512)\b|\bSigningMethodEdDSA\b/g;
 
 /* -------------------------------------------------------------------------- */
 /* Rule catalog                                                               */
@@ -93,7 +123,7 @@ const RULE_GO_ECDSA: RuleMeta = {
 const RULE_GO_ECDH: RuleMeta = {
   id: "go-ecdh",
   title: "Go ECDH key exchange",
-  description: "crypto/ecdh P256/P384/P521/X25519 key agreement",
+  description: "crypto/ecdh P256/P384/P521 key agreement",
   category: "key-exchange",
   severity: "high",
   confidence: "high",
@@ -103,6 +133,19 @@ const RULE_GO_ECDH: RuleMeta = {
   message:
     "Elliptic-curve Diffie-Hellman (Go crypto/ecdh) is broken by Shor's algorithm (harvest-now-decrypt-later).",
 };
+const RULE_GO_X25519: RuleMeta = {
+  id: "go-x25519",
+  title: "Go X25519 key exchange",
+  description: "crypto/ecdh X25519 key agreement",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "X25519",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "X25519 (Go crypto/ecdh) is modern but still classical key agreement — harvest-now-decrypt-later.",
+};
 const RULE_GO_ED25519: RuleMeta = {
   id: "go-ed25519",
   title: "Go Ed25519 signature",
@@ -128,6 +171,132 @@ const RULE_GO_DSA: RuleMeta = {
   message: "Classical DSA (Go) is deprecated and forgeable by a quantum attacker.",
   remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
 };
+const RULE_GO_RSA_DECRYPT: RuleMeta = {
+  id: "go-rsa-decrypt",
+  title: "Go RSA public-key decryption",
+  description: "crypto/rsa DecryptOAEP",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "RSA public-key decryption (Go) recovers data protected by a classical KEM — harvest-now-decrypt-later exposed.",
+};
+const RULE_GO_RSA_VERIFY: RuleMeta = {
+  id: "go-rsa-verify",
+  title: "Go RSA signature verification",
+  description: "crypto/rsa VerifyPKCS1v15 / VerifyPSS",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Verifies classical RSA signatures (Go), which are forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_GO_ECDSA_VERIFY: RuleMeta = {
+  id: "go-ecdsa-verify",
+  title: "Go ECDSA signature verification",
+  description: "crypto/ecdsa Verify / VerifyASN1",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Verifies classical ECDSA signatures (Go), which are forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_GO_ED25519_VERIFY: RuleMeta = {
+  id: "go-ed25519-verify",
+  title: "Go Ed25519 signature verification",
+  description: "crypto/ed25519 Verify",
+  category: "signature",
+  severity: "low",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Verifies Ed25519 signatures (Go) — modern but still classical and quantum-forgeable.",
+};
+const RULE_GO_ECDH_CLASSIC: RuleMeta = {
+  id: "go-ecdh-classic",
+  title: "Go classic EC key agreement (crypto/elliptic)",
+  description: "crypto/elliptic GenerateKey / ScalarMult (pre-1.20 ECDH)",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "medium",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Low-level elliptic-curve key agreement (Go crypto/elliptic) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_GO_TLS_SKIP_VERIFY: RuleMeta = {
+  id: "go-tls-insecure-skip-verify",
+  title: "Go TLS certificate verification disabled",
+  description: "crypto/tls Config InsecureSkipVerify: true",
+  category: "tls",
+  severity: "high",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_CERT_VALIDATION,
+  message: "InsecureSkipVerify:true disables TLS certificate verification (Go) — MITM risk.",
+  remediation: "Remove InsecureSkipVerify:true; verify certificates properly.",
+};
+const RULE_GO_TLS_LEGACY_VERSION: RuleMeta = {
+  id: "go-tls-legacy-version",
+  title: "Go legacy TLS version pinned",
+  description: "crypto/tls MinVersion pinned to TLS 1.0/1.1 or SSL 3.0",
+  category: "tls",
+  severity: "medium",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_WEAK_STRENGTH,
+  message:
+    "MinVersion pins a deprecated TLS/SSL floor (TLS 1.0/1.1 or SSL 3.0) in Go; require TLS 1.3.",
+  remediation: "Set MinVersion: tls.VersionTLS13 and prefer PQC-hybrid key exchange.",
+};
+const RULE_GO_JWT_SIGNINGMETHOD: RuleMeta = {
+  id: "go-jwt-signingmethod",
+  title: "Go identifier-form JWT signing method",
+  description: "golang-jwt SigningMethodRS/PS/ES* / SigningMethodEdDSA identifier",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "unknown", // representative umbrella; refined per-match (RSA/ECDSA/EdDSA)
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "A classical JWT signature algorithm (Go golang-jwt, identifier form) is used, forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204); track IETF PQC JOSE/COSE algorithms",
+};
+
+// The x509 PEM/DER key + certificate layer: parsing/marshalling classical RSA,
+// EC and PKIX key material and X.509 certificates. This is the "handles classical
+// keys" surface the Sign/Verify/GenerateKey rules miss — a key-loading utility
+// (`x509.ParsePKCS8PrivateKey`) touches quantum-vulnerable material without ever
+// naming rsa/ecdsa. Family is ambiguous at the parse site, so `unknown`.
+const RE_GO_X509_PARSE =
+  /\bx509\.(?:ParsePKCS1PrivateKey|ParsePKCS8PrivateKey|ParsePKIXPublicKey|ParseECPrivateKey|ParsePKCS1PublicKey|MarshalPKCS1PrivateKey|MarshalPKCS8PrivateKey|MarshalPKIXPublicKey|MarshalECPrivateKey|ParseCertificates?|ParseCertificateRequest|CreateCertificate|CreateCertificateRequest)\b/g;
+const RULE_GO_X509_PARSE: RuleMeta = {
+  id: "go-x509-parse",
+  title: "Go x509 classical key/certificate handling",
+  description: "x509.Parse*/Marshal*/Create* for RSA/EC/PKIX keys and X.509 certificates",
+  category: "certificate",
+  severity: "medium",
+  confidence: "medium",
+  algorithm: "unknown",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "This code parses/marshals classical asymmetric key or X.509 certificate material (x509.*), a quantum forgery/harvest surface.",
+  remediation:
+    "Inventory the key/cert types handled here; plan PQC (ML-DSA) certificate + key migration.",
+};
 
 /** Detects classical asymmetric crypto in Go source (crypto/* standard library). */
 export const goDetector: Detector = {
@@ -141,8 +310,18 @@ export const goDetector: Detector = {
     RULE_GO_RSA_SIGN,
     RULE_GO_ECDSA,
     RULE_GO_ECDH,
+    RULE_GO_X25519,
     RULE_GO_ED25519,
     RULE_GO_DSA,
+    RULE_GO_RSA_DECRYPT,
+    RULE_GO_RSA_VERIFY,
+    RULE_GO_ECDSA_VERIFY,
+    RULE_GO_ED25519_VERIFY,
+    RULE_GO_ECDH_CLASSIC,
+    RULE_GO_TLS_SKIP_VERIFY,
+    RULE_GO_TLS_LEGACY_VERSION,
+    RULE_GO_JWT_SIGNINGMETHOD,
+    RULE_GO_X509_PARSE,
   ],
   appliesTo: (f) => hasExtension(f, GO_EXTENSIONS),
   detect({ file, content }): Finding[] {
@@ -159,8 +338,32 @@ export const goDetector: Detector = {
     add(RE_GO_RSA_SIGN, RULE_GO_RSA_SIGN);
     add(RE_GO_ECDSA, RULE_GO_ECDSA);
     add(RE_GO_ECDH, RULE_GO_ECDH);
+    add(RE_GO_X25519, RULE_GO_X25519);
     add(RE_GO_ED25519, RULE_GO_ED25519);
     add(RE_GO_DSA, RULE_GO_DSA);
+    add(RE_GO_RSA_DECRYPT, RULE_GO_RSA_DECRYPT);
+    add(RE_GO_RSA_VERIFY, RULE_GO_RSA_VERIFY);
+    add(RE_GO_ECDSA_VERIFY, RULE_GO_ECDSA_VERIFY);
+    add(RE_GO_ED25519_VERIFY, RULE_GO_ED25519_VERIFY);
+    add(RE_GO_ECDH_CLASSIC, RULE_GO_ECDH_CLASSIC);
+    add(RE_GO_TLS_SKIP_VERIFY, RULE_GO_TLS_SKIP_VERIFY);
+    add(RE_GO_TLS_LEGACY_VERSION, RULE_GO_TLS_LEGACY_VERSION);
+    add(RE_GO_X509_PARSE, RULE_GO_X509_PARSE);
+
+    // Identifier-form golang-jwt signing methods (jwt.SigningMethodRS256, …).
+    // Refine the umbrella "unknown" algorithm per match: m[1] is the RS/PS/ES
+    // prefix (RS/PS → RSA, ES → ECDSA); when it is undefined the EdDSA branch
+    // matched, so the family is EdDSA.
+    eachMatch(RE_GO_JWT_SIGNINGMETHOD, content, (m) => {
+      const algorithm: Finding["algorithm"] = m[1] === "ES" ? "ECDSA" : m[1] ? "RSA" : "EdDSA";
+      findings.push(
+        findingFromRule(
+          RULE_GO_JWT_SIGNINGMETHOD,
+          { file, content, index: m.index, matchLength: m[0].length },
+          { algorithm },
+        ),
+      );
+    });
 
     return findings;
   },

package/src/detectors/java.ts

@@ -21,7 +21,7 @@
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
 import { JAVA_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
-import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cwe.js";
 
 /* -------------------------------------------------------------------------- */
 /* Regexes                                                                    */
@@ -35,7 +35,34 @@ const RE_JAVA_GETINSTANCE =
 
 // BouncyCastle lightweight-API class instantiations.
 const RE_JAVA_BC =
-  /\bnew\s+(RSAKeyPairGenerator|DSAKeyPairGenerator|ECKeyPairGenerator|ECDSASigner|Ed25519Signer|Ed448Signer|X25519Agreement|X448Agreement)\s*\(/g;
+  /\bnew\s+(RSAKeyPairGenerator|DSAKeyPairGenerator|ECKeyPairGenerator|ECDSASigner|Ed25519Signer|Ed448Signer|X25519Agreement|X448Agreement|ECDHBasicAgreement|DHBasicAgreement|X25519KeyPairGenerator|Ed25519KeyPairGenerator|RSAEngine|OAEPEncoding)\s*\(/g;
+
+// BouncyCastle lightweight-API curve/EdDSA classes as a BARE constructor call —
+// the Kotlin form (`X448KeyPairGenerator()`, no `new` keyword). RE_JAVA_BC above
+// only matches the Java `new <Class>(` form, so Kotlin sources that drive the
+// lightweight API directly are missed. The negative lookbehind `(?<!\bnew\s+)`
+// keeps this additive: `new X448Agreement(` stays with RE_JAVA_BC (java-xdh),
+// while bare `X448Agreement(` routes to the family-specific rules below. Scoped
+// to the exact X448/X25519/Ed448/Ed25519 class names to stay precise.
+const RE_JAVA_BC_CURVE =
+  /(?<!\bnew\s+)\b(X448KeyPairGenerator|X448Agreement|X448PrivateKeyParameters|X25519KeyPairGenerator|X25519Agreement|Ed448KeyPairGenerator|Ed448Signer|Ed25519KeyPairGenerator|Ed25519Signer)\s*\(/g;
+
+// Insecure JSSE / TLS configuration expressed in Java source. Mirrors the JS
+// tlsDetector in source.ts (category "tls"): a legacy SSL/TLS protocol version
+// requested from SSLContext, and TLS hostname verification neutered via an
+// all-trusting verifier (Apache HttpClient's NoopHostnameVerifier /
+// ALLOW_ALL_HOSTNAME_VERIFIER).
+const RE_JAVA_TLS_LEGACY = /\bSSLContext\s*\.\s*getInstance\s*\(\s*"(SSL|SSLv3|TLSv1)"/g;
+const RE_JAVA_TLS_NOVERIFY = /\b(NoopHostnameVerifier|ALLOW_ALL_HOSTNAME_VERIFIER)\b/g;
+
+// Identifier-form JWT/JOSE signature algorithms (audit F7). The quoted-string
+// alg token ("RS256") is caught by the language-agnostic jwt-jose detector, but
+// the Java JWT libraries pass the alg as an IDENTIFIER, not a string literal:
+// jjwt's `SignatureAlgorithm.RS256` and auth0 java-jwt's `Algorithm.RSA256` /
+// `Algorithm.ECDSA256`. ("SignatureAlgorithm" has no word boundary before its
+// "Algorithm", so the auth0 branch cannot re-match the jjwt form.)
+const RE_JAVA_JWT_ALG =
+  /\bSignatureAlgorithm\.(?:RS|PS|ES)(?:256|384|512)\b|\bAlgorithm\.(?:RSA|ECDSA)(?:256|384|512)\b/g;
 
 /* -------------------------------------------------------------------------- */
 /* Rule catalog                                                               */
@@ -138,7 +165,7 @@ const RULE_JAVA_XDH: RuleMeta = {
   title: "Java X25519/X448 key agreement",
   description: "JCA XDH / X25519 / X448 (KeyPairGenerator / KeyAgreement)",
   category: "key-exchange",
-  severity: "low",
+  severity: "medium",
   confidence: "high",
   algorithm: "X25519",
   hndl: true,
@@ -158,6 +185,87 @@ const RULE_JAVA_EDDSA: RuleMeta = {
   cwe: CWE_BROKEN_CRYPTO,
   message: "Ed25519/Ed448 (Java/JCA) is a modern but still classical signature scheme.",
 };
+// BouncyCastle lightweight-API rules for bare (Kotlin-form) constructor calls.
+// Split by family so X448 and X25519 report their own algorithm string (java-xdh
+// lumps both under "X25519"). Severity/CWE copied from the JCA siblings above.
+const RULE_JAVA_BC_X448: RuleMeta = {
+  id: "java-bc-x448",
+  title: "Java/Kotlin X448 key agreement (BouncyCastle lightweight API)",
+  description: "BouncyCastle X448KeyPairGenerator / X448Agreement / X448PrivateKeyParameters",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "X448",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "X448 (Java/Kotlin, BouncyCastle lightweight API) is modern but still classical key agreement — harvest-now-decrypt-later.",
+};
+const RULE_JAVA_BC_X25519: RuleMeta = {
+  id: "java-bc-x25519",
+  title: "Java/Kotlin X25519 key agreement (BouncyCastle lightweight API)",
+  description: "BouncyCastle X25519KeyPairGenerator / X25519Agreement",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "X25519",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "X25519 (Java/Kotlin, BouncyCastle lightweight API) is modern but still classical key agreement — harvest-now-decrypt-later.",
+};
+const RULE_JAVA_BC_EDDSA: RuleMeta = {
+  id: "java-bc-eddsa",
+  title: "Java/Kotlin Ed25519/Ed448 signature (BouncyCastle lightweight API)",
+  description:
+    "BouncyCastle Ed448KeyPairGenerator / Ed448Signer / Ed25519KeyPairGenerator / Ed25519Signer",
+  category: "signature",
+  severity: "low",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Ed25519/Ed448 (Java/Kotlin, BouncyCastle lightweight API) is a modern but still classical signature scheme.",
+};
+const RULE_JAVA_TLS_LEGACY: RuleMeta = {
+  id: "java-tls-legacy-version",
+  title: "Legacy SSL/TLS version requested",
+  description: 'SSLContext.getInstance("SSL" | "SSLv3" | "TLSv1")',
+  category: "tls",
+  severity: "medium",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_WEAK_STRENGTH,
+  message: "SSL/SSLv3/TLS 1.0 are deprecated and insecure (Java/JSSE); require TLS 1.3.",
+  remediation: 'Use SSLContext.getInstance("TLSv1.3") and prefer PQC-hybrid key exchange.',
+};
+const RULE_JAVA_TLS_NOVERIFY: RuleMeta = {
+  id: "java-tls-hostname-verification-disabled",
+  title: "TLS hostname verification disabled",
+  description: "NoopHostnameVerifier / ALLOW_ALL_HOSTNAME_VERIFIER",
+  category: "tls",
+  severity: "high",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_CERT_VALIDATION,
+  message: "An all-trusting hostname verifier (Java) disables TLS hostname checking (MITM risk).",
+  remediation: "Remove the all-trusting verifier; rely on the default hostname verifier.",
+};
+const RULE_JAVA_JWT_ALG: RuleMeta = {
+  id: "java-jwt-alg",
+  title: "Java identifier-form JWT/JOSE algorithm",
+  description: "jjwt SignatureAlgorithm.RS/PS/ES* / auth0 Algorithm.RSA*/ECDSA*",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "unknown",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "A classical JWT/JOSE signature algorithm (Java, identifier form) is used, forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204); track IETF PQC JOSE/COSE algorithms",
+};
 
 /**
  * Classify a `<factory>.getInstance("<alg>")` pair into a rule, or null when the
@@ -175,6 +283,11 @@ function classifyGetInstance(factory: string, rawAlg: string): RuleMeta | null {
   if (alg.includes("ED25519") || alg.includes("ED448") || alg.includes("EDDSA"))
     return RULE_JAVA_EDDSA;
   if (alg.includes("X25519") || alg.includes("X448") || alg === "XDH") return RULE_JAVA_XDH;
+  // RSASSA-PSS is an RSA *signature* scheme, not encryption/KEM. The string
+  // contains "RSA", so it must be caught here — BEFORE the generic RSA branch
+  // below, which would otherwise (mis)classify it as HNDL-exposed RSA
+  // encryption (java-rsa / hndl:true). Signatures are hndl:false. (Fixes F8.)
+  if (alg.includes("PSS")) return RULE_JAVA_RSA_SIGN;
   if (alg.includes("RSA")) return isSignature ? RULE_JAVA_RSA_SIGN : RULE_JAVA_RSA;
   if (alg.includes("DSA")) return RULE_JAVA_DSA; // ECDSA already handled above
   if (alg.includes("DH") || alg.includes("DIFFIEHELLMAN")) return RULE_JAVA_DH;
@@ -191,12 +304,32 @@ const BC_CLASS_RULES: Record<string, RuleMeta> = {
   Ed448Signer: RULE_JAVA_EDDSA,
   X25519Agreement: RULE_JAVA_XDH,
   X448Agreement: RULE_JAVA_XDH,
+  ECDHBasicAgreement: RULE_JAVA_ECDH,
+  DHBasicAgreement: RULE_JAVA_DH,
+  X25519KeyPairGenerator: RULE_JAVA_XDH,
+  Ed25519KeyPairGenerator: RULE_JAVA_EDDSA,
+  RSAEngine: RULE_JAVA_RSA,
+  OAEPEncoding: RULE_JAVA_RSA,
+};
+
+/** BouncyCastle lightweight-API bare-constructor class name → family rule. */
+const BC_CURVE_CLASS_RULES: Record<string, RuleMeta> = {
+  X448KeyPairGenerator: RULE_JAVA_BC_X448,
+  X448Agreement: RULE_JAVA_BC_X448,
+  X448PrivateKeyParameters: RULE_JAVA_BC_X448,
+  X25519KeyPairGenerator: RULE_JAVA_BC_X25519,
+  X25519Agreement: RULE_JAVA_BC_X25519,
+  Ed448KeyPairGenerator: RULE_JAVA_BC_EDDSA,
+  Ed448Signer: RULE_JAVA_BC_EDDSA,
+  Ed25519KeyPairGenerator: RULE_JAVA_BC_EDDSA,
+  Ed25519Signer: RULE_JAVA_BC_EDDSA,
 };
 
 /** Detects classical asymmetric crypto in Java / Kotlin (JCA + BouncyCastle). */
 export const javaDetector: Detector = {
   id: "java-crypto",
-  description: "Classical asymmetric crypto in Java/Kotlin (JCA getInstance + BouncyCastle)",
+  description:
+    "Classical asymmetric crypto on the JVM — Java/Kotlin/Scala (JCA getInstance + BouncyCastle)",
   scope: "source",
   language: "java",
   rules: [
@@ -209,6 +342,12 @@ export const javaDetector: Detector = {
     RULE_JAVA_DH,
     RULE_JAVA_XDH,
     RULE_JAVA_EDDSA,
+    RULE_JAVA_BC_X448,
+    RULE_JAVA_BC_X25519,
+    RULE_JAVA_BC_EDDSA,
+    RULE_JAVA_TLS_LEGACY,
+    RULE_JAVA_TLS_NOVERIFY,
+    RULE_JAVA_JWT_ALG,
   ],
   appliesTo: (f) => hasExtension(f, JAVA_EXTENSIONS),
   detect({ file, content }): Finding[] {
@@ -230,6 +369,54 @@ export const javaDetector: Detector = {
       );
     });
 
+    // BouncyCastle lightweight-API classes as a bare constructor call (Kotlin
+    // form, no `new`). RE_JAVA_BC_CURVE's negative lookbehind excludes the
+    // `new <Class>(` form already handled above, so this only adds the missed
+    // 448/25519 Kotlin-style matches — no double-counting.
+    eachMatch(RE_JAVA_BC_CURVE, content, (m) => {
+      const rule = BC_CURVE_CLASS_RULES[m[1]];
+      if (!rule) return;
+      findings.push(
+        findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+      );
+    });
+
+    // Legacy SSL/TLS protocol version requested from SSLContext.
+    eachMatch(RE_JAVA_TLS_LEGACY, content, (m) => {
+      findings.push(
+        findingFromRule(RULE_JAVA_TLS_LEGACY, {
+          file,
+          content,
+          index: m.index,
+          matchLength: m[0].length,
+        }),
+      );
+    });
+
+    // All-trusting hostname verifier — disables TLS hostname verification.
+    eachMatch(RE_JAVA_TLS_NOVERIFY, content, (m) => {
+      findings.push(
+        findingFromRule(RULE_JAVA_TLS_NOVERIFY, {
+          file,
+          content,
+          index: m.index,
+          matchLength: m[0].length,
+        }),
+      );
+    });
+
+    // Identifier-form JWT/JOSE signature algorithms (jjwt / auth0).
+    eachMatch(RE_JAVA_JWT_ALG, content, (m) => {
+      findings.push(
+        findingFromRule(RULE_JAVA_JWT_ALG, {
+          file,
+          content,
+          index: m.index,
+          matchLength: m[0].length,
+        }),
+      );
+    });
+
     return findings;
   },
 };

package/src/detectors/jose.ts

@@ -0,0 +1,94 @@
+/**
+ * Config detector: classical KEY-MANAGEMENT (JWE) algorithms in JOSE. This is
+ * distinct from the JWS signature side (RS256/ES256, handled elsewhere) and from
+ * the JWK key-material detector: here we flag the `alg` values that wrap a
+ * content-encryption key with classical asymmetric crypto, because the encrypted
+ * payload is CONFIDENTIALITY — harvest-now-decrypt-later exposed. A JWE token
+ * captured today (from a log, an audit trail, a stored assertion) is decryptable
+ * once the wrapping key falls to a CRQC.
+ *
+ * Covered `alg` (RFC 7518 §4) values:
+ *  - `RSA-OAEP`, `RSA-OAEP-256`, `RSA1_5`  → RSA key encryption.
+ *  - `ECDH-ES`, `ECDH-ES+A128KW`, …        → classical EC Diffie-Hellman key agreement.
+ *
+ * These exact strings are JOSE identifiers, so a content-level match is precise;
+ * the detector applies to any file (config, JSON, source) after a fast reject.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+interface JoseRule {
+  re: RegExp;
+  meta: RuleMeta;
+}
+
+const JOSE_RULES: JoseRule[] = [
+  {
+    re: /"alg"\s*:\s*"RSA(?:-OAEP(?:-256)?|1_5)"/g,
+    meta: {
+      id: "jose-jwe-rsa",
+      title: "JWE RSA key wrapping",
+      description: 'JWE "alg" of RSA-OAEP / RSA-OAEP-256 / RSA1_5 (RFC 7518)',
+      category: "kem",
+      severity: "high",
+      confidence: "high",
+      algorithm: "RSA",
+      hndl: true,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "JWE wraps the content-encryption key with classical RSA (RSA-OAEP/RSA1_5); the encrypted payload is harvest-now-decrypt-later exposed.",
+      remediation:
+        "Plan migration to a post-quantum KEM (ML-KEM-768) for key wrapping as JOSE/COSE PQ algorithms are standardised.",
+    },
+  },
+  {
+    re: /"alg"\s*:\s*"ECDH-ES(?:\+A\d{3}KW)?"/g,
+    meta: {
+      id: "jose-jwe-ecdh",
+      title: "JWE ECDH-ES key agreement",
+      description: 'JWE "alg" of ECDH-ES / ECDH-ES+A*KW (RFC 7518)',
+      category: "key-exchange",
+      severity: "high",
+      confidence: "high",
+      algorithm: "ECDH",
+      hndl: true,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "JWE derives the content-encryption key via classical ECDH-ES; the encrypted payload is harvest-now-decrypt-later exposed.",
+      remediation:
+        "Plan migration to hybrid post-quantum key agreement (X25519MLKEM768) as JOSE PQ algorithms are standardised.",
+    },
+  },
+];
+
+/** Detects classical JWE key-management (`alg`) values in JOSE tokens/config. */
+export const joseDetector: Detector = {
+  id: "jose-jwe-keymgmt",
+  description:
+    "Classical JWE key-management algorithms (RSA-OAEP, ECDH-ES) — confidentiality, HNDL",
+  scope: "config",
+  language: "any",
+  rules: JOSE_RULES.map((r) => r.meta),
+  // Prose examples (a README showing `"alg":"RSA-OAEP"`) are not JOSE config.
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    // Fast reject: no JOSE key-management alg token present.
+    if (
+      !content.includes("RSA-OAEP") &&
+      !content.includes("RSA1_5") &&
+      !content.includes("ECDH-ES")
+    ) {
+      return [];
+    }
+    const findings: Finding[] = [];
+    for (const rule of JOSE_RULES) {
+      eachMatch(rule.re, content, (m) => {
+        findings.push(
+          findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }),
+        );
+      });
+    }
+    return findings;
+  },
+};