@quantakrypto/core 0.4.2 → 0.4.4

package/src/detectors/php.ts

@@ -0,0 +1,225 @@
+/**
+ * Source-code detector for classical asymmetric cryptography in PHP — one of the
+ * most-deployed backend languages, previously uncovered. Handles the three
+ * dominant crypto surfaces:
+ *
+ *  - **ext/openssl** — `openssl_pkey_new()` (classified by its
+ *    `OPENSSL_KEYTYPE_*` config, defaulting to RSA), `openssl_public_encrypt` /
+ *    `openssl_private_decrypt` (RSA), and `openssl_sign` / `openssl_verify`.
+ *  - **phpseclib3** — `RSA::createKey()` / `EC::createKey()` / `DSA::createKey()`.
+ *  - **libsodium** — `sodium_crypto_box`/`kx` keypairs (X25519) and
+ *    `sodium_crypto_sign` keypairs (Ed25519).
+ *
+ * Lexical, like the other packs; the `openssl_*` / `sodium_crypto_*` prefixes and
+ * `OPENSSL_KEYTYPE_*` constants are distinctive, so the false-positive rate is low.
+ *
+ * HNDL: RSA encryption and (EC/X)DH key agreement are harvest-now-decrypt-later
+ * exposed (hndl:true); ECDSA / DSA / Ed25519 signatures are hndl:false but
+ * forgeable. `openssl_pkey_new` EC and `EC::createKey` are ambiguous (feed BOTH
+ * ECDSA and ECDH), classified conservatively as key-exchange-capable (hndl:true).
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { PHP_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+const RE_PHP_PKEY_NEW = /\bopenssl_pkey_new\s*\(/g;
+const RE_PHP_RSA_CRYPT = /\bopenssl_(?:public_encrypt|private_decrypt)\s*\(/g;
+const RE_PHP_SIGN = /\bopenssl_(?:sign|verify)\s*\(/g;
+// phpseclib3 factory methods. The class names are generic, so require `::createKey`.
+const RE_PHP_SECLIB = /\b(RSA|EC|DSA|DH)::createKey\s*\(/g;
+// libsodium X25519 (box / kx / scalarmult) and Ed25519 (sign) key pairs.
+const RE_PHP_SODIUM_X25519 =
+  /\bsodium_crypto_(?:box|kx)_(?:seed_)?keypair\s*\(|\bsodium_crypto_scalarmult(?:_base)?\s*\(/g;
+const RE_PHP_SODIUM_ED25519 = /\bsodium_crypto_sign_(?:seed_)?keypair\s*\(/g;
+
+/** Key-type classification for `openssl_pkey_new`, keyed by its config constant. */
+interface KeyInfo {
+  algo: Finding["algorithm"];
+  cat: Finding["category"];
+  sev: Finding["severity"];
+  hndl: boolean;
+  label: string;
+  remediation?: string;
+}
+const HYBRID = "hybrid X25519MLKEM768 (ML-KEM-768) for key agreement; ML-DSA-65 (FIPS 204) to sign";
+
+const RULE_PHP_KEYGEN: RuleMeta = {
+  id: "php-openssl-keygen",
+  title: "PHP openssl key generation",
+  description: "openssl_pkey_new (RSA/EC/DSA/DH, by OPENSSL_KEYTYPE_*)",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Generates a classical key pair via PHP openssl_pkey_new — not quantum-safe.",
+};
+const RULE_PHP_RSA_CRYPT: RuleMeta = {
+  id: "php-openssl-rsa-crypt",
+  title: "PHP openssl RSA public-key encryption",
+  description: "openssl_public_encrypt / openssl_private_decrypt",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "RSA public-key encryption/decryption (PHP openssl) is harvest-now-decrypt-later exposed.",
+};
+const RULE_PHP_SIGN: RuleMeta = {
+  id: "php-openssl-sign",
+  title: "PHP openssl signature",
+  description: "openssl_sign / openssl_verify",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "unknown",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Classical signature via PHP openssl (RSA/ECDSA/DSA) is forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_PHP_SECLIB: RuleMeta = {
+  id: "php-phpseclib-keygen",
+  title: "PHP phpseclib key generation",
+  description: "phpseclib3 RSA/EC/DSA/DH ::createKey",
+  category: "kem",
+  severity: "high",
+  confidence: "medium",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Generates a classical key pair via phpseclib3 (createKey) — not quantum-safe.",
+};
+const RULE_PHP_SODIUM_X25519: RuleMeta = {
+  id: "php-sodium-x25519",
+  title: "PHP libsodium X25519 key agreement",
+  description: "sodium_crypto_box/kx keypair + scalarmult",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "X25519",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "libsodium crypto_box/kx (PHP) uses X25519 key agreement — modern but classical, harvest-now-decrypt-later exposed.",
+};
+const RULE_PHP_SODIUM_ED25519: RuleMeta = {
+  id: "php-sodium-ed25519",
+  title: "PHP libsodium Ed25519 signature",
+  description: "sodium_crypto_sign keypair",
+  category: "signature",
+  severity: "low",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "libsodium crypto_sign (PHP) uses Ed25519 — classical and forgeable by a quantum attacker.",
+};
+
+/** phpseclib class name → its classification. */
+const SECLIB_INFO: Record<string, KeyInfo> = {
+  RSA: { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" },
+  EC: {
+    algo: "ECDH",
+    cat: "key-exchange",
+    sev: "high",
+    hndl: true,
+    label: "EC (ECDSA/ECDH)",
+    remediation: HYBRID,
+  },
+  DSA: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
+  DH: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
+};
+
+/** Classify `openssl_pkey_new` by the `OPENSSL_KEYTYPE_*` constant in its config.
+ * The window is bounded to the current statement (up to the next `;`, capped at
+ * 300 chars) so it can't bleed into a following `openssl_pkey_new` call's key
+ * type. Defaults to RSA — openssl_pkey_new's own default private_key_type is RSA
+ * when none is given. */
+function classifyPkeyNew(content: string, index: number): KeyInfo {
+  const semi = content.indexOf(";", index);
+  const end = Math.min(index + 300, semi === -1 ? content.length : semi);
+  const w = content.slice(index, end);
+  if (/\bOPENSSL_KEYTYPE_EC\b/.test(w)) return SECLIB_INFO.EC;
+  if (/\bOPENSSL_KEYTYPE_DSA\b/.test(w)) return SECLIB_INFO.DSA;
+  if (/\bOPENSSL_KEYTYPE_DH\b/.test(w)) return SECLIB_INFO.DH;
+  return SECLIB_INFO.RSA;
+}
+
+/** Detects classical asymmetric crypto in PHP (openssl, phpseclib, libsodium). */
+export const phpDetector: Detector = {
+  id: "php-crypto",
+  description: "Classical asymmetric crypto in PHP (openssl, phpseclib3, libsodium)",
+  scope: "source",
+  language: "php",
+  rules: [
+    RULE_PHP_KEYGEN,
+    RULE_PHP_RSA_CRYPT,
+    RULE_PHP_SIGN,
+    RULE_PHP_SECLIB,
+    RULE_PHP_SODIUM_X25519,
+    RULE_PHP_SODIUM_ED25519,
+  ],
+  appliesTo: (f) => hasExtension(f, PHP_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta): void =>
+      eachMatch(re, content, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+
+    // openssl_pkey_new — one finding per call, classified by its key-type config.
+    eachMatch(RE_PHP_PKEY_NEW, content, (m) => {
+      const info = classifyPkeyNew(content, m.index);
+      findings.push(
+        findingFromRule(
+          RULE_PHP_KEYGEN,
+          { file, content, index: m.index, matchLength: m[0].length },
+          {
+            title: `PHP openssl ${info.label} key generation`,
+            category: info.cat,
+            severity: info.sev,
+            algorithm: info.algo,
+            hndl: info.hndl,
+            message: `Generates a classical ${info.label} key pair via PHP openssl_pkey_new — not quantum-safe.`,
+            ...(info.remediation ? { remediation: info.remediation } : {}),
+          },
+        ),
+      );
+    });
+
+    add(RE_PHP_RSA_CRYPT, RULE_PHP_RSA_CRYPT);
+    add(RE_PHP_SIGN, RULE_PHP_SIGN);
+
+    // phpseclib3 ::createKey — classify by the class (RSA/EC/DSA/DH).
+    eachMatch(RE_PHP_SECLIB, content, (m) => {
+      const info = SECLIB_INFO[m[1]];
+      findings.push(
+        findingFromRule(
+          RULE_PHP_SECLIB,
+          { file, content, index: m.index, matchLength: m[0].length },
+          {
+            title: `PHP phpseclib ${info.label} key generation`,
+            category: info.cat,
+            severity: info.sev,
+            algorithm: info.algo,
+            hndl: info.hndl,
+            message: `Generates a classical ${info.label} key pair via phpseclib3 createKey — not quantum-safe.`,
+            ...(info.remediation ? { remediation: info.remediation } : {}),
+          },
+        ),
+      );
+    });
+
+    add(RE_PHP_SODIUM_X25519, RULE_PHP_SODIUM_X25519);
+    add(RE_PHP_SODIUM_ED25519, RULE_PHP_SODIUM_ED25519);
+    return findings;
+  },
+};

package/src/detectors/python.ts

@@ -22,7 +22,7 @@
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
 import { PYTHON_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
-import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cwe.js";
 
 /* -------------------------------------------------------------------------- */
 /* Precompiled regexes (module scope)                                         */
@@ -38,8 +38,15 @@ const RE_PY_RSA_ENCRYPT = /\bpadding\.OAEP\s*\(|\bPKCS1_OAEP\.new\s*\(/g;
 const RE_PY_EC_KEYGEN = /\bec\.generate_private_key\s*\(|\bECC\.generate\s*\(/g;
 // ECDSA signatures: cryptography `ec.ECDSA(`, paramiko ECDSAKey.
 const RE_PY_ECDSA = /\bec\.ECDSA\s*\(|\bparamiko\.ECDSAKey\b|\bECDSAKey\.generate\s*\(/g;
+// ECDH key agreement: cryptography `ec.ECDH(` — the actual harvest-now event in
+// `private_key.exchange(ec.ECDH(), peer)`; previously missed entirely (audit F3).
+const RE_PY_ECDH = /\bec\.ECDH\s*\(/g;
 // DSA: PyCryptodome `DSA.generate(`, paramiko DSSKey.
 const RE_PY_DSA = /\bDSA\.generate\s*\(|\bparamiko\.DSSKey\b|\bDSSKey\.generate\s*\(/g;
+// hazmat DSA: cryptography `dsa.generate_private_key(` — the `cryptography` DSA
+// keygen path (lowercase module) that RE_PY_DSA's uppercase `DSA.generate` misses
+// (audit F9-python).
+const RE_PY_HAZMAT_DSA = /\bdsa\.generate_private_key\s*\(/g;
 // Finite-field Diffie-Hellman (cryptography `dh`).
 const RE_PY_DH = /\bdh\.generate_parameters\s*\(|\bdh\.DHParameterNumbers\s*\(/g;
 // Modern-but-classical curve primitives (cryptography). `.generate(` anchors so
@@ -48,6 +55,15 @@ const RE_PY_X25519 = /\bX25519PrivateKey\.generate\s*\(/g;
 const RE_PY_X448 = /\bX448PrivateKey\.generate\s*\(/g;
 const RE_PY_EDDSA = /\b(?:Ed25519|Ed448)PrivateKey\.generate\s*\(|\bparamiko\.Ed25519Key\b/g;
 
+// Python TLS misconfiguration. Mirrors the JS `tlsDetector` split of source.ts:
+// certificate-verification bypass (requests `verify=False`, `ssl.CERT_NONE`,
+// `check_hostname=False`, `ssl._create_unverified_context(`) is the high-severity
+// MITM surface (CWE-295); a pinned legacy protocol (`ssl.PROTOCOL_TLSv1`) is the
+// medium-severity weak-strength surface (CWE-326).
+const RE_PY_TLS_REJECT =
+  /\bverify\s*=\s*False\b|\bssl\.CERT_NONE\b|\bcheck_hostname\s*=\s*False\b|\bssl\._create_unverified_context\s*\(/g;
+const RE_PY_TLS_LEGACY = /\bPROTOCOL_TLSv1\b/g;
+
 /* -------------------------------------------------------------------------- */
 /* Rule catalog                                                               */
 /* -------------------------------------------------------------------------- */
@@ -106,6 +122,19 @@ const RULE_PY_ECDSA: RuleMeta = {
   message: "Classical ECDSA signing (Python) is forgeable by a quantum attacker.",
   remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
 };
+const RULE_PY_ECDH: RuleMeta = {
+  id: "python-ecdh",
+  title: "Python ECDH key agreement",
+  description: "cryptography ec.ECDH() exchange",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Elliptic-curve Diffie-Hellman key agreement (Python) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
 const RULE_PY_DSA: RuleMeta = {
   id: "python-dsa",
   title: "Python DSA key/usage",
@@ -119,6 +148,20 @@ const RULE_PY_DSA: RuleMeta = {
   message: "Classical DSA (Python) is deprecated and forgeable by a quantum attacker.",
   remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
 };
+const RULE_PY_HAZMAT_DSA: RuleMeta = {
+  id: "python-hazmat-dsa",
+  title: "Python DSA key generation (cryptography)",
+  description: "cryptography dsa.generate_private_key",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "DSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "cryptography dsa.generate_private_key (Python) creates a classical DSA key; DSA is deprecated and forgeable by a quantum attacker.",
+  remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
+};
 const RULE_PY_DH: RuleMeta = {
   id: "python-dh",
   title: "Python Diffie-Hellman key exchange",
@@ -137,7 +180,7 @@ const RULE_PY_X25519: RuleMeta = {
   title: "Python X25519 key exchange",
   description: "cryptography X25519PrivateKey.generate",
   category: "key-exchange",
-  severity: "low",
+  severity: "medium",
   confidence: "high",
   algorithm: "X25519",
   hndl: true,
@@ -150,7 +193,7 @@ const RULE_PY_X448: RuleMeta = {
   title: "Python X448 key exchange",
   description: "cryptography X448PrivateKey.generate",
   category: "key-exchange",
-  severity: "low",
+  severity: "medium",
   confidence: "high",
   algorithm: "X448",
   hndl: true,
@@ -169,6 +212,91 @@ const RULE_PY_EDDSA: RuleMeta = {
   cwe: CWE_BROKEN_CRYPTO,
   message: "Ed25519/Ed448 (Python) is a modern but still classical signature scheme.",
 };
+const RULE_PY_TLS_REJECT: RuleMeta = {
+  id: "python-tls-reject",
+  title: "Python TLS certificate verification disabled",
+  description:
+    "requests verify=False / ssl.CERT_NONE / check_hostname=False / _create_unverified_context",
+  category: "tls",
+  severity: "high",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_CERT_VALIDATION,
+  message:
+    "TLS certificate verification is disabled (verify=False / CERT_NONE / check_hostname=False / _create_unverified_context), which allows man-in-the-middle attacks.",
+  remediation:
+    "Enable certificate verification (verify=True, ssl.CERT_REQUIRED, check_hostname=True) and verify certificates properly.",
+};
+const RULE_PY_TLS_LEGACY: RuleMeta = {
+  id: "python-tls-legacy-version",
+  title: "Python legacy TLS version pinned",
+  description: "ssl.PROTOCOL_TLSv1 (TLS 1.0)",
+  category: "tls",
+  severity: "medium",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_WEAK_STRENGTH,
+  message: "TLS 1.0 (ssl.PROTOCOL_TLSv1) is deprecated and insecure; require TLS 1.3.",
+  remediation:
+    "Use ssl.PROTOCOL_TLS_CLIENT with minimum_version = ssl.TLSVersion.TLSv1_3 and prefer PQC-hybrid key exchange.",
+};
+
+/**
+ * Aliasable `cryptography` / PyCryptodome modules → the (method, rule) pairs
+ * reachable through them. Lets an aliased module import
+ * (`from ... import rsa as _rsa` → `_rsa.generate_private_key(`) resolve back to
+ * the same rule the direct `rsa.generate_private_key(` would fire, since the
+ * detector's regexes are module-qualified and miss a renamed prefix.
+ */
+const PY_MODULE_RULES: Record<string, ReadonlyArray<{ method: string; rule: RuleMeta }>> = {
+  rsa: [{ method: "generate_private_key", rule: RULE_PY_RSA_KEYGEN }],
+  ec: [
+    { method: "generate_private_key", rule: RULE_PY_EC_KEYGEN },
+    { method: "ECDSA", rule: RULE_PY_ECDSA },
+    { method: "ECDH", rule: RULE_PY_ECDH },
+  ],
+  dsa: [{ method: "generate_private_key", rule: RULE_PY_HAZMAT_DSA }],
+  dh: [{ method: "generate_parameters", rule: RULE_PY_DH }],
+  padding: [{ method: "OAEP", rule: RULE_PY_RSA_ENCRYPT }],
+  // PyCryptodome factory modules (`.generate(`).
+  RSA: [{ method: "generate", rule: RULE_PY_RSA_KEYGEN }],
+  ECC: [{ method: "generate", rule: RULE_PY_EC_KEYGEN }],
+  DSA: [{ method: "generate", rule: RULE_PY_DSA }],
+};
+
+/** Escape a string for interpolation into a dynamically-built RegExp. */
+function escapePyRe(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/**
+ * Collect module aliases for the aliasable crypto modules, so a later
+ * `<alias>.<method>(` call still resolves. Handles both `from <path> import
+ * <mod> as <alias>` (including comma-separated specifiers) and the bare
+ * `import <path.mod> as <alias>`. Returns Map<module, alias[]>; an alias equal to
+ * its own module name is skipped (matched directly already).
+ */
+function collectPyModuleAliases(content: string): Map<string, string[]> {
+  const out = new Map<string, string[]>();
+  const add = (mod: string, alias: string): void => {
+    if (!alias || alias === mod || !(mod in PY_MODULE_RULES)) return;
+    const list = out.get(mod) ?? [];
+    if (!list.includes(alias)) list.push(alias);
+    out.set(mod, list);
+  };
+  // `from <path> import a as b, c as d` — scan the import list for `X as Y`.
+  const fromRe = /(?:^|\n)[ \t]*from\s+[\w.]+\s+import\s+([^\n#]+)/g;
+  for (let m = fromRe.exec(content); m; m = fromRe.exec(content)) {
+    const specRe = /([A-Za-z_]\w*)\s+as\s+([A-Za-z_]\w*)/g;
+    for (let s = specRe.exec(m[1]); s; s = specRe.exec(m[1])) add(s[1], s[2]);
+  }
+  // `import <path.mod> as <alias>` — the aliased module is the last dotted segment.
+  const impRe = /(?:^|\n)[ \t]*import\s+([\w.]+)\s+as\s+([A-Za-z_]\w*)/g;
+  for (let m = impRe.exec(content); m; m = impRe.exec(content)) {
+    add(m[1].split(".").pop() ?? m[1], m[2]);
+  }
+  return out;
+}
 
 /** Detects classical asymmetric crypto in Python source. */
 export const pythonDetector: Detector = {
@@ -181,11 +309,15 @@ export const pythonDetector: Detector = {
     RULE_PY_RSA_ENCRYPT,
     RULE_PY_EC_KEYGEN,
     RULE_PY_ECDSA,
+    RULE_PY_ECDH,
     RULE_PY_DSA,
+    RULE_PY_HAZMAT_DSA,
     RULE_PY_DH,
     RULE_PY_X25519,
     RULE_PY_X448,
     RULE_PY_EDDSA,
+    RULE_PY_TLS_REJECT,
+    RULE_PY_TLS_LEGACY,
   ],
   appliesTo: (f) => hasExtension(f, PYTHON_EXTENSIONS),
   detect({ file, content }): Finding[] {
@@ -201,11 +333,29 @@ export const pythonDetector: Detector = {
     add(RE_PY_RSA_ENCRYPT, RULE_PY_RSA_ENCRYPT);
     add(RE_PY_EC_KEYGEN, RULE_PY_EC_KEYGEN);
     add(RE_PY_ECDSA, RULE_PY_ECDSA);
+    add(RE_PY_ECDH, RULE_PY_ECDH);
     add(RE_PY_DSA, RULE_PY_DSA);
+    add(RE_PY_HAZMAT_DSA, RULE_PY_HAZMAT_DSA);
     add(RE_PY_DH, RULE_PY_DH);
     add(RE_PY_X25519, RULE_PY_X25519);
     add(RE_PY_X448, RULE_PY_X448);
     add(RE_PY_EDDSA, RULE_PY_EDDSA);
+    add(RE_PY_TLS_REJECT, RULE_PY_TLS_REJECT);
+    add(RE_PY_TLS_LEGACY, RULE_PY_TLS_LEGACY);
+
+    // Module-alias resolution: `from ... import rsa as _rsa` then
+    // `_rsa.generate_private_key(` — the direct regexes are module-qualified
+    // (`\brsa\.`) and miss a renamed prefix. Runs on the ORIGINAL content so
+    // locations stay exact; fires only for an alias explicitly bound to a known
+    // crypto module, so precision is unaffected.
+    for (const [mod, aliasList] of collectPyModuleAliases(content)) {
+      for (const alias of aliasList) {
+        const a = escapePyRe(alias);
+        for (const { method, rule } of PY_MODULE_RULES[mod]) {
+          add(new RegExp(`\\b${a}\\.${method}\\s*\\(`, "g"), rule);
+        }
+      }
+    }
 
     return findings;
   },

package/src/detectors/ruby.ts

@@ -1,22 +1,40 @@
 /**
  * Source-code detector for classical asymmetric cryptography in Ruby. Ruby's
  * asymmetric crypto is almost entirely `OpenSSL::PKey::{RSA,EC,DSA,DH}`, which
- * makes the signals precise. Lexical, same strategy as the other packs.
+ * makes the signals precise. Lexical, same strategy as the other packs. Beyond
+ * keygen it also covers RSA public-key encryption on a loaded key, DH key
+ * agreement, the type-agnostic `OpenSSL::PKey.read` loader, Ed25519 key
+ * generation, and disabled TLS peer verification (`VERIFY_NONE`).
  *
  * HNDL: RSA (keygen/encryption) and (EC)DH key agreement are harvest-now-
- * decrypt-later exposed (hndl:true); DSA signatures are hndl:false but forgeable.
- * `OpenSSL::PKey::EC` is ambiguous (feeds ECDSA + ECDH), so it is classified
- * conservatively as key-exchange-capable (hndl:true), like the other EC keygen
- * rules.
+ * decrypt-later exposed (hndl:true); DSA / Ed25519 signatures are hndl:false but
+ * forgeable. `OpenSSL::PKey::EC` is ambiguous (feeds ECDSA + ECDH), so it is
+ * classified conservatively as key-exchange-capable (hndl:true), like the other
+ * EC keygen rules; `OpenSSL::PKey.read` loads a key of unknown type and is
+ * likewise treated conservatively.
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
 import { RUBY_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
-import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION } from "../cwe.js";
 
 const RE_RB_RSA = /\bOpenSSL::PKey::RSA\.(?:new|generate)\s*\(/g;
 const RE_RB_EC = /\bOpenSSL::PKey::EC\.(?:new|generate)\s*\(/g;
 const RE_RB_DSA = /\bOpenSSL::PKey::DSA\.(?:new|generate)\s*\(/g;
 const RE_RB_DH = /\bOpenSSL::PKey::DH\.new\s*\(/g;
+// RSA public-key encryption on an already-loaded key (audit F4-ruby / F9).
+const RE_RB_RSA_CRYPT = /\.public_encrypt\b|\.private_decrypt\b/g;
+// Finite-field DH shared-secret agreement.
+const RE_RB_DH_AGREE = /\bdh_compute_key\s*\(/g;
+// Type-agnostic key loader — could be RSA/EC/DSA/DH (conservative).
+const RE_RB_PKEY_READ = /\bOpenSSL::PKey\.read\s*\(/g;
+// Ed25519 signing key via the generic generate_key factory.
+const RE_RB_ED25519 = /\bOpenSSL::PKey\.generate_key\s*\(\s*["']ED25519["']/g;
+// `ed25519` gem — Ed25519::SigningKey / VerifyKey (signature keys).
+const RE_RB_ED25519_GEM = /\bEd25519::(?:SigningKey|VerifyKey)\b/g;
+// `rbnacl` (libsodium) — Curve25519/X25519 key agreement: PrivateKey, Box, GroupElement.
+const RE_RB_RBNACL = /\bRbNaCl::(?:PrivateKey|Box|GroupElement)\b/g;
+// TLS peer verification disabled (mirrors the JS tlsDetector rejectUnauthorized rule).
+const RE_RB_TLS_VERIFY_NONE = /\bOpenSSL::SSL::VERIFY_NONE\b/g;
 
 const RULE_RB_RSA: RuleMeta = {
   id: "ruby-rsa",
@@ -71,6 +89,100 @@ const RULE_RB_DH: RuleMeta = {
   message:
     "Finite-field Diffie-Hellman (Ruby/OpenSSL) is broken by Shor's algorithm (harvest-now-decrypt-later).",
 };
+const RULE_RB_RSA_CRYPT: RuleMeta = {
+  id: "ruby-rsa-crypt",
+  title: "Ruby RSA public-key encryption",
+  description: "OpenSSL::PKey::RSA#public_encrypt / #private_decrypt",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "RSA public-key encryption/decryption (Ruby/OpenSSL) is harvest-now-decrypt-later exposed.",
+};
+const RULE_RB_DH_AGREE: RuleMeta = {
+  id: "ruby-dh-agree",
+  title: "Ruby Diffie-Hellman key agreement",
+  description: "OpenSSL DH compute_key shared-secret agreement",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "DH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Finite-field Diffie-Hellman key agreement (Ruby/OpenSSL) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_RB_PKEY_READ: RuleMeta = {
+  id: "ruby-pkey-read",
+  title: "Ruby PKey loaded from serialized key",
+  description: "OpenSSL::PKey.read (type-agnostic key loader)",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "medium",
+  algorithm: "unknown",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Loads a classical asymmetric key of unknown type (RSA/EC/DSA/DH) via OpenSSL::PKey.read. Treated conservatively as key-exchange-capable (harvest-now-decrypt-later).",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+const RULE_RB_ED25519: RuleMeta = {
+  id: "ruby-ed25519",
+  title: "Ruby Ed25519 key generation",
+  description: 'OpenSSL::PKey.generate_key("ED25519")',
+  category: "signature",
+  severity: "low",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Generates an Ed25519 signing key (Ruby/OpenSSL) — modern but classical, and forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_RB_ED25519_GEM: RuleMeta = {
+  id: "ruby-ed25519-gem",
+  title: "Ruby Ed25519 signature (ed25519 gem)",
+  description: "ed25519 gem Ed25519::SigningKey / Ed25519::VerifyKey",
+  category: "signature",
+  severity: "low",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Ed25519 signing/verification via the `ed25519` gem — modern but classical, and forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_RB_RBNACL: RuleMeta = {
+  id: "ruby-rbnacl",
+  title: "Ruby X25519 key agreement (rbnacl)",
+  description: "rbnacl (libsodium) RbNaCl::PrivateKey / Box / GroupElement",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "X25519",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Curve25519/X25519 key agreement via the `rbnacl` gem (libsodium) — modern but classical key agreement, harvest-now-decrypt-later exposed.",
+};
+const RULE_RB_TLS_VERIFY_NONE: RuleMeta = {
+  id: "ruby-tls-verify-none",
+  title: "Ruby TLS certificate verification disabled",
+  description: "OpenSSL::SSL::VERIFY_NONE",
+  category: "tls",
+  severity: "high",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_CERT_VALIDATION,
+  message: "OpenSSL::SSL::VERIFY_NONE disables TLS peer certificate verification (MITM risk).",
+  remediation: "Use OpenSSL::SSL::VERIFY_PEER and verify the certificate chain.",
+};
 
 /** Detects classical asymmetric crypto in Ruby (OpenSSL::PKey). */
 export const rubyDetector: Detector = {
@@ -78,7 +190,19 @@ export const rubyDetector: Detector = {
   description: "Classical asymmetric crypto in Ruby (OpenSSL::PKey::{RSA,EC,DSA,DH})",
   scope: "source",
   language: "ruby",
-  rules: [RULE_RB_RSA, RULE_RB_EC, RULE_RB_DSA, RULE_RB_DH],
+  rules: [
+    RULE_RB_RSA,
+    RULE_RB_EC,
+    RULE_RB_DSA,
+    RULE_RB_DH,
+    RULE_RB_RSA_CRYPT,
+    RULE_RB_DH_AGREE,
+    RULE_RB_PKEY_READ,
+    RULE_RB_ED25519,
+    RULE_RB_ED25519_GEM,
+    RULE_RB_RBNACL,
+    RULE_RB_TLS_VERIFY_NONE,
+  ],
   appliesTo: (f) => hasExtension(f, RUBY_EXTENSIONS),
   detect({ file, content }): Finding[] {
     const findings: Finding[] = [];
@@ -92,6 +216,13 @@ export const rubyDetector: Detector = {
     add(RE_RB_EC, RULE_RB_EC);
     add(RE_RB_DSA, RULE_RB_DSA);
     add(RE_RB_DH, RULE_RB_DH);
+    add(RE_RB_RSA_CRYPT, RULE_RB_RSA_CRYPT);
+    add(RE_RB_DH_AGREE, RULE_RB_DH_AGREE);
+    add(RE_RB_PKEY_READ, RULE_RB_PKEY_READ);
+    add(RE_RB_ED25519, RULE_RB_ED25519);
+    add(RE_RB_ED25519_GEM, RULE_RB_ED25519_GEM);
+    add(RE_RB_RBNACL, RULE_RB_RBNACL);
+    add(RE_RB_TLS_VERIFY_NONE, RULE_RB_TLS_VERIFY_NONE);
     return findings;
   },
 };