@quantakrypto/core 0.4.2 → 0.4.4

package/src/detectors/source.ts

@@ -29,6 +29,7 @@
 import type { Detector, Finding, RuleMeta } from "../types.js";
 import {
   JS_TS_EXTENSIONS,
+  DOC_EXTENSIONS,
   JWT_HOST_EXTENSIONS,
   eachMatch,
   findingFromRule,
@@ -45,6 +46,135 @@ import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cw
 // (ordered alternation would otherwise match `rsa` and reject the `-pss` tail).
 const RE_GENERATE_KEYPAIR =
   /generateKeyPair(?:Sync)?\s*\(\s*['"`](rsa-pss|rsa|ec|dsa|dh|x25519|x448|ed25519|ed448)['"`]/g;
+
+/** Per-key-type classification for `generateKeyPair(Sync)('<type>', …)`. Hoisted
+ * to module scope so the direct matcher AND the import-alias pass (below) share
+ * one source of truth for how each key type is classified. */
+interface KeygenInfo {
+  algo: Finding["algorithm"];
+  cat: Finding["category"];
+  sev: Finding["severity"];
+  hndl: boolean;
+  label: string;
+  message?: string;
+  remediation?: string;
+}
+const KEYGEN_INFO: Record<string, KeygenInfo> = {
+  rsa: { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" },
+  // RSA-PSS is signature-only, so classify it as a (forgeable) signature
+  // rather than a KEM — no HNDL confidentiality exposure.
+  "rsa-pss": {
+    algo: "RSA",
+    cat: "signature",
+    sev: "high",
+    hndl: false,
+    label: "RSA-PSS",
+    message: "Generates a classical RSA-PSS signing key, which is forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+  },
+  // EC keys feed BOTH ECDSA (sign) and ECDH (key agreement). ECDH is
+  // HNDL-exposed, so classify conservatively as key-exchange-capable and
+  // surface both concerns rather than asserting signature-only (P0-4).
+  ec: {
+    algo: "ECDH",
+    cat: "key-exchange",
+    sev: "high",
+    hndl: true,
+    label: "EC (ECDSA/ECDH)",
+    message:
+      "Generates a classical EC key pair. EC keys feed BOTH ECDSA signatures " +
+      "and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
+    remediation:
+      "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+  },
+  dsa: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
+  dh: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
+  x25519: { algo: "X25519", cat: "key-exchange", sev: "medium", hndl: true, label: "X25519" },
+  x448: { algo: "X448", cat: "key-exchange", sev: "medium", hndl: true, label: "X448" },
+  ed25519: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed25519" },
+  ed448: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed448" },
+};
+
+/** Emit a keygen finding for `generateKeyPair(Sync)('<type>')` at [index]. Shared
+ * by the direct matcher and the import-alias pass so both classify identically. */
+function pushKeygenFinding(
+  findings: Finding[],
+  rawType: string,
+  file: string,
+  content: string,
+  index: number,
+  matchLength: number,
+): void {
+  const info = KEYGEN_INFO[rawType.toLowerCase()];
+  if (!info) return;
+  findings.push(
+    findingFromRule(
+      RULE_NODE_KEYGEN,
+      { file, content, index, matchLength },
+      {
+        title: `${info.label} key generation`,
+        category: info.cat,
+        severity: info.sev,
+        algorithm: info.algo,
+        hndl: info.hndl,
+        message:
+          info.message ??
+          `Generates a classical ${info.label} key pair, which is not quantum-safe.`,
+        ...(info.remediation ? { remediation: info.remediation } : {}),
+      },
+    ),
+  );
+}
+
+/** Canonical Node-crypto call names whose import-aliases we resolve. */
+const ALIASABLE: readonly string[] = [
+  "generateKeyPairSync",
+  "generateKeyPair",
+  "createECDH",
+  "createDiffieHellman",
+  "createDiffieHellmanGroup",
+];
+
+/**
+ * Collect import-aliases for the canonical crypto calls we resolve, so
+ * `import { generateKeyPairSync as gk } from 'node:crypto'` (or the CommonJS
+ * `const { generateKeyPairSync: gk } = require('crypto')`) is followed when `gk`
+ * is called later. Returns Map<canonical, alias[]>. An alias equal to its own
+ * canonical name is skipped (already matched directly). Precision-safe: the
+ * alias is only ever bound to a known crypto symbol, so a later `gk(` call is
+ * unambiguously that symbol.
+ */
+function collectCryptoAliases(content: string): Map<string, string[]> {
+  const out = new Map<string, string[]>();
+  const add = (canonical: string, alias: string): void => {
+    if (!alias || alias === canonical) return;
+    const list = out.get(canonical) ?? [];
+    if (!list.includes(alias)) list.push(alias);
+    out.set(canonical, list);
+  };
+  // ESM named imports: `import { A as B, C as D } from '...'`.
+  const esm = /import\s*(?:type\s+)?\{([^}]*)\}\s*from\s*['"][^'"]*['"]/g;
+  for (let m = esm.exec(content); m; m = esm.exec(content)) {
+    const spec = /([A-Za-z_$][\w$]*)\s+as\s+([A-Za-z_$][\w$]*)/g;
+    for (let s = spec.exec(m[1]); s; s = spec.exec(m[1])) {
+      if (ALIASABLE.includes(s[1])) add(s[1], s[2]);
+    }
+  }
+  // CommonJS destructure-rename: `const { A: B } = require('...')`.
+  const cjs = /(?:const|let|var)\s*\{([^}]*)\}\s*=\s*require\s*\(\s*['"][^'"]*['"]\s*\)/g;
+  for (let m = cjs.exec(content); m; m = cjs.exec(content)) {
+    const spec = /([A-Za-z_$][\w$]*)\s*:\s*([A-Za-z_$][\w$]*)/g;
+    for (let s = spec.exec(m[1]); s; s = spec.exec(m[1])) {
+      if (ALIASABLE.includes(s[1])) add(s[1], s[2]);
+    }
+  }
+  return out;
+}
+
+/** Escape a string for safe interpolation into a dynamically-built RegExp. */
+function escapeRe(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 const RE_CREATE_SIGN_VERIFY = /create(?:Sign|Verify)\s*\(/g;
 // One-shot crypto.sign/verify(algorithm, data, key). A LOOKBEHIND (not a
 // consumed char) anchors it so it doesn't fire inside identifiers like `assign(`
@@ -81,7 +211,7 @@ const RE_JSRSASIGN_SIGN = /KJUR\.crypto\.(?:Signature|ECDSA)\b/g;
 const RE_NODE_RSA = /new\s+NodeRSA\s*\(/g;
 // secp256k1 — direct @noble/secp256k1 / secp256k1-style API usage in source.
 const RE_SECP256K1 =
-  /\b(?:secp(?:256k1)?|secp)\s*\.\s*(?:sign|verify|getPublicKey|getSharedSecret|ecdh|recoverPublicKey)\s*\(/g;
+  /\b(?:secp(?:256k1)?|secp)\s*\.\s*(sign|verify|getPublicKey|getSharedSecret|ecdh|recoverPublicKey)\s*\(/g;
 
 // JWT/JOSE.
 const RE_JWT_ALG = /['"`](RS(?:256|384|512)|PS(?:256|384|512)|ES(?:256|384|512|256K)|EdDSA)['"`]/g;
@@ -237,74 +367,54 @@ const nodeCryptoDetector: Detector = {
 
     // generateKeyPair(Sync)('rsa' | 'ec' | 'dsa' | 'dh' | 'x25519' | 'ed25519', ...)
     eachMatch(RE_GENERATE_KEYPAIR, content, (m) => {
-      const type = m[1].toLowerCase();
-      const map: Record<
-        string,
-        {
-          algo: Finding["algorithm"];
-          cat: Finding["category"];
-          sev: Finding["severity"];
-          hndl: boolean;
-          label: string;
-          message?: string;
-          remediation?: string;
-        }
-      > = {
-        rsa: { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" },
-        // RSA-PSS is signature-only, so classify it as a (forgeable) signature
-        // rather than a KEM — no HNDL confidentiality exposure.
-        "rsa-pss": {
-          algo: "RSA",
-          cat: "signature",
-          sev: "high",
-          hndl: false,
-          label: "RSA-PSS",
-          message:
-            "Generates a classical RSA-PSS signing key, which is forgeable by a quantum attacker.",
-          remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
-        },
-        // EC keys feed BOTH ECDSA (sign) and ECDH (key agreement). ECDH is
-        // HNDL-exposed, so classify conservatively as key-exchange-capable and
-        // surface both concerns rather than asserting signature-only (P0-4).
-        ec: {
-          algo: "ECDH",
-          cat: "key-exchange",
-          sev: "high",
-          hndl: true,
-          label: "EC (ECDSA/ECDH)",
-          message:
-            "Generates a classical EC key pair. EC keys feed BOTH ECDSA signatures " +
-            "and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
-          remediation:
-            "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
-        },
-        dsa: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
-        dh: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
-        x25519: { algo: "X25519", cat: "key-exchange", sev: "low", hndl: true, label: "X25519" },
-        x448: { algo: "X448", cat: "key-exchange", sev: "low", hndl: true, label: "X448" },
-        ed25519: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed25519" },
-        ed448: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed448" },
-      };
-      const info = map[type];
-      findings.push(
-        findingFromRule(
-          RULE_NODE_KEYGEN,
-          { file, content, index: m.index, matchLength: m[0].length },
-          {
-            title: `${info.label} key generation`,
-            category: info.cat,
-            severity: info.sev,
-            algorithm: info.algo,
-            hndl: info.hndl,
-            message:
-              info.message ??
-              `Generates a classical ${info.label} key pair, which is not quantum-safe.`,
-            ...(info.remediation ? { remediation: info.remediation } : {}),
-          },
-        ),
-      );
+      pushKeygenFinding(findings, m[1], file, content, m.index, m[0].length);
     });
 
+    // Import-alias resolution: follow `import { generateKeyPairSync as gk }` (and
+    // the CommonJS destructure-rename) so an aliased call still detects. Only the
+    // keygen / ECDH / DH constructors are resolved — their classification is
+    // unambiguous. The alias regexes run on the ORIGINAL content, so locations
+    // stay exact; it fires only when the alias was explicitly bound to a known
+    // crypto symbol, so precision is unaffected.
+    const aliases = collectCryptoAliases(content);
+    for (const [canonical, names] of aliases) {
+      for (const alias of names) {
+        const a = escapeRe(alias);
+        if (canonical === "generateKeyPairSync" || canonical === "generateKeyPair") {
+          const re = new RegExp(
+            `\\b${a}\\s*\\(\\s*['"\`](rsa-pss|rsa|ec|dsa|dh|x25519|x448|ed25519|ed448)['"\`]`,
+            "g",
+          );
+          eachMatch(re, content, (m) =>
+            pushKeygenFinding(findings, m[1], file, content, m.index, m[0].length),
+          );
+        } else if (canonical === "createECDH") {
+          eachMatch(new RegExp(`\\b${a}\\s*\\(`, "g"), content, (m) =>
+            findings.push(
+              findingFromRule(RULE_NODE_ECDH, {
+                file,
+                content,
+                index: m.index,
+                matchLength: m[0].length,
+              }),
+            ),
+          );
+        } else {
+          // createDiffieHellman / createDiffieHellmanGroup.
+          eachMatch(new RegExp(`\\b${a}\\s*\\(`, "g"), content, (m) =>
+            findings.push(
+              findingFromRule(RULE_NODE_DH, {
+                file,
+                content,
+                index: m.index,
+                matchLength: m[0].length,
+              }),
+            ),
+          );
+        }
+      }
+    }
+
     // createSign / createVerify — RSA / ECDSA / DSA signatures.
     eachMatch(RE_CREATE_SIGN_VERIFY, content, (m) => {
       findings.push(
@@ -610,7 +720,27 @@ const libraryDetector: Detector = {
     add(RE_FORGE_RSA, RULE_FORGE_RSA); // node-forge: pki.rsa.generateKeyPair(...)
     add(RE_FORGE_ED25519, RULE_FORGE_ED25519); // node-forge: forge.ed25519.*
     add(RE_ELLIPTIC_EC, RULE_ELLIPTIC_EC); // elliptic: new EC('secp256k1')
-    add(RE_SECP256K1, RULE_SECP256K1); // secp.sign / getPublicKey / getSharedSecret
+    // secp256k1: classify per method — getSharedSecret/ecdh are key AGREEMENT
+    // (ECDH, harvest-now-decrypt-later); sign/verify/getPublicKey/recover are
+    // ECDSA signatures (not HNDL). The old rule flagged everything as ECDSA.
+    eachMatch(RE_SECP256K1, content, (m) => {
+      const kex = m[1] === "getSharedSecret" || m[1] === "ecdh";
+      findings.push(
+        findingFromRule(
+          RULE_SECP256K1,
+          { file, content, index: m.index, matchLength: m[0].length },
+          kex
+            ? {
+                title: "secp256k1 ECDH key agreement",
+                category: "key-exchange",
+                algorithm: "ECDH",
+                hndl: true,
+                message: `secp256k1 ECDH key agreement (.${m[1]}()) is classical and harvest-now-decrypt-later exposed.`,
+              }
+            : undefined,
+        ),
+      );
+    });
     add(RE_JSRSASIGN_KEYGEN, RULE_JSRSASIGN_KEYGEN); // jsrsasign: KEYUTIL.generateKeypair(...)
     add(RE_JSRSASIGN_SIGN, RULE_JSRSASIGN_SIGN); // jsrsasign: KJUR.crypto.*
     add(RE_NODE_RSA, RULE_NODE_RSA_LIB); // node-rsa: new NodeRSA(...)
@@ -623,6 +753,11 @@ const libraryDetector: Detector = {
 /* JWT / JOSE / COSE algorithm strings                                         */
 /* -------------------------------------------------------------------------- */
 
+// JOSE RSA key-transport algorithms (JWE `alg`): quoted RSA-OAEP / RSA-OAEP-256
+// /384/512 / RSA1_5. Classical RSA *encryption* (key transport) — distinct from
+// the RS*/PS* *signature* tokens above, and a harvest-now-decrypt-later surface.
+const RE_JOSE_KEM = /['"`](RSA-OAEP(?:-(?:256|384|512))?|RSA1_5)['"`]/g;
+
 const RULE_JWT_ALG: RuleMeta = {
   id: "jwt-classical-alg",
   title: "Classical JWT/JOSE algorithm",
@@ -650,6 +785,20 @@ const RULE_JOSE_ECDH: RuleMeta = {
     "JOSE ECDH-ES performs classical ECDH key agreement — harvest-now-decrypt-later exposed.",
   remediation: "Track IETF PQC JOSE/COSE; adopt hybrid X25519MLKEM768 KEM-based encryption.",
 };
+const RULE_JOSE_RSA_OAEP: RuleMeta = {
+  id: "jose-rsa-oaep",
+  title: "JOSE RSA key-transport algorithm",
+  description: "JWE RSA-OAEP / RSA-OAEP-256/384/512 / RSA1_5 key encryption",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "medium",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "JOSE RSA key transport (RSA-OAEP / RSA1_5) is classical RSA encryption — harvest-now-decrypt-later exposed.",
+  remediation: "Track IETF PQC JOSE/COSE; adopt hybrid X25519MLKEM768 KEM-based encryption.",
+};
 
 /**
  * Detects classical signature algorithm identifiers used by JWT/JOSE, plus
@@ -664,7 +813,7 @@ const jwtDetector: Detector = {
   // signal in JS/TS or Python (e.g. PyJWT `algorithm="RS256"`), so this detector
   // is un-gated from JS-only to the JWT host surfaces.
   language: "any",
-  rules: [RULE_JWT_ALG, RULE_JOSE_ECDH],
+  rules: [RULE_JWT_ALG, RULE_JOSE_ECDH, RULE_JOSE_RSA_OAEP],
   appliesTo: (f) => hasExtension(f, JWT_HOST_EXTENSIONS),
   detect({ file, content }): Finding[] {
     const findings: Finding[] = [];
@@ -703,6 +852,20 @@ const jwtDetector: Detector = {
       );
     });
 
+    // JOSE RSA key transport (RSA-OAEP / RSA1_5) — classical RSA encryption, HNDL.
+    eachMatch(RE_JOSE_KEM, content, (m) => {
+      findings.push(
+        findingFromRule(
+          RULE_JOSE_RSA_OAEP,
+          { file, content, index: m.index, matchLength: m[0].length },
+          {
+            title: `JOSE RSA key transport ${m[1]}`,
+            message: `JOSE "${m[1]}" is classical RSA key transport — harvest-now-decrypt-later exposed.`,
+          },
+        ),
+      );
+    });
+
     return findings;
   },
 };
@@ -810,6 +973,48 @@ const tlsDetector: Detector = {
 const RE_SSH_PUBKEY = /\b(ssh-rsa|ssh-ed25519|ssh-dss|ecdsa-sha2-nistp(?:256|384|521))\b/g;
 const RE_CERT_SIG_ALG =
   /\b(sha(?:1|256|384|512)WithRSAEncryption|ecdsa-with-SHA(?:1|256|384|512)|rsassaPss|dsaWithSHA(?:1|256))\b/g;
+// Classical SSH key-exchange algorithm identifiers: finite-field DH groups
+// (diffie-hellman-group{1,14,15,16,17,18} + group-exchange), ECDH over NIST
+// curves (ecdh-sha2-nistp*), and Curve25519 (curve25519-sha256). All are
+// Shor-broken key agreement — the harvest-now-decrypt-later surface a lexical
+// scan misses when only the `crypto/*` API is matched, not the negotiated kex.
+const RE_SSH_KEX =
+  /\b(diffie-hellman-group(?:1|14|15|16|17|18)(?:-sha1|-sha256|-sha512)?|diffie-hellman-group-exchange-sha(?:1|256)|ecdh-sha2-nistp(?:256|384|521)|curve25519-sha256)\b/g;
+
+// A bare key-type token (`ssh-rsa`, `ssh-ed25519`, …) is real SSH crypto only
+// when it is EITHER (a) followed by base64 key material — an actual
+// authorized_keys / known_hosts entry — OR (b) one of ≥2 DISTINCT ssh key/host-key
+// algorithm tokens on the same line — an algorithm-preference list
+// (`HostKeyAlgorithms ssh-ed25519,ecdsa-sha2-nistp256,ssh-rsa`, `%w[…]`, …). A
+// lone token, e.g. a UI label / i18n value like `"ssh-rsa": "ssh-rsa"`, is
+// neither, so it must NOT be flagged. `RE_SSH_ALGO_TOKEN` is a separate (cloned-
+// on-use) copy so counting per line never disturbs the outer `eachMatch` state.
+const RE_SSH_ALGO_TOKEN = /\b(ssh-rsa|ssh-ed25519|ssh-dss|ecdsa-sha2-nistp(?:256|384|521))\b/g;
+/** How far around a token we look for a sibling algorithm on the same line. A
+ * real `HostKeyAlgorithms` list is short; bounding the window keeps the per-token
+ * work O(1) so a pathological single huge line can't make detection quadratic. */
+const SSH_LINE_WINDOW = 512;
+function isRealSshKeyOrAlgoList(content: string, index: number, matchLen: number): boolean {
+  // (a) base64 key material immediately after the token → a real SSH public key.
+  if (/^\s+[A-Za-z0-9+/]{20,}/.test(content.slice(index + matchLen, index + matchLen + 80))) {
+    return true;
+  }
+  // (b) ≥2 distinct ssh key/host-key algorithm tokens on the same line → a list.
+  // Bound both the back-scan for the line start and the window itself so the work
+  // is constant per token and never crosses a line boundary (i18n entries live on
+  // separate lines, so a lone repeated token stays a single distinct token).
+  const from = Math.max(0, index - SSH_LINE_WINDOW);
+  const pre = content.slice(from, index);
+  const preNl = pre.lastIndexOf("\n");
+  const lineStart = preNl === -1 ? from : from + preNl + 1;
+  const to = Math.min(content.length, index + matchLen + SSH_LINE_WINDOW);
+  const post = content.slice(index, to);
+  const postNl = post.indexOf("\n");
+  const lineEnd = postNl === -1 ? to : index + postNl;
+  const distinct = new Set<string>();
+  for (const t of content.slice(lineStart, lineEnd).matchAll(RE_SSH_ALGO_TOKEN)) distinct.add(t[1]);
+  return distinct.size >= 2;
+}
 
 const RULE_SSH_PUBKEY: RuleMeta = {
   id: "ssh-public-key",
@@ -823,7 +1028,8 @@ const RULE_SSH_PUBKEY: RuleMeta = {
   cwe: CWE_BROKEN_CRYPTO,
   sensitive: true,
   message: "A classical SSH public key is forgeable by a quantum attacker.",
-  remediation: "Plan migration to PQC-capable SSH (e.g. sntrup761x25519 KEX, PQC host keys).",
+  remediation:
+    "Plan migration to PQC-capable SSH: prefer the mlkem768x25519-sha256 KEX (ML-KEM-768 hybrid, OpenSSH 10's default since Apr 2025); sntrup761x25519 is an acceptable interim. Rotate to PQC host keys as they land.",
 };
 const RULE_CERT_SIG_ALG: RuleMeta = {
   id: "cert-signature-algorithm",
@@ -839,6 +1045,21 @@ const RULE_CERT_SIG_ALG: RuleMeta = {
     "A classical certificate signature algorithm (RSA/ECDSA/DSA) is a quantum forgery surface.",
   remediation: "Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.",
 };
+const RULE_SSH_KEX: RuleMeta = {
+  id: "ssh-kex-classical",
+  title: "Classical SSH key exchange",
+  description: "diffie-hellman-group* / group-exchange / ecdh-sha2-* / curve25519-sha256 kex",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "medium",
+  algorithm: "unknown",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "A classical SSH key-exchange algorithm (finite-field DH / ECDH / X25519) is harvest-now-decrypt-later exposed.",
+  remediation:
+    "Prefer the mlkem768x25519-sha256 KEX (ML-KEM-768 hybrid, OpenSSH 10 default); sntrup761x25519 is an acceptable interim.",
+};
 
 /**
  * Detects classical SSH public keys (`authorized_keys` / `known_hosts` lines)
@@ -851,13 +1072,18 @@ const sshCertDetector: Detector = {
   description: "SSH public keys and TLS/X.509 certificate signature algorithms in config",
   scope: "config",
   language: "any",
-  rules: [RULE_SSH_PUBKEY, RULE_CERT_SIG_ALG],
-  appliesTo: () => true,
+  rules: [RULE_SSH_PUBKEY, RULE_CERT_SIG_ALG, RULE_SSH_KEX],
+  // Skip prose/docs: a changelog or README that merely mentions `ssh-rsa` in a
+  // sentence is not crypto config. PEM material is caught by its own detector.
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
   detect({ file, content }): Finding[] {
     const findings: Finding[] = [];
 
     // SSH public keys: ssh-rsa AAAA…, ecdsa-sha2-nistp256 …, ssh-ed25519 …
     eachMatch(RE_SSH_PUBKEY, content, (m) => {
+      // Skip a bare token that is neither a real key nor an algorithm list (e.g.
+      // a `"ssh-rsa": "ssh-rsa"` i18n label) — see `isRealSshKeyOrAlgoList`.
+      if (!isRealSshKeyOrAlgoList(content, m.index, m[0].length)) return;
       const tok = m[1];
       const algorithm: Finding["algorithm"] = tok.startsWith("ssh-rsa")
         ? "RSA"
@@ -900,6 +1126,89 @@ const sshCertDetector: Detector = {
       );
     });
 
+    // SSH key-exchange algorithm identifiers (finite-field DH / ECDH / X25519).
+    eachMatch(RE_SSH_KEX, content, (m) => {
+      const tok = m[1];
+      const algorithm: Finding["algorithm"] = tok.startsWith("diffie-hellman")
+        ? "DH"
+        : tok.startsWith("ecdh")
+          ? "ECDH"
+          : "X25519";
+      findings.push(
+        findingFromRule(
+          RULE_SSH_KEX,
+          { file, content, index: m.index, matchLength: m[0].length },
+          {
+            title: `Classical SSH key exchange (${tok})`,
+            algorithm,
+            message: `SSH key-exchange "${tok}" is classical (${algorithm}) — harvest-now-decrypt-later exposed.`,
+          },
+        ),
+      );
+    });
+
+    return findings;
+  },
+};
+
+/* -------------------------------------------------------------------------- */
+/* Classical TLS key-exchange cipher suites (language-agnostic config)         */
+/* -------------------------------------------------------------------------- */
+
+// Classical KEX cipher-suite identifiers, in both the OpenSSL (`ECDHE-RSA-…`) and
+// IANA (`TLS_ECDHE_RSA_WITH_…`) spellings, with `-` or `_` separators. These name
+// a Shor-broken key exchange (ECDHE/DHE), so they are the harvest-now surface a
+// PQC scanner should flag — distinct from the legacy-*version* / weak-cipher rules
+// above. Case-sensitive on purpose: cipher-suite tokens are upper-case constants,
+// so prose like "ecdhe rsa" does not misfire. No trailing \b so the IANA
+// `TLS_ECDHE_RSA_WITH_…` form (a `_` follows `RSA`) still matches.
+const RE_TLS_CLASSICAL_KEX = /\b(?:TLS_)?(?:ECDHE|ECDH|DHE)[-_](?:RSA|ECDSA|DSS)/g;
+
+const RULE_TLS_CLASSICAL_KEX: RuleMeta = {
+  id: "tls-classical-kex",
+  title: "Classical TLS key-exchange cipher suite",
+  description: "ECDHE / DHE cipher suites negotiate Shor-broken key exchange",
+  category: "tls",
+  severity: "medium",
+  confidence: "medium",
+  algorithm: "unknown",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Classical TLS key exchange (ECDHE/DHE) is harvest-now-decrypt-later exposed — the session key can be recorded now and recovered by a quantum attacker.",
+  remediation:
+    "Adopt a PQC-hybrid TLS 1.3 key exchange (e.g. X25519MLKEM768) as your stack and peers support it; keep classical suites only as a transitional fallback.",
+};
+
+/**
+ * Detects classical TLS key-exchange cipher suites in any text/config file
+ * (OpenSSL cipher lists, IANA suite constants in Go/Java/C#/Rust, `.properties`,
+ * etc.). Language-agnostic because the suite identifiers are the same tokens
+ * everywhere — this is the cross-language TLS gap the legacy-version rule misses.
+ */
+const tlsClassicalKexDetector: Detector = {
+  id: "tls-cipher-suite",
+  description: "Classical TLS key-exchange cipher suites (ECDHE/DHE) in any config",
+  scope: "config",
+  language: "any",
+  rules: [RULE_TLS_CLASSICAL_KEX],
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    eachMatch(RE_TLS_CLASSICAL_KEX, content, (m) => {
+      const tok = m[0];
+      const algorithm: Finding["algorithm"] = tok.includes("ECDH") ? "ECDH" : "DH";
+      findings.push(
+        findingFromRule(
+          RULE_TLS_CLASSICAL_KEX,
+          { file, content, index: m.index, matchLength: m[0].length },
+          {
+            algorithm,
+            message: `Classical TLS key-exchange suite "${tok}…" (${algorithm}) is harvest-now-decrypt-later exposed.`,
+          },
+        ),
+      );
+    });
     return findings;
   },
 };
@@ -912,4 +1221,5 @@ export const sourceDetectors: Detector[] = [
   jwtDetector,
   tlsDetector,
   sshCertDetector,
+  tlsClassicalKexDetector,
 ];