@quantakrypto/core 0.4.3 → 0.4.4

package/src/detectors/cloudformation.ts

@@ -0,0 +1,215 @@
+/**
+ * IaC detector: classical asymmetric cryptography (and legacy TLS config)
+ * declared in AWS CloudFormation / Azure ARM (incl. Bicep-compiled JSON)
+ * templates — plus CDK `cdk synth` output, which is plain CloudFormation
+ * JSON. This is a distinct surface from `terraform.ts`: CloudFormation/ARM
+ * use PascalCase JSON/YAML property names, never Terraform's snake_case HCL
+ * attributes, so the two detectors never collide on the same file.
+ *
+ * Covered:
+ *  - AWS::KMS::Key `KeySpec`:                    `"RSA_…"` (kem) / `"ECC_…"` (key-exchange)
+ *  - AWS::CertificateManager::Certificate
+ *    `KeyAlgorithm`:                             `"RSA_…"` / `"EC_…"` (certificate)
+ *  - CloudFront distribution `MinimumProtocolVersion`: legacy `TLSv1` / `TLSv1.1` (tls)
+ *  - ELB/ALB listener `SslPolicy`:                legacy `ELBSecurityPolicy-2016-08` /
+ *                                                 `-TLS-1-0-…` / `-TLS-1-1-…` (tls)
+ *  - Azure ARM `Microsoft.KeyVault` key `kty`:    `"RSA"` (kem) / `"EC"` (key-exchange)
+ *
+ * `KeySpec` is PascalCase and case-sensitive, so it never matches Terraform's
+ * snake_case `customer_master_key_spec` (same underlying AWS API, different
+ * authoring surface). A fast-reject on a CFN/ARM marker keeps this detector
+ * from ever firing on arbitrary JSON/YAML that happens to contain one of
+ * these property names in an unrelated context.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO, CWE_WEAK_STRENGTH } from "../cwe.js";
+
+const CFN_EXTENSIONS: readonly string[] = [".json", ".yaml", ".yml"];
+
+// Fast-reject markers: at least one must appear before any rule regex runs, so
+// this detector never scans arbitrary JSON/YAML that merely happens to share
+// an attribute name (`KeySpec`, `kty`, …) with an unrelated schema.
+const CFN_MARKERS: readonly string[] = [
+  "AWS::KMS",
+  "AWS::CertificateManager",
+  "AWSTemplateFormatVersion",
+  "MinimumProtocolVersion",
+  "Microsoft.KeyVault",
+  '"SslPolicy"',
+];
+
+// Each attribute is matched with an optional quote around the key and `:` as
+// the separator (both plain-JSON and YAML-block-scalar forms use `:`). The
+// `(?<![\w"-])` lookbehind stops a longer/prefixed attribute name from
+// matching on its suffix.
+const RE_CFN_KMS_RSA = /(?<![\w"-])"?KeySpec"?\s*:\s*"?RSA_\d+"?/g;
+const RE_CFN_KMS_EC = /(?<![\w"-])"?KeySpec"?\s*:\s*"?ECC_[A-Z0-9_]+"?/g;
+const RE_CFN_ACM_RSA = /(?<![\w"-])"?KeyAlgorithm"?\s*:\s*"?RSA_\d+"?/g;
+const RE_CFN_ACM_EC = /(?<![\w"-])"?KeyAlgorithm"?\s*:\s*"?EC_[A-Za-z0-9]+"?/g;
+// CloudFront: only the pre-2018 "TLSv1" / "TLSv1_2016" / "TLSv1.1_2016"
+// values are legacy; the lookahead delimiter stops this from matching a
+// "TLSv1.2_2018"-style value that merely starts with the same prefix.
+const RE_CFN_CLOUDFRONT_TLS =
+  /(?<![\w"-])"?MinimumProtocolVersion"?\s*:\s*"?(?:TLSv1(?:\.1)?_2016|TLSv1)(?=["'\s,}]|$)/gm;
+// ELB/ALB legacy SSL negotiation policies (named, dated policy strings).
+const RE_CFN_ELB_TLS =
+  /(?<![\w"-])"?SslPolicy"?\s*:\s*"ELBSecurityPolicy-(?:2016-08|TLS-1-0-\d{4}-\d{2}|TLS-1-1-\d{4}-\d{2})"/g;
+// Azure ARM Microsoft.KeyVault key resource `properties.kty`.
+const RE_CFN_ARM_KV_RSA = /(?<![\w"-])"?kty"?\s*:\s*"?RSA"?(?!\w)/g;
+const RE_CFN_ARM_KV_EC = /(?<![\w"-])"?kty"?\s*:\s*"?EC"?(?!\w)/g;
+
+const RULE_CFN_KMS_RSA: RuleMeta = {
+  id: "cfn-kms-rsa",
+  title: "CloudFormation KMS RSA key",
+  description: 'AWS::KMS::Key KeySpec = "RSA_*"',
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "CloudFormation provisions a classical RSA KMS key (harvest-now-decrypt-later exposed for encryption CMKs).",
+  remediation: "Plan migration to PQC as cloud KMS adds ML-KEM / ML-DSA key specs.",
+};
+const RULE_CFN_KMS_EC: RuleMeta = {
+  id: "cfn-kms-ec",
+  title: "CloudFormation KMS EC key",
+  description: 'AWS::KMS::Key KeySpec = "ECC_*"',
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "CloudFormation provisions a classical EC KMS key; EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+const RULE_CFN_ACM_RSA: RuleMeta = {
+  id: "cfn-acm-rsa",
+  title: "CloudFormation ACM RSA certificate",
+  description: 'AWS::CertificateManager::Certificate KeyAlgorithm = "RSA_*"',
+  category: "certificate",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "CloudFormation provisions an ACM certificate with a classical RSA key, which is not quantum-safe.",
+  remediation: "Plan migration to PQC (ML-KEM-768 for encryption, ML-DSA-65 for signatures).",
+};
+const RULE_CFN_ACM_EC: RuleMeta = {
+  id: "cfn-acm-ec",
+  title: "CloudFormation ACM EC certificate",
+  description: 'AWS::CertificateManager::Certificate KeyAlgorithm = "EC_*"',
+  category: "certificate",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "CloudFormation provisions an ACM certificate with a classical EC key, forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+};
+const RULE_CFN_CLOUDFRONT_TLS: RuleMeta = {
+  id: "cfn-cloudfront-legacy-tls",
+  title: "CloudFormation CloudFront legacy TLS",
+  description: 'CloudFront Distribution MinimumProtocolVersion = "TLSv1" / "TLSv1.1"',
+  category: "tls",
+  severity: "medium",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_WEAK_STRENGTH,
+  message: "CloudFront distribution permits TLS 1.0/1.1, which are deprecated and insecure.",
+  remediation:
+    "Set MinimumProtocolVersion to TLSv1.2_2021 (or later) and prefer PQC-hybrid key exchange.",
+};
+const RULE_CFN_ELB_TLS: RuleMeta = {
+  id: "cfn-elb-legacy-tls",
+  title: "CloudFormation ELB/ALB legacy TLS policy",
+  description: "Elastic Load Balancer SslPolicy naming a pre-2017 legacy policy",
+  category: "tls",
+  severity: "medium",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_WEAK_STRENGTH,
+  message: "Load balancer listener uses a legacy SSL negotiation policy permitting TLS 1.0/1.1.",
+  remediation: "Use ELBSecurityPolicy-TLS13-1-2-2021-06 (or the latest FS+TLS1.2/1.3 policy).",
+};
+const RULE_CFN_ARM_KV_RSA: RuleMeta = {
+  id: "cfn-arm-keyvault-rsa",
+  title: "ARM template Key Vault RSA key",
+  description: 'Microsoft.KeyVault key resource kty = "RSA"',
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "ARM template provisions a classical RSA Azure Key Vault key, which is not quantum-safe.",
+  remediation: "Plan migration to PQC (ML-KEM-768 / ML-DSA-65).",
+};
+const RULE_CFN_ARM_KV_EC: RuleMeta = {
+  id: "cfn-arm-keyvault-ec",
+  title: "ARM template Key Vault EC key",
+  description: 'Microsoft.KeyVault key resource kty = "EC"',
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "ARM template provisions a classical EC Azure Key Vault key; EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+
+/**
+ * Detects classical asymmetric crypto and legacy TLS config declared in
+ * AWS CloudFormation / Azure ARM (incl. Bicep-compiled JSON) templates.
+ */
+export const cloudformationDetector: Detector = {
+  id: "cloudformation-crypto",
+  description:
+    "Classical asymmetric crypto and legacy TLS config declared in CloudFormation / ARM templates (IaC)",
+  scope: "config",
+  language: "any",
+  rules: [
+    RULE_CFN_KMS_RSA,
+    RULE_CFN_KMS_EC,
+    RULE_CFN_ACM_RSA,
+    RULE_CFN_ACM_EC,
+    RULE_CFN_CLOUDFRONT_TLS,
+    RULE_CFN_ELB_TLS,
+    RULE_CFN_ARM_KV_RSA,
+    RULE_CFN_ARM_KV_EC,
+  ],
+  appliesTo: (f) => hasExtension(f, CFN_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    if (!CFN_MARKERS.some((marker) => content.includes(marker))) return [];
+
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, content, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    add(RE_CFN_KMS_RSA, RULE_CFN_KMS_RSA);
+    add(RE_CFN_KMS_EC, RULE_CFN_KMS_EC);
+    add(RE_CFN_ACM_RSA, RULE_CFN_ACM_RSA);
+    add(RE_CFN_ACM_EC, RULE_CFN_ACM_EC);
+    add(RE_CFN_CLOUDFRONT_TLS, RULE_CFN_CLOUDFRONT_TLS);
+    add(RE_CFN_ELB_TLS, RULE_CFN_ELB_TLS);
+    add(RE_CFN_ARM_KV_RSA, RULE_CFN_ARM_KV_RSA);
+    add(RE_CFN_ARM_KV_EC, RULE_CFN_ARM_KV_EC);
+    return findings;
+  },
+};

package/src/detectors/database.ts

@@ -0,0 +1,88 @@
+/**
+ * Config detector: classical crypto in database usage — public-key encryption of
+ * stored data (pgcrypto) and weak client TLS posture. Data-at-rest is the sharpest
+ * harvest-now-decrypt-later target: a column encrypted to an RSA key today is a
+ * time capsule an adversary can hold until key recovery is cheap.
+ *
+ * Covered:
+ *  - pgcrypto `pgp_pub_encrypt` / `pgp_pub_decrypt` in `.sql` (RSA/ElGamal public-key
+ *    encryption of column data) → `hndl:true`.
+ *  - libpq `sslmode = disable | allow | prefer | require` in any config/connection
+ *    file — a mode that does NOT verify the server certificate, so the classical
+ *    TLS session it does (or doesn't) negotiate is both MITM-able and harvestable.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION } from "../cwe.js";
+
+const RE_PGCRYPTO = /\bpgp_pub_(?:encrypt|decrypt)\b/g;
+const RE_WEAK_SSLMODE = /\bsslmode\s*=\s*["']?(?:disable|allow|prefer|require)\b/gi;
+
+const RULE_PGCRYPTO: RuleMeta = {
+  id: "db-pgcrypto-pubkey",
+  title: "pgcrypto public-key encryption",
+  description: "Postgres pgcrypto pgp_pub_encrypt / pgp_pub_decrypt (RSA/ElGamal) on stored data",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Column data is encrypted with pgcrypto public-key crypto (classical RSA/ElGamal); stored ciphertext is harvest-now-decrypt-later exposed.",
+  remediation:
+    "Plan migration to a post-quantum KEM (ML-KEM-768) envelope for at-rest data; re-encrypt long-lived rows.",
+};
+const RULE_WEAK_SSLMODE: RuleMeta = {
+  id: "db-weak-sslmode",
+  title: "Database sslmode without verification",
+  description: "libpq sslmode is disable/allow/prefer/require (no certificate verification)",
+  category: "tls",
+  severity: "medium",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_CERT_VALIDATION,
+  message:
+    "Database sslmode does not verify the server certificate; the classical TLS session is MITM-able and its key exchange is harvestable.",
+  remediation:
+    "Use sslmode=verify-full and TLS 1.3; track PQC-hybrid KEX (X25519MLKEM768) for database transport.",
+};
+
+/** Detects classical database at-rest / transport crypto. */
+export const databaseDetector: Detector = {
+  id: "database-crypto",
+  description: "Classical crypto in database usage (pgcrypto public-key, weak client sslmode)",
+  scope: "config",
+  language: "any",
+  rules: [RULE_PGCRYPTO, RULE_WEAK_SSLMODE],
+  // Skip prose/docs: a README showing `sslmode=require` is not a live connection string.
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    if (file.toLowerCase().endsWith(".sql") && content.includes("pgp_pub_")) {
+      eachMatch(RE_PGCRYPTO, content, (m) =>
+        findings.push(
+          findingFromRule(RULE_PGCRYPTO, {
+            file,
+            content,
+            index: m.index,
+            matchLength: m[0].length,
+          }),
+        ),
+      );
+    }
+    if (content.includes("sslmode")) {
+      eachMatch(RE_WEAK_SSLMODE, content, (m) =>
+        findings.push(
+          findingFromRule(RULE_WEAK_SSLMODE, {
+            file,
+            content,
+            index: m.index,
+            matchLength: m[0].length,
+          }),
+        ),
+      );
+    }
+    return findings;
+  },
+};

package/src/detectors/dnssec.ts

@@ -0,0 +1,186 @@
+/**
+ * Config detector: classical DNSSEC signing algorithms in zone files and
+ * signer/resolver config (BIND, Knot DNS, PowerDNS, `ldns-signzone` /
+ * `dnssec-signzone` invocations recorded in ops config).
+ *
+ * DNSSEC is "communication between things" infrastructure: resolvers verify
+ * DNSKEY/RRSIG chains to authenticate zone data. Unlike a KEM or key-exchange
+ * finding, a DNSSEC signing key is not harvest-now-decrypt-later exposed —
+ * there is no confidentiality to harvest — but every classical signature it
+ * produces becomes FORGEABLE the moment a cryptographically-relevant quantum
+ * computer (CRQC) exists. A forged DNSKEY/RRSIG chain lets an attacker spoof
+ * DNSSEC-validated records (cache poisoning that a validating resolver would
+ * otherwise reject). So these findings are `category: "signature"`,
+ * `hndl: false`.
+ *
+ * RFC 8624 / IANA "DNSSEC Algorithm Numbers" families covered, mapped to
+ * {@link AlgorithmFamily}:
+ *  - RSASHA1 (5), RSASHA1-NSEC3-SHA1 (7), RSASHA256 (8), RSASHA512 (10) → RSA
+ *  - ECDSAP256SHA256 (13), ECDSAP384SHA384 (14)                        → ECDSA
+ *  - ED25519 (15), ED448 (16)                                          → EdDSA
+ *  - DSA (3), DSA-NSEC3-SHA1 (6)                                      → DSA
+ *
+ * Two independent match shapes per family, both gated to `.zone` / `.db` /
+ * `.conf` files AND to a file-level DNSSEC marker (see `hasDnssecMarker`
+ * below) so the algorithm tokens can't fire on unrelated config:
+ *
+ *  1. NAMED form — the algorithm's mnemonic name, as written in signer/policy
+ *     config (Knot `algorithm RSASHA256;`, a `dnssec-policy` block, BIND
+ *     `algorithm: ecdsap256sha256;`) or on an `ldns-signzone -a ECDSAP256SHA256`
+ *     / `dnssec-signzone -a ECDSAP256SHA256` command line. These mnemonics
+ *     (`RSASHA256`, `ECDSAP384SHA384`, `ED25519`, …) are distinctive enough to
+ *     match bare, EXCEPT plain `DSA`, which is too generic a token on its own
+ *     (used well outside DNSSEC); that one is only matched immediately after
+ *     an `algorithm` keyword.
+ *  2. STRUCTURAL form — the DNSKEY presentation-format RDATA, e.g.
+ *     `example.com. IN DNSKEY 257 3 8 AwEAAd...`, where the fields after the
+ *     `DNSKEY` keyword are `flags protocol algorithm public-key` (RFC 4034
+ *     §2). Anchoring on the literal `DNSKEY` keyword AND the literal
+ *     protocol value `3` (always 3 for DNSSEC) before a restricted algorithm
+ *     number keeps this precise despite being numeric. Bare algorithm
+ *     numbers with no such anchor are deliberately NOT matched anywhere —
+ *     `algorithm 8;` alone is far too ambiguous to key off of.
+ *
+ * Fast reject: `detect()` bails unless the file contains `DNSKEY`, `RRSIG`,
+ * a case-insensitive `dnssec` substring (present in `dnssec-policy`,
+ * `dnssec-signing: on`, etc. in any real signer config), or an
+ * `ldns-signzone` / `dnssec-signzone` invocation. This stops the DSA/EdDSA
+ * named-form tokens — which are individually generic outside DNSSEC — from
+ * firing on, say, an unrelated SSH or TLS `.conf` file that happens to
+ * mention `ED25519` or `DSA` for its own reasons.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+const DNSSEC_EXTENSIONS: readonly string[] = [".zone", ".db", ".conf"];
+
+// IANA DNSSEC algorithm numbers, grouped by family.
+const NUM_RSA = "5|7|8|10"; // RSASHA1, RSASHA1-NSEC3-SHA1, RSASHA256, RSASHA512
+const NUM_ECDSA = "13|14"; // ECDSAP256SHA256, ECDSAP384SHA384
+const NUM_EDDSA = "15|16"; // ED25519, ED448
+const NUM_DSA = "3|6"; // DSA, DSA-NSEC3-SHA1
+
+// --- NAMED form: mnemonic algorithm names in signer/policy config or CLI args. ---
+const RE_NAMED_RSA = /\bRSASHA(?:256|512|1(?:-NSEC3-SHA1)?)\b/g;
+const RE_NAMED_ECDSA = /\bECDSAP(?:256SHA256|384SHA384)\b/g;
+const RE_NAMED_EDDSA = /\bED(?:25519|448)\b/g;
+// Bare "DSA" is too generic to key off alone; require it right after an
+// `algorithm` keyword (Knot/BIND config / dnssec-policy style), optionally
+// quoted or separated by `:`/`=`.
+const RE_NAMED_DSA = /\balgorithm\s*[:=]?\s*"?DSA(?:-NSEC3-SHA1)?"?\b/gi;
+
+// --- STRUCTURAL form: `DNSKEY <flags> 3 <algorithm>` presentation RDATA (RFC 4034 §2). ---
+const RE_DNSKEY_RSA = new RegExp(`\\bDNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_RSA})\\b`, "g");
+const RE_DNSKEY_ECDSA = new RegExp(`\\bDNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_ECDSA})\\b`, "g");
+const RE_DNSKEY_EDDSA = new RegExp(`\\bDNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_EDDSA})\\b`, "g");
+const RE_DNSKEY_DSA = new RegExp(`\\bDNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_DSA})\\b`, "g");
+
+const RULE_DNSSEC_RSA: RuleMeta = {
+  id: "dnssec-rsa-sig",
+  title: "DNSSEC RSA signing algorithm",
+  description: "DNSSEC zone signed with a classical RSA algorithm (RSASHA1/256/512)",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "DNSSEC zone is signed with a classical RSA algorithm (RSASHA1/RSASHA1-NSEC3-SHA1/RSASHA256/RSASHA512); DNSKEY/RRSIG signatures become forgeable once a CRQC exists.",
+  remediation:
+    "Track IETF dnsop post-quantum DNSSEC signing work (ML-DSA); plan re-signing with a PQC algorithm once assigned an IANA DNSSEC algorithm number.",
+};
+const RULE_DNSSEC_ECDSA: RuleMeta = {
+  id: "dnssec-ecdsa-sig",
+  title: "DNSSEC ECDSA signing algorithm",
+  description: "DNSSEC zone signed with a classical ECDSA algorithm (ECDSAP256SHA256/384SHA384)",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "DNSSEC zone is signed with a classical ECDSA algorithm (ECDSAP256SHA256/ECDSAP384SHA384); DNSKEY/RRSIG signatures become forgeable once a CRQC exists.",
+  remediation:
+    "Track IETF dnsop post-quantum DNSSEC signing work (ML-DSA); plan re-signing with a PQC algorithm once assigned an IANA DNSSEC algorithm number.",
+};
+const RULE_DNSSEC_EDDSA: RuleMeta = {
+  id: "dnssec-eddsa-sig",
+  title: "DNSSEC EdDSA signing algorithm",
+  description: "DNSSEC zone signed with a classical EdDSA algorithm (ED25519/ED448)",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "DNSSEC zone is signed with a classical EdDSA algorithm (ED25519/ED448); modern but still classical — DNSKEY/RRSIG signatures become forgeable once a CRQC exists.",
+  remediation:
+    "Track IETF dnsop post-quantum DNSSEC signing work (ML-DSA); plan re-signing with a PQC algorithm once assigned an IANA DNSSEC algorithm number.",
+};
+const RULE_DNSSEC_DSA: RuleMeta = {
+  id: "dnssec-dsa-sig",
+  title: "DNSSEC DSA signing algorithm (deprecated)",
+  description:
+    "DNSSEC zone signed with the deprecated classical DSA algorithm (DSA/DSA-NSEC3-SHA1)",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "DSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "DNSSEC zone is signed with DSA/DSA-NSEC3-SHA1 — deprecated by RFC 8624 (MUST NOT sign) and, independent of that, forgeable once a CRQC exists.",
+  remediation:
+    "Re-sign with a non-deprecated algorithm today (RFC 8624); track IETF dnsop post-quantum DNSSEC signing work (ML-DSA) for the eventual PQC migration.",
+};
+
+/** True when `content` carries some DNSSEC-specific marker (not just a bare algorithm token). */
+function hasDnssecMarker(content: string): boolean {
+  return (
+    content.includes("DNSKEY") ||
+    content.includes("RRSIG") ||
+    /dnssec/i.test(content) ||
+    /ldns-signzone|dnssec-signzone/.test(content)
+  );
+}
+
+interface DnssecRule {
+  meta: RuleMeta;
+  res: readonly RegExp[];
+}
+
+const DNSSEC_RULES: readonly DnssecRule[] = [
+  { meta: RULE_DNSSEC_RSA, res: [RE_NAMED_RSA, RE_DNSKEY_RSA] },
+  { meta: RULE_DNSSEC_ECDSA, res: [RE_NAMED_ECDSA, RE_DNSKEY_ECDSA] },
+  { meta: RULE_DNSSEC_EDDSA, res: [RE_NAMED_EDDSA, RE_DNSKEY_EDDSA] },
+  { meta: RULE_DNSSEC_DSA, res: [RE_NAMED_DSA, RE_DNSKEY_DSA] },
+];
+
+/** Detects classical DNSSEC signing algorithms in zone files and signer config. */
+export const dnssecDetector: Detector = {
+  id: "dnssec-crypto",
+  description: "Classical DNSSEC signing algorithms in zone files / signer config",
+  scope: "config",
+  language: "any",
+  rules: DNSSEC_RULES.map((r) => r.meta),
+  appliesTo: (f) => hasExtension(f, DNSSEC_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    if (!hasDnssecMarker(content)) return [];
+
+    const findings: Finding[] = [];
+    for (const { meta, res } of DNSSEC_RULES) {
+      for (const re of res) {
+        eachMatch(re, content, (m) =>
+          findings.push(
+            findingFromRule(meta, { file, content, index: m.index, matchLength: m[0].length }),
+          ),
+        );
+      }
+    }
+    return findings;
+  },
+};