@quantakrypto/core 0.4.3 → 0.4.4

package/src/detectors/mesh.ts

@@ -0,0 +1,154 @@
+/**
+ * Config detector: classical crypto in SERVICE MESH configuration — the
+ * control-plane identity/CA systems and mesh-internal TLS settings of
+ * Linkerd, HashiCorp Consul Connect, and Istio. These mint the mTLS identity
+ * certificates that secure sidecar-to-sidecar traffic and are configured in
+ * their own Helm values / HCL / CRD surfaces, distinct from what `k8s.ts`
+ * already covers (cert-manager `Certificate`/`Issuer` keys and Istio's
+ * `minProtocolVersion` TLS floor — NOT duplicated here).
+ *
+ * Covered (gated by a mesh marker in the document to keep generic keys like
+ * `scheme:` / `private_key_type` from firing on unrelated YAML/HCL):
+ *  - Linkerd control-plane identity issuer: Helm values `identityTrustAnchorsPEM`
+ *    and `identity.issuer.scheme` / nested `issuer.scheme: linkerd.io/tls` — the
+ *    default self-managed Linkerd identity scheme, which mints workload
+ *    certificates from an ECDSA P-256 trust anchor. Flagged as a classical mesh
+ *    CA (certificate, ECDSA, hndl:false) since Linkerd's identity issuer signs
+ *    forgeable-by-quantum leaf certs, not a confidentiality key.
+ *  - HashiCorp Consul Connect: the `connect { ca_config { private_key_type =
+ *    "ec" | "rsa" } } }` mesh CA provider setting (also `ca_provider`). Flagged
+ *    as a classical mesh CA (certificate; ECDSA for "ec", RSA for "rsa").
+ *  - Istio `DestinationRule` / `Gateway` `tls.cipherSuites:` listing a classical
+ *    `ECDHE-RSA-*` / `ECDHE-ECDSA-*` suite — the (EC)DHE key exchange in these
+ *    suites is classical and harvest-now-decrypt-later exposed (tls, ECDH,
+ *    hndl:true). This complements, and does not duplicate, `k8s.ts`'s
+ *    `minProtocolVersion` legacy-TLS-floor rule.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO, CWE_RISKY_PRIMITIVE } from "../cwe.js";
+
+const MESH_EXTENSIONS: readonly string[] = [".yaml", ".yml", ".hcl"];
+
+// Linkerd's default self-managed identity scheme (`linkerd.io/tls`, as opposed
+// to a `kubernetes.io/tls` bring-your-own-cert secret) mints its trust anchor
+// and issuer credentials as ECDSA P-256 by default. Matched in both nested
+// YAML form (`scheme: linkerd.io/tls`) and the flattened Helm `--set`/values
+// key form (`identity.issuer.scheme: linkerd.io/tls`), plus the distinctive
+// `identityTrustAnchorsPEM` values key which only exists in Linkerd charts.
+const RE_MESH_LINKERD_ECDSA =
+  /identityTrustAnchorsPEM\b|(?:identity\.issuer\.scheme|scheme)\s*[:=]\s*["']?linkerd\.io\/tls\b/g;
+
+// Consul Connect's CA provider config: `private_key_type = "ec" | "rsa"`
+// inside a `ca_config` block. Matched in both HCL (`=`) and JSON (`:`) forms,
+// mirroring the terraform.ts attribute-matching convention.
+const RE_MESH_CONSUL_RSA = /(?<![\w"-])"?private_key_type"?\s*[:=]\s*"rsa"/gi;
+const RE_MESH_CONSUL_EC = /(?<![\w"-])"?private_key_type"?\s*[:=]\s*"ec"/gi;
+
+// Istio mesh TLS cipher suites: OpenSSL-style suite names naming classical
+// ECDHE key exchange combined with an RSA or ECDSA certificate. These are
+// distinctive tokens (no generic-config collision risk).
+const RE_MESH_ISTIO_CLASSICAL_CIPHER = /\bECDHE-(?:RSA|ECDSA)-[A-Z0-9_-]+\b/g;
+
+const RULE_MESH_LINKERD_ECDSA: RuleMeta = {
+  id: "mesh-linkerd-identity-ecdsa",
+  title: "Linkerd ECDSA identity issuer",
+  description: "Linkerd control-plane identity issuer (default ECDSA P-256 mesh CA)",
+  category: "certificate",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Linkerd's control-plane identity issuer mints workload certificates from a classical ECDSA P-256 trust anchor by default, forgeable by a quantum attacker.",
+  remediation:
+    "Plan migration to ML-DSA-65 (FIPS 204) once Linkerd's identity issuer supports PQC signing.",
+};
+const RULE_MESH_CONSUL_RSA: RuleMeta = {
+  id: "mesh-consul-connect-rsa",
+  title: "Consul Connect RSA mesh CA",
+  description: 'Consul Connect ca_config private_key_type = "rsa"',
+  category: "certificate",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Consul Connect's mesh CA issues leaf certificates from a classical RSA private key, which is not quantum-safe.",
+  remediation:
+    "Plan migration to PQC certificate keys (ML-DSA-65) as the Connect CA provider adds support.",
+};
+const RULE_MESH_CONSUL_EC: RuleMeta = {
+  id: "mesh-consul-connect-ec",
+  title: "Consul Connect EC mesh CA",
+  description: 'Consul Connect ca_config private_key_type = "ec"',
+  category: "certificate",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Consul Connect's mesh CA issues leaf certificates from a classical EC private key, forgeable by a quantum attacker.",
+  remediation: "Plan migration to ML-DSA-65 (FIPS 204) as the Connect CA provider adds support.",
+};
+const RULE_MESH_ISTIO_CLASSICAL_CIPHER: RuleMeta = {
+  id: "mesh-istio-classical-cipher",
+  title: "Istio classical ECDHE cipher suite",
+  description:
+    "Istio DestinationRule/Gateway tls.cipherSuites lists a classical ECDHE-RSA/ECDHE-ECDSA suite",
+  category: "tls",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_RISKY_PRIMITIVE,
+  message:
+    "Istio mesh TLS cipher suite allows classical ECDHE key exchange, which is harvest-now-decrypt-later exposed.",
+  remediation:
+    "Prefer TLS 1.3 AEAD suites and track PQC-hybrid mesh key exchange (X25519MLKEM768) as Envoy/BoringSSL adds support.",
+};
+
+/**
+ * Detects classical asymmetric crypto in service-mesh configuration: Linkerd's
+ * default ECDSA identity issuer, Consul Connect's mesh CA private key type,
+ * and classical ECDHE cipher suites in Istio DestinationRule/Gateway TLS
+ * policy.
+ */
+export const meshDetector: Detector = {
+  id: "service-mesh-crypto",
+  description:
+    "Classical crypto in service-mesh config (Linkerd identity, Consul Connect CA, Istio cipher suites)",
+  scope: "config",
+  language: "any",
+  rules: [
+    RULE_MESH_LINKERD_ECDSA,
+    RULE_MESH_CONSUL_RSA,
+    RULE_MESH_CONSUL_EC,
+    RULE_MESH_ISTIO_CLASSICAL_CIPHER,
+  ],
+  appliesTo: (f) => hasExtension(f, MESH_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const isLinkerd = content.includes("linkerd") || content.includes("identityTrustAnchors");
+    const isConsulConnect = content.includes("consul") && content.includes("connect");
+    const isIstioCipher = content.includes("DestinationRule") || content.includes("cipherSuites");
+    if (!isLinkerd && !isConsulConnect && !isIstioCipher) return [];
+
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, content, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    if (isLinkerd) add(RE_MESH_LINKERD_ECDSA, RULE_MESH_LINKERD_ECDSA);
+    if (isConsulConnect) {
+      add(RE_MESH_CONSUL_RSA, RULE_MESH_CONSUL_RSA);
+      add(RE_MESH_CONSUL_EC, RULE_MESH_CONSUL_EC);
+    }
+    if (isIstioCipher) add(RE_MESH_ISTIO_CLASSICAL_CIPHER, RULE_MESH_ISTIO_CLASSICAL_CIPHER);
+    return findings;
+  },
+};

package/src/detectors/messaging.ts

@@ -0,0 +1,98 @@
+/**
+ * Config detector: classical transport crypto in message brokers / event streams
+ * (Kafka, RabbitMQ, MQTT/Mosquitto, NATS). Broker traffic is "communication
+ * between things"; a legacy TLS floor or a classical (EC)DHE cipher suite makes
+ * every message in flight harvest-now-decrypt-later exposed.
+ *
+ * Covered in broker config files (`.properties`, `.conf`, `.cfg`, `.ini`):
+ *  - Kafka `ssl.protocol` / `ssl.enabled.protocols = TLSv1 | TLSv1.1` (legacy).
+ *  - MQTT/Mosquitto `tls_version tlsv1 | tlsv1.1` (legacy).
+ *  - Kafka `ssl.cipher.suites` naming a classical `ECDHE_RSA` / `ECDHE_ECDSA` /
+ *    `TLS_RSA` suite — the harvestable key-exchange path.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_RISKY_PRIMITIVE, CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+const MQ_EXTENSIONS: readonly string[] = [".properties", ".conf", ".cfg", ".ini"];
+
+interface MqRule {
+  re: RegExp;
+  meta: RuleMeta;
+}
+
+const MQ_RULES: MqRule[] = [
+  {
+    // Match TLSv1 (=1.0) and TLSv1.1 but never TLSv1.2 / TLSv1.3: the negative
+    // lookahead stops "TLSv1" from matching the "TLSv1" inside "TLSv1.3".
+    re: /\bssl\.(?:enabled\.)?protocols?\s*=\s*[^\n]*\bTLSv1(?:\.1)?(?![.\d])/gi,
+    meta: {
+      id: "mq-kafka-legacy-tls",
+      title: "Kafka legacy TLS protocol",
+      description: "Kafka ssl.protocol / ssl.enabled.protocols permits TLS 1.0 / 1.1",
+      category: "tls",
+      severity: "medium",
+      confidence: "high",
+      hndl: false,
+      cwe: CWE_RISKY_PRIMITIVE,
+      message:
+        "Kafka broker permits legacy TLS 1.0/1.1; its classical key exchange is weak and harvestable.",
+      remediation: "Require TLS 1.3 and track PQC-hybrid KEX (X25519MLKEM768).",
+    },
+  },
+  {
+    re: /\btls_version\s+tlsv1(?:\.1)?(?![.\d])/gi,
+    meta: {
+      id: "mq-mqtt-legacy-tls",
+      title: "MQTT legacy TLS version",
+      description: "Mosquitto/MQTT tls_version permits TLS 1.0 / 1.1",
+      category: "tls",
+      severity: "medium",
+      confidence: "high",
+      hndl: false,
+      cwe: CWE_RISKY_PRIMITIVE,
+      message:
+        "MQTT broker permits legacy TLS 1.0/1.1; its classical key exchange is weak and harvestable.",
+      remediation: "Require TLS 1.3 and track PQC-hybrid KEX for device fleets.",
+    },
+  },
+  {
+    re: /\bssl\.cipher\.suites\s*=\s*[^\n]*(?:ECDHE_RSA|ECDHE_ECDSA|TLS_RSA|_DHE_RSA)/g,
+    meta: {
+      id: "mq-classical-cipher",
+      title: "Broker classical (EC)DHE cipher suite",
+      description: "Kafka ssl.cipher.suites names a classical ECDHE/DHE/RSA suite",
+      category: "tls",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "ECDH",
+      hndl: true,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "Broker TLS is pinned to a classical (EC)DHE/RSA cipher suite; the key exchange is harvest-now-decrypt-later exposed.",
+      remediation:
+        "Move to TLS 1.3 with a PQC-hybrid group (X25519MLKEM768) once the broker/runtime supports it.",
+    },
+  },
+];
+
+/** Detects classical transport crypto in message-broker / event-stream config. */
+export const messagingDetector: Detector = {
+  id: "messaging-transport",
+  description: "Classical transport crypto in message brokers (Kafka, MQTT, RabbitMQ, NATS)",
+  scope: "config",
+  language: "any",
+  rules: MQ_RULES.map((r) => r.meta),
+  appliesTo: (f) => hasExtension(f, MQ_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    for (const rule of MQ_RULES) {
+      eachMatch(rule.re, content, (m) => {
+        findings.push(
+          findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }),
+        );
+      });
+    }
+    return findings;
+  },
+};

package/src/detectors/pem.ts

@@ -51,7 +51,7 @@ const PEM_RULES: PemRule[] = [
       sensitive: true,
       message: "Embedded EC private key (SEC1 PEM); classical ECDSA/ECDH key, not quantum-safe.",
       remediation:
-        "Migrate to ML-DSA (FIPS 204) keys and remove embedded private keys from source.",
+        "Migrate to ML-DSA (FIPS 204) for signatures or hybrid X25519MLKEM768 for key agreement; remove embedded private keys from source.",
     },
   },
   {

package/src/detectors/php.ts

@@ -0,0 +1,225 @@
+/**
+ * Source-code detector for classical asymmetric cryptography in PHP — one of the
+ * most-deployed backend languages, previously uncovered. Handles the three
+ * dominant crypto surfaces:
+ *
+ *  - **ext/openssl** — `openssl_pkey_new()` (classified by its
+ *    `OPENSSL_KEYTYPE_*` config, defaulting to RSA), `openssl_public_encrypt` /
+ *    `openssl_private_decrypt` (RSA), and `openssl_sign` / `openssl_verify`.
+ *  - **phpseclib3** — `RSA::createKey()` / `EC::createKey()` / `DSA::createKey()`.
+ *  - **libsodium** — `sodium_crypto_box`/`kx` keypairs (X25519) and
+ *    `sodium_crypto_sign` keypairs (Ed25519).
+ *
+ * Lexical, like the other packs; the `openssl_*` / `sodium_crypto_*` prefixes and
+ * `OPENSSL_KEYTYPE_*` constants are distinctive, so the false-positive rate is low.
+ *
+ * HNDL: RSA encryption and (EC/X)DH key agreement are harvest-now-decrypt-later
+ * exposed (hndl:true); ECDSA / DSA / Ed25519 signatures are hndl:false but
+ * forgeable. `openssl_pkey_new` EC and `EC::createKey` are ambiguous (feed BOTH
+ * ECDSA and ECDH), classified conservatively as key-exchange-capable (hndl:true).
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { PHP_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+const RE_PHP_PKEY_NEW = /\bopenssl_pkey_new\s*\(/g;
+const RE_PHP_RSA_CRYPT = /\bopenssl_(?:public_encrypt|private_decrypt)\s*\(/g;
+const RE_PHP_SIGN = /\bopenssl_(?:sign|verify)\s*\(/g;
+// phpseclib3 factory methods. The class names are generic, so require `::createKey`.
+const RE_PHP_SECLIB = /\b(RSA|EC|DSA|DH)::createKey\s*\(/g;
+// libsodium X25519 (box / kx / scalarmult) and Ed25519 (sign) key pairs.
+const RE_PHP_SODIUM_X25519 =
+  /\bsodium_crypto_(?:box|kx)_(?:seed_)?keypair\s*\(|\bsodium_crypto_scalarmult(?:_base)?\s*\(/g;
+const RE_PHP_SODIUM_ED25519 = /\bsodium_crypto_sign_(?:seed_)?keypair\s*\(/g;
+
+/** Key-type classification for `openssl_pkey_new`, keyed by its config constant. */
+interface KeyInfo {
+  algo: Finding["algorithm"];
+  cat: Finding["category"];
+  sev: Finding["severity"];
+  hndl: boolean;
+  label: string;
+  remediation?: string;
+}
+const HYBRID = "hybrid X25519MLKEM768 (ML-KEM-768) for key agreement; ML-DSA-65 (FIPS 204) to sign";
+
+const RULE_PHP_KEYGEN: RuleMeta = {
+  id: "php-openssl-keygen",
+  title: "PHP openssl key generation",
+  description: "openssl_pkey_new (RSA/EC/DSA/DH, by OPENSSL_KEYTYPE_*)",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Generates a classical key pair via PHP openssl_pkey_new — not quantum-safe.",
+};
+const RULE_PHP_RSA_CRYPT: RuleMeta = {
+  id: "php-openssl-rsa-crypt",
+  title: "PHP openssl RSA public-key encryption",
+  description: "openssl_public_encrypt / openssl_private_decrypt",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "RSA public-key encryption/decryption (PHP openssl) is harvest-now-decrypt-later exposed.",
+};
+const RULE_PHP_SIGN: RuleMeta = {
+  id: "php-openssl-sign",
+  title: "PHP openssl signature",
+  description: "openssl_sign / openssl_verify",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "unknown",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Classical signature via PHP openssl (RSA/ECDSA/DSA) is forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_PHP_SECLIB: RuleMeta = {
+  id: "php-phpseclib-keygen",
+  title: "PHP phpseclib key generation",
+  description: "phpseclib3 RSA/EC/DSA/DH ::createKey",
+  category: "kem",
+  severity: "high",
+  confidence: "medium",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Generates a classical key pair via phpseclib3 (createKey) — not quantum-safe.",
+};
+const RULE_PHP_SODIUM_X25519: RuleMeta = {
+  id: "php-sodium-x25519",
+  title: "PHP libsodium X25519 key agreement",
+  description: "sodium_crypto_box/kx keypair + scalarmult",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "X25519",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "libsodium crypto_box/kx (PHP) uses X25519 key agreement — modern but classical, harvest-now-decrypt-later exposed.",
+};
+const RULE_PHP_SODIUM_ED25519: RuleMeta = {
+  id: "php-sodium-ed25519",
+  title: "PHP libsodium Ed25519 signature",
+  description: "sodium_crypto_sign keypair",
+  category: "signature",
+  severity: "low",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "libsodium crypto_sign (PHP) uses Ed25519 — classical and forgeable by a quantum attacker.",
+};
+
+/** phpseclib class name → its classification. */
+const SECLIB_INFO: Record<string, KeyInfo> = {
+  RSA: { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" },
+  EC: {
+    algo: "ECDH",
+    cat: "key-exchange",
+    sev: "high",
+    hndl: true,
+    label: "EC (ECDSA/ECDH)",
+    remediation: HYBRID,
+  },
+  DSA: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
+  DH: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
+};
+
+/** Classify `openssl_pkey_new` by the `OPENSSL_KEYTYPE_*` constant in its config.
+ * The window is bounded to the current statement (up to the next `;`, capped at
+ * 300 chars) so it can't bleed into a following `openssl_pkey_new` call's key
+ * type. Defaults to RSA — openssl_pkey_new's own default private_key_type is RSA
+ * when none is given. */
+function classifyPkeyNew(content: string, index: number): KeyInfo {
+  const semi = content.indexOf(";", index);
+  const end = Math.min(index + 300, semi === -1 ? content.length : semi);
+  const w = content.slice(index, end);
+  if (/\bOPENSSL_KEYTYPE_EC\b/.test(w)) return SECLIB_INFO.EC;
+  if (/\bOPENSSL_KEYTYPE_DSA\b/.test(w)) return SECLIB_INFO.DSA;
+  if (/\bOPENSSL_KEYTYPE_DH\b/.test(w)) return SECLIB_INFO.DH;
+  return SECLIB_INFO.RSA;
+}
+
+/** Detects classical asymmetric crypto in PHP (openssl, phpseclib, libsodium). */
+export const phpDetector: Detector = {
+  id: "php-crypto",
+  description: "Classical asymmetric crypto in PHP (openssl, phpseclib3, libsodium)",
+  scope: "source",
+  language: "php",
+  rules: [
+    RULE_PHP_KEYGEN,
+    RULE_PHP_RSA_CRYPT,
+    RULE_PHP_SIGN,
+    RULE_PHP_SECLIB,
+    RULE_PHP_SODIUM_X25519,
+    RULE_PHP_SODIUM_ED25519,
+  ],
+  appliesTo: (f) => hasExtension(f, PHP_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta): void =>
+      eachMatch(re, content, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+
+    // openssl_pkey_new — one finding per call, classified by its key-type config.
+    eachMatch(RE_PHP_PKEY_NEW, content, (m) => {
+      const info = classifyPkeyNew(content, m.index);
+      findings.push(
+        findingFromRule(
+          RULE_PHP_KEYGEN,
+          { file, content, index: m.index, matchLength: m[0].length },
+          {
+            title: `PHP openssl ${info.label} key generation`,
+            category: info.cat,
+            severity: info.sev,
+            algorithm: info.algo,
+            hndl: info.hndl,
+            message: `Generates a classical ${info.label} key pair via PHP openssl_pkey_new — not quantum-safe.`,
+            ...(info.remediation ? { remediation: info.remediation } : {}),
+          },
+        ),
+      );
+    });
+
+    add(RE_PHP_RSA_CRYPT, RULE_PHP_RSA_CRYPT);
+    add(RE_PHP_SIGN, RULE_PHP_SIGN);
+
+    // phpseclib3 ::createKey — classify by the class (RSA/EC/DSA/DH).
+    eachMatch(RE_PHP_SECLIB, content, (m) => {
+      const info = SECLIB_INFO[m[1]];
+      findings.push(
+        findingFromRule(
+          RULE_PHP_SECLIB,
+          { file, content, index: m.index, matchLength: m[0].length },
+          {
+            title: `PHP phpseclib ${info.label} key generation`,
+            category: info.cat,
+            severity: info.sev,
+            algorithm: info.algo,
+            hndl: info.hndl,
+            message: `Generates a classical ${info.label} key pair via phpseclib3 createKey — not quantum-safe.`,
+            ...(info.remediation ? { remediation: info.remediation } : {}),
+          },
+        ),
+      );
+    });
+
+    add(RE_PHP_SODIUM_X25519, RULE_PHP_SODIUM_X25519);
+    add(RE_PHP_SODIUM_ED25519, RULE_PHP_SODIUM_ED25519);
+    return findings;
+  },
+};

package/src/detectors/python.ts

@@ -241,6 +241,63 @@ const RULE_PY_TLS_LEGACY: RuleMeta = {
     "Use ssl.PROTOCOL_TLS_CLIENT with minimum_version = ssl.TLSVersion.TLSv1_3 and prefer PQC-hybrid key exchange.",
 };
 
+/**
+ * Aliasable `cryptography` / PyCryptodome modules → the (method, rule) pairs
+ * reachable through them. Lets an aliased module import
+ * (`from ... import rsa as _rsa` → `_rsa.generate_private_key(`) resolve back to
+ * the same rule the direct `rsa.generate_private_key(` would fire, since the
+ * detector's regexes are module-qualified and miss a renamed prefix.
+ */
+const PY_MODULE_RULES: Record<string, ReadonlyArray<{ method: string; rule: RuleMeta }>> = {
+  rsa: [{ method: "generate_private_key", rule: RULE_PY_RSA_KEYGEN }],
+  ec: [
+    { method: "generate_private_key", rule: RULE_PY_EC_KEYGEN },
+    { method: "ECDSA", rule: RULE_PY_ECDSA },
+    { method: "ECDH", rule: RULE_PY_ECDH },
+  ],
+  dsa: [{ method: "generate_private_key", rule: RULE_PY_HAZMAT_DSA }],
+  dh: [{ method: "generate_parameters", rule: RULE_PY_DH }],
+  padding: [{ method: "OAEP", rule: RULE_PY_RSA_ENCRYPT }],
+  // PyCryptodome factory modules (`.generate(`).
+  RSA: [{ method: "generate", rule: RULE_PY_RSA_KEYGEN }],
+  ECC: [{ method: "generate", rule: RULE_PY_EC_KEYGEN }],
+  DSA: [{ method: "generate", rule: RULE_PY_DSA }],
+};
+
+/** Escape a string for interpolation into a dynamically-built RegExp. */
+function escapePyRe(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/**
+ * Collect module aliases for the aliasable crypto modules, so a later
+ * `<alias>.<method>(` call still resolves. Handles both `from <path> import
+ * <mod> as <alias>` (including comma-separated specifiers) and the bare
+ * `import <path.mod> as <alias>`. Returns Map<module, alias[]>; an alias equal to
+ * its own module name is skipped (matched directly already).
+ */
+function collectPyModuleAliases(content: string): Map<string, string[]> {
+  const out = new Map<string, string[]>();
+  const add = (mod: string, alias: string): void => {
+    if (!alias || alias === mod || !(mod in PY_MODULE_RULES)) return;
+    const list = out.get(mod) ?? [];
+    if (!list.includes(alias)) list.push(alias);
+    out.set(mod, list);
+  };
+  // `from <path> import a as b, c as d` — scan the import list for `X as Y`.
+  const fromRe = /(?:^|\n)[ \t]*from\s+[\w.]+\s+import\s+([^\n#]+)/g;
+  for (let m = fromRe.exec(content); m; m = fromRe.exec(content)) {
+    const specRe = /([A-Za-z_]\w*)\s+as\s+([A-Za-z_]\w*)/g;
+    for (let s = specRe.exec(m[1]); s; s = specRe.exec(m[1])) add(s[1], s[2]);
+  }
+  // `import <path.mod> as <alias>` — the aliased module is the last dotted segment.
+  const impRe = /(?:^|\n)[ \t]*import\s+([\w.]+)\s+as\s+([A-Za-z_]\w*)/g;
+  for (let m = impRe.exec(content); m; m = impRe.exec(content)) {
+    add(m[1].split(".").pop() ?? m[1], m[2]);
+  }
+  return out;
+}
+
 /** Detects classical asymmetric crypto in Python source. */
 export const pythonDetector: Detector = {
   id: "python-crypto",
@@ -286,6 +343,20 @@ export const pythonDetector: Detector = {
     add(RE_PY_TLS_REJECT, RULE_PY_TLS_REJECT);
     add(RE_PY_TLS_LEGACY, RULE_PY_TLS_LEGACY);
 
+    // Module-alias resolution: `from ... import rsa as _rsa` then
+    // `_rsa.generate_private_key(` — the direct regexes are module-qualified
+    // (`\brsa\.`) and miss a renamed prefix. Runs on the ORIGINAL content so
+    // locations stay exact; fires only for an alias explicitly bound to a known
+    // crypto module, so precision is unaffected.
+    for (const [mod, aliasList] of collectPyModuleAliases(content)) {
+      for (const alias of aliasList) {
+        const a = escapePyRe(alias);
+        for (const { method, rule } of PY_MODULE_RULES[mod]) {
+          add(new RegExp(`\\b${a}\\.${method}\\s*\\(`, "g"), rule);
+        }
+      }
+    }
+
     return findings;
   },
 };

package/src/detectors/rust.ts

@@ -115,6 +115,18 @@ const RULE_RUST_X25519: RuleMeta = {
   cwe: CWE_BROKEN_CRYPTO,
   message: "X25519 (Rust) is modern but still classical key agreement — harvest-now-decrypt-later.",
 };
+const RULE_RUST_X448: RuleMeta = {
+  id: "rust-x448",
+  title: "Rust X448 key agreement",
+  description: "the `x448` crate Secret key agreement",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "X448",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "X448 (Rust) is modern but still classical key agreement — harvest-now-decrypt-later.",
+};
 const RULE_RUST_OPENSSL_RSA: RuleMeta = {
   id: "rust-openssl-rsa",
   title: "Rust openssl RSA key generation",
@@ -251,6 +263,51 @@ const RULE_RUST_TLS_DANGEROUS: RuleMeta = {
   remediation: "Avoid the dangerous() escape hatch; keep the default certificate verifier.",
 };
 
+/**
+ * Aliasable Rust crypto types (`<crate>::<OrigType>` → rule). A renamed `use`
+ * (`use x25519_dalek::{EphemeralSecret as MontgomerySecret}`) binds the alias to a
+ * classical-key type; a later `MontgomerySecret::<ctor>(` is that key's
+ * construction. The `::`-qualified and braced rules above miss this because the
+ * call site uses the renamed identifier, not the original path.
+ */
+const RUST_ALIASABLE: Record<string, RuleMeta> = {
+  "x25519_dalek::EphemeralSecret": RULE_RUST_X25519,
+  "x25519_dalek::StaticSecret": RULE_RUST_X25519,
+  "x448::Secret": RULE_RUST_X448,
+  "ed25519_dalek::SigningKey": RULE_RUST_ED25519,
+  "ed25519_dalek::Keypair": RULE_RUST_ED25519,
+  "ed25519_dalek::SecretKey": RULE_RUST_ED25519,
+};
+
+/** Escape a string for interpolation into a dynamically-built RegExp. */
+function escapeRustRe(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/**
+ * Collect `use <crate>::<OrigType> as <Alias>` bindings (braced or single) that
+ * rename an aliasable crypto type, returning {alias, rule} pairs. An alias equal
+ * to its own type name is skipped (the qualified/bare rules already catch it).
+ */
+function collectRustTypeAliases(content: string): Array<{ alias: string; rule: RuleMeta }> {
+  const out: Array<{ alias: string; rule: RuleMeta }> = [];
+  const push = (crate: string, orig: string, alias: string): void => {
+    if (!alias || alias === orig) return;
+    const rule = RUST_ALIASABLE[`${crate}::${orig}`];
+    if (rule) out.push({ alias, rule });
+  };
+  // Braced: `use <crate>::{ Orig as Alias, ... }`.
+  const braced = /\buse\s+([\w:]+)::\{([^}]*)\}/g;
+  for (let m = braced.exec(content); m; m = braced.exec(content)) {
+    const specRe = /([A-Za-z_]\w*)\s+as\s+([A-Za-z_]\w*)/g;
+    for (let s = specRe.exec(m[2]); s; s = specRe.exec(m[2])) push(m[1], s[1], s[2]);
+  }
+  // Single: `use <crate>::Orig as Alias;`.
+  const single = /\buse\s+([\w:]+)::([A-Za-z_]\w*)\s+as\s+([A-Za-z_]\w*)/g;
+  for (let m = single.exec(content); m; m = single.exec(content)) push(m[1], m[2], m[3]);
+  return out;
+}
+
 /** Detects classical asymmetric crypto in Rust (rsa, ring, dalek, p256/k256). */
 export const rustDetector: Detector = {
   id: "rust-crypto",
@@ -263,6 +320,7 @@ export const rustDetector: Detector = {
     RULE_RUST_ECDH,
     RULE_RUST_ED25519,
     RULE_RUST_X25519,
+    RULE_RUST_X448,
     RULE_RUST_OPENSSL_RSA,
     RULE_RUST_OPENSSL_EC,
     RULE_RUST_OPENSSL_DSA,
@@ -311,6 +369,19 @@ export const rustDetector: Detector = {
     });
     add(RE_RUST_TLS_ACCEPT_INVALID, RULE_RUST_TLS_ACCEPT_INVALID);
     add(RE_RUST_TLS_DANGEROUS, RULE_RUST_TLS_DANGEROUS);
+
+    // Type-alias resolution: `use x25519_dalek::{EphemeralSecret as MontgomerySecret}`
+    // then `MontgomerySecret::random_from_rng(` — the braced+renamed `use` defeats
+    // the `::`-qualified rules. Match the aliased type's construction calls; runs
+    // on the ORIGINAL content so locations stay exact, and fires only for an alias
+    // explicitly bound to a known crypto type (precision-safe).
+    for (const { alias, rule } of collectRustTypeAliases(content)) {
+      const a = escapeRustRe(alias);
+      add(
+        new RegExp(`\\b${a}::(?:new|random|random_from_rng|generate|from_bytes)\\s*\\(`, "g"),
+        rule,
+      );
+    }
     return findings;
   },
 };