@quantakrypto/core 0.4.3 → 0.4.4

package/src/detectors/secrets.ts

@@ -0,0 +1,114 @@
+/**
+ * Config detector: secrets encrypted at rest with classical asymmetric key
+ * wrapping. This is the purest "harvest now, decrypt later" surface — the
+ * ciphertext is often committed to a git repository, which means it is already
+ * replicated, effectively immortal, and retroactively un-fixable (you can
+ * re-encrypt HEAD, not history). Every recipient key here is classical.
+ *
+ * Covered:
+ *  - Mozilla SOPS / age recipients: `age1…` bech32 public keys (X25519 key
+ *    agreement wrapping the data key).
+ *  - PGP-encrypted payloads: `-----BEGIN PGP MESSAGE-----` (RSA/ElGamal ESK).
+ *  - Bitnami Sealed Secrets: `kind: SealedSecret` (controller wraps with RSA-OAEP).
+ *
+ * Symmetric-only schemes (ansible-vault AES, age with a scrypt passphrase) are
+ * intentionally NOT flagged: a strong symmetric key is only Grover-weakened, not
+ * broken, so it is out of scope for a *classical-asymmetric* readiness signal.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+interface SecretRule {
+  re: RegExp;
+  meta: RuleMeta;
+}
+
+const SECRET_RULES: SecretRule[] = [
+  {
+    // age/SOPS recipient: `age1` + 58 bech32 chars. Distinctive enough for any file.
+    re: /\bage1[0-9a-z]{58}\b/g,
+    meta: {
+      id: "secrets-age-recipient",
+      title: "age / SOPS recipient (X25519)",
+      description: "An age (SOPS) recipient public key wraps secrets with classical X25519",
+      category: "key-exchange",
+      severity: "high",
+      confidence: "high",
+      algorithm: "X25519",
+      hndl: true,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "Secrets are wrapped to an age/SOPS X25519 recipient (classical key agreement); harvest-now-decrypt-later exposed, and if committed to git the ciphertext is retroactively un-fixable.",
+      remediation:
+        "Track a post-quantum age recipient / KMS (ML-KEM) and re-encrypt; rotate any secret whose ciphertext has left your control.",
+    },
+  },
+  {
+    re: /-----BEGIN PGP MESSAGE-----/g,
+    meta: {
+      id: "secrets-pgp-message",
+      title: "PGP-encrypted secret (RSA/ElGamal)",
+      description: "A PGP MESSAGE block: the session key is wrapped with classical RSA/ElGamal",
+      category: "kem",
+      severity: "high",
+      confidence: "high",
+      algorithm: "RSA",
+      hndl: true,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "A PGP-encrypted secret whose session key is wrapped with classical RSA/ElGamal; harvest-now-decrypt-later exposed.",
+      remediation:
+        "Re-encrypt with a post-quantum KEM (ML-KEM-768) once available; rotate the underlying secret.",
+    },
+  },
+  {
+    re: /\bkind:\s*["']?SealedSecret\b/g,
+    meta: {
+      id: "secrets-sealed-secret",
+      title: "Bitnami Sealed Secret (RSA-OAEP)",
+      description: "A SealedSecret is wrapped by the controller's classical RSA-OAEP key",
+      category: "kem",
+      severity: "high",
+      confidence: "high",
+      algorithm: "RSA",
+      hndl: true,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "A Bitnami SealedSecret is wrapped with the controller's classical RSA-OAEP key; harvest-now-decrypt-later exposed, and typically committed to git.",
+      remediation:
+        "Plan migration as sealed-secrets adds PQC support; rotate the sealing key and secrets when it does.",
+    },
+  },
+];
+
+/** Detects secrets encrypted at rest with classical asymmetric key wrapping. */
+export const secretsDetector: Detector = {
+  id: "secrets-at-rest",
+  description:
+    "Secrets wrapped at rest with classical asymmetric crypto (SOPS/age, PGP, Sealed Secrets)",
+  scope: "config",
+  language: "any",
+  rules: SECRET_RULES.map((r) => r.meta),
+  // Skip prose/docs: a tutorial showing an example age recipient is not a secret store.
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    // Fast reject: none of the distinctive markers present.
+    if (
+      !content.includes("age1") &&
+      !content.includes("BEGIN PGP MESSAGE") &&
+      !content.includes("SealedSecret")
+    ) {
+      return [];
+    }
+    const findings: Finding[] = [];
+    for (const rule of SECRET_RULES) {
+      eachMatch(rule.re, content, (m) => {
+        findings.push(
+          findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }),
+        );
+      });
+    }
+    return findings;
+  },
+};

package/src/detectors/source.ts

@@ -46,6 +46,135 @@ import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cw
 // (ordered alternation would otherwise match `rsa` and reject the `-pss` tail).
 const RE_GENERATE_KEYPAIR =
   /generateKeyPair(?:Sync)?\s*\(\s*['"`](rsa-pss|rsa|ec|dsa|dh|x25519|x448|ed25519|ed448)['"`]/g;
+
+/** Per-key-type classification for `generateKeyPair(Sync)('<type>', …)`. Hoisted
+ * to module scope so the direct matcher AND the import-alias pass (below) share
+ * one source of truth for how each key type is classified. */
+interface KeygenInfo {
+  algo: Finding["algorithm"];
+  cat: Finding["category"];
+  sev: Finding["severity"];
+  hndl: boolean;
+  label: string;
+  message?: string;
+  remediation?: string;
+}
+const KEYGEN_INFO: Record<string, KeygenInfo> = {
+  rsa: { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" },
+  // RSA-PSS is signature-only, so classify it as a (forgeable) signature
+  // rather than a KEM — no HNDL confidentiality exposure.
+  "rsa-pss": {
+    algo: "RSA",
+    cat: "signature",
+    sev: "high",
+    hndl: false,
+    label: "RSA-PSS",
+    message: "Generates a classical RSA-PSS signing key, which is forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+  },
+  // EC keys feed BOTH ECDSA (sign) and ECDH (key agreement). ECDH is
+  // HNDL-exposed, so classify conservatively as key-exchange-capable and
+  // surface both concerns rather than asserting signature-only (P0-4).
+  ec: {
+    algo: "ECDH",
+    cat: "key-exchange",
+    sev: "high",
+    hndl: true,
+    label: "EC (ECDSA/ECDH)",
+    message:
+      "Generates a classical EC key pair. EC keys feed BOTH ECDSA signatures " +
+      "and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
+    remediation:
+      "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+  },
+  dsa: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
+  dh: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
+  x25519: { algo: "X25519", cat: "key-exchange", sev: "medium", hndl: true, label: "X25519" },
+  x448: { algo: "X448", cat: "key-exchange", sev: "medium", hndl: true, label: "X448" },
+  ed25519: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed25519" },
+  ed448: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed448" },
+};
+
+/** Emit a keygen finding for `generateKeyPair(Sync)('<type>')` at [index]. Shared
+ * by the direct matcher and the import-alias pass so both classify identically. */
+function pushKeygenFinding(
+  findings: Finding[],
+  rawType: string,
+  file: string,
+  content: string,
+  index: number,
+  matchLength: number,
+): void {
+  const info = KEYGEN_INFO[rawType.toLowerCase()];
+  if (!info) return;
+  findings.push(
+    findingFromRule(
+      RULE_NODE_KEYGEN,
+      { file, content, index, matchLength },
+      {
+        title: `${info.label} key generation`,
+        category: info.cat,
+        severity: info.sev,
+        algorithm: info.algo,
+        hndl: info.hndl,
+        message:
+          info.message ??
+          `Generates a classical ${info.label} key pair, which is not quantum-safe.`,
+        ...(info.remediation ? { remediation: info.remediation } : {}),
+      },
+    ),
+  );
+}
+
+/** Canonical Node-crypto call names whose import-aliases we resolve. */
+const ALIASABLE: readonly string[] = [
+  "generateKeyPairSync",
+  "generateKeyPair",
+  "createECDH",
+  "createDiffieHellman",
+  "createDiffieHellmanGroup",
+];
+
+/**
+ * Collect import-aliases for the canonical crypto calls we resolve, so
+ * `import { generateKeyPairSync as gk } from 'node:crypto'` (or the CommonJS
+ * `const { generateKeyPairSync: gk } = require('crypto')`) is followed when `gk`
+ * is called later. Returns Map<canonical, alias[]>. An alias equal to its own
+ * canonical name is skipped (already matched directly). Precision-safe: the
+ * alias is only ever bound to a known crypto symbol, so a later `gk(` call is
+ * unambiguously that symbol.
+ */
+function collectCryptoAliases(content: string): Map<string, string[]> {
+  const out = new Map<string, string[]>();
+  const add = (canonical: string, alias: string): void => {
+    if (!alias || alias === canonical) return;
+    const list = out.get(canonical) ?? [];
+    if (!list.includes(alias)) list.push(alias);
+    out.set(canonical, list);
+  };
+  // ESM named imports: `import { A as B, C as D } from '...'`.
+  const esm = /import\s*(?:type\s+)?\{([^}]*)\}\s*from\s*['"][^'"]*['"]/g;
+  for (let m = esm.exec(content); m; m = esm.exec(content)) {
+    const spec = /([A-Za-z_$][\w$]*)\s+as\s+([A-Za-z_$][\w$]*)/g;
+    for (let s = spec.exec(m[1]); s; s = spec.exec(m[1])) {
+      if (ALIASABLE.includes(s[1])) add(s[1], s[2]);
+    }
+  }
+  // CommonJS destructure-rename: `const { A: B } = require('...')`.
+  const cjs = /(?:const|let|var)\s*\{([^}]*)\}\s*=\s*require\s*\(\s*['"][^'"]*['"]\s*\)/g;
+  for (let m = cjs.exec(content); m; m = cjs.exec(content)) {
+    const spec = /([A-Za-z_$][\w$]*)\s*:\s*([A-Za-z_$][\w$]*)/g;
+    for (let s = spec.exec(m[1]); s; s = spec.exec(m[1])) {
+      if (ALIASABLE.includes(s[1])) add(s[1], s[2]);
+    }
+  }
+  return out;
+}
+
+/** Escape a string for safe interpolation into a dynamically-built RegExp. */
+function escapeRe(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 const RE_CREATE_SIGN_VERIFY = /create(?:Sign|Verify)\s*\(/g;
 // One-shot crypto.sign/verify(algorithm, data, key). A LOOKBEHIND (not a
 // consumed char) anchors it so it doesn't fire inside identifiers like `assign(`
@@ -82,7 +211,7 @@ const RE_JSRSASIGN_SIGN = /KJUR\.crypto\.(?:Signature|ECDSA)\b/g;
 const RE_NODE_RSA = /new\s+NodeRSA\s*\(/g;
 // secp256k1 — direct @noble/secp256k1 / secp256k1-style API usage in source.
 const RE_SECP256K1 =
-  /\b(?:secp(?:256k1)?|secp)\s*\.\s*(?:sign|verify|getPublicKey|getSharedSecret|ecdh|recoverPublicKey)\s*\(/g;
+  /\b(?:secp(?:256k1)?|secp)\s*\.\s*(sign|verify|getPublicKey|getSharedSecret|ecdh|recoverPublicKey)\s*\(/g;
 
 // JWT/JOSE.
 const RE_JWT_ALG = /['"`](RS(?:256|384|512)|PS(?:256|384|512)|ES(?:256|384|512|256K)|EdDSA)['"`]/g;
@@ -238,74 +367,54 @@ const nodeCryptoDetector: Detector = {
 
     // generateKeyPair(Sync)('rsa' | 'ec' | 'dsa' | 'dh' | 'x25519' | 'ed25519', ...)
     eachMatch(RE_GENERATE_KEYPAIR, content, (m) => {
-      const type = m[1].toLowerCase();
-      const map: Record<
-        string,
-        {
-          algo: Finding["algorithm"];
-          cat: Finding["category"];
-          sev: Finding["severity"];
-          hndl: boolean;
-          label: string;
-          message?: string;
-          remediation?: string;
-        }
-      > = {
-        rsa: { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" },
-        // RSA-PSS is signature-only, so classify it as a (forgeable) signature
-        // rather than a KEM — no HNDL confidentiality exposure.
-        "rsa-pss": {
-          algo: "RSA",
-          cat: "signature",
-          sev: "high",
-          hndl: false,
-          label: "RSA-PSS",
-          message:
-            "Generates a classical RSA-PSS signing key, which is forgeable by a quantum attacker.",
-          remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
-        },
-        // EC keys feed BOTH ECDSA (sign) and ECDH (key agreement). ECDH is
-        // HNDL-exposed, so classify conservatively as key-exchange-capable and
-        // surface both concerns rather than asserting signature-only (P0-4).
-        ec: {
-          algo: "ECDH",
-          cat: "key-exchange",
-          sev: "high",
-          hndl: true,
-          label: "EC (ECDSA/ECDH)",
-          message:
-            "Generates a classical EC key pair. EC keys feed BOTH ECDSA signatures " +
-            "and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
-          remediation:
-            "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
-        },
-        dsa: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
-        dh: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
-        x25519: { algo: "X25519", cat: "key-exchange", sev: "medium", hndl: true, label: "X25519" },
-        x448: { algo: "X448", cat: "key-exchange", sev: "medium", hndl: true, label: "X448" },
-        ed25519: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed25519" },
-        ed448: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed448" },
-      };
-      const info = map[type];
-      findings.push(
-        findingFromRule(
-          RULE_NODE_KEYGEN,
-          { file, content, index: m.index, matchLength: m[0].length },
-          {
-            title: `${info.label} key generation`,
-            category: info.cat,
-            severity: info.sev,
-            algorithm: info.algo,
-            hndl: info.hndl,
-            message:
-              info.message ??
-              `Generates a classical ${info.label} key pair, which is not quantum-safe.`,
-            ...(info.remediation ? { remediation: info.remediation } : {}),
-          },
-        ),
-      );
+      pushKeygenFinding(findings, m[1], file, content, m.index, m[0].length);
     });
 
+    // Import-alias resolution: follow `import { generateKeyPairSync as gk }` (and
+    // the CommonJS destructure-rename) so an aliased call still detects. Only the
+    // keygen / ECDH / DH constructors are resolved — their classification is
+    // unambiguous. The alias regexes run on the ORIGINAL content, so locations
+    // stay exact; it fires only when the alias was explicitly bound to a known
+    // crypto symbol, so precision is unaffected.
+    const aliases = collectCryptoAliases(content);
+    for (const [canonical, names] of aliases) {
+      for (const alias of names) {
+        const a = escapeRe(alias);
+        if (canonical === "generateKeyPairSync" || canonical === "generateKeyPair") {
+          const re = new RegExp(
+            `\\b${a}\\s*\\(\\s*['"\`](rsa-pss|rsa|ec|dsa|dh|x25519|x448|ed25519|ed448)['"\`]`,
+            "g",
+          );
+          eachMatch(re, content, (m) =>
+            pushKeygenFinding(findings, m[1], file, content, m.index, m[0].length),
+          );
+        } else if (canonical === "createECDH") {
+          eachMatch(new RegExp(`\\b${a}\\s*\\(`, "g"), content, (m) =>
+            findings.push(
+              findingFromRule(RULE_NODE_ECDH, {
+                file,
+                content,
+                index: m.index,
+                matchLength: m[0].length,
+              }),
+            ),
+          );
+        } else {
+          // createDiffieHellman / createDiffieHellmanGroup.
+          eachMatch(new RegExp(`\\b${a}\\s*\\(`, "g"), content, (m) =>
+            findings.push(
+              findingFromRule(RULE_NODE_DH, {
+                file,
+                content,
+                index: m.index,
+                matchLength: m[0].length,
+              }),
+            ),
+          );
+        }
+      }
+    }
+
     // createSign / createVerify — RSA / ECDSA / DSA signatures.
     eachMatch(RE_CREATE_SIGN_VERIFY, content, (m) => {
       findings.push(
@@ -611,7 +720,27 @@ const libraryDetector: Detector = {
     add(RE_FORGE_RSA, RULE_FORGE_RSA); // node-forge: pki.rsa.generateKeyPair(...)
     add(RE_FORGE_ED25519, RULE_FORGE_ED25519); // node-forge: forge.ed25519.*
     add(RE_ELLIPTIC_EC, RULE_ELLIPTIC_EC); // elliptic: new EC('secp256k1')
-    add(RE_SECP256K1, RULE_SECP256K1); // secp.sign / getPublicKey / getSharedSecret
+    // secp256k1: classify per method — getSharedSecret/ecdh are key AGREEMENT
+    // (ECDH, harvest-now-decrypt-later); sign/verify/getPublicKey/recover are
+    // ECDSA signatures (not HNDL). The old rule flagged everything as ECDSA.
+    eachMatch(RE_SECP256K1, content, (m) => {
+      const kex = m[1] === "getSharedSecret" || m[1] === "ecdh";
+      findings.push(
+        findingFromRule(
+          RULE_SECP256K1,
+          { file, content, index: m.index, matchLength: m[0].length },
+          kex
+            ? {
+                title: "secp256k1 ECDH key agreement",
+                category: "key-exchange",
+                algorithm: "ECDH",
+                hndl: true,
+                message: `secp256k1 ECDH key agreement (.${m[1]}()) is classical and harvest-now-decrypt-later exposed.`,
+              }
+            : undefined,
+        ),
+      );
+    });
     add(RE_JSRSASIGN_KEYGEN, RULE_JSRSASIGN_KEYGEN); // jsrsasign: KEYUTIL.generateKeypair(...)
     add(RE_JSRSASIGN_SIGN, RULE_JSRSASIGN_SIGN); // jsrsasign: KJUR.crypto.*
     add(RE_NODE_RSA, RULE_NODE_RSA_LIB); // node-rsa: new NodeRSA(...)
@@ -852,6 +981,41 @@ const RE_CERT_SIG_ALG =
 const RE_SSH_KEX =
   /\b(diffie-hellman-group(?:1|14|15|16|17|18)(?:-sha1|-sha256|-sha512)?|diffie-hellman-group-exchange-sha(?:1|256)|ecdh-sha2-nistp(?:256|384|521)|curve25519-sha256)\b/g;
 
+// A bare key-type token (`ssh-rsa`, `ssh-ed25519`, …) is real SSH crypto only
+// when it is EITHER (a) followed by base64 key material — an actual
+// authorized_keys / known_hosts entry — OR (b) one of ≥2 DISTINCT ssh key/host-key
+// algorithm tokens on the same line — an algorithm-preference list
+// (`HostKeyAlgorithms ssh-ed25519,ecdsa-sha2-nistp256,ssh-rsa`, `%w[…]`, …). A
+// lone token, e.g. a UI label / i18n value like `"ssh-rsa": "ssh-rsa"`, is
+// neither, so it must NOT be flagged. `RE_SSH_ALGO_TOKEN` is a separate (cloned-
+// on-use) copy so counting per line never disturbs the outer `eachMatch` state.
+const RE_SSH_ALGO_TOKEN = /\b(ssh-rsa|ssh-ed25519|ssh-dss|ecdsa-sha2-nistp(?:256|384|521))\b/g;
+/** How far around a token we look for a sibling algorithm on the same line. A
+ * real `HostKeyAlgorithms` list is short; bounding the window keeps the per-token
+ * work O(1) so a pathological single huge line can't make detection quadratic. */
+const SSH_LINE_WINDOW = 512;
+function isRealSshKeyOrAlgoList(content: string, index: number, matchLen: number): boolean {
+  // (a) base64 key material immediately after the token → a real SSH public key.
+  if (/^\s+[A-Za-z0-9+/]{20,}/.test(content.slice(index + matchLen, index + matchLen + 80))) {
+    return true;
+  }
+  // (b) ≥2 distinct ssh key/host-key algorithm tokens on the same line → a list.
+  // Bound both the back-scan for the line start and the window itself so the work
+  // is constant per token and never crosses a line boundary (i18n entries live on
+  // separate lines, so a lone repeated token stays a single distinct token).
+  const from = Math.max(0, index - SSH_LINE_WINDOW);
+  const pre = content.slice(from, index);
+  const preNl = pre.lastIndexOf("\n");
+  const lineStart = preNl === -1 ? from : from + preNl + 1;
+  const to = Math.min(content.length, index + matchLen + SSH_LINE_WINDOW);
+  const post = content.slice(index, to);
+  const postNl = post.indexOf("\n");
+  const lineEnd = postNl === -1 ? to : index + postNl;
+  const distinct = new Set<string>();
+  for (const t of content.slice(lineStart, lineEnd).matchAll(RE_SSH_ALGO_TOKEN)) distinct.add(t[1]);
+  return distinct.size >= 2;
+}
+
 const RULE_SSH_PUBKEY: RuleMeta = {
   id: "ssh-public-key",
   title: "Classical SSH public key",
@@ -917,6 +1081,9 @@ const sshCertDetector: Detector = {
 
     // SSH public keys: ssh-rsa AAAA…, ecdsa-sha2-nistp256 …, ssh-ed25519 …
     eachMatch(RE_SSH_PUBKEY, content, (m) => {
+      // Skip a bare token that is neither a real key nor an algorithm list (e.g.
+      // a `"ssh-rsa": "ssh-rsa"` i18n label) — see `isRealSshKeyOrAlgoList`.
+      if (!isRealSshKeyOrAlgoList(content, m.index, m[0].length)) return;
       const tok = m[1];
       const algorithm: Finding["algorithm"] = tok.startsWith("ssh-rsa")
         ? "RSA"

package/src/detectors/stateful-hbs.ts

@@ -39,8 +39,9 @@ interface HbsRule {
 
 const HBS_RULES: HbsRule[] = [
   {
-    // LMS parameter set, e.g. LMS_SHA256_M32_H10 (RFC 8554 / SP 800-208).
-    re: /\bLMS_SHA256_[MN]\d+_[HW]\d+\b/g,
+    // LMS parameter set, e.g. LMS_SHA256_M32_H10 / LMS_SHAKE_M24_H10 (SP 800-208
+    // adds SHAKE256 and the 192-bit M24/N24 sets to RFC 8554's SHA-256 sets).
+    re: /\bLMS_(?:SHA256|SHAKE(?:256)?)_[MN]\d+_[HW]\d+\b/g,
     meta: {
       id: "stateful-hbs-lms-param",
       title: "LMS parameter set (stateful hash-based signature)",
@@ -93,8 +94,9 @@ const HBS_RULES: HbsRule[] = [
     },
   },
   {
-    // XMSS parameter set, e.g. XMSS-SHA2_10_256 (RFC 8391 / SP 800-208).
-    re: /\bXMSS-SHA2_\d+_256\b/g,
+    // XMSS parameter set, e.g. XMSS-SHA2_10_256 / XMSS-SHAKE256_10_192 (SP 800-208
+    // adds the SHAKE256 and 192-bit variants to RFC 8391's SHA-2/256 sets).
+    re: /\bXMSS-(?:SHA2|SHAKE(?:256)?)_\d+_(?:192|256)\b/g,
     meta: {
       id: "stateful-hbs-xmss-param",
       title: "XMSS parameter set (stateful hash-based signature)",
@@ -111,8 +113,9 @@ const HBS_RULES: HbsRule[] = [
     },
   },
   {
-    // XMSSMT (multi-tree XMSS) parameter set, e.g. XMSSMT-SHA2_20/2_256.
-    re: /\bXMSSMT-SHA2_\d+\b/g,
+    // XMSSMT (multi-tree XMSS) parameter set, e.g. XMSSMT-SHA2_20/2_256 or the
+    // SP 800-208 SHAKE256 variant XMSSMT-SHAKE256_20/2_256.
+    re: /\bXMSSMT-(?:SHA2|SHAKE(?:256)?)_\d+\b/g,
     meta: {
       id: "stateful-hbs-xmssmt-param",
       title: "XMSSMT parameter set (stateful hash-based signature)",

package/src/detectors/terraform.ts

@@ -0,0 +1,154 @@
+/**
+ * IaC detector: classical asymmetric cryptography provisioned by Terraform /
+ * OpenTofu (`.tf`, `.tf.json`). Infrastructure-as-code mints real keys and CMKs
+ * that never appear in application source, so this is a distinct surface from the
+ * language packs.
+ *
+ * Covered:
+ *  - hashicorp/tls `tls_private_key`:      `algorithm = "RSA" | "ECDSA"`
+ *  - Google Cloud KMS `version_template`:  `algorithm = "RSA_SIGN_…" | "EC_SIGN_…"`
+ *  - AWS KMS `aws_kms_key`:                `customer_master_key_spec = "RSA_…" | "ECC_…"`
+ *  - Azure `azurerm_key_vault_key`:        `key_type = "RSA" | "EC"` (+ HSM variants)
+ *
+ * The HCL assignment forms (`algorithm = "…"`, `customer_master_key_spec = "…"`,
+ * `key_type = "…"`) are specific enough inside `.tf` files that the false-positive
+ * risk is low. EC keys are classified conservatively as key-agreement-capable
+ * (hndl:true) since a provisioned EC key can feed ECDH.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+const TF_EXTENSIONS: readonly string[] = [".tf", ".tf.json"];
+
+// Each attribute is matched in BOTH HCL (`algorithm = "RSA"`) and the `.tf.json`
+// variant (`"algorithm": "RSA"`): an optional quote around the key, and `:` or
+// `=` as the separator. The `(?<![\w"-])` lookbehind stops a longer attribute
+// name (`my_algorithm`) from matching on its suffix.
+// RSA: tls_private_key `"RSA"` plus the Google KMS `RSA_SIGN_…` / `RSA_DECRYPT_…`.
+const RE_TF_RSA = /(?<![\w"-])"?algorithm"?\s*[:=]\s*"RSA(?:_[A-Z0-9_]+)?"/g;
+// ECDSA / EC signing: tls_private_key `"ECDSA"` and Google KMS `"EC_SIGN_…"`.
+const RE_TF_ECDSA = /(?<![\w"-])"?algorithm"?\s*[:=]\s*"(?:ECDSA|EC_SIGN_[A-Z0-9_]+)"/g;
+// AWS KMS customer master key specs.
+const RE_TF_KMS_RSA = /(?<![\w"-])"?customer_master_key_spec"?\s*[:=]\s*"RSA_\d+"/g;
+const RE_TF_KMS_EC = /(?<![\w"-])"?customer_master_key_spec"?\s*[:=]\s*"ECC_[A-Z0-9_]+"/g;
+// Azure Key Vault key type (incl. the `-HSM` variants).
+const RE_TF_AZ_RSA = /(?<![\w"-])"?key_type"?\s*[:=]\s*"RSA(?:-HSM)?"/g;
+const RE_TF_AZ_EC = /(?<![\w"-])"?key_type"?\s*[:=]\s*"EC(?:-HSM)?"/g;
+
+const RULE_TF_RSA: RuleMeta = {
+  id: "tf-rsa-key",
+  title: "Terraform RSA key",
+  description: "Terraform tls_private_key / KMS RSA key material",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Terraform provisions a classical RSA key, which is not quantum-safe.",
+  remediation: "Plan migration to PQC (ML-KEM-768 for encryption, ML-DSA-65 for signatures).",
+};
+const RULE_TF_ECDSA: RuleMeta = {
+  id: "tf-ecdsa-key",
+  title: "Terraform ECDSA key",
+  description: "Terraform tls_private_key / KMS EC signing key",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Terraform provisions a classical ECDSA key, forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+};
+const RULE_TF_KMS_RSA: RuleMeta = {
+  id: "tf-kms-rsa",
+  title: "Terraform AWS KMS RSA CMK",
+  description: 'Terraform aws_kms_key customer_master_key_spec = "RSA_*"',
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Terraform provisions a classical RSA KMS customer master key (harvest-now-decrypt-later exposed for encryption CMKs).",
+  remediation: "Plan migration to PQC as cloud KMS adds ML-KEM / ML-DSA key specs.",
+};
+const RULE_TF_KMS_EC: RuleMeta = {
+  id: "tf-kms-ec",
+  title: "Terraform AWS KMS EC CMK",
+  description: 'Terraform aws_kms_key customer_master_key_spec = "ECC_*"',
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Terraform provisions a classical EC KMS customer master key; EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+const RULE_TF_AZ_RSA: RuleMeta = {
+  id: "tf-keyvault-rsa",
+  title: "Terraform Azure Key Vault RSA key",
+  description: 'Terraform azurerm_key_vault_key key_type = "RSA"',
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Terraform provisions a classical RSA Azure Key Vault key, which is not quantum-safe.",
+  remediation: "Plan migration to PQC (ML-KEM-768 / ML-DSA-65).",
+};
+const RULE_TF_AZ_EC: RuleMeta = {
+  id: "tf-keyvault-ec",
+  title: "Terraform Azure Key Vault EC key",
+  description: 'Terraform azurerm_key_vault_key key_type = "EC"',
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Terraform provisions a classical EC Azure Key Vault key; EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+
+/** Detects classical asymmetric crypto provisioned in Terraform / OpenTofu. */
+export const terraformDetector: Detector = {
+  id: "terraform-crypto",
+  description: "Classical asymmetric crypto provisioned by Terraform / OpenTofu (IaC)",
+  scope: "config",
+  language: "any",
+  rules: [
+    RULE_TF_RSA,
+    RULE_TF_ECDSA,
+    RULE_TF_KMS_RSA,
+    RULE_TF_KMS_EC,
+    RULE_TF_AZ_RSA,
+    RULE_TF_AZ_EC,
+  ],
+  appliesTo: (f) => hasExtension(f, TF_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, content, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    add(RE_TF_RSA, RULE_TF_RSA);
+    add(RE_TF_ECDSA, RULE_TF_ECDSA);
+    add(RE_TF_KMS_RSA, RULE_TF_KMS_RSA);
+    add(RE_TF_KMS_EC, RULE_TF_KMS_EC);
+    add(RE_TF_AZ_RSA, RULE_TF_AZ_RSA);
+    add(RE_TF_AZ_EC, RULE_TF_AZ_EC);
+    return findings;
+  },
+};