@quantakrypto/core 0.4.3 → 0.5.0

package/dist/detectors/source.js

@@ -1,4 +1,4 @@
-import { JS_TS_EXTENSIONS, DOC_EXTENSIONS, JWT_HOST_EXTENSIONS, eachMatch, findingFromRule, hasExtension, nearSortedCall, } from "../detect-utils.js";
+import { JS_TS_EXTENSIONS, DOC_EXTENSIONS, JWT_HOST_EXTENSIONS, eachMatch, enclosingObject, findingFromRule, hasExtension, nearSortedCall, } from "../detect-utils.js";
 import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cwe.js";
 /* -------------------------------------------------------------------------- */
 /* Precompiled regexes (module scope — never recreated per file)              */
@@ -6,6 +6,107 @@ import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cw
 // `rsa-pss` is listed before `rsa` so the alternation consumes the full token
 // (ordered alternation would otherwise match `rsa` and reject the `-pss` tail).
 const RE_GENERATE_KEYPAIR = /generateKeyPair(?:Sync)?\s*\(\s*['"`](rsa-pss|rsa|ec|dsa|dh|x25519|x448|ed25519|ed448)['"`]/g;
+const KEYGEN_INFO = {
+    rsa: { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" },
+    // RSA-PSS is signature-only, so classify it as a (forgeable) signature
+    // rather than a KEM — no HNDL confidentiality exposure.
+    "rsa-pss": {
+        algo: "RSA",
+        cat: "signature",
+        sev: "high",
+        hndl: false,
+        label: "RSA-PSS",
+        message: "Generates a classical RSA-PSS signing key, which is forgeable by a quantum attacker.",
+        remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+    },
+    // EC keys feed BOTH ECDSA (sign) and ECDH (key agreement). ECDH is
+    // HNDL-exposed, so classify conservatively as key-exchange-capable and
+    // surface both concerns rather than asserting signature-only (P0-4).
+    ec: {
+        algo: "ECDH",
+        cat: "key-exchange",
+        sev: "high",
+        hndl: true,
+        label: "EC (ECDSA/ECDH)",
+        message: "Generates a classical EC key pair. EC keys feed BOTH ECDSA signatures " +
+            "and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
+        remediation: "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+    },
+    dsa: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
+    dh: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
+    x25519: { algo: "X25519", cat: "key-exchange", sev: "medium", hndl: true, label: "X25519" },
+    x448: { algo: "X448", cat: "key-exchange", sev: "medium", hndl: true, label: "X448" },
+    ed25519: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed25519" },
+    ed448: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed448" },
+};
+/** Emit a keygen finding for `generateKeyPair(Sync)('<type>')` at [index]. Shared
+ * by the direct matcher and the import-alias pass so both classify identically. */
+function pushKeygenFinding(findings, rawType, file, content, index, matchLength) {
+    const info = KEYGEN_INFO[rawType.toLowerCase()];
+    if (!info)
+        return;
+    findings.push(findingFromRule(RULE_NODE_KEYGEN, { file, content, index, matchLength }, {
+        title: `${info.label} key generation`,
+        category: info.cat,
+        severity: info.sev,
+        algorithm: info.algo,
+        hndl: info.hndl,
+        message: info.message ??
+            `Generates a classical ${info.label} key pair, which is not quantum-safe.`,
+        ...(info.remediation ? { remediation: info.remediation } : {}),
+    }));
+}
+/** Canonical Node-crypto call names whose import-aliases we resolve. */
+const ALIASABLE = [
+    "generateKeyPairSync",
+    "generateKeyPair",
+    "createECDH",
+    "createDiffieHellman",
+    "createDiffieHellmanGroup",
+];
+/**
+ * Collect import-aliases for the canonical crypto calls we resolve, so
+ * `import { generateKeyPairSync as gk } from 'node:crypto'` (or the CommonJS
+ * `const { generateKeyPairSync: gk } = require('crypto')`) is followed when `gk`
+ * is called later. Returns Map<canonical, alias[]>. An alias equal to its own
+ * canonical name is skipped (already matched directly). Precision-safe: the
+ * alias is only ever bound to a known crypto symbol, so a later `gk(` call is
+ * unambiguously that symbol.
+ */
+function collectCryptoAliases(content) {
+    const out = new Map();
+    const add = (canonical, alias) => {
+        if (!alias || alias === canonical)
+            return;
+        const list = out.get(canonical) ?? [];
+        if (!list.includes(alias))
+            list.push(alias);
+        out.set(canonical, list);
+    };
+    // ESM named imports: `import { A as B, C as D } from '...'`.
+    const esm = /import\s*(?:type\s+)?\{([^}]*)\}\s*from\s*['"][^'"]*['"]/g;
+    for (let m = esm.exec(content); m; m = esm.exec(content)) {
+        const spec = /([A-Za-z_$][\w$]*)\s+as\s+([A-Za-z_$][\w$]*)/g;
+        for (let s = spec.exec(m[1]); s; s = spec.exec(m[1])) {
+            if (ALIASABLE.includes(s[1]))
+                add(s[1], s[2]);
+        }
+    }
+    // CommonJS destructure-rename: `const { A: B } = require('...')`.
+    const cjs = /(?:const|let|var)\s*\{([^}]*)\}\s*=\s*require\s*\(\s*['"][^'"]*['"]\s*\)/g;
+    for (let m = cjs.exec(content); m; m = cjs.exec(content)) {
+        const spec = /([A-Za-z_$][\w$]*)\s*:\s*([A-Za-z_$][\w$]*)/g;
+        for (let s = spec.exec(m[1]); s; s = spec.exec(m[1])) {
+            if (ALIASABLE.includes(s[1]))
+                add(s[1], s[2]);
+        }
+    }
+    return out;
+}
+/** Escape a string for safe interpolation into a dynamically-built RegExp. */
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 const RE_CREATE_SIGN_VERIFY = /create(?:Sign|Verify)\s*\(/g;
 // One-shot crypto.sign/verify(algorithm, data, key). A LOOKBEHIND (not a
 // consumed char) anchors it so it doesn't fire inside identifiers like `assign(`
@@ -35,7 +136,7 @@ const RE_JSRSASIGN_KEYGEN = /KEYUTIL\.generateKeypair\s*\(/g;
 const RE_JSRSASIGN_SIGN = /KJUR\.crypto\.(?:Signature|ECDSA)\b/g;
 const RE_NODE_RSA = /new\s+NodeRSA\s*\(/g;
 // secp256k1 — direct @noble/secp256k1 / secp256k1-style API usage in source.
-const RE_SECP256K1 = /\b(?:secp(?:256k1)?|secp)\s*\.\s*(?:sign|verify|getPublicKey|getSharedSecret|ecdh|recoverPublicKey)\s*\(/g;
+const RE_SECP256K1 = /\b(?:secp(?:256k1)?|secp)\s*\.\s*(sign|verify|getPublicKey|getSharedSecret|ecdh|recoverPublicKey)\s*\(/g;
 // JWT/JOSE.
 const RE_JWT_ALG = /['"`](RS(?:256|384|512)|PS(?:256|384|512)|ES(?:256|384|512|256K)|EdDSA)['"`]/g;
 // JOSE ECDH-ES key agreement (HNDL) and COSE algorithm identifiers.
@@ -46,10 +147,14 @@ const RE_TLS_REJECT = /rejectUnauthorized\s*:\s*false/g;
 // Hardened cipher regex: bounded spans (no unbounded `[^'"`]*` straddling the
 // alternation), single-quote-style anchoring removed in favour of {0,256} bounds
 // so worst-case backtracking is linear in the bound, not the file (P0-6).
-// The `(?<![!-])` lookbehind skips OpenSSL EXCLUSION syntax — `!MD5` / `-RC4`
-// DISABLE those ciphers, so a hardened list like `...:!aNULL:!MD5:!RC4` must not
-// be flagged as weak (audit: crypto #7). A genuinely-enabled `RC4` still matches.
-const RE_TLS_WEAK_CIPHER = /ciphers\s*:\s*['"`][^'"`\n]{0,256}?\b(?<![!-])(RC4|DES|3DES|MD5|NULL|EXPORT|aNULL|eNULL)\b[^'"`\n]{0,256}?['"`]/gi;
+// Skip OpenSSL EXCLUSION syntax — `!MD5` / `:-RC4` / `!ECDHE-RSA-RC4-SHA` DISABLE
+// those ciphers, so a hardened list must not be flagged as weak (audit: crypto #7). The
+// single variable-length lookbehind walks back over the suite-name chars to the
+// ELEMENT boundary (`:` / whitespace / comma / quote / start) and rejects the match
+// when that element begins with `!` or `-` — covering a bare `!RC4`, a space-separated
+// `HIGH !RC4`, and a full-suite `!ECDHE-RSA-RC4-SHA`. The intra-name hyphen in a
+// genuinely-enabled `ECDHE-RSA-RC4-SHA` (no leading `!`/`-`) still matches.
+const RE_TLS_WEAK_CIPHER = /ciphers\s*:\s*['"`][^'"`\n]{0,256}?\b(?<![:'"`,\s]\s*[!-][\w-]{0,64})(RC4|DES|3DES|MD5|NULL|EXPORT|aNULL|eNULL)\b[^'"`\n]{0,256}?['"`]/gi;
 /* -------------------------------------------------------------------------- */
 /* Node.js `crypto` module                                                    */
 /* -------------------------------------------------------------------------- */
@@ -177,52 +282,41 @@ const nodeCryptoDetector = {
         const findings = [];
         // generateKeyPair(Sync)('rsa' | 'ec' | 'dsa' | 'dh' | 'x25519' | 'ed25519', ...)
         eachMatch(RE_GENERATE_KEYPAIR, content, (m) => {
-            const type = m[1].toLowerCase();
-            const map = {
-                rsa: { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" },
-                // RSA-PSS is signature-only, so classify it as a (forgeable) signature
-                // rather than a KEM — no HNDL confidentiality exposure.
-                "rsa-pss": {
-                    algo: "RSA",
-                    cat: "signature",
-                    sev: "high",
-                    hndl: false,
-                    label: "RSA-PSS",
-                    message: "Generates a classical RSA-PSS signing key, which is forgeable by a quantum attacker.",
-                    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
-                },
-                // EC keys feed BOTH ECDSA (sign) and ECDH (key agreement). ECDH is
-                // HNDL-exposed, so classify conservatively as key-exchange-capable and
-                // surface both concerns rather than asserting signature-only (P0-4).
-                ec: {
-                    algo: "ECDH",
-                    cat: "key-exchange",
-                    sev: "high",
-                    hndl: true,
-                    label: "EC (ECDSA/ECDH)",
-                    message: "Generates a classical EC key pair. EC keys feed BOTH ECDSA signatures " +
-                        "and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
-                    remediation: "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
-                },
-                dsa: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
-                dh: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
-                x25519: { algo: "X25519", cat: "key-exchange", sev: "medium", hndl: true, label: "X25519" },
-                x448: { algo: "X448", cat: "key-exchange", sev: "medium", hndl: true, label: "X448" },
-                ed25519: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed25519" },
-                ed448: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed448" },
-            };
-            const info = map[type];
-            findings.push(findingFromRule(RULE_NODE_KEYGEN, { file, content, index: m.index, matchLength: m[0].length }, {
-                title: `${info.label} key generation`,
-                category: info.cat,
-                severity: info.sev,
-                algorithm: info.algo,
-                hndl: info.hndl,
-                message: info.message ??
-                    `Generates a classical ${info.label} key pair, which is not quantum-safe.`,
-                ...(info.remediation ? { remediation: info.remediation } : {}),
-            }));
+            pushKeygenFinding(findings, m[1], file, content, m.index, m[0].length);
         });
+        // Import-alias resolution: follow `import { generateKeyPairSync as gk }` (and
+        // the CommonJS destructure-rename) so an aliased call still detects. Only the
+        // keygen / ECDH / DH constructors are resolved — their classification is
+        // unambiguous. The alias regexes run on the ORIGINAL content, so locations
+        // stay exact; it fires only when the alias was explicitly bound to a known
+        // crypto symbol, so precision is unaffected.
+        const aliases = collectCryptoAliases(content);
+        for (const [canonical, names] of aliases) {
+            for (const alias of names) {
+                const a = escapeRe(alias);
+                if (canonical === "generateKeyPairSync" || canonical === "generateKeyPair") {
+                    const re = new RegExp(`\\b${a}\\s*\\(\\s*['"\`](rsa-pss|rsa|ec|dsa|dh|x25519|x448|ed25519|ed448)['"\`]`, "g");
+                    eachMatch(re, content, (m) => pushKeygenFinding(findings, m[1], file, content, m.index, m[0].length));
+                }
+                else if (canonical === "createECDH") {
+                    eachMatch(new RegExp(`\\b${a}\\s*\\(`, "g"), content, (m) => findings.push(findingFromRule(RULE_NODE_ECDH, {
+                        file,
+                        content,
+                        index: m.index,
+                        matchLength: m[0].length,
+                    })));
+                }
+                else {
+                    // createDiffieHellman / createDiffieHellmanGroup.
+                    eachMatch(new RegExp(`\\b${a}\\s*\\(`, "g"), content, (m) => findings.push(findingFromRule(RULE_NODE_DH, {
+                        file,
+                        content,
+                        index: m.index,
+                        matchLength: m[0].length,
+                    })));
+                }
+            }
+        }
         // createSign / createVerify — RSA / ECDSA / DSA signatures.
         eachMatch(RE_CREATE_SIGN_VERIFY, content, (m) => {
             findings.push(findingFromRule(RULE_NODE_SIGN, {
@@ -343,7 +437,9 @@ const webCryptoDetector = {
                 algorithm = name === "X448" ? "X448" : "X25519";
                 category = "key-exchange";
                 hndl = true;
-                severity = "low"; // modern but classical
+                // `medium`, aligned with X25519/X448 key agreement in node/rust/go — HNDL-exposed
+                // key agreement scores the same regardless of which surface uses it.
+                severity = "medium";
             }
             else if (name === "ED25519" || name === "ED448") {
                 algorithm = "EdDSA";
@@ -485,7 +581,21 @@ const libraryDetector = {
         add(RE_FORGE_RSA, RULE_FORGE_RSA); // node-forge: pki.rsa.generateKeyPair(...)
         add(RE_FORGE_ED25519, RULE_FORGE_ED25519); // node-forge: forge.ed25519.*
         add(RE_ELLIPTIC_EC, RULE_ELLIPTIC_EC); // elliptic: new EC('secp256k1')
-        add(RE_SECP256K1, RULE_SECP256K1); // secp.sign / getPublicKey / getSharedSecret
+        // secp256k1: classify per method — getSharedSecret/ecdh are key AGREEMENT
+        // (ECDH, harvest-now-decrypt-later); sign/verify/getPublicKey/recover are
+        // ECDSA signatures (not HNDL). The old rule flagged everything as ECDSA.
+        eachMatch(RE_SECP256K1, content, (m) => {
+            const kex = m[1] === "getSharedSecret" || m[1] === "ecdh";
+            findings.push(findingFromRule(RULE_SECP256K1, { file, content, index: m.index, matchLength: m[0].length }, kex
+                ? {
+                    title: "secp256k1 ECDH key agreement",
+                    category: "key-exchange",
+                    algorithm: "ECDH",
+                    hndl: true,
+                    message: `secp256k1 ECDH key agreement (.${m[1]}()) is classical and harvest-now-decrypt-later exposed.`,
+                }
+                : undefined));
+        });
         add(RE_JSRSASIGN_KEYGEN, RULE_JSRSASIGN_KEYGEN); // jsrsasign: KEYUTIL.generateKeypair(...)
         add(RE_JSRSASIGN_SIGN, RULE_JSRSASIGN_SIGN); // jsrsasign: KJUR.crypto.*
         add(RE_NODE_RSA, RULE_NODE_RSA_LIB); // node-rsa: new NodeRSA(...)
@@ -555,8 +665,21 @@ const jwtDetector = {
     appliesTo: (f) => hasExtension(f, JWT_HOST_EXTENSIONS),
     detect({ file, content }) {
         const findings = [];
+        // Deferral guards against double-counting:
+        //  - webCryptoDetector owns a quoted `RSA-OAEP`/`ECDH-ES` sitting next to a
+        //    `subtle.*(` call (it matches the `RSA-OAEP`/`ECDH` name). Collect the subtle
+        //    call offsets so the JOSE key-management loops can skip those. (In non-JS host
+        //    files there are no subtle calls, so nothing is skipped.)
+        //  - jwkDetector owns any alg/`kty` that lives inside a JWK object; skip a token
+        //    whose enclosing `{…}` carries a `"kty"` so a JWK's own `alg` is not counted by
+        //    both detectors. Mirrors the same guard jose.ts applies for other languages.
+        const subtleCalls = [];
+        eachMatch(RE_SUBTLE_CALL, content, (m) => subtleCalls.push(m.index));
+        const inJwk = (index) => enclosingObject(content, index).includes('"kty"');
         // Classical JWS signature alg tokens. Anchored to quotes to avoid words.
         eachMatch(RE_JWT_ALG, content, (m) => {
+            if (inJwk(m.index))
+                return; // jwk-{rsa,ec,eddsa} owns a JWK's own alg
             const alg = m[1];
             let algorithm;
             if (alg.startsWith("RS") || alg.startsWith("PS"))
@@ -573,6 +696,10 @@ const jwtDetector = {
         });
         // JOSE ECDH-ES key agreement (and ECDH-ES+A*KW) — confidentiality, HNDL.
         eachMatch(RE_JOSE_ECDH, content, (m) => {
+            if (inJwk(m.index))
+                return; // jwk-ec owns a JWK's own alg
+            if (nearSortedCall(subtleCalls, m.index, 400))
+                return; // webcrypto owns it
             findings.push(findingFromRule(RULE_JOSE_ECDH, { file, content, index: m.index, matchLength: m[0].length }, {
                 title: `JOSE key agreement ${m[1]}`,
                 message: `JOSE "${m[1]}" performs classical ECDH key agreement — harvest-now-decrypt-later exposed.`,
@@ -580,6 +707,12 @@ const jwtDetector = {
         });
         // JOSE RSA key transport (RSA-OAEP / RSA1_5) — classical RSA encryption, HNDL.
         eachMatch(RE_JOSE_KEM, content, (m) => {
+            if (inJwk(m.index))
+                return; // jwk-rsa owns a JWK's own alg
+            // webCryptoDetector's regex matches `RSA-OAEP` but NOT `RSA1_5`, so only defer the
+            // OAEP form near a subtle call — deferring RSA1_5 would drop it entirely.
+            if (m[1].startsWith("RSA-OAEP") && nearSortedCall(subtleCalls, m.index, 400))
+                return;
             findings.push(findingFromRule(RULE_JOSE_RSA_OAEP, { file, content, index: m.index, matchLength: m[0].length }, {
                 title: `JOSE RSA key transport ${m[1]}`,
                 message: `JOSE "${m[1]}" is classical RSA key transport — harvest-now-decrypt-later exposed.`,
@@ -678,6 +811,55 @@ const RE_CERT_SIG_ALG = /\b(sha(?:1|256|384|512)WithRSAEncryption|ecdsa-with-SHA
 // Shor-broken key agreement — the harvest-now-decrypt-later surface a lexical
 // scan misses when only the `crypto/*` API is matched, not the negotiated kex.
 const RE_SSH_KEX = /\b(diffie-hellman-group(?:1|14|15|16|17|18)(?:-sha1|-sha256|-sha512)?|diffie-hellman-group-exchange-sha(?:1|256)|ecdh-sha2-nistp(?:256|384|521)|curve25519-sha256)\b/g;
+/**
+ * True when the match at `index` sits inside a DOCUMENTATION field value — a
+ * `description` / `help` / `summary` / `doc` / `comment` / `note` assignment
+ * (`key = "…"` or `key: "…"`), as used by Terraform/Packer variable descriptions,
+ * JSON-schema docs, etc. Classical KEX/cipher algorithm names LISTED in such a field
+ * are prose ("acceptable values include ecdh-sha2-nistp256, …"), not an active
+ * setting, so a transport-token rule must not fire on them. Scans the current line's
+ * prefix only (cheap; the common single-line description case).
+ */
+function inDocFieldValue(content, index) {
+    const lineStart = content.lastIndexOf("\n", index - 1) + 1;
+    const prefix = content.slice(lineStart, index);
+    return /\b(?:description|help|summary|doc|comment|note)\b\s*[:=]/i.test(prefix);
+}
+// A bare key-type token (`ssh-rsa`, `ssh-ed25519`, …) is real SSH crypto only
+// when it is EITHER (a) followed by base64 key material — an actual
+// authorized_keys / known_hosts entry — OR (b) one of ≥2 DISTINCT ssh key/host-key
+// algorithm tokens on the same line — an algorithm-preference list
+// (`HostKeyAlgorithms ssh-ed25519,ecdsa-sha2-nistp256,ssh-rsa`, `%w[…]`, …). A
+// lone token, e.g. a UI label / i18n value like `"ssh-rsa": "ssh-rsa"`, is
+// neither, so it must NOT be flagged. `RE_SSH_ALGO_TOKEN` is a separate (cloned-
+// on-use) copy so counting per line never disturbs the outer `eachMatch` state.
+const RE_SSH_ALGO_TOKEN = /\b(ssh-rsa|ssh-ed25519|ssh-dss|ecdsa-sha2-nistp(?:256|384|521))\b/g;
+/** How far around a token we look for a sibling algorithm on the same line. A
+ * real `HostKeyAlgorithms` list is short; bounding the window keeps the per-token
+ * work O(1) so a pathological single huge line can't make detection quadratic. */
+const SSH_LINE_WINDOW = 512;
+function isRealSshKeyOrAlgoList(content, index, matchLen) {
+    // (a) base64 key material immediately after the token → a real SSH public key.
+    if (/^\s+[A-Za-z0-9+/]{20,}/.test(content.slice(index + matchLen, index + matchLen + 80))) {
+        return true;
+    }
+    // (b) ≥2 distinct ssh key/host-key algorithm tokens on the same line → a list.
+    // Bound both the back-scan for the line start and the window itself so the work
+    // is constant per token and never crosses a line boundary (i18n entries live on
+    // separate lines, so a lone repeated token stays a single distinct token).
+    const from = Math.max(0, index - SSH_LINE_WINDOW);
+    const pre = content.slice(from, index);
+    const preNl = pre.lastIndexOf("\n");
+    const lineStart = preNl === -1 ? from : from + preNl + 1;
+    const to = Math.min(content.length, index + matchLen + SSH_LINE_WINDOW);
+    const post = content.slice(index, to);
+    const postNl = post.indexOf("\n");
+    const lineEnd = postNl === -1 ? to : index + postNl;
+    const distinct = new Set();
+    for (const t of content.slice(lineStart, lineEnd).matchAll(RE_SSH_ALGO_TOKEN))
+        distinct.add(t[1]);
+    return distinct.size >= 2;
+}
 const RULE_SSH_PUBKEY = {
     id: "ssh-public-key",
     title: "Classical SSH public key",
@@ -737,6 +919,10 @@ const sshCertDetector = {
         const findings = [];
         // SSH public keys: ssh-rsa AAAA…, ecdsa-sha2-nistp256 …, ssh-ed25519 …
         eachMatch(RE_SSH_PUBKEY, content, (m) => {
+            // Skip a bare token that is neither a real key nor an algorithm list (e.g.
+            // a `"ssh-rsa": "ssh-rsa"` i18n label) — see `isRealSshKeyOrAlgoList`.
+            if (!isRealSshKeyOrAlgoList(content, m.index, m[0].length))
+                return;
             const tok = m[1];
             const algorithm = tok.startsWith("ssh-rsa")
                 ? "RSA"
@@ -767,6 +953,8 @@ const sshCertDetector = {
         });
         // SSH key-exchange algorithm identifiers (finite-field DH / ECDH / X25519).
         eachMatch(RE_SSH_KEX, content, (m) => {
+            if (inDocFieldValue(content, m.index))
+                return; // names listed in a doc string
             const tok = m[1];
             const algorithm = tok.startsWith("diffie-hellman")
                 ? "DH"
@@ -822,6 +1010,8 @@ const tlsClassicalKexDetector = {
     detect({ file, content }) {
         const findings = [];
         eachMatch(RE_TLS_CLASSICAL_KEX, content, (m) => {
+            if (inDocFieldValue(content, m.index))
+                return; // names listed in a doc string
             const tok = m[0];
             const algorithm = tok.includes("ECDH") ? "ECDH" : "DH";
             findings.push(findingFromRule(RULE_TLS_CLASSICAL_KEX, { file, content, index: m.index, matchLength: m[0].length }, {