@quantakrypto/core 0.4.3 → 0.5.0

package/dist/detectors/weak-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"weak-hash.js","sourceRoot":"","sources":["../../src/detectors/weak-hash.ts"],"names":[],"mappings":"AAiEA,OAAO,EACL,cAAc,EACd,SAAS,EACT,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,kFAAkF;AAClF,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,MAAM,YAAY,GAAG,mCAAmC,CAAC;AACzD,iDAAiD;AACjD,MAAM,YAAY,GAAG,mEAAmE,CAAC;AACzF,kFAAkF;AAClF,6DAA6D;AAC7D,MAAM,WAAW,GAAG,2EAA2E,CAAC;AAChG,kFAAkF;AAClF,oFAAoF;AACpF,gFAAgF;AAChF,kFAAkF;AAClF,qFAAqF;AACrF,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAA,kDAAkD,CAAC;AAClF,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,qBAAqB,YAAY,sDAAsD,YAAY,EAAE,EACrG,IAAI,CACL,CAAC;AACF,kFAAkF;AAClF,kFAAkF;AAClF,kEAAkE;AAClE,4EAA4E;AAC5E,kEAAkE;AAClE,MAAM,cAAc,GAClB,8EAA8E,CAAC;AAEjF,kFAAkF;AAClF,MAAM,WAAW,GAAG,gCAAgC,CAAC;AACrD,MAAM,WAAW,GAAG,4BAA4B,CAAC;AACjD,MAAM,UAAU,GAAG,gDAAgD,CAAC;AACpE,MAAM,cAAc,GAAG,IAAI,MAAM,CAC/B,qBAAqB,YAAY,oDAAoD,YAAY,EAAE,EACnG,IAAI,CACL,CAAC;AACF,MAAM,aAAa,GAAG,wEAAwE,CAAC;AAE/F,MAAM,SAAS,GAAa;IAC1B,EAAE,EAAE,0BAA0B;IAC9B,KAAK,EAAE,8CAA8C;IACrD,WAAW,EACT,4FAA4F;IAC9F,QAAQ,EAAE,MAAM;IAChB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,sSAAsS;IACxS,WAAW,EACT,gNAAgN;CACnN,CAAC;AACF,MAAM,QAAQ,GAAa;IACzB,EAAE,EAAE,yBAAyB;IAC7B,KAAK,EAAE,4CAA4C;IACnD,WAAW,EACT,0FAA0F;IAC5F,QAAQ,EAAE,MAAM;IAChB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,0SAA0S;IAC5S,WAAW,EACT,qOAAqO;CACxO,CAAC;AAOF,MAAM,eAAe,GAA4B;IAC/C;QACE,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,CAAC;KAChF;IACD,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,CAAC,EAAE;CAC/F,CAAC;AAEF;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,IACE,uFAAuF,CAAC,IAAI,CAC1F,OAAO,CACR,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,sDAAsD,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACtF,IAAI,iDAAiD,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,0EAA0E;IAC1E,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,0CAA0C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,EAAE,EAAE,qBAAqB;IACzB,WAAW,EAAE,6EAA6E;IAC1F,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,4EAA4E;IAC5E,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;IAClD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,0EAA0E;QAC1E,sEAAsE;QACtE,6DAA6D;QAC7D,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QAE5C,sEAAsE;QACtE,wEAAwE;QACxE,qDAAqD;QACrD,MAAM,IAAI,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,eAAe,EAAE,CAAC;YAC5C,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;gBACrB,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACxB,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config/source detector: weak hash functions (SHA-1, MD5) used specifically in\n * a DIGITAL-SIGNATURE or X.509 CERTIFICATE algorithm — NOT generic hashing and\n * NOT password hashing.\n *\n * WHY THIS LIVES IN A PQC-READINESS TOOL (quantum-adjacent, not quantum-broken).\n * SHA-1/MD5 are not \"quantum-broken\" — Grover only halves preimage strength and\n * a CRQC does not conjure signature-hash collisions. We flag them anyway, and\n * frame them as *quantum-adjacent: same migration window*:\n *   - NIST SP 800-131A Rev 3 disallows SHA-1 for generating digital signatures\n *     and retires SHA-1 entirely by 2030 — the SAME transition window the same\n *     document sets for the classical→PQC migration. One standard, one deadline.\n *   - CNSA 2.0 pairs its PQC mandate (ML-KEM / ML-DSA) with SHA-384/512; a\n *     CNSA-2.0 target that re-keys to PQC must also drop SHA-1 from its\n *     signature/certificate chain in the same effort.\n *   - A quantum-readiness migration RE-KEYS and RE-SIGNS every certificate and\n *     signature anyway. Surfacing weak signature hashes in that same pass costs\n *     nothing extra and closes a today-exploitable gap (SHA-1/MD5 signature\n *     forgery via chosen-prefix collisions) alongside the future one.\n * We deliberately do NOT claim these hashes are broken by quantum computers.\n *\n * WHY THE SCOPE IS NARROW (signature/certificate ONLY).\n * A bare `sha1(x)` or `sha1sum file` is often a perfectly acceptable\n * non-security checksum (ETags, cache keys, content addressing, Git object ids).\n * PASSWORD hashing with a weak/fast hash is a real weakness too, but it is a\n * DIFFERENT weakness (CWE-916, needs a slow KDF like Argon2/bcrypt/scrypt), a\n * different remediation, and — crucially — is NOT on the PQC migration path, so\n * it does not belong in this detector. We only fire when the weak hash is bound\n * to a signature/certificate algorithm, where \"move to SHA-256+ while you re-key\n * for PQC\" is exactly the right, single remediation. That binding is enforced by\n * a file-level fast-reject marker (see `hasSignatureMarker`) plus regexes that\n * only match signature/cert *algorithm identifiers*, never a lone hash call.\n *\n * SURFACES COVERED (all verified signature/certificate contexts):\n *  1. Java JCA standard names — `Signature.getInstance(\"SHA1withRSA\")`,\n *     `\"MD5withRSA\"`, `\"SHA1withDSA\"`, `\"SHA1withECDSA\"` (JDK Standard Algorithm\n *     Names). Regex anchors on the `…with(RSA|DSA|ECDSA)` shape, so the token is\n *     unambiguously a signature algorithm, never a bare digest.\n *  2. .NET signing calls — a weak hash passed to `.SignData(…)` / `.SignHash(…)`\n *     as `HashAlgorithmName.SHA1` or the legacy string `\"SHA1\"` (e.g.\n *     `RSACryptoServiceProvider.SignData(data, \"SHA1\")`). Matched only INSIDE the\n *     sign call, so an unrelated `HashAlgorithmName.SHA1` used for a checksum is\n *     not flagged.\n *  3. X.509 / ASN.1 signature-algorithm identifiers — the OID *names*\n *     (`sha1WithRSAEncryption`, `md5WithRSAEncryption`, `ecdsa-with-SHA1`,\n *     `dsaWithSHA1`) and their dotted OIDs (`1.2.840.113549.1.1.5` =\n *     sha1WithRSAEncryption, `1.2.840.113549.1.1.4` = md5WithRSAEncryption,\n *     `1.2.840.10045.4.1` = ecdsa-with-SHA1). These are certificate\n *     signatureAlgorithm values by definition.\n *  4. OpenSSL CLI in a signing/cert context — `-sha1` / `-md5` on the same line\n *     as `openssl` AND a certificate/signing subcommand or flag\n *     (`req` / `x509` / `ca` / `-sign` / `-signkey`). A bare `openssl dgst -sha1\n *     file` (a checksum, no `-sign`) is intentionally NOT matched.\n *\n * NOT DUPLICATED: XML-DSig `rsa-sha1` (see `xmldsig.ts`) and DKIM `rsa-sha1`\n * (see `dkim.ts`) already emit SIGNATURE findings on their own surfaces; this\n * detector deliberately does not touch those and focuses on the Java / .NET /\n * X.509 / OpenSSL surfaces above.\n *\n * Category is `hash` (weak/pre-quantum hash usage — the previously-unused\n * category). `hndl: false` — a signature has no confidentiality to harvest.\n * `algorithm: \"unknown\"` — the weak *hash* is not itself an asymmetric family;\n * the signature it weakens is (RSA/ECDSA/DSA), but the finding is about the hash.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport {\n  DOC_EXTENSIONS,\n  eachMatch,\n  findingFromRule,\n  hasExtension,\n  maskBlockComments,\n  maskCommentLines,\n} from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\n// --- SHA-1 in a signature/certificate algorithm identifier ---------------------\n// Java JCA standard names: `SHA1withRSA`, `SHA1withDSA`, `SHA1withECDSA`. The\n// `…with(RSA|DSA|ECDSA)` shape makes the token unambiguously a signature alg.\n// `-?` tolerates the `SHA-1` spelling; `i` covers case variation in real code.\nconst RE_SHA1_JAVA = /\\bSHA-?1with(?:RSA|DSA|ECDSA)\\b/gi;\n// X.509 / ASN.1 signature-algorithm OID *names*.\nconst RE_SHA1_X509 = /\\b(?:sha-?1WithRSAEncryption|ecdsa-with-SHA-?1|dsaWithSHA-?1)\\b/gi;\n// X.509 signature-algorithm dotted OIDs (sha1WithRSAEncryption, ecdsa-with-SHA1).\n// Lookarounds keep the id from matching inside a longer OID.\nconst RE_SHA1_OID = /(?<![\\d.])(?:1\\.2\\.840\\.113549\\.1\\.1\\.5|1\\.2\\.840\\.10045\\.4\\.1)(?![\\d.])/g;\n// OpenSSL CLI: `-sha1` on the same line as `openssl` AND an actual SIGNING marker\n// (`req` / `ca` subcommand, or `-sign`/`-signkey`/`-CA`/`-CAkey`), in either order.\n// A bare `x509` subcommand is NOT a signing marker — `openssl x509 -fingerprint\n// -sha1` / `-subject_hash` are read-only thumbprint/identifier ops, not signature\n// generation (audit M1). `openssl dgst -sha1 file` (checksum) is likewise unmatched.\nconst OPENSSL_SIGN = String.raw`(?:\\breq\\b|\\bca\\b|-sign(?:key)?\\b|-CA(?:key)?\\b)`;\nconst RE_SHA1_OPENSSL = new RegExp(\n  `openssl\\\\b[^\\\\n]*?${OPENSSL_SIGN}[^\\\\n]*?-sha1\\\\b|openssl\\\\b[^\\\\n]*?-sha1\\\\b[^\\\\n]*?${OPENSSL_SIGN}`,\n  \"gi\",\n);\n// .NET: a weak hash bound to a signing call (`.SignData(…)` / `.SignHash(…)`), as\n// `HashAlgorithmName.SHA1` or the legacy `\"SHA1\"` string arg. Bounded by `;` (the\n// statement), NOT `)` — the first argument is often itself a call\n// (`.SignData(Encoding.UTF8.GetBytes(m), HashAlgorithmName.SHA1, …)`), so a\n// `[^)]` span would stop at the inner `)` and miss it (audit H3).\nconst RE_SHA1_DOTNET =\n  /\\.Sign(?:Data|Hash)\\s*\\([^;]*?(?:HashAlgorithmName\\.SHA-?1|[\"']SHA-?1[\"'])/gi;\n\n// --- MD5 in a signature/certificate algorithm identifier -----------------------\nconst RE_MD5_JAVA = /\\bMD5with(?:RSA|DSA|ECDSA)\\b/gi;\nconst RE_MD5_X509 = /\\bmd5WithRSAEncryption\\b/gi;\nconst RE_MD5_OID = /(?<![\\d.])1\\.2\\.840\\.113549\\.1\\.1\\.4(?![\\d.])/g;\nconst RE_MD5_OPENSSL = new RegExp(\n  `openssl\\\\b[^\\\\n]*?${OPENSSL_SIGN}[^\\\\n]*?-md5\\\\b|openssl\\\\b[^\\\\n]*?-md5\\\\b[^\\\\n]*?${OPENSSL_SIGN}`,\n  \"gi\",\n);\nconst RE_MD5_DOTNET = /\\.Sign(?:Data|Hash)\\s*\\([^;]*?(?:HashAlgorithmName\\.MD5|[\"']MD5[\"'])/gi;\n\nconst RULE_SHA1: RuleMeta = {\n  id: \"weak-hash-sha1-signature\",\n  title: \"SHA-1 in a signature / certificate algorithm\",\n  description:\n    \"SHA-1 used in a digital-signature or X.509 certificate algorithm (Java/.NET/X.509/OpenSSL)\",\n  category: \"hash\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"unknown\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"SHA-1 used in a digital-signature/certificate algorithm; SHA-1 is disallowed for signatures (NIST SP 800-131A Rev 3, fully retired 2030 — the same window as the PQC migration) and enables collision-based signature forgery. Quantum-adjacent: migrate the hash alongside the signature algorithm.\",\n  remediation:\n    \"Move signature/certificate hashes to SHA-256 or stronger (SHA-384/512 for CNSA 2.0 targets) and re-issue affected certificates; fold the PQC signature migration (ML-DSA) into the same re-key/re-sign effort.\",\n};\nconst RULE_MD5: RuleMeta = {\n  id: \"weak-hash-md5-signature\",\n  title: \"MD5 in a signature / certificate algorithm\",\n  description:\n    \"MD5 used in a digital-signature or X.509 certificate algorithm (Java/.NET/X.509/OpenSSL)\",\n  category: \"hash\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"unknown\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"MD5 used in a digital-signature/certificate algorithm; MD5 signatures are catastrophically broken today (practical chosen-prefix collisions have forged CA certificates) and must be replaced immediately. Quantum-adjacent: migrate the hash alongside the signature algorithm in the PQC re-sign pass.\",\n  remediation:\n    \"Replace MD5 signature/certificate hashes with SHA-256 or stronger (SHA-384/512 for CNSA 2.0 targets) and re-issue affected certificates immediately; fold the PQC signature migration (ML-DSA) into the same re-key/re-sign effort.\",\n};\n\ninterface WeakHashRule {\n  meta: RuleMeta;\n  res: readonly RegExp[];\n}\n\nconst WEAK_HASH_RULES: readonly WeakHashRule[] = [\n  {\n    meta: RULE_SHA1,\n    res: [RE_SHA1_JAVA, RE_SHA1_X509, RE_SHA1_OID, RE_SHA1_OPENSSL, RE_SHA1_DOTNET],\n  },\n  { meta: RULE_MD5, res: [RE_MD5_JAVA, RE_MD5_X509, RE_MD5_OID, RE_MD5_OPENSSL, RE_MD5_DOTNET] },\n];\n\n/**\n * True when `content` carries a signature/certificate marker — a signal that any\n * weak hash present is bound to a signature or cert, not a bare checksum. This is\n * the guard that keeps `sha1(x)` / `sha1sum` / a password hash from ever firing:\n * without one of these markers the file is not scanned at all.\n */\nfunction hasSignatureMarker(content: string): boolean {\n  if (\n    /with\\s?RSA|with\\s?DSA|with\\s?ECDSA|WithRSAEncryption|ecdsa-with-SHA-?1|dsaWithSHA-?1/i.test(\n      content,\n    )\n  ) {\n    return true;\n  }\n  if (/1\\.2\\.840\\.113549\\.1\\.1\\.[45]|1\\.2\\.840\\.10045\\.4\\.1/.test(content)) return true;\n  if (/Signature\\.getInstance|\\.Sign(?:Data|Hash)\\s*\\(/.test(content)) return true;\n  // OpenSSL only counts as a marker with a cert/signing subcommand or flag.\n  if (/openssl/i.test(content) && /\\b(?:req|x509|ca|-signkey|-sign|dgst)\\b/i.test(content)) {\n    return true;\n  }\n  return false;\n}\n\n/**\n * Detects SHA-1 / MD5 used specifically in signature or certificate algorithms\n * (Java JCA, .NET signing calls, X.509 OID names/OIDs, OpenSSL cert/signing CLI).\n */\nexport const weakHashDetector: Detector = {\n  id: \"weak-hash-signature\",\n  description: \"Weak hash (SHA-1/MD5) in a digital-signature or X.509 certificate algorithm\",\n  scope: \"config\",\n  language: \"any\",\n  rules: WEAK_HASH_RULES.map((r) => r.meta),\n  // Skip prose/docs: a page explaining `SHA1withRSA` is not live config/code.\n  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    // Fast reject on the ORIGINAL content: only scan files whose weak hash is\n    // bound to a signature/cert context. A lone `sha1(...)` checksum or a\n    // password hash has no such marker and is skipped wholesale.\n    if (!hasSignatureMarker(content)) return [];\n\n    // Mask C-style block comments and `//` / `#` / `;` line comments so a\n    // commented-out algorithm can't fire. Offsets are preserved, so finding\n    // line/column/snippet for the live lines stay exact.\n    const scan = maskCommentLines(maskBlockComments(content), [\"//\", \"#\", \";\"]);\n    const findings: Finding[] = [];\n    for (const { meta, res } of WEAK_HASH_RULES) {\n      for (const re of res) {\n        eachMatch(re, scan, (m) =>\n          findings.push(\n            findingFromRule(meta, { file, content, index: m.index, matchLength: m[0].length }),\n          ),\n        );\n      }\n    }\n    return findings;\n  },\n};\n"]}

package/dist/detectors/webauthn.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Config detector: classical asymmetric signature algorithms pinned by
+ * WebAuthn / FIDO2 / passkey attestation & assertion, expressed as COSE
+ * algorithm identifiers in relying-party code and config
+ * (@simplewebauthn/server, py_webauthn, go-webauthn, webauthn4j).
+ *
+ * WHY WebAuthn is PQC-relevant: a WebAuthn credential is an asymmetric key
+ * pair whose PUBLIC key the authenticator returns (COSE-encoded) at
+ * registration; every subsequent assertion is a classical signature over the
+ * authentication challenge, and attestation statements are classical
+ * signatures over the credential. These are AUTHENTICATION signatures, not
+ * confidentiality — there is nothing to "harvest now" — but the moment a
+ * cryptographically-relevant quantum computer (CRQC) exists, an attacker who
+ * has a user's registered public key (or an attestation CA's key) can FORGE
+ * assertions/attestations and impersonate the user or a genuine authenticator.
+ * So every finding here is `category: "signature"`, `hndl: false`.
+ *
+ * The relying party pins which algorithms it will accept: `pubKeyCredParams`
+ * (registration) and `supportedAlgorithmIDs` (verification) enumerate COSE
+ * `alg` values, and the classical ones — ES256 (COSE -7, ECDSA P-256),
+ * RS256 (-257, RSA), EdDSA (-8) and their P-384/P-521/RSA-2048+ siblings — are
+ * exactly the ones a PQC migration must inventory and replace once FIDO/COSE
+ * standardise post-quantum algorithm identifiers.
+ *
+ * WHY numeric COSE ids need their own detector: the existing JWT/JOSE rule
+ * only matches QUOTED alg strings (`"ES256"`, `"RS256"`). WebAuthn libraries
+ * almost never write those strings — they use the NUMERIC COSE ids
+ * (`alg: -7`, `supportedAlgorithmIDs: [-7, -257]`) and language-level enum
+ * identifiers (`COSEAlgorithmIdentifier.ES256`, `webauthncose.AlgES256`,
+ * `COSEAlgorithmIdentifier.EDDSA`). None of those carry the quote characters
+ * the JWT rule keys off, so the entire WebAuthn surface is invisible today.
+ *
+ * Two independent match shapes per family, both gated by a file-level WebAuthn
+ * marker (see `hasWebauthnMarker`) so the generic numeric `alg: -7` form can't
+ * fire on unrelated code that happens to assign a small negative number:
+ *
+ *  1. NUMERIC form — the COSE `alg` value as an integer, either as an object
+ *     member (`alg: -7`, `alg = -257`) or inside a `supportedAlgorithmIDs`
+ *     array (`supportedAlgorithmIDs: [-7, -257]`). Restricted to the classical
+ *     COSE numbers only; symmetric / KDF / "direct" ids (e.g. -6, HS*) are
+ *     never in the alternation, so they cannot match.
+ *  2. ENUM form — the COSE algorithm's identifier as written in each library:
+ *     `COSEAlgorithmIdentifier.ES256|RS256|EdDSA|ECDSA_SHA_256` (webauthn4j,
+ *     py_webauthn) and Go's `webauthncose.AlgES256` / `AlgRS256` / `AlgEdDSA`
+ *     constants.
+ *
+ * COSE algorithm numbers → {@link AlgorithmFamily} (per the COSE registry, using
+ * the mapping this detector is specified against):
+ *  - ES256 (-7), ES384 (-35), ES512 (-36)      → ECDSA
+ *  - RS256 (-257), RS384 (-258), RS512 (-259)  → RSA
+ *  - EdDSA (-8)                                 → EdDSA
+ *
+ * Fast reject: `detect()` bails unless the file carries a distinctive WebAuthn
+ * API token (`pubKeyCredParams`, `PublicKeyCredential`, `webauthn`,
+ * `COSEAlgorithm`, `supportedAlgorithmIDs`, `navigator.credentials`). Those
+ * tokens are the marker gate ONLY — they never produce a standalone finding.
+ */
+import type { Detector } from "../types.js";
+/** Detects classical COSE signature algorithms pinned by WebAuthn/FIDO2 relying parties. */
+export declare const webauthnDetector: Detector;
+//# sourceMappingURL=webauthn.d.ts.map

package/dist/detectors/webauthn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../src/detectors/webauthn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAwH/D,4FAA4F;AAC5F,eAAO,MAAM,gBAAgB,EAAE,QA0B9B,CAAC"}

package/dist/detectors/webauthn.js

@@ -0,0 +1,109 @@
+import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension, maskBlockComments, maskCommentLines, } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+// Classical COSE algorithm numbers, grouped by family (see module docstring).
+const NUM_ECDSA = "7|35|36"; // ES256, ES384, ES512
+const NUM_RSA = "257|258|259"; // RS256, RS384, RS512
+const NUM_EDDSA = "8"; // EdDSA
+// --- NUMERIC form: a COSE `alg` value written as an integer. ---
+// (a) object member: `alg: -7`, `alg = -257` (JS/JSON, Python `alg=-7`).
+// `["']?alg["']?` tolerates the JSON/serialized form `"alg": -7` (the WebAuthn
+// options object is JSON-serializable and often stored/transmitted/tested as JSON
+// with a quoted key), as well as the unquoted `alg: -7` / `alg = -7` (audit M2).
+const RE_NUM_ECDSA = new RegExp(`["']?\\balg\\b["']?\\s*[:=]\\s*-(?:${NUM_ECDSA})\\b`, "g");
+const RE_NUM_RSA = new RegExp(`["']?\\balg\\b["']?\\s*[:=]\\s*-(?:${NUM_RSA})\\b`, "g");
+const RE_NUM_EDDSA = new RegExp(`["']?\\balg\\b["']?\\s*[:=]\\s*-(?:${NUM_EDDSA})\\b`, "g");
+// (b) `supportedAlgorithmIDs: [-7, -257]` array (@simplewebauthn verify option).
+// `[^\]]*` stays inside a single array literal; one match per family even when
+// the array lists several ids of that family.
+const RE_IDS_ECDSA = new RegExp(`supportedAlgorithmIDs\\s*[:=]\\s*\\[[^\\]]*-(?:${NUM_ECDSA})\\b`, "g");
+const RE_IDS_RSA = new RegExp(`supportedAlgorithmIDs\\s*[:=]\\s*\\[[^\\]]*-(?:${NUM_RSA})\\b`, "g");
+const RE_IDS_EDDSA = new RegExp(`supportedAlgorithmIDs\\s*[:=]\\s*\\[[^\\]]*-(?:${NUM_EDDSA})\\b`, "g");
+// --- ENUM form: the COSE algorithm's language-level identifier. ---
+// webauthn4j / py_webauthn: `COSEAlgorithmIdentifier.<name>`; go-webauthn:
+// `webauthncose.Alg<name>` (matched bare as `Alg<name>`).
+const RE_ENUM_ECDSA = /\bCOSEAlgorithmIdentifier\.(?:ES(?:256|384|512)|ECDSA_SHA_(?:256|384|512))\b|\bAlgES(?:256|384|512)\b/g;
+const RE_ENUM_RSA = /\bCOSEAlgorithmIdentifier\.(?:RS(?:256|384|512)|RSASSA_[A-Za-z0-9_]+)\b|\bAlgRS(?:256|384|512)\b/g;
+const RE_ENUM_EDDSA = /\bCOSEAlgorithmIdentifier\.(?:EdDSA|EDDSA)\b|\bAlgEdDSA\b/g;
+const REMEDIATION = "WebAuthn/FIDO2 is standardizing PQC COSE algorithms; inventory the classical attestation/assertion algs now and plan migration.";
+const RULE_WEBAUTHN_ECDSA = {
+    id: "webauthn-ecdsa",
+    title: "WebAuthn ECDSA COSE algorithm",
+    description: "WebAuthn/FIDO2 credential pins a classical ECDSA COSE algorithm (ES256/ES384/ES512)",
+    category: "signature",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "WebAuthn/FIDO2 relying party accepts a classical ECDSA COSE algorithm (ES256/ES384/ES512); attestation/assertion signatures become forgeable once a CRQC exists.",
+    remediation: REMEDIATION,
+};
+const RULE_WEBAUTHN_RSA = {
+    id: "webauthn-rsa",
+    title: "WebAuthn RSA COSE algorithm",
+    description: "WebAuthn/FIDO2 credential pins a classical RSA COSE algorithm (RS256/RS384/RS512)",
+    category: "signature",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "WebAuthn/FIDO2 relying party accepts a classical RSA COSE algorithm (RS256/RS384/RS512); attestation/assertion signatures become forgeable once a CRQC exists.",
+    remediation: REMEDIATION,
+};
+const RULE_WEBAUTHN_EDDSA = {
+    id: "webauthn-eddsa",
+    title: "WebAuthn EdDSA COSE algorithm",
+    description: "WebAuthn/FIDO2 credential pins the classical EdDSA COSE algorithm (COSE -8)",
+    category: "signature",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "EdDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "WebAuthn/FIDO2 relying party accepts the classical EdDSA COSE algorithm (Ed25519); modern but still classical — attestation/assertion signatures become forgeable once a CRQC exists.",
+    remediation: REMEDIATION,
+};
+const WEBAUTHN_RULES = [
+    { meta: RULE_WEBAUTHN_ECDSA, res: [RE_NUM_ECDSA, RE_IDS_ECDSA, RE_ENUM_ECDSA] },
+    { meta: RULE_WEBAUTHN_RSA, res: [RE_NUM_RSA, RE_IDS_RSA, RE_ENUM_RSA] },
+    { meta: RULE_WEBAUTHN_EDDSA, res: [RE_NUM_EDDSA, RE_IDS_EDDSA, RE_ENUM_EDDSA] },
+];
+/**
+ * True when `content` carries a distinctive WebAuthn API token. Used ONLY as
+ * the fast-reject marker gate — none of these tokens produce a finding — so the
+ * generic numeric `alg: -7` form can't fire on unrelated code.
+ */
+function hasWebauthnMarker(content) {
+    return (content.includes("pubKeyCredParams") ||
+        content.includes("PublicKeyCredential") ||
+        content.includes("COSEAlgorithm") ||
+        content.includes("supportedAlgorithmIDs") ||
+        content.includes("navigator.credentials") ||
+        /webauthn/i.test(content));
+}
+/** Detects classical COSE signature algorithms pinned by WebAuthn/FIDO2 relying parties. */
+export const webauthnDetector = {
+    id: "webauthn-crypto",
+    description: "Classical COSE signature algorithms in WebAuthn/FIDO2/passkey relying-party code",
+    scope: "config",
+    language: "any",
+    rules: WEBAUTHN_RULES.map((r) => r.meta),
+    appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+    detect({ file, content }) {
+        if (!hasWebauthnMarker(content))
+            return [];
+        // Mask C-style (`//`, `/* */`) and hash (`#`) comments so a commented-out
+        // options object can't fire. Offsets are preserved so finding locations stay
+        // exact.
+        const scan = maskCommentLines(maskBlockComments(content), ["//", "#"]);
+        const findings = [];
+        for (const { meta, res } of WEBAUTHN_RULES) {
+            for (const re of res) {
+                eachMatch(re, scan, (m) => findings.push(findingFromRule(meta, { file, content, index: m.index, matchLength: m[0].length })));
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=webauthn.js.map

package/dist/detectors/webauthn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../src/detectors/webauthn.ts"],"names":[],"mappings":"AA0DA,OAAO,EACL,cAAc,EACd,SAAS,EACT,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,8EAA8E;AAC9E,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,sBAAsB;AACnD,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,sBAAsB;AACrD,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,QAAQ;AAE/B,kEAAkE;AAClE,yEAAyE;AACzE,+EAA+E;AAC/E,kFAAkF;AAClF,iFAAiF;AACjF,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,sCAAsC,SAAS,MAAM,EAAE,GAAG,CAAC,CAAC;AAC5F,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,sCAAsC,OAAO,MAAM,EAAE,GAAG,CAAC,CAAC;AACxF,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,sCAAsC,SAAS,MAAM,EAAE,GAAG,CAAC,CAAC;AAC5F,iFAAiF;AACjF,+EAA+E;AAC/E,8CAA8C;AAC9C,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,kDAAkD,SAAS,MAAM,EACjE,GAAG,CACJ,CAAC;AACF,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,kDAAkD,OAAO,MAAM,EAAE,GAAG,CAAC,CAAC;AACpG,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,kDAAkD,SAAS,MAAM,EACjE,GAAG,CACJ,CAAC;AAEF,qEAAqE;AACrE,2EAA2E;AAC3E,0DAA0D;AAC1D,MAAM,aAAa,GACjB,wGAAwG,CAAC;AAC3G,MAAM,WAAW,GACf,mGAAmG,CAAC;AACtG,MAAM,aAAa,GAAG,4DAA4D,CAAC;AAEnF,MAAM,WAAW,GACf,iIAAiI,CAAC;AAEpI,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,+BAA+B;IACtC,WAAW,EACT,qFAAqF;IACvF,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,kKAAkK;IACpK,WAAW,EAAE,WAAW;CACzB,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,6BAA6B;IACpC,WAAW,EAAE,mFAAmF;IAChG,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,gKAAgK;IAClK,WAAW,EAAE,WAAW;CACzB,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,+BAA+B;IACtC,WAAW,EAAE,6EAA6E;IAC1F,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,uLAAuL;IACzL,WAAW,EAAE,WAAW;CACzB,CAAC;AAOF,MAAM,cAAc,GAA4B;IAC9C,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE;IAC/E,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE;IACvE,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE;CAChF,CAAC;AAEF;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACpC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QACvC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QACjC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QACzC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QACzC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAC1B,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,EAAE,EAAE,iBAAiB;IACrB,WAAW,EAAE,kFAAkF;IAC/F,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;IAClD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QAE3C,0EAA0E;QAC1E,6EAA6E;QAC7E,SAAS;QACT,MAAM,IAAI,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,cAAc,EAAE,CAAC;YAC3C,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;gBACrB,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACxB,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config detector: classical asymmetric signature algorithms pinned by\n * WebAuthn / FIDO2 / passkey attestation & assertion, expressed as COSE\n * algorithm identifiers in relying-party code and config\n * (@simplewebauthn/server, py_webauthn, go-webauthn, webauthn4j).\n *\n * WHY WebAuthn is PQC-relevant: a WebAuthn credential is an asymmetric key\n * pair whose PUBLIC key the authenticator returns (COSE-encoded) at\n * registration; every subsequent assertion is a classical signature over the\n * authentication challenge, and attestation statements are classical\n * signatures over the credential. These are AUTHENTICATION signatures, not\n * confidentiality — there is nothing to \"harvest now\" — but the moment a\n * cryptographically-relevant quantum computer (CRQC) exists, an attacker who\n * has a user's registered public key (or an attestation CA's key) can FORGE\n * assertions/attestations and impersonate the user or a genuine authenticator.\n * So every finding here is `category: \"signature\"`, `hndl: false`.\n *\n * The relying party pins which algorithms it will accept: `pubKeyCredParams`\n * (registration) and `supportedAlgorithmIDs` (verification) enumerate COSE\n * `alg` values, and the classical ones — ES256 (COSE -7, ECDSA P-256),\n * RS256 (-257, RSA), EdDSA (-8) and their P-384/P-521/RSA-2048+ siblings — are\n * exactly the ones a PQC migration must inventory and replace once FIDO/COSE\n * standardise post-quantum algorithm identifiers.\n *\n * WHY numeric COSE ids need their own detector: the existing JWT/JOSE rule\n * only matches QUOTED alg strings (`\"ES256\"`, `\"RS256\"`). WebAuthn libraries\n * almost never write those strings — they use the NUMERIC COSE ids\n * (`alg: -7`, `supportedAlgorithmIDs: [-7, -257]`) and language-level enum\n * identifiers (`COSEAlgorithmIdentifier.ES256`, `webauthncose.AlgES256`,\n * `COSEAlgorithmIdentifier.EDDSA`). None of those carry the quote characters\n * the JWT rule keys off, so the entire WebAuthn surface is invisible today.\n *\n * Two independent match shapes per family, both gated by a file-level WebAuthn\n * marker (see `hasWebauthnMarker`) so the generic numeric `alg: -7` form can't\n * fire on unrelated code that happens to assign a small negative number:\n *\n *  1. NUMERIC form — the COSE `alg` value as an integer, either as an object\n *     member (`alg: -7`, `alg = -257`) or inside a `supportedAlgorithmIDs`\n *     array (`supportedAlgorithmIDs: [-7, -257]`). Restricted to the classical\n *     COSE numbers only; symmetric / KDF / \"direct\" ids (e.g. -6, HS*) are\n *     never in the alternation, so they cannot match.\n *  2. ENUM form — the COSE algorithm's identifier as written in each library:\n *     `COSEAlgorithmIdentifier.ES256|RS256|EdDSA|ECDSA_SHA_256` (webauthn4j,\n *     py_webauthn) and Go's `webauthncose.AlgES256` / `AlgRS256` / `AlgEdDSA`\n *     constants.\n *\n * COSE algorithm numbers → {@link AlgorithmFamily} (per the COSE registry, using\n * the mapping this detector is specified against):\n *  - ES256 (-7), ES384 (-35), ES512 (-36)      → ECDSA\n *  - RS256 (-257), RS384 (-258), RS512 (-259)  → RSA\n *  - EdDSA (-8)                                 → EdDSA\n *\n * Fast reject: `detect()` bails unless the file carries a distinctive WebAuthn\n * API token (`pubKeyCredParams`, `PublicKeyCredential`, `webauthn`,\n * `COSEAlgorithm`, `supportedAlgorithmIDs`, `navigator.credentials`). Those\n * tokens are the marker gate ONLY — they never produce a standalone finding.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport {\n  DOC_EXTENSIONS,\n  eachMatch,\n  findingFromRule,\n  hasExtension,\n  maskBlockComments,\n  maskCommentLines,\n} from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\n// Classical COSE algorithm numbers, grouped by family (see module docstring).\nconst NUM_ECDSA = \"7|35|36\"; // ES256, ES384, ES512\nconst NUM_RSA = \"257|258|259\"; // RS256, RS384, RS512\nconst NUM_EDDSA = \"8\"; // EdDSA\n\n// --- NUMERIC form: a COSE `alg` value written as an integer. ---\n// (a) object member: `alg: -7`, `alg = -257` (JS/JSON, Python `alg=-7`).\n// `[\"']?alg[\"']?` tolerates the JSON/serialized form `\"alg\": -7` (the WebAuthn\n// options object is JSON-serializable and often stored/transmitted/tested as JSON\n// with a quoted key), as well as the unquoted `alg: -7` / `alg = -7` (audit M2).\nconst RE_NUM_ECDSA = new RegExp(`[\"']?\\\\balg\\\\b[\"']?\\\\s*[:=]\\\\s*-(?:${NUM_ECDSA})\\\\b`, \"g\");\nconst RE_NUM_RSA = new RegExp(`[\"']?\\\\balg\\\\b[\"']?\\\\s*[:=]\\\\s*-(?:${NUM_RSA})\\\\b`, \"g\");\nconst RE_NUM_EDDSA = new RegExp(`[\"']?\\\\balg\\\\b[\"']?\\\\s*[:=]\\\\s*-(?:${NUM_EDDSA})\\\\b`, \"g\");\n// (b) `supportedAlgorithmIDs: [-7, -257]` array (@simplewebauthn verify option).\n// `[^\\]]*` stays inside a single array literal; one match per family even when\n// the array lists several ids of that family.\nconst RE_IDS_ECDSA = new RegExp(\n  `supportedAlgorithmIDs\\\\s*[:=]\\\\s*\\\\[[^\\\\]]*-(?:${NUM_ECDSA})\\\\b`,\n  \"g\",\n);\nconst RE_IDS_RSA = new RegExp(`supportedAlgorithmIDs\\\\s*[:=]\\\\s*\\\\[[^\\\\]]*-(?:${NUM_RSA})\\\\b`, \"g\");\nconst RE_IDS_EDDSA = new RegExp(\n  `supportedAlgorithmIDs\\\\s*[:=]\\\\s*\\\\[[^\\\\]]*-(?:${NUM_EDDSA})\\\\b`,\n  \"g\",\n);\n\n// --- ENUM form: the COSE algorithm's language-level identifier. ---\n// webauthn4j / py_webauthn: `COSEAlgorithmIdentifier.<name>`; go-webauthn:\n// `webauthncose.Alg<name>` (matched bare as `Alg<name>`).\nconst RE_ENUM_ECDSA =\n  /\\bCOSEAlgorithmIdentifier\\.(?:ES(?:256|384|512)|ECDSA_SHA_(?:256|384|512))\\b|\\bAlgES(?:256|384|512)\\b/g;\nconst RE_ENUM_RSA =\n  /\\bCOSEAlgorithmIdentifier\\.(?:RS(?:256|384|512)|RSASSA_[A-Za-z0-9_]+)\\b|\\bAlgRS(?:256|384|512)\\b/g;\nconst RE_ENUM_EDDSA = /\\bCOSEAlgorithmIdentifier\\.(?:EdDSA|EDDSA)\\b|\\bAlgEdDSA\\b/g;\n\nconst REMEDIATION =\n  \"WebAuthn/FIDO2 is standardizing PQC COSE algorithms; inventory the classical attestation/assertion algs now and plan migration.\";\n\nconst RULE_WEBAUTHN_ECDSA: RuleMeta = {\n  id: \"webauthn-ecdsa\",\n  title: \"WebAuthn ECDSA COSE algorithm\",\n  description:\n    \"WebAuthn/FIDO2 credential pins a classical ECDSA COSE algorithm (ES256/ES384/ES512)\",\n  category: \"signature\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"WebAuthn/FIDO2 relying party accepts a classical ECDSA COSE algorithm (ES256/ES384/ES512); attestation/assertion signatures become forgeable once a CRQC exists.\",\n  remediation: REMEDIATION,\n};\nconst RULE_WEBAUTHN_RSA: RuleMeta = {\n  id: \"webauthn-rsa\",\n  title: \"WebAuthn RSA COSE algorithm\",\n  description: \"WebAuthn/FIDO2 credential pins a classical RSA COSE algorithm (RS256/RS384/RS512)\",\n  category: \"signature\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"WebAuthn/FIDO2 relying party accepts a classical RSA COSE algorithm (RS256/RS384/RS512); attestation/assertion signatures become forgeable once a CRQC exists.\",\n  remediation: REMEDIATION,\n};\nconst RULE_WEBAUTHN_EDDSA: RuleMeta = {\n  id: \"webauthn-eddsa\",\n  title: \"WebAuthn EdDSA COSE algorithm\",\n  description: \"WebAuthn/FIDO2 credential pins the classical EdDSA COSE algorithm (COSE -8)\",\n  category: \"signature\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"WebAuthn/FIDO2 relying party accepts the classical EdDSA COSE algorithm (Ed25519); modern but still classical — attestation/assertion signatures become forgeable once a CRQC exists.\",\n  remediation: REMEDIATION,\n};\n\ninterface WebauthnRule {\n  meta: RuleMeta;\n  res: readonly RegExp[];\n}\n\nconst WEBAUTHN_RULES: readonly WebauthnRule[] = [\n  { meta: RULE_WEBAUTHN_ECDSA, res: [RE_NUM_ECDSA, RE_IDS_ECDSA, RE_ENUM_ECDSA] },\n  { meta: RULE_WEBAUTHN_RSA, res: [RE_NUM_RSA, RE_IDS_RSA, RE_ENUM_RSA] },\n  { meta: RULE_WEBAUTHN_EDDSA, res: [RE_NUM_EDDSA, RE_IDS_EDDSA, RE_ENUM_EDDSA] },\n];\n\n/**\n * True when `content` carries a distinctive WebAuthn API token. Used ONLY as\n * the fast-reject marker gate — none of these tokens produce a finding — so the\n * generic numeric `alg: -7` form can't fire on unrelated code.\n */\nfunction hasWebauthnMarker(content: string): boolean {\n  return (\n    content.includes(\"pubKeyCredParams\") ||\n    content.includes(\"PublicKeyCredential\") ||\n    content.includes(\"COSEAlgorithm\") ||\n    content.includes(\"supportedAlgorithmIDs\") ||\n    content.includes(\"navigator.credentials\") ||\n    /webauthn/i.test(content)\n  );\n}\n\n/** Detects classical COSE signature algorithms pinned by WebAuthn/FIDO2 relying parties. */\nexport const webauthnDetector: Detector = {\n  id: \"webauthn-crypto\",\n  description: \"Classical COSE signature algorithms in WebAuthn/FIDO2/passkey relying-party code\",\n  scope: \"config\",\n  language: \"any\",\n  rules: WEBAUTHN_RULES.map((r) => r.meta),\n  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    if (!hasWebauthnMarker(content)) return [];\n\n    // Mask C-style (`//`, `/* */`) and hash (`#`) comments so a commented-out\n    // options object can't fire. Offsets are preserved so finding locations stay\n    // exact.\n    const scan = maskCommentLines(maskBlockComments(content), [\"//\", \"#\"]);\n    const findings: Finding[] = [];\n    for (const { meta, res } of WEBAUTHN_RULES) {\n      for (const re of res) {\n        eachMatch(re, scan, (m) =>\n          findings.push(\n            findingFromRule(meta, { file, content, index: m.index, matchLength: m[0].length }),\n          ),\n        );\n      }\n    }\n    return findings;\n  },\n};\n"]}

package/dist/detectors/xmldsig.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Config detector: classical crypto in XML Digital Signature / XML Encryption
+ * (W3C XML-DSig / XML-Enc), the algorithm layer under SAML SSO, WS-Security /
+ * SOAP, and signed XML documents. Enterprise identity is ubiquitous and its IdP
+ * signing keys are long-lived, so a forged SAML assertion is a prime quantum
+ * forgery surface; an encrypted SAML assertion (RSA key transport) is
+ * harvest-now-decrypt-later exposed.
+ *
+ * Detection keys off the W3C algorithm URIs, which are globally-unique constant
+ * strings (RFC-precise, so a lexical match is exact):
+ *  - `…xmldsig#rsa-sha1` / `…xmldsig-more#rsa-sha256` …  → RSA signature (forgeable)
+ *  - `…xmldsig11#dsa-sha256` / `…xmldsig#dsa-sha1`       → DSA signature
+ *  - `…xmldsig-more#ecdsa-sha256` …                      → ECDSA signature
+ *  - `…xmlenc#rsa-oaep(-mgf1p)` / `…xmlenc#rsa-1_5`      → RSA key transport (HNDL)
+ *
+ * These URIs appear both in XML config (`.xml`) and as string constants in SAML
+ * library code (python3-saml, xml-crypto, OpenSAML), so the detector runs on any
+ * non-doc file.
+ */
+import type { Detector } from "../types.js";
+/** Detects classical XML-DSig / XML-Enc algorithms (SAML, WS-Security, signed XML). */
+export declare const xmldsigDetector: Detector;
+//# sourceMappingURL=xmldsig.d.ts.map

package/dist/detectors/xmldsig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xmldsig.d.ts","sourceRoot":"","sources":["../../src/detectors/xmldsig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAsE/D,uFAAuF;AACvF,eAAO,MAAM,eAAe,EAAE,QAwB7B,CAAC"}

package/dist/detectors/xmldsig.js

@@ -0,0 +1,84 @@
+import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+// The `#fragment` of the W3C XML-DSig / XML-Enc algorithm URIs. Anchored on the
+// namespace fragment (`xmldsig…#` / `xmlenc#`) so a bare `rsa-sha256` elsewhere
+// doesn't misfire.
+const RE_XMLDSIG_RSA = /\bxmldsig(?:-more|11)?#rsa-sha(?:1|224|256|384|512)\b/g;
+const RE_XMLDSIG_DSA = /\bxmldsig(?:11)?#dsa-sha(?:1|256)\b/g;
+const RE_XMLDSIG_ECDSA = /\bxmldsig-more#ecdsa-sha(?:1|224|256|384|512)\b/g;
+const RE_XMLENC_RSA = /\bxmlenc#rsa-(?:oaep(?:-mgf1p)?|1_5)\b/g;
+const RULE_XMLDSIG_RSA = {
+    id: "xmldsig-rsa-sign",
+    title: "XML-DSig RSA signature",
+    description: "XML Digital Signature with an RSA-SHA* algorithm (SAML/WS-Security)",
+    category: "signature",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "XML signatures (SAML / WS-Security) use classical RSA (rsa-sha*); a quantum attacker could forge assertions signed with this key.",
+    remediation: "Track PQC XML-DSig / SAML profiles (ML-DSA); rotate to a PQC signing key as tooling and IdPs add support.",
+};
+const RULE_XMLDSIG_DSA = {
+    id: "xmldsig-dsa-sign",
+    title: "XML-DSig DSA signature",
+    description: "XML Digital Signature with a DSA-SHA* algorithm",
+    category: "signature",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "DSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "XML signatures use classical DSA (dsa-sha*) — deprecated and quantum-forgeable.",
+    remediation: "Migrate off DSA now; track PQC XML-DSig profiles (ML-DSA).",
+};
+const RULE_XMLDSIG_ECDSA = {
+    id: "xmldsig-ecdsa-sign",
+    title: "XML-DSig ECDSA signature",
+    description: "XML Digital Signature with an ECDSA-SHA* algorithm",
+    category: "signature",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "XML signatures use classical ECDSA (ecdsa-sha*); forgeable by a quantum attacker.",
+    remediation: "Track PQC XML-DSig / SAML profiles (ML-DSA); rotate the signing key when supported.",
+};
+const RULE_XMLENC_RSA = {
+    id: "xmlenc-rsa-keytransport",
+    title: "XML-Enc RSA key transport",
+    description: "XML Encryption with RSA-OAEP / RSA-1_5 key transport (encrypted SAML assertions)",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "XML Encryption wraps the content key with classical RSA (rsa-oaep / rsa-1_5); encrypted XML (e.g. SAML assertions) is harvest-now-decrypt-later exposed.",
+    remediation: "Plan migration to a post-quantum KEM (ML-KEM-768) for key transport as XML-Enc / SAML PQC profiles mature.",
+};
+/** Detects classical XML-DSig / XML-Enc algorithms (SAML, WS-Security, signed XML). */
+export const xmldsigDetector = {
+    id: "xmldsig-crypto",
+    description: "Classical XML-DSig / XML-Enc algorithms (SAML, WS-Security, signed XML)",
+    scope: "config",
+    language: "any",
+    // Skip prose/docs: a page explaining the SAML algorithm URIs is not live config.
+    appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+    rules: [RULE_XMLDSIG_RSA, RULE_XMLDSIG_DSA, RULE_XMLDSIG_ECDSA, RULE_XMLENC_RSA],
+    detect({ file, content }) {
+        // Fast reject: only proceed if an XML-DSig / XML-Enc namespace fragment is present.
+        if (!content.includes("xmldsig") && !content.includes("xmlenc"))
+            return [];
+        const findings = [];
+        const add = (re, rule) => eachMatch(re, content, (m) => findings.push(findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length })));
+        add(RE_XMLDSIG_RSA, RULE_XMLDSIG_RSA);
+        add(RE_XMLDSIG_DSA, RULE_XMLDSIG_DSA);
+        add(RE_XMLDSIG_ECDSA, RULE_XMLDSIG_ECDSA);
+        add(RE_XMLENC_RSA, RULE_XMLENC_RSA);
+        return findings;
+    },
+};
+//# sourceMappingURL=xmldsig.js.map

package/dist/detectors/xmldsig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xmldsig.js","sourceRoot":"","sources":["../../src/detectors/xmldsig.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,gFAAgF;AAChF,gFAAgF;AAChF,mBAAmB;AACnB,MAAM,cAAc,GAAG,wDAAwD,CAAC;AAChF,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAC9D,MAAM,gBAAgB,GAAG,kDAAkD,CAAC;AAC5E,MAAM,aAAa,GAAG,yCAAyC,CAAC;AAEhE,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,qEAAqE;IAClF,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,mIAAmI;IACrI,WAAW,EACT,2GAA2G;CAC9G,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,iDAAiD;IAC9D,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,iFAAiF;IAC1F,WAAW,EAAE,4DAA4D;CAC1E,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,oBAAoB;IACxB,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,oDAAoD;IACjE,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,mFAAmF;IAC5F,WAAW,EACT,qFAAqF;CACxF,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,yBAAyB;IAC7B,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,kFAAkF;IAC/F,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,0JAA0J;IAC5J,WAAW,EACT,4GAA4G;CAC/G,CAAC;AAEF,uFAAuF;AACvF,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,EAAE,EAAE,gBAAgB;IACpB,WAAW,EAAE,yEAAyE;IACtF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,iFAAiF;IACjF,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;IAClD,KAAK,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,eAAe,CAAC;IAChF,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,oFAAoF;QACpF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAQ,EAAE,CAC/C,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QACJ,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config detector: classical crypto in XML Digital Signature / XML Encryption\n * (W3C XML-DSig / XML-Enc), the algorithm layer under SAML SSO, WS-Security /\n * SOAP, and signed XML documents. Enterprise identity is ubiquitous and its IdP\n * signing keys are long-lived, so a forged SAML assertion is a prime quantum\n * forgery surface; an encrypted SAML assertion (RSA key transport) is\n * harvest-now-decrypt-later exposed.\n *\n * Detection keys off the W3C algorithm URIs, which are globally-unique constant\n * strings (RFC-precise, so a lexical match is exact):\n *  - `…xmldsig#rsa-sha1` / `…xmldsig-more#rsa-sha256` …  → RSA signature (forgeable)\n *  - `…xmldsig11#dsa-sha256` / `…xmldsig#dsa-sha1`       → DSA signature\n *  - `…xmldsig-more#ecdsa-sha256` …                      → ECDSA signature\n *  - `…xmlenc#rsa-oaep(-mgf1p)` / `…xmlenc#rsa-1_5`      → RSA key transport (HNDL)\n *\n * These URIs appear both in XML config (`.xml`) and as string constants in SAML\n * library code (python3-saml, xml-crypto, OpenSAML), so the detector runs on any\n * non-doc file.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\n// The `#fragment` of the W3C XML-DSig / XML-Enc algorithm URIs. Anchored on the\n// namespace fragment (`xmldsig…#` / `xmlenc#`) so a bare `rsa-sha256` elsewhere\n// doesn't misfire.\nconst RE_XMLDSIG_RSA = /\\bxmldsig(?:-more|11)?#rsa-sha(?:1|224|256|384|512)\\b/g;\nconst RE_XMLDSIG_DSA = /\\bxmldsig(?:11)?#dsa-sha(?:1|256)\\b/g;\nconst RE_XMLDSIG_ECDSA = /\\bxmldsig-more#ecdsa-sha(?:1|224|256|384|512)\\b/g;\nconst RE_XMLENC_RSA = /\\bxmlenc#rsa-(?:oaep(?:-mgf1p)?|1_5)\\b/g;\n\nconst RULE_XMLDSIG_RSA: RuleMeta = {\n  id: \"xmldsig-rsa-sign\",\n  title: \"XML-DSig RSA signature\",\n  description: \"XML Digital Signature with an RSA-SHA* algorithm (SAML/WS-Security)\",\n  category: \"signature\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"XML signatures (SAML / WS-Security) use classical RSA (rsa-sha*); a quantum attacker could forge assertions signed with this key.\",\n  remediation:\n    \"Track PQC XML-DSig / SAML profiles (ML-DSA); rotate to a PQC signing key as tooling and IdPs add support.\",\n};\nconst RULE_XMLDSIG_DSA: RuleMeta = {\n  id: \"xmldsig-dsa-sign\",\n  title: \"XML-DSig DSA signature\",\n  description: \"XML Digital Signature with a DSA-SHA* algorithm\",\n  category: \"signature\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"DSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"XML signatures use classical DSA (dsa-sha*) — deprecated and quantum-forgeable.\",\n  remediation: \"Migrate off DSA now; track PQC XML-DSig profiles (ML-DSA).\",\n};\nconst RULE_XMLDSIG_ECDSA: RuleMeta = {\n  id: \"xmldsig-ecdsa-sign\",\n  title: \"XML-DSig ECDSA signature\",\n  description: \"XML Digital Signature with an ECDSA-SHA* algorithm\",\n  category: \"signature\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"XML signatures use classical ECDSA (ecdsa-sha*); forgeable by a quantum attacker.\",\n  remediation:\n    \"Track PQC XML-DSig / SAML profiles (ML-DSA); rotate the signing key when supported.\",\n};\nconst RULE_XMLENC_RSA: RuleMeta = {\n  id: \"xmlenc-rsa-keytransport\",\n  title: \"XML-Enc RSA key transport\",\n  description: \"XML Encryption with RSA-OAEP / RSA-1_5 key transport (encrypted SAML assertions)\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"XML Encryption wraps the content key with classical RSA (rsa-oaep / rsa-1_5); encrypted XML (e.g. SAML assertions) is harvest-now-decrypt-later exposed.\",\n  remediation:\n    \"Plan migration to a post-quantum KEM (ML-KEM-768) for key transport as XML-Enc / SAML PQC profiles mature.\",\n};\n\n/** Detects classical XML-DSig / XML-Enc algorithms (SAML, WS-Security, signed XML). */\nexport const xmldsigDetector: Detector = {\n  id: \"xmldsig-crypto\",\n  description: \"Classical XML-DSig / XML-Enc algorithms (SAML, WS-Security, signed XML)\",\n  scope: \"config\",\n  language: \"any\",\n  // Skip prose/docs: a page explaining the SAML algorithm URIs is not live config.\n  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),\n  rules: [RULE_XMLDSIG_RSA, RULE_XMLDSIG_DSA, RULE_XMLDSIG_ECDSA, RULE_XMLENC_RSA],\n  detect({ file, content }): Finding[] {\n    // Fast reject: only proceed if an XML-DSig / XML-Enc namespace fragment is present.\n    if (!content.includes(\"xmldsig\") && !content.includes(\"xmlenc\")) return [];\n    const findings: Finding[] = [];\n    const add = (re: RegExp, rule: RuleMeta): void =>\n      eachMatch(re, content, (m) =>\n        findings.push(\n          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),\n        ),\n      );\n    add(RE_XMLDSIG_RSA, RULE_XMLDSIG_RSA);\n    add(RE_XMLDSIG_DSA, RULE_XMLDSIG_DSA);\n    add(RE_XMLDSIG_ECDSA, RULE_XMLDSIG_ECDSA);\n    add(RE_XMLENC_RSA, RULE_XMLENC_RSA);\n    return findings;\n  },\n};\n"]}

package/dist/evidence.d.ts

@@ -1,4 +1,5 @@
 import type { ScanResult } from "./types.js";
+import type { CryptoPolicy, PolicyMapping } from "./policy.js";
 /** Stable per-finding record for the evidence body (deterministic per commit). */
 export interface EvidenceFinding {
     ruleId: string;
@@ -23,14 +24,27 @@ export interface ReadinessReport {
     };
     inventory: ScanResult["inventory"];
     findings: EvidenceFinding[];
+    /** §4 policy verdicts, present only when a crypto policy was supplied. */
+    policyMapping?: PolicyMapping;
     cbom: unknown;
     attestation: {
         /** sha256 over the canonicalized deterministic body (excludes scanTimeUtc). */
         contentHash: string;
-        /** RFC-3161 / transparency-log token — filled by an external signer. */
-        timestamp: null;
-        /** Detached signature over `contentHash` — filled by an external signer. */
-        signature: null;
+        /**
+         * RFC-3161 / transparency-log token over `contentHash`, produced by an EXTERNAL
+         * timestamper (opaque string, e.g. base64). `null` until {@link signReadinessReport}
+         * runs one.
+         */
+        timestamp: string | null;
+        /**
+         * Detached signature over `contentHash`, produced by an EXTERNAL signer (opaque
+         * string, e.g. base64/PEM). `null` until {@link signReadinessReport} runs one.
+         */
+        signature: string | null;
+        /** Non-sensitive provenance label of the signer (e.g. "openssl", "cosign"). */
+        signedWith?: string;
+        /** Non-sensitive provenance label of the timestamper (e.g. "openssl-ts"). */
+        timestampedWith?: string;
     };
 }
 export interface ReadinessReportOptions {
@@ -38,6 +52,8 @@ export interface ReadinessReportOptions {
     repository?: string;
     /** Full commit SHA (e.g. from `GITHUB_SHA`); omitted → null. */
     commit?: string;
+    /** Optional org cryptography policy — adds the §4 `policyMapping` verdicts. */
+    policy?: CryptoPolicy;
 }
 /**
  * Build the A.8.24 readiness report for a scan result. The attestation's
@@ -45,4 +61,63 @@ export interface ReadinessReportOptions {
  * block itself, so re-running the same scan on the same commit is verifiable.
  */
 export declare function buildReadinessReport(result: ScanResult, opts?: ReadinessReportOptions): ReadinessReport;
+/** The result of {@link verifyReadinessReport}. */
+export interface VerifyReadinessResult {
+    /** True iff the recomputed body hash equals the hash claimed in the attestation. */
+    valid: boolean;
+    /** The hash recomputed over the report's CURRENT body. */
+    computedHash: string;
+    /** The hash claimed in the report's attestation (`attestation.contentHash`). */
+    claimedHash: string;
+    /** A short human reason; present only when `valid` is false. */
+    reason?: string;
+}
+/**
+ * Recompute the deterministic content hash over a readiness report's body and
+ * compare it to the hash the attestation claims. Detects tampering with ANY
+ * hashed field — a finding, the inventory, a policy verdict, or subject/tool
+ * metadata: editing it after the fact changes the recomputed hash, so `valid`
+ * becomes false.
+ *
+ * By construction the scan timestamp, the CBOM envelope, and the attestation
+ * block itself are EXCLUDED from the hash (see {@link buildReadinessReport}), so
+ * touching those does not fail verification — their integrity follows from their
+ * hashed inputs. The body is reconstructed from the report's OWN stored fields
+ * (including `tool.version`), so a report built by an older qScan still verifies.
+ *
+ * This checks the INTEGRITY hash only. It does NOT validate the detached
+ * signature or RFC-3161 timestamp: those are opaque tokens from an external
+ * signer (ADR-0004) and are verified with that signer's own tooling.
+ */
+export declare function verifyReadinessReport(report: ReadinessReport): VerifyReadinessResult;
+/**
+ * An EXTERNAL signer/timestamper the tool orchestrates. Per ADR-0004 the tool
+ * implements no cryptography: it hands the payload to an operator-provided signer
+ * (an `openssl`/`cosign` invocation, an RFC-3161 TSA client, …) and records what
+ * comes back. `label` is a short, non-sensitive provenance string (e.g. the signer
+ * program name) — NOT the full command, which may contain a key path.
+ */
+export interface EvidenceSigner {
+    label: string;
+    /**
+     * Produce a detached signature / timestamp token (opaque string) over `payload`.
+     * May be async so a future signer can shell out OR call a KMS / RFC-3161 TSA over
+     * the network without foreclosing that once this contract freezes at 1.0.
+     */
+    sign(payload: string): string | Promise<string>;
+}
+/** Options for {@link signReadinessReport}: a detached-signature and/or a timestamp signer. */
+export interface SignEvidenceOptions {
+    signer?: EvidenceSigner;
+    timestamper?: EvidenceSigner;
+}
+/**
+ * Fill a readiness report's attestation with a detached signature and/or RFC-3161
+ * timestamp, produced by EXTERNAL signers over the report's `contentHash`. Pure
+ * orchestration: it invokes the injected signers and records their opaque output
+ * plus a provenance label — it performs no cryptography itself (ADR-0004). Returns a
+ * NEW report; the hashed body is untouched (attestation is excluded from the hash),
+ * so signing never changes `contentHash`.
+ */
+export declare function signReadinessReport(report: ReadinessReport, opts: SignEvidenceOptions): Promise<ReadinessReport>;
 //# sourceMappingURL=evidence.d.ts.map

package/dist/evidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,wBAAwB,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC;IACf,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACnC,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE;QACX,+EAA+E;QAC/E,WAAW,EAAE,MAAM,CAAC;QACpB,wEAAwE;QACxE,SAAS,EAAE,IAAI,CAAC;QAChB,4EAA4E;QAC5E,SAAS,EAAE,IAAI,CAAC;KACjB,CAAC;CACH;AAeD,MAAM,WAAW,sBAAsB;IACrC,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,EAClB,IAAI,GAAE,sBAA2B,GAChC,eAAe,CAsCjB"}
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE/D,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,wBAAwB,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC;IACf,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACnC,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,0EAA0E;IAC1E,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE;QACX,+EAA+E;QAC/E,WAAW,EAAE,MAAM,CAAC;QACpB;;;;WAIG;QACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB;;;WAGG;QACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,+EAA+E;QAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,6EAA6E;QAC7E,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAeD,MAAM,WAAW,sBAAsB;IACrC,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,EAClB,IAAI,GAAE,sBAA2B,GAChC,eAAe,CA2CjB;AAED,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,oFAAoF;IACpF,KAAK,EAAE,OAAO,CAAC;IACf,0DAA0D;IAC1D,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,qBAAqB,CA6BpF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACjD;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,WAAW,CAAC,EAAE,cAAc,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,eAAe,CAAC,CAgB1B"}

package/dist/evidence.js

@@ -19,6 +19,7 @@
 import { createHash } from "node:crypto";
 import { toCbom } from "./cbom.js";
 import { VERSION } from "./version.js";
+import { buildPolicyMapping } from "./policy.js";
 /** Canonical JSON: object keys sorted recursively, so the hash is reproducible. */
 function canonicalize(value) {
     if (Array.isArray(value))
@@ -50,6 +51,9 @@ export function buildReadinessReport(result, opts = {}) {
     // its CycloneDX envelope carries a volatile timestamp/serial — so it is
     // EXCLUDED from the hashed body (its integrity follows from its hashed inputs)
     // to keep the content hash reproducible across scan runs on the same commit.
+    // §4: if the org supplied a crypto policy, attest the per-finding verdicts too.
+    // Deterministic (same findings + policy → same mapping), so it is hashed.
+    const policyMapping = opts.policy ? buildPolicyMapping(result.findings, opts.policy) : undefined;
     const hashableBody = {
         reportType: "quantakrypto-readiness",
         specVersion: 1,
@@ -61,6 +65,7 @@ export function buildReadinessReport(result, opts = {}) {
         tool: { name: "qScan", version: VERSION },
         inventory: result.inventory,
         findings,
+        ...(policyMapping ? { policyMapping } : {}),
     };
     const contentHash = "sha256:" +
         createHash("sha256")
@@ -73,4 +78,75 @@ export function buildReadinessReport(result, opts = {}) {
         attestation: { contentHash, timestamp: null, signature: null },
     };
 }
+/**
+ * Recompute the deterministic content hash over a readiness report's body and
+ * compare it to the hash the attestation claims. Detects tampering with ANY
+ * hashed field — a finding, the inventory, a policy verdict, or subject/tool
+ * metadata: editing it after the fact changes the recomputed hash, so `valid`
+ * becomes false.
+ *
+ * By construction the scan timestamp, the CBOM envelope, and the attestation
+ * block itself are EXCLUDED from the hash (see {@link buildReadinessReport}), so
+ * touching those does not fail verification — their integrity follows from their
+ * hashed inputs. The body is reconstructed from the report's OWN stored fields
+ * (including `tool.version`), so a report built by an older qScan still verifies.
+ *
+ * This checks the INTEGRITY hash only. It does NOT validate the detached
+ * signature or RFC-3161 timestamp: those are opaque tokens from an external
+ * signer (ADR-0004) and are verified with that signer's own tooling.
+ */
+export function verifyReadinessReport(report) {
+    const hashableBody = {
+        reportType: report.reportType,
+        specVersion: report.specVersion,
+        subject: {
+            repository: report.subject.repository,
+            commit: report.subject.commit,
+            scannedRoot: report.subject.scannedRoot,
+        },
+        tool: { name: report.tool.name, version: report.tool.version },
+        inventory: report.inventory,
+        findings: report.findings,
+        ...(report.policyMapping ? { policyMapping: report.policyMapping } : {}),
+    };
+    const computedHash = "sha256:" +
+        createHash("sha256")
+            .update(JSON.stringify(canonicalize(hashableBody)))
+            .digest("hex");
+    const claimedHash = report.attestation.contentHash;
+    if (computedHash === claimedHash) {
+        return { valid: true, computedHash, claimedHash };
+    }
+    return {
+        valid: false,
+        computedHash,
+        claimedHash,
+        reason: "content-hash mismatch: the report body was modified after it was built",
+    };
+}
+/**
+ * Fill a readiness report's attestation with a detached signature and/or RFC-3161
+ * timestamp, produced by EXTERNAL signers over the report's `contentHash`. Pure
+ * orchestration: it invokes the injected signers and records their opaque output
+ * plus a provenance label — it performs no cryptography itself (ADR-0004). Returns a
+ * NEW report; the hashed body is untouched (attestation is excluded from the hash),
+ * so signing never changes `contentHash`.
+ */
+export async function signReadinessReport(report, opts) {
+    const payload = report.attestation.contentHash;
+    const signature = opts.signer ? await opts.signer.sign(payload) : report.attestation.signature;
+    const timestamp = opts.timestamper
+        ? await opts.timestamper.sign(payload)
+        : report.attestation.timestamp;
+    return {
+        ...report,
+        attestation: {
+            ...report.attestation,
+            signature,
+            timestamp,
+            ...(opts.signer ? { signedWith: opts.signer.label } : {}),
+            ...(opts.timestamper ? { timestampedWith: opts.timestamper.label } : {}),
+        },
+    };
+}
 //# sourceMappingURL=evidence.js.map