@quantakrypto/core 0.4.3 → 0.5.0

package/src/detectors/dnssec.ts

@@ -0,0 +1,195 @@
+/**
+ * Config detector: classical DNSSEC signing algorithms in zone files and
+ * signer/resolver config (BIND, Knot DNS, PowerDNS, `ldns-signzone` /
+ * `dnssec-signzone` invocations recorded in ops config).
+ *
+ * DNSSEC is "communication between things" infrastructure: resolvers verify
+ * DNSKEY/RRSIG chains to authenticate zone data. Unlike a KEM or key-exchange
+ * finding, a DNSSEC signing key is not harvest-now-decrypt-later exposed —
+ * there is no confidentiality to harvest — but every classical signature it
+ * produces becomes FORGEABLE the moment a cryptographically-relevant quantum
+ * computer (CRQC) exists. A forged DNSKEY/RRSIG chain lets an attacker spoof
+ * DNSSEC-validated records (cache poisoning that a validating resolver would
+ * otherwise reject). So these findings are `category: "signature"`,
+ * `hndl: false`.
+ *
+ * RFC 8624 / IANA "DNSSEC Algorithm Numbers" families covered, mapped to
+ * {@link AlgorithmFamily}:
+ *  - RSASHA1 (5), RSASHA1-NSEC3-SHA1 (7), RSASHA256 (8), RSASHA512 (10) → RSA
+ *  - ECDSAP256SHA256 (13), ECDSAP384SHA384 (14)                        → ECDSA
+ *  - ED25519 (15), ED448 (16)                                          → EdDSA
+ *  - DSA (3), DSA-NSEC3-SHA1 (6)                                      → DSA
+ *
+ * Two independent match shapes per family, both gated to `.zone` / `.db` /
+ * `.conf` files AND to a file-level DNSSEC marker (see `hasDnssecMarker`
+ * below) so the algorithm tokens can't fire on unrelated config:
+ *
+ *  1. NAMED form — the algorithm's mnemonic name, as written in signer/policy
+ *     config (Knot `algorithm RSASHA256;`, a `dnssec-policy` block, BIND
+ *     `algorithm: ecdsap256sha256;`) or on an `ldns-signzone -a ECDSAP256SHA256`
+ *     / `dnssec-signzone -a ECDSAP256SHA256` command line. These mnemonics
+ *     (`RSASHA256`, `ECDSAP384SHA384`, `ED25519`, …) are distinctive enough to
+ *     match bare, EXCEPT plain `DSA`, which is too generic a token on its own
+ *     (used well outside DNSSEC); that one is only matched immediately after
+ *     an `algorithm` keyword.
+ *  2. STRUCTURAL form — the DNSKEY presentation-format RDATA, e.g.
+ *     `example.com. IN DNSKEY 257 3 8 AwEAAd...`, where the fields after the
+ *     `DNSKEY` keyword are `flags protocol algorithm public-key` (RFC 4034
+ *     §2). Anchoring on the literal `DNSKEY` keyword AND the literal
+ *     protocol value `3` (always 3 for DNSSEC) before a restricted algorithm
+ *     number keeps this precise despite being numeric. Bare algorithm
+ *     numbers with no such anchor are deliberately NOT matched anywhere —
+ *     `algorithm 8;` alone is far too ambiguous to key off of.
+ *
+ * Fast reject: `detect()` bails unless the file contains `DNSKEY`, `RRSIG`,
+ * a case-insensitive `dnssec` substring (present in `dnssec-policy`,
+ * `dnssec-signing: on`, etc. in any real signer config), or an
+ * `ldns-signzone` / `dnssec-signzone` invocation. This stops the DSA/EdDSA
+ * named-form tokens — which are individually generic outside DNSSEC — from
+ * firing on, say, an unrelated SSH or TLS `.conf` file that happens to
+ * mention `ED25519` or `DSA` for its own reasons.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule, hasExtension, maskCommentLines } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+const DNSSEC_EXTENSIONS: readonly string[] = [".zone", ".db", ".conf"];
+
+// IANA DNSSEC algorithm numbers, grouped by family.
+const NUM_RSA = "5|7|8|10"; // RSASHA1, RSASHA1-NSEC3-SHA1, RSASHA256, RSASHA512
+const NUM_ECDSA = "13|14"; // ECDSAP256SHA256, ECDSAP384SHA384
+const NUM_EDDSA = "15|16"; // ED25519, ED448
+const NUM_DSA = "3|6"; // DSA, DSA-NSEC3-SHA1
+
+// --- NAMED form: mnemonic algorithm names in signer/policy config or CLI args. ---
+// Case-insensitive: BIND `dnssec-policy` and Knot config conventionally write the
+// mnemonics in lowercase (`algorithm rsasha256;`, `algorithm ed25519;`), so a
+// case-sensitive match would miss the primary real-world signer-config syntax. Still
+// gated by `hasDnssecMarker` + the DNSSEC extensions, so generic tokens can't fire.
+const RE_NAMED_RSA = /\bRSASHA(?:256|512|1(?:-NSEC3-SHA1)?)\b/gi;
+const RE_NAMED_ECDSA = /\bECDSAP(?:256SHA256|384SHA384)\b/gi;
+const RE_NAMED_EDDSA = /\bED(?:25519|448)\b/gi;
+// Bare "DSA" is too generic to key off alone; require it right after an
+// `algorithm` keyword (Knot/BIND config / dnssec-policy style), optionally
+// quoted or separated by `:`/`=`.
+const RE_NAMED_DSA = /\balgorithm\s*[:=]?\s*"?DSA(?:-NSEC3-SHA1)?"?\b/gi;
+
+// --- STRUCTURAL form: `[C]DNSKEY <flags> 3 <algorithm>` presentation RDATA (RFC 4034
+// §2). `C?` also matches CDNSKEY (child-zone key with identical RDATA, RFC 7344). ---
+const RE_DNSKEY_RSA = new RegExp(`\\bC?DNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_RSA})\\b`, "g");
+const RE_DNSKEY_ECDSA = new RegExp(`\\bC?DNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_ECDSA})\\b`, "g");
+const RE_DNSKEY_EDDSA = new RegExp(`\\bC?DNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_EDDSA})\\b`, "g");
+const RE_DNSKEY_DSA = new RegExp(`\\bC?DNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_DSA})\\b`, "g");
+
+const RULE_DNSSEC_RSA: RuleMeta = {
+  id: "dnssec-rsa-sig",
+  title: "DNSSEC RSA signing algorithm",
+  description: "DNSSEC zone signed with a classical RSA algorithm (RSASHA1/256/512)",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "DNSSEC zone is signed with a classical RSA algorithm (RSASHA1/RSASHA1-NSEC3-SHA1/RSASHA256/RSASHA512); DNSKEY/RRSIG signatures become forgeable once a CRQC exists.",
+  remediation:
+    "Track IETF dnsop post-quantum DNSSEC signing work (ML-DSA); plan re-signing with a PQC algorithm once assigned an IANA DNSSEC algorithm number.",
+};
+const RULE_DNSSEC_ECDSA: RuleMeta = {
+  id: "dnssec-ecdsa-sig",
+  title: "DNSSEC ECDSA signing algorithm",
+  description: "DNSSEC zone signed with a classical ECDSA algorithm (ECDSAP256SHA256/384SHA384)",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "DNSSEC zone is signed with a classical ECDSA algorithm (ECDSAP256SHA256/ECDSAP384SHA384); DNSKEY/RRSIG signatures become forgeable once a CRQC exists.",
+  remediation:
+    "Track IETF dnsop post-quantum DNSSEC signing work (ML-DSA); plan re-signing with a PQC algorithm once assigned an IANA DNSSEC algorithm number.",
+};
+const RULE_DNSSEC_EDDSA: RuleMeta = {
+  id: "dnssec-eddsa-sig",
+  title: "DNSSEC EdDSA signing algorithm",
+  description: "DNSSEC zone signed with a classical EdDSA algorithm (ED25519/ED448)",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "DNSSEC zone is signed with a classical EdDSA algorithm (ED25519/ED448); modern but still classical — DNSKEY/RRSIG signatures become forgeable once a CRQC exists.",
+  remediation:
+    "Track IETF dnsop post-quantum DNSSEC signing work (ML-DSA); plan re-signing with a PQC algorithm once assigned an IANA DNSSEC algorithm number.",
+};
+const RULE_DNSSEC_DSA: RuleMeta = {
+  id: "dnssec-dsa-sig",
+  title: "DNSSEC DSA signing algorithm (deprecated)",
+  description:
+    "DNSSEC zone signed with the deprecated classical DSA algorithm (DSA/DSA-NSEC3-SHA1)",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "DSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "DNSSEC zone is signed with DSA/DSA-NSEC3-SHA1 — deprecated by RFC 8624 (MUST NOT sign) and, independent of that, forgeable once a CRQC exists.",
+  remediation:
+    "Re-sign with a non-deprecated algorithm today (RFC 8624); track IETF dnsop post-quantum DNSSEC signing work (ML-DSA) for the eventual PQC migration.",
+};
+
+/** True when `content` carries some DNSSEC-specific marker (not just a bare algorithm token). */
+function hasDnssecMarker(content: string): boolean {
+  return (
+    content.includes("DNSKEY") ||
+    content.includes("RRSIG") ||
+    /dnssec/i.test(content) ||
+    /ldns-signzone|dnssec-signzone/.test(content)
+  );
+}
+
+interface DnssecRule {
+  meta: RuleMeta;
+  res: readonly RegExp[];
+}
+
+const DNSSEC_RULES: readonly DnssecRule[] = [
+  { meta: RULE_DNSSEC_RSA, res: [RE_NAMED_RSA, RE_DNSKEY_RSA] },
+  { meta: RULE_DNSSEC_ECDSA, res: [RE_NAMED_ECDSA, RE_DNSKEY_ECDSA] },
+  { meta: RULE_DNSSEC_EDDSA, res: [RE_NAMED_EDDSA, RE_DNSKEY_EDDSA] },
+  { meta: RULE_DNSSEC_DSA, res: [RE_NAMED_DSA, RE_DNSKEY_DSA] },
+];
+
+/** Detects classical DNSSEC signing algorithms in zone files and signer config. */
+export const dnssecDetector: Detector = {
+  id: "dnssec-crypto",
+  description: "Classical DNSSEC signing algorithms in zone files / signer config",
+  scope: "config",
+  language: "any",
+  rules: DNSSEC_RULES.map((r) => r.meta),
+  appliesTo: (f) => hasExtension(f, DNSSEC_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    if (!hasDnssecMarker(content)) return [];
+
+    // Mask whole comment lines so a commented-out algorithm can't fire: zone files
+    // use `;`, named.conf uses `#` and `//`. These extensions are not centrally
+    // stripped; offsets are preserved so finding locations stay exact.
+    const scan = maskCommentLines(content, [";", "#", "//"]);
+    const findings: Finding[] = [];
+    for (const { meta, res } of DNSSEC_RULES) {
+      for (const re of res) {
+        eachMatch(re, scan, (m) =>
+          findings.push(
+            findingFromRule(meta, { file, content, index: m.index, matchLength: m[0].length }),
+          ),
+        );
+      }
+    }
+    return findings;
+  },
+};

package/src/detectors/elixir.ts

@@ -0,0 +1,268 @@
+/**
+ * Source-code detector for classical asymmetric cryptography in Elixir (the BEAM
+ * / Phoenix ecosystem), previously uncovered. Handles the three common surfaces:
+ *
+ *  - **Erlang `:crypto`** — `:crypto.generate_key(:rsa|:ecdh|:dh|:eddsa, …)`
+ *    (the curve atom disambiguates X25519/X448 from a generic ECDH curve) and
+ *    `:crypto.sign/:crypto.verify(:rsa|:ecdsa|:eddsa, …)`.
+ *  - **`X509`** (the `x509` hex package) — `X509.PrivateKey.new_rsa` / `new_ec`.
+ *  - **`JOSE`** (erlang-jose) — `JOSE.JWK.generate_key({:rsa|:ec|:okp, …})`.
+ *
+ * Lexical, like the other packs; the `:crypto.` atom-module syntax and the
+ * `X509.` / `JOSE.` module paths are distinctive, so the false-positive rate is low.
+ *
+ * HNDL: RSA and (EC/X)DH key agreement are harvest-now-decrypt-later exposed
+ * (hndl:true); ECDSA / EdDSA signatures are hndl:false but forgeable.
+ */
+import type { AlgorithmFamily, Detector, Finding, RuleMeta } from "../types.js";
+import { ELIXIR_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+const RE_EX_GEN = /:crypto\.generate_key\s*\(\s*:(\w+)/g;
+// `:crypto.compute_key(:ecdh|:dh, PeerPub, MyKey, :curve)` is the DH/ECDH AGREEMENT
+// operation itself — the harvest-now-decrypt-later step — which generate_key alone
+// misses. Classified by the same type/curve logic as generate_key.
+const RE_EX_COMPUTE = /:crypto\.compute_key\s*\(\s*:(\w+)/g;
+const RE_EX_SIGN = /:crypto\.(?:sign|verify)\s*\(\s*:(\w+)/g;
+const RE_EX_X509_RSA = /\bX509\.PrivateKey\.new_rsa\s*\(/g;
+const RE_EX_X509_EC = /\bX509\.PrivateKey\.new_ec\s*\(/g;
+const RE_EX_JOSE = /\bJOSE\.JWK\.generate_key\s*\(\s*\{\s*:(\w+)/g;
+
+interface Cls {
+  algo: AlgorithmFamily;
+  cat: Finding["category"];
+  sev: Finding["severity"];
+  hndl: boolean;
+  label: string;
+  remediation?: string;
+}
+const SIG_REM = "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)";
+const KEX_REM = "hybrid X25519MLKEM768 (ML-KEM-768)";
+
+const RULE_EX_KEYGEN: RuleMeta = {
+  id: "elixir-crypto-keygen",
+  title: "Elixir :crypto key generation",
+  description: ":crypto.generate_key (rsa/ecdh/dh/eddsa)",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Generates a classical key pair via Erlang :crypto (Elixir) — not quantum-safe.",
+};
+const RULE_EX_SIGN: RuleMeta = {
+  id: "elixir-crypto-sign",
+  title: "Elixir :crypto signature",
+  description: ":crypto.sign / :crypto.verify (rsa/ecdsa/eddsa)",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "unknown",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical signature via Erlang :crypto (Elixir) is forgeable by a quantum attacker.",
+  remediation: SIG_REM,
+};
+const RULE_EX_X509: RuleMeta = {
+  id: "elixir-x509-keygen",
+  title: "Elixir X509 key generation",
+  description: "X509.PrivateKey.new_rsa / new_ec",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Generates a classical key pair via the X509 library (Elixir) — not quantum-safe.",
+};
+const RULE_EX_JOSE: RuleMeta = {
+  id: "elixir-jose-jwk",
+  title: "Elixir JOSE JWK generation",
+  description: "JOSE.JWK.generate_key ({:rsa|:ec|:okp})",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Generates a classical JWK via JOSE (Elixir) — not quantum-safe.",
+};
+
+const RSA_CLS: Cls = { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" };
+const DH_CLS: Cls = { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "DH" };
+const ECDH_CLS: Cls = {
+  algo: "ECDH",
+  cat: "key-exchange",
+  sev: "high",
+  hndl: true,
+  label: "ECDH",
+  remediation: KEX_REM,
+};
+const X25519_CLS: Cls = {
+  algo: "X25519",
+  cat: "key-exchange",
+  sev: "medium",
+  hndl: true,
+  label: "X25519",
+  remediation: KEX_REM,
+};
+const X448_CLS: Cls = { ...X25519_CLS, algo: "X448", label: "X448" };
+const EDDSA_CLS: Cls = {
+  algo: "EdDSA",
+  cat: "signature",
+  sev: "low",
+  hndl: false,
+  label: "EdDSA",
+  remediation: SIG_REM,
+};
+const EC_CLS: Cls = {
+  algo: "ECDH",
+  cat: "key-exchange",
+  sev: "high",
+  hndl: true,
+  label: "EC (ECDSA/ECDH)",
+  remediation: KEX_REM,
+};
+
+/** Classify a `:crypto.generate_key(:<type>, …)` by its type atom (+ the curve
+ * atom in a short window for the ecdh X25519/X448 case). */
+function classifyGen(type: string, window: string): Cls | null {
+  switch (type) {
+    case "rsa":
+      return RSA_CLS;
+    case "dh":
+      return DH_CLS;
+    case "eddsa":
+    case "ed25519":
+      return EDDSA_CLS;
+    case "ecdh":
+      if (/:x25519\b/i.test(window)) return X25519_CLS;
+      if (/:x448\b/i.test(window)) return X448_CLS;
+      return ECDH_CLS;
+    default:
+      return null; // srp / other non-broken-in-this-model types
+  }
+}
+
+/** Signature algorithm classification for `:crypto.sign(:<type>, …)`. */
+function classifySign(type: string): AlgorithmFamily | null {
+  if (type === "rsa") return "RSA";
+  if (type === "ecdsa") return "ECDSA";
+  if (type === "eddsa" || type === "ed25519") return "EdDSA";
+  if (type === "dss") return "DSA"; // Erlang's algorithm atom for DSA signatures
+  return null;
+}
+
+/** Detects classical asymmetric crypto in Elixir (:crypto, X509, JOSE). */
+export const elixirDetector: Detector = {
+  id: "elixir-crypto",
+  description: "Classical asymmetric crypto in Elixir (:crypto, X509, JOSE)",
+  scope: "source",
+  language: "elixir",
+  rules: [RULE_EX_KEYGEN, RULE_EX_SIGN, RULE_EX_X509, RULE_EX_JOSE],
+  appliesTo: (f) => hasExtension(f, ELIXIR_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    const at = (m: RegExpExecArray) => ({
+      file,
+      content,
+      index: m.index,
+      matchLength: m[0].length,
+    });
+
+    // :crypto.generate_key(:type, …) — classify by the type atom (+ curve window).
+    eachMatch(RE_EX_GEN, content, (m) => {
+      const cls = classifyGen(m[1], content.slice(m.index, m.index + 80));
+      if (!cls) return;
+      findings.push(
+        findingFromRule(RULE_EX_KEYGEN, at(m), {
+          title: `Elixir :crypto ${cls.label} key generation`,
+          category: cls.cat,
+          severity: cls.sev,
+          algorithm: cls.algo,
+          hndl: cls.hndl,
+          message: `Generates a classical ${cls.label} key pair via Erlang :crypto (Elixir) — not quantum-safe.`,
+          ...(cls.remediation ? { remediation: cls.remediation } : {}),
+        }),
+      );
+    });
+
+    // :crypto.compute_key(:type, …) — the (EC)DH agreement operation.
+    eachMatch(RE_EX_COMPUTE, content, (m) => {
+      const cls = classifyGen(m[1], content.slice(m.index, m.index + 120));
+      if (!cls) return;
+      findings.push(
+        findingFromRule(RULE_EX_KEYGEN, at(m), {
+          title: `Elixir :crypto ${cls.label} key agreement`,
+          category: cls.cat,
+          severity: cls.sev,
+          algorithm: cls.algo,
+          hndl: cls.hndl,
+          message: `Performs classical ${cls.label} key agreement via Erlang :crypto (Elixir) — harvest-now-decrypt-later exposed.`,
+          ...(cls.remediation ? { remediation: cls.remediation } : {}),
+        }),
+      );
+    });
+
+    // :crypto.sign / :crypto.verify(:type, …).
+    eachMatch(RE_EX_SIGN, content, (m) => {
+      const algo = classifySign(m[1]);
+      if (!algo) return;
+      findings.push(
+        findingFromRule(RULE_EX_SIGN, at(m), {
+          algorithm: algo,
+          message: `Classical ${algo} signature via Erlang :crypto (Elixir) is forgeable by a quantum attacker.`,
+        }),
+      );
+    });
+
+    // X509.PrivateKey.new_rsa / new_ec.
+    eachMatch(RE_EX_X509_RSA, content, (m) =>
+      findings.push(findingFromRule(RULE_EX_X509, at(m), { algorithm: "RSA" })),
+    );
+    eachMatch(RE_EX_X509_EC, content, (m) =>
+      findings.push(
+        findingFromRule(RULE_EX_X509, at(m), {
+          title: "Elixir X509 EC key generation",
+          category: EC_CLS.cat,
+          algorithm: EC_CLS.algo,
+          hndl: EC_CLS.hndl,
+          message:
+            "Generates a classical EC key pair via the X509 library (Elixir); EC keys feed BOTH ECDSA and ECDH.",
+          remediation: KEX_REM,
+        }),
+      ),
+    );
+
+    // JOSE.JWK.generate_key({:rsa|:ec|:okp, …}). An OKP key is EdDSA (Ed25519/Ed448,
+    // signature) OR a Montgomery key-agreement key (X25519/X448, HNDL) — inspect the
+    // curve atom in a short window so an X25519 OKP is not mislabeled as an EdDSA
+    // signature.
+    eachMatch(RE_EX_JOSE, content, (m) => {
+      const kind = m[1];
+      let okpCls: Cls = EDDSA_CLS;
+      if (kind === "okp") {
+        const window = content.slice(m.index, m.index + 80);
+        if (/:x25519\b/i.test(window)) okpCls = X25519_CLS;
+        else if (/:x448\b/i.test(window)) okpCls = X448_CLS;
+      }
+      const cls =
+        kind === "rsa" ? RSA_CLS : kind === "ec" ? EC_CLS : kind === "okp" ? okpCls : null;
+      if (!cls) return;
+      findings.push(
+        findingFromRule(RULE_EX_JOSE, at(m), {
+          title: `Elixir JOSE ${cls.label} JWK`,
+          category: cls.cat,
+          severity: cls.sev,
+          algorithm: cls.algo,
+          hndl: cls.hndl,
+          message: `Generates a classical ${cls.label} JWK via JOSE (Elixir) — not quantum-safe.`,
+          ...(cls.remediation ? { remediation: cls.remediation } : {}),
+        }),
+      );
+    });
+
+    return findings;
+  },
+};

package/src/detectors/java.ts

@@ -35,7 +35,7 @@ const RE_JAVA_GETINSTANCE =
 
 // BouncyCastle lightweight-API class instantiations.
 const RE_JAVA_BC =
-  /\bnew\s+(RSAKeyPairGenerator|DSAKeyPairGenerator|ECKeyPairGenerator|ECDSASigner|Ed25519Signer|Ed448Signer|X25519Agreement|X448Agreement|ECDHBasicAgreement|DHBasicAgreement|X25519KeyPairGenerator|Ed25519KeyPairGenerator|RSAEngine|OAEPEncoding)\s*\(/g;
+  /\bnew\s+(RSAKeyPairGenerator|DSAKeyPairGenerator|ECKeyPairGenerator|ECDSASigner|Ed25519Signer|Ed448Signer|X25519Agreement|X448Agreement|ECDHBasicAgreement|DHBasicAgreement|X25519KeyPairGenerator|X448KeyPairGenerator|Ed25519KeyPairGenerator|Ed448KeyPairGenerator|X448PrivateKeyParameters|RSAEngine|OAEPEncoding)\s*\(/g;
 
 // BouncyCastle lightweight-API curve/EdDSA classes as a BARE constructor call —
 // the Kotlin form (`X448KeyPairGenerator()`, no `new` keyword). RE_JAVA_BC above
@@ -47,13 +47,30 @@ const RE_JAVA_BC =
 const RE_JAVA_BC_CURVE =
   /(?<!\bnew\s+)\b(X448KeyPairGenerator|X448Agreement|X448PrivateKeyParameters|X25519KeyPairGenerator|X25519Agreement|Ed448KeyPairGenerator|Ed448Signer|Ed25519KeyPairGenerator|Ed25519Signer)\s*\(/g;
 
+// The non-curve BouncyCastle classes (RSA/EC/DSA/DH keygen, signers, engines) as a
+// BARE constructor call — the Kotlin form, `ECKeyPairGenerator()` with no `new`. Java
+// and Scala instantiate Java classes with `new` (caught by RE_JAVA_BC), so bare calls
+// to these distinctive class names are Kotlin. The `(?<!\bnew\s+)` avoids double-
+// counting the `new` form; routed through the same BC_CLASS_RULES map.
+const RE_JAVA_BC_BARE =
+  /(?<!\bnew\s+)\b(RSAKeyPairGenerator|DSAKeyPairGenerator|ECKeyPairGenerator|ECDSASigner|ECDHBasicAgreement|DHBasicAgreement|RSAEngine|OAEPEncoding)\s*\(/g;
+
 // Insecure JSSE / TLS configuration expressed in Java source. Mirrors the JS
 // tlsDetector in source.ts (category "tls"): a legacy SSL/TLS protocol version
 // requested from SSLContext, and TLS hostname verification neutered via an
 // all-trusting verifier (Apache HttpClient's NoopHostnameVerifier /
 // ALLOW_ALL_HOSTNAME_VERIFIER).
-const RE_JAVA_TLS_LEGACY = /\bSSLContext\s*\.\s*getInstance\s*\(\s*"(SSL|SSLv3|TLSv1)"/g;
-const RE_JAVA_TLS_NOVERIFY = /\b(NoopHostnameVerifier|ALLOW_ALL_HOSTNAME_VERIFIER)\b/g;
+// `TLSv1(?:\.1)?` catches both TLS 1.0 and the equally-deprecated TLS 1.1 (RFC 8996),
+// mirroring the JS tlsDetector; the closing `"` keeps `"TLSv1.2"`/`"TLSv1.3"`/`"TLS"`
+// from matching. `SSLv2` is included alongside `SSLv3`.
+const RE_JAVA_TLS_LEGACY =
+  /\bSSLContext\s*\.\s*getInstance\s*\(\s*"(SSL|SSLv2|SSLv3|TLSv1(?:\.1)?)"/g;
+// Require a USAGE position, not a bare identifier: `NoopHostnameVerifier` followed by
+// `(` (construction) or `.` (`.INSTANCE`), and `ALLOW_ALL_HOSTNAME_VERIFIER` preceded
+// by `.` (member access). This keeps `new NoopHostnameVerifier()` and
+// `SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER` while dropping the common
+// false positive of a plain `import …NoopHostnameVerifier;` line.
+const RE_JAVA_TLS_NOVERIFY = /\bNoopHostnameVerifier\s*[.(]|\.\s*ALLOW_ALL_HOSTNAME_VERIFIER\b/g;
 
 // Identifier-form JWT/JOSE signature algorithms (audit F7). The quoted-string
 // alg token ("RS256") is caught by the language-agnostic jwt-jose detector, but
@@ -278,6 +295,10 @@ function classifyGetInstance(factory: string, rawAlg: string): RuleMeta | null {
   const isSignature = factory === "Signature";
 
   if (alg.includes("ECDSA")) return RULE_JAVA_ECDSA_SIGN;
+  // ECIES (EC Integrated Encryption Scheme, incl. `ECIESwithAES-CBC`) is classical EC
+  // public-key ENCRYPTION — harvest-now-decrypt-later exposed. Checked before the EC
+  // branches below (which would otherwise miss it) and the RSA/DSA checks.
+  if (alg.includes("ECIES")) return RULE_JAVA_ECDH;
   if (alg.includes("ECDH")) return RULE_JAVA_ECDH;
   if (alg === "EC") return isSignature ? RULE_JAVA_ECDSA_SIGN : RULE_JAVA_EC_KEYGEN;
   if (alg.includes("ED25519") || alg.includes("ED448") || alg.includes("EDDSA"))
@@ -307,7 +328,10 @@ const BC_CLASS_RULES: Record<string, RuleMeta> = {
   ECDHBasicAgreement: RULE_JAVA_ECDH,
   DHBasicAgreement: RULE_JAVA_DH,
   X25519KeyPairGenerator: RULE_JAVA_XDH,
+  X448KeyPairGenerator: RULE_JAVA_XDH,
+  X448PrivateKeyParameters: RULE_JAVA_XDH,
   Ed25519KeyPairGenerator: RULE_JAVA_EDDSA,
+  Ed448KeyPairGenerator: RULE_JAVA_EDDSA,
   RSAEngine: RULE_JAVA_RSA,
   OAEPEncoding: RULE_JAVA_RSA,
 };
@@ -328,7 +352,8 @@ const BC_CURVE_CLASS_RULES: Record<string, RuleMeta> = {
 /** Detects classical asymmetric crypto in Java / Kotlin (JCA + BouncyCastle). */
 export const javaDetector: Detector = {
   id: "java-crypto",
-  description: "Classical asymmetric crypto in Java/Kotlin (JCA getInstance + BouncyCastle)",
+  description:
+    "Classical asymmetric crypto on the JVM — Java/Kotlin/Scala (JCA getInstance + BouncyCastle)",
   scope: "source",
   language: "java",
   rules: [
@@ -380,6 +405,16 @@ export const javaDetector: Detector = {
       );
     });
 
+    // Bare (Kotlin-form) constructor calls to the non-curve BC classes — same rules
+    // as the `new` form, routed via BC_CLASS_RULES.
+    eachMatch(RE_JAVA_BC_BARE, content, (m) => {
+      const rule = BC_CLASS_RULES[m[1]];
+      if (!rule) return;
+      findings.push(
+        findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+      );
+    });
+
     // Legacy SSL/TLS protocol version requested from SSLContext.
     eachMatch(RE_JAVA_TLS_LEGACY, content, (m) => {
       findings.push(

package/src/detectors/jose.ts

@@ -0,0 +1,110 @@
+/**
+ * Config detector: classical KEY-MANAGEMENT (JWE) algorithms in JOSE. This is
+ * distinct from the JWS signature side (RS256/ES256, handled elsewhere) and from
+ * the JWK key-material detector: here we flag the `alg` values that wrap a
+ * content-encryption key with classical asymmetric crypto, because the encrypted
+ * payload is CONFIDENTIALITY — harvest-now-decrypt-later exposed. A JWE token
+ * captured today (from a log, an audit trail, a stored assertion) is decryptable
+ * once the wrapping key falls to a CRQC.
+ *
+ * Covered `alg` (RFC 7518 §4) values:
+ *  - `RSA-OAEP`, `RSA-OAEP-256`, `RSA1_5`  → RSA key encryption.
+ *  - `ECDH-ES`, `ECDH-ES+A128KW`, …        → classical EC Diffie-Hellman key agreement.
+ *
+ * These exact strings are JOSE identifiers, so a content-level match is precise;
+ * the detector applies to any file (config, JSON, source) after a fast reject.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import {
+  JWT_HOST_EXTENSIONS,
+  DOC_EXTENSIONS,
+  eachMatch,
+  enclosingObject,
+  findingFromRule,
+  hasExtension,
+} from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+interface JoseRule {
+  re: RegExp;
+  meta: RuleMeta;
+}
+
+const JOSE_RULES: JoseRule[] = [
+  {
+    re: /"alg"\s*:\s*"RSA(?:-OAEP(?:-256)?|1_5)"/g,
+    meta: {
+      id: "jose-jwe-rsa",
+      title: "JWE RSA key wrapping",
+      description: 'JWE "alg" of RSA-OAEP / RSA-OAEP-256 / RSA1_5 (RFC 7518)',
+      category: "kem",
+      severity: "high",
+      confidence: "high",
+      algorithm: "RSA",
+      hndl: true,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "JWE wraps the content-encryption key with classical RSA (RSA-OAEP/RSA1_5); the encrypted payload is harvest-now-decrypt-later exposed.",
+      remediation:
+        "Plan migration to a post-quantum KEM (ML-KEM-768) for key wrapping as JOSE/COSE PQ algorithms are standardised.",
+    },
+  },
+  {
+    re: /"alg"\s*:\s*"ECDH-ES(?:\+A\d{3}KW)?"/g,
+    meta: {
+      id: "jose-jwe-ecdh",
+      title: "JWE ECDH-ES key agreement",
+      description: 'JWE "alg" of ECDH-ES / ECDH-ES+A*KW (RFC 7518)',
+      category: "key-exchange",
+      severity: "high",
+      confidence: "high",
+      algorithm: "ECDH",
+      hndl: true,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "JWE derives the content-encryption key via classical ECDH-ES; the encrypted payload is harvest-now-decrypt-later exposed.",
+      remediation:
+        "Plan migration to hybrid post-quantum key agreement (X25519MLKEM768) as JOSE PQ algorithms are standardised.",
+    },
+  },
+];
+
+/** Detects classical JWE key-management (`alg`) values in JOSE tokens/config. */
+export const joseDetector: Detector = {
+  id: "jose-jwe-keymgmt",
+  description:
+    "Classical JWE key-management algorithms (RSA-OAEP, ECDH-ES) — confidentiality, HNDL",
+  scope: "config",
+  language: "any",
+  rules: JOSE_RULES.map((r) => r.meta),
+  // Prose examples (a README showing `"alg":"RSA-OAEP"`) are not JOSE config. In the
+  // JS/TS/Python/Go/Ruby source files that source.ts's `jose-rsa-oaep`/`jose-ecdh-es`
+  // token rules actually cover (JWT_HOST_EXTENSIONS), defer to them to avoid a
+  // double-count — but STILL run on other source languages (Java/C#/Rust/PHP/Elixir/
+  // C/C++), which source.ts does not cover for these tokens.
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS) && !hasExtension(f, JWT_HOST_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    // Fast reject: no JOSE key-management alg token present.
+    if (
+      !content.includes("RSA-OAEP") &&
+      !content.includes("RSA1_5") &&
+      !content.includes("ECDH-ES")
+    ) {
+      return [];
+    }
+    const findings: Finding[] = [];
+    for (const rule of JOSE_RULES) {
+      eachMatch(rule.re, content, (m) => {
+        // If this `alg` belongs to a JWK (a `"kty"` sits in the SAME object), the jwk
+        // detector already reports the key — defer so it isn't counted twice. Scoped
+        // to the enclosing object so an unrelated nearby JWK doesn't suppress a real
+        // standalone JWE header.
+        if (enclosingObject(content, m.index).includes('"kty"')) return;
+        findings.push(
+          findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }),
+        );
+      });
+    }
+    return findings;
+  },
+};