@quantakrypto/core 0.4.3 → 0.5.0

package/src/detectors/objc.ts

@@ -0,0 +1,209 @@
+/**
+ * Source detector for classical asymmetric cryptography in Objective-C on Apple
+ * platforms (iOS / macOS / tvOS / watchOS), via the Security framework's
+ * `SecKey*` API (and, underneath it, CommonCrypto). This is the Objective-C
+ * sibling of the Swift pack: the same Security-framework surface, reached from
+ * `.m` / `.mm` translation units instead of `.swift`. Lexical, same strategy as
+ * the other language packs — the Security-framework identifiers
+ * (`kSecAttrKeyType*`, `kSecKeyAlgorithm*`) are distinctive enough to keep the
+ * false-positive risk low.
+ *
+ * WHY a dedicated Objective-C pack (and not the C/C++ pack):
+ *  - The C/C++ pack (`c.ts`) matches OpenSSL / libsodium / Mbed TLS / wolfSSL
+ *    symbols and is gated to `.c/.h/.cc/.cpp/...` (which INCLUDES `.h`). Apple's
+ *    Security framework is a different API surface entirely, so a separate pack
+ *    is the clean home for it.
+ *  - Objective-C headers are `.h` — shared with C/C++. To avoid double-scanning
+ *    a header the C pack already owns, this detector is gated to `.m` and `.mm`
+ *    ONLY (implementation files). Declarations of `SecKey*` usage live in the
+ *    implementation, not the interface, so no real coverage is lost.
+ *
+ * Security-framework surface mapped here:
+ *  - Key generation attributes (`SecKeyCreateRandomKey` / `SecKeyGeneratePair`):
+ *      `kSecAttrKeyTypeRSA`                         → RSA keygen (kem, hndl:true)
+ *      `kSecAttrKeyTypeEC` / `…ECSECPrimeRandom`    → EC keygen (ECDSA, signature,
+ *                                                     hndl:false — EC keys default
+ *                                                     to signing; conservative)
+ *  - Signing / verifying (`SecKeyCreateSignature` / `SecKeyVerifySignature`):
+ *      `kSecKeyAlgorithmRSASignature*`              → RSA signature (hndl:false)
+ *      `kSecKeyAlgorithmECDSASignature*`            → ECDSA signature (hndl:false)
+ *  - Encryption / key agreement (`SecKeyCreateEncryptedData` / `SecKeyCopyKeyExchangeResult`):
+ *      `kSecKeyAlgorithmRSAEncryption*`             → RSA encryption (kem, hndl:true)
+ *      `kSecKeyAlgorithmECDHKeyExchange*`           → ECDH key agreement (hndl:true)
+ *
+ * Comment suppression is handled inline here (Objective-C is a C-style comment
+ * language): C-style block comments and `//` line comments are masked before the
+ * regexes run, so commented-out crypto never fires.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import {
+  eachMatch,
+  findingFromRule,
+  hasExtension,
+  maskBlockComments,
+  maskCommentLines,
+  OBJC_EXTENSIONS,
+} from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+// Security-framework key-type attributes (used with SecKeyCreateRandomKey /
+// SecKeyGeneratePair). RSA vs EC. The EC form covers both the modern
+// `kSecAttrKeyTypeECSECPrimeRandom` and the legacy `kSecAttrKeyTypeEC` alias.
+const RE_OBJC_SEC_RSA = /\bkSecAttrKeyTypeRSA\b/g;
+const RE_OBJC_SEC_EC = /\bkSecAttrKeyType(?:ECSECPrimeRandom|EC)\b/g;
+// SecKey algorithm constants for signing / encryption / key agreement. The `\w*`
+// tail captures the full family suffix (…PKCS1v15SHA256, …OAEPSHA256, …Standard,
+// …CofactorX963SHA256, …) without needing to enumerate every variant.
+const RE_OBJC_RSA_SIGN = /\bkSecKeyAlgorithmRSASignature\w*/g;
+const RE_OBJC_RSA_ENCRYPT = /\bkSecKeyAlgorithmRSAEncryption\w*/g;
+const RE_OBJC_ECDSA_SIGN = /\bkSecKeyAlgorithmECDSASignature\w*/g;
+const RE_OBJC_ECDH = /\bkSecKeyAlgorithmECDHKeyExchange\w*/g;
+
+const RULE_OBJC_SEC_RSA: RuleMeta = {
+  id: "objc-seckey-rsa",
+  title: "Objective-C Security-framework RSA key",
+  description: "SecKeyCreateRandomKey / SecKeyGeneratePair with kSecAttrKeyTypeRSA",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Security-framework RSA key (Objective-C) is classical and not quantum-safe.",
+  remediation:
+    "Migrate to PQC as Apple's CryptoKit / Security add support: ML-KEM for encryption/key-agreement, ML-DSA for signatures.",
+};
+const RULE_OBJC_SEC_EC: RuleMeta = {
+  id: "objc-seckey-ec",
+  title: "Objective-C Security-framework EC key",
+  description: "SecKeyCreateRandomKey / SecKeyGeneratePair with kSecAttrKeyTypeECSECPrimeRandom",
+  // An EC key at generation is AMBIGUOUS (it can feed ECDSA signing OR ECDH key
+  // agreement). The fleet convention (java-ec-keygen, python-ec-keygen, swift-sec-ec,
+  // cloud-kms-ec, …) classifies ambiguous EC keygen as key-exchange/ECDH/hndl:true —
+  // the HNDL-SAFE choice, so a possible key-agreement use is never under-reported.
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Security-framework EC key (Objective-C); EC keys feed ECDH key agreement (harvest-now-decrypt-later exposed) as well as ECDSA signatures, and are not quantum-safe.",
+  remediation:
+    "Migrate to PQC as Apple's CryptoKit / Security add support: ML-KEM for the ECDH key-agreement path, ML-DSA for signatures.",
+};
+const RULE_OBJC_RSA_SIGN: RuleMeta = {
+  id: "objc-rsa-sign",
+  title: "Objective-C RSA signature",
+  description: "SecKeyCreateSignature / SecKeyVerifySignature with kSecKeyAlgorithmRSASignature*",
+  category: "signature",
+  // `high`, consistent with every sibling pack's signature severity (swift-rsa,
+  // go-rsa-sign, java-rsa-sign) — the same primitive must not flip CI exit codes
+  // based on which language wrote it.
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Classical RSA signing (Objective-C, Security framework) is forgeable by a quantum attacker.",
+  remediation: "Migrate to ML-DSA (FIPS 204) as Apple's CryptoKit / Security add PQC support.",
+};
+const RULE_OBJC_RSA_ENCRYPT: RuleMeta = {
+  id: "objc-rsa-encrypt",
+  title: "Objective-C RSA encryption",
+  description: "SecKeyCreateEncryptedData with kSecKeyAlgorithmRSAEncryption*",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Classical RSA encryption (Objective-C, Security framework) is harvest-now-decrypt-later exposed.",
+  remediation: "Migrate to ML-KEM (FIPS 203) as Apple's CryptoKit / Security add PQC support.",
+};
+const RULE_OBJC_ECDSA_SIGN: RuleMeta = {
+  id: "objc-ecdsa-sign",
+  title: "Objective-C ECDSA signature",
+  description: "SecKeyCreateSignature / SecKeyVerifySignature with kSecKeyAlgorithmECDSASignature*",
+  category: "signature",
+  // `high`, consistent with swift-ecdsa / go-ecdsa / java-ecdsa-sign / dart-ecdsa.
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Classical ECDSA signing (Objective-C, Security framework) is forgeable by a quantum attacker.",
+  remediation: "Migrate to ML-DSA (FIPS 204) as Apple's CryptoKit / Security add PQC support.",
+};
+const RULE_OBJC_ECDH: RuleMeta = {
+  id: "objc-ecdh",
+  title: "Objective-C ECDH key agreement",
+  description: "SecKeyCopyKeyExchangeResult with kSecKeyAlgorithmECDHKeyExchange*",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Elliptic-curve Diffie-Hellman (Objective-C, Security framework) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+  remediation:
+    "Migrate key agreement to ML-KEM (FIPS 203) as Apple's CryptoKit / Security add PQC support.",
+};
+
+/** Detects classical asymmetric crypto in Objective-C (Apple Security framework). */
+export const objcDetector: Detector = {
+  id: "objc-crypto",
+  description: "Classical asymmetric crypto in Objective-C (Apple Security framework / SecKey)",
+  scope: "source",
+  language: "objc",
+  rules: [
+    RULE_OBJC_SEC_RSA,
+    RULE_OBJC_SEC_EC,
+    RULE_OBJC_RSA_SIGN,
+    RULE_OBJC_RSA_ENCRYPT,
+    RULE_OBJC_ECDSA_SIGN,
+    RULE_OBJC_ECDH,
+  ],
+  appliesTo: (f) => hasExtension(f, OBJC_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    // Fast reject: none of the Security-framework surface can appear without one
+    // of these substrings, so most Objective-C files bail before any regex runs.
+    if (
+      !content.includes("SecKey") &&
+      !content.includes("kSecAttrKeyType") &&
+      !content.includes("kSecKeyAlgorithm")
+    ) {
+      return [];
+    }
+    // Mask C-style block comments then `//` line comments so commented-out crypto
+    // does not fire. Both maskers preserve byte offsets, so finding line/column
+    // stay exact.
+    const masked = maskCommentLines(maskBlockComments(content), ["//"]);
+
+    const findings: Finding[] = [];
+    // Scan the masked text, but build the finding (its snippet) from the ORIGINAL
+    // `content` so a line with a trailing comment renders live, not blanked.
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, masked, (m) =>
+        findings.push(
+          findingFromRule(rule, {
+            file,
+            content,
+            index: m.index,
+            matchLength: m[0].length,
+          }),
+        ),
+      );
+    add(RE_OBJC_SEC_RSA, RULE_OBJC_SEC_RSA);
+    add(RE_OBJC_SEC_EC, RULE_OBJC_SEC_EC);
+    add(RE_OBJC_RSA_SIGN, RULE_OBJC_RSA_SIGN);
+    add(RE_OBJC_RSA_ENCRYPT, RULE_OBJC_RSA_ENCRYPT);
+    add(RE_OBJC_ECDSA_SIGN, RULE_OBJC_ECDSA_SIGN);
+    add(RE_OBJC_ECDH, RULE_OBJC_ECDH);
+    return findings;
+  },
+};

package/src/detectors/openpgp.ts

@@ -0,0 +1,194 @@
+/**
+ * Config detector: BINARY OpenPGP key material and encrypted messages committed to
+ * a repository — `secring.gpg` / `pubring.gpg` / `.gpg` / `.pgp` / `.kbx`. Armored
+ * blocks (`-----BEGIN PGP …-----`, base64 text) are handled by the PEM/secrets
+ * detectors; this covers the BINARY packet form, which the scan pipeline now reads
+ * byte-preserving (latin1; see {@link ../walk.ts isKeystorePath}) so we can read
+ * packet tags and the public-key algorithm id.
+ *
+ * A committed OpenPGP SECRET key is the sharp finding: a classical private key
+ * (RSA/DSA/ElGamal/ECDSA/EdDSA/ECDH) in version control is exposed and
+ * retroactively un-fixable. A binary PGP-encrypted message (PKESK) is
+ * harvest-now-decrypt-later exposed. Secret-key matches are sensitive material, so
+ * reporters drop the (binary) snippet.
+ *
+ * Packet framing per RFC 4880/9580. The parser is pure and bounds-checked (fuzzed).
+ */
+import type { AlgorithmFamily, Detector, Finding, RuleMeta } from "../types.js";
+import { findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_HARDCODED_KEY, CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+const OPENPGP_EXTENSIONS: readonly string[] = [".gpg", ".pgp"];
+
+// Packet tags we care about.
+const TAG_PKESK = 1; // public-key encrypted session key (an encrypted message)
+const TAG_SECRET_KEY = 5;
+const TAG_PUBLIC_KEY = 6;
+const TAG_SECRET_SUBKEY = 7;
+const TAG_PUBLIC_SUBKEY = 14;
+
+interface Packet {
+  tag: number;
+  /** Offset where the packet body begins (after the length octets). */
+  bodyOffset: number;
+}
+
+/** Parse the FIRST OpenPGP packet header; return its tag and body offset. */
+function firstPacket(content: string): Packet | undefined {
+  if (content.length < 2) return undefined;
+  const b0 = content.charCodeAt(0);
+  if ((b0 & 0x80) === 0) return undefined; // high bit always set on a packet tag
+  if (b0 & 0x40) {
+    // New-format packet: tag is the low 6 bits; length octet(s) follow.
+    const tag = b0 & 0x3f;
+    const l = content.charCodeAt(1);
+    let bodyOffset: number;
+    if (l < 192) bodyOffset = 2;
+    else if (l < 224) bodyOffset = 3;
+    else if (l === 255) bodyOffset = 6;
+    else bodyOffset = 2; // partial-body length
+    return { tag, bodyOffset };
+  }
+  // Old-format packet: tag in bits 5-2; length-type in the low 2 bits.
+  const tag = (b0 >> 2) & 0x0f;
+  const lt = b0 & 0x03;
+  const bodyOffset = lt === 0 ? 2 : lt === 1 ? 3 : lt === 2 ? 5 : 1;
+  return { tag, bodyOffset };
+}
+
+/** Map an OpenPGP public-key algorithm id to a family + HNDL (confidentiality) flag. */
+function algo(id: number): { family: AlgorithmFamily; hndl: boolean } | undefined {
+  switch (id) {
+    case 1:
+    case 2:
+    case 3:
+      return { family: "RSA", hndl: true }; // RSA (encrypt-capable)
+    case 16:
+    case 20:
+      return { family: "unknown", hndl: true }; // ElGamal (encrypt)
+    case 17:
+      return { family: "DSA", hndl: false }; // DSA (sign only)
+    case 18:
+      return { family: "ECDH", hndl: true }; // ECDH (encrypt)
+    case 19:
+      return { family: "ECDSA", hndl: false }; // ECDSA (sign only)
+    case 22:
+      return { family: "EdDSA", hndl: false }; // EdDSA (sign only)
+    // RFC 9580 (crypto-refresh) v6 algorithm ids.
+    case 25:
+      return { family: "X25519", hndl: true }; // X25519 (encrypt / key agreement)
+    case 26:
+      return { family: "X448", hndl: true }; // X448 (encrypt / key agreement)
+    case 27:
+      return { family: "EdDSA", hndl: false }; // Ed25519 (sign only)
+    case 28:
+      return { family: "EdDSA", hndl: false }; // Ed448 (sign only)
+    default:
+      return undefined;
+  }
+}
+
+/** Read the public-key algorithm id from a key packet body, or undefined. */
+function keyPacketAlgo(content: string, bodyOffset: number): number | undefined {
+  if (bodyOffset >= content.length) return undefined;
+  const version = content.charCodeAt(bodyOffset);
+  // v2/v3: version(1) created(4) validity(2) algo; v4/v5/v6: version(1) created(4) algo.
+  const algoOffset = version === 2 || version === 3 ? bodyOffset + 7 : bodyOffset + 5;
+  if (algoOffset >= content.length) return undefined;
+  return content.charCodeAt(algoOffset);
+}
+
+/** Read the wrapping algorithm from a PKESK (encrypted-message) packet body. */
+function pkeskAlgo(content: string, bodyOffset: number): number | undefined {
+  if (bodyOffset >= content.length) return undefined;
+  const version = content.charCodeAt(bodyOffset);
+  // v3: version(1) keyid(8) algo. (v6 differs; v3 dominates on-disk.)
+  if (version !== 3) return undefined;
+  const algoOffset = bodyOffset + 9;
+  if (algoOffset >= content.length) return undefined;
+  return content.charCodeAt(algoOffset);
+}
+
+function rule(id: string, title: string, message: string, opts: Partial<RuleMeta>): RuleMeta {
+  return {
+    id,
+    title,
+    description: message,
+    category: "certificate",
+    severity: "high",
+    confidence: "high",
+    hndl: false,
+    cwe: CWE_HARDCODED_KEY,
+    message,
+    remediation:
+      "Remove key material from version control and rotate it; store keys in a secret manager / HSM. Plan re-issuance with PQC keys (ML-DSA-65 / ML-KEM-768) as OpenPGP tooling supports them.",
+    ...opts,
+  };
+}
+
+const RULE_SECRET = rule(
+  "openpgp-secret-key",
+  "OpenPGP secret key (binary)",
+  "A binary OpenPGP SECRET key is committed to version control — a classical private key that is exposed and retroactively un-fixable.",
+  { sensitive: true },
+);
+const RULE_PUBLIC = rule(
+  "openpgp-public-key",
+  "OpenPGP public key (binary)",
+  "A binary OpenPGP public key uses classical asymmetric crypto (RSA/DSA/EC); plan a PQC migration path.",
+  { severity: "medium" },
+);
+const RULE_PKESK = rule(
+  "openpgp-encrypted-message",
+  "OpenPGP-encrypted message (binary)",
+  "A binary OpenPGP-encrypted message wraps its session key with classical asymmetric crypto (RSA/ElGamal/ECDH); harvest-now-decrypt-later exposed.",
+  { category: "kem", hndl: true, cwe: CWE_BROKEN_CRYPTO },
+);
+const RULE_KEYBOX = rule(
+  "openpgp-keybox",
+  "GnuPG keybox (.kbx)",
+  "A GnuPG keybox (.kbx) is a database of classical OpenPGP/X.509 keys and certificates.",
+  { severity: "medium", cwe: CWE_BROKEN_CRYPTO },
+);
+
+/** Detects binary OpenPGP key material / messages and GnuPG keyboxes. */
+export const openpgpDetector: Detector = {
+  id: "openpgp-material",
+  description: "Binary OpenPGP key material / encrypted messages and GnuPG keyboxes",
+  scope: "config",
+  language: "any",
+  rules: [RULE_SECRET, RULE_PUBLIC, RULE_PKESK, RULE_KEYBOX],
+  appliesTo: (f) => hasExtension(f, OPENPGP_EXTENSIONS) || f.toLowerCase().endsWith(".kbx"),
+  detect({ file, content }): Finding[] {
+    const at = { file, content, index: 0, matchLength: Math.min(4, content.length) };
+
+    // GnuPG keybox: a key/cert database, identified by the "KBXf" magic in its
+    // first blob header (so a garbage/empty .kbx does not fire).
+    if (file.toLowerCase().endsWith(".kbx")) {
+      return content.includes("KBXf") ? [findingFromRule(RULE_KEYBOX, at)] : [];
+    }
+
+    const pkt = firstPacket(content);
+    if (!pkt) return [];
+    const { tag, bodyOffset } = pkt;
+
+    if (tag === TAG_SECRET_KEY || tag === TAG_SECRET_SUBKEY) {
+      const id = keyPacketAlgo(content, bodyOffset);
+      const a = id !== undefined ? algo(id) : undefined;
+      return [
+        findingFromRule(RULE_SECRET, at, a ? { algorithm: a.family, hndl: a.hndl } : undefined),
+      ];
+    }
+    if (tag === TAG_PUBLIC_KEY || tag === TAG_PUBLIC_SUBKEY) {
+      const id = keyPacketAlgo(content, bodyOffset);
+      const a = id !== undefined ? algo(id) : undefined;
+      return [findingFromRule(RULE_PUBLIC, at, a ? { algorithm: a.family } : undefined)];
+    }
+    if (tag === TAG_PKESK) {
+      const id = pkeskAlgo(content, bodyOffset);
+      const a = id !== undefined ? algo(id) : undefined;
+      return [findingFromRule(RULE_PKESK, at, a ? { algorithm: a.family } : undefined)];
+    }
+    return [];
+  },
+};

package/src/detectors/pem.ts

@@ -51,7 +51,7 @@ const PEM_RULES: PemRule[] = [
       sensitive: true,
       message: "Embedded EC private key (SEC1 PEM); classical ECDSA/ECDH key, not quantum-safe.",
       remediation:
-        "Migrate to ML-DSA (FIPS 204) keys and remove embedded private keys from source.",
+        "Migrate to ML-DSA (FIPS 204) for signatures or hybrid X25519MLKEM768 for key agreement; remove embedded private keys from source.",
     },
   },
   {
@@ -211,6 +211,31 @@ const PEM_RULES: PemRule[] = [
   },
 ];
 
+/**
+ * True when what follows the begin marker looks like a REAL PEM block rather than a
+ * `-----BEGIN …-----` header STRING LITERAL (as appears in PEM parsers, tests, and
+ * i18n messages). `from` points just past the begin marker. Three accepting signals:
+ *
+ *  (a) a full LINE of base64 (≥24 chars, optional `=` padding) — real multi-line PEM
+ *      bodies are line-wrapped base64; requiring the whole line to be base64 stops a
+ *      long camelCase identifier on a code line from validating a bare header constant.
+ *  (b) an ESCAPED-newline base64 run (`\n<base64>`, a LITERAL backslash-n) — a key
+ *      embedded in a single-line JSON/.env string (GCP service accounts, `PRIVATE_KEY=
+ *      "…\n…"`), whose body can run past the window before its `-----END`. The literal
+ *      `\n` escape distinguishes it from a source constant, which has a REAL newline.
+ *  (c) a matching `-----END …-----` marker with NO double-quote between it and the
+ *      begin marker. This admits short/placeholder bodies (`x`, `abc`, `MIIB` in tests)
+ *      while rejecting a parser's PAIRED header/footer constants, whose intervening
+ *      `";` … `= "` always contains a `"` — a char a real PEM body never holds.
+ */
+function hasBase64Body(content: string, from: number): boolean {
+  const window = content.slice(from, from + 800);
+  if (/^[ \t]*[A-Za-z0-9+/]{24,}={0,2}[ \t]*$/m.test(window)) return true;
+  if (/\\n[A-Za-z0-9+/]{24,}/.test(window)) return true;
+  const end = window.search(/-----END [A-Z0-9 ]+-----/);
+  return end >= 0 && !window.slice(0, end).includes('"');
+}
+
 /** Detects PEM key/certificate material in arbitrary files. */
 export const pemDetector: Detector = {
   id: "pem-material",
@@ -227,6 +252,11 @@ export const pemDetector: Detector = {
     const findings: Finding[] = [];
     for (const rule of PEM_RULES) {
       eachMatch(rule.re, content, (m) => {
+        // Require an actual base64 body after the marker, so a bare
+        // `-----BEGIN RSA PRIVATE KEY-----` string literal in a PEM parser / test /
+        // i18n message does NOT get reported as an embedded key. A real PEM block has
+        // a run of base64 within the next few hundred chars.
+        if (!hasBase64Body(content, m.index + m[0].length)) return;
         findings.push(
           findingFromRule(rule.meta, {
             file,

package/src/detectors/php.ts

@@ -0,0 +1,230 @@
+/**
+ * Source-code detector for classical asymmetric cryptography in PHP — one of the
+ * most-deployed backend languages, previously uncovered. Handles the three
+ * dominant crypto surfaces:
+ *
+ *  - **ext/openssl** — `openssl_pkey_new()` (classified by its
+ *    `OPENSSL_KEYTYPE_*` config, defaulting to RSA), `openssl_public_encrypt` /
+ *    `openssl_private_decrypt` / `openssl_seal` / `openssl_open` (RSA), and
+ *    `openssl_sign` / `openssl_verify`.
+ *  - **phpseclib3** — `RSA::createKey()` / `EC::createKey()` / `DSA::createKey()`.
+ *  - **libsodium** — `sodium_crypto_box`/`kx` keypairs (X25519) and
+ *    `sodium_crypto_sign` keypairs (Ed25519).
+ *
+ * Lexical, like the other packs; the `openssl_*` / `sodium_crypto_*` prefixes and
+ * `OPENSSL_KEYTYPE_*` constants are distinctive, so the false-positive rate is low.
+ *
+ * HNDL: RSA encryption and (EC/X)DH key agreement are harvest-now-decrypt-later
+ * exposed (hndl:true); ECDSA / DSA / Ed25519 signatures are hndl:false but
+ * forgeable. `openssl_pkey_new` EC and `EC::createKey` are ambiguous (feed BOTH
+ * ECDSA and ECDH), classified conservatively as key-exchange-capable (hndl:true).
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { PHP_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+const RE_PHP_PKEY_NEW = /\bopenssl_pkey_new\s*\(/g;
+// public_encrypt/private_decrypt (direct RSA) plus seal/open (RSA-envelope: seal
+// encrypts a random symmetric key under each recipient's RSA public key, open
+// decrypts it with the private key) — all RSA key transport, harvest-now exposed.
+const RE_PHP_RSA_CRYPT = /\bopenssl_(?:public_encrypt|private_decrypt|seal|open)\s*\(/g;
+const RE_PHP_SIGN = /\bopenssl_(?:sign|verify)\s*\(/g;
+// phpseclib3 factory methods. The class names are generic, so require `::createKey`.
+const RE_PHP_SECLIB = /\b(RSA|EC|DSA|DH)::createKey\s*\(/g;
+// libsodium X25519 (box / kx / scalarmult) and Ed25519 (sign) key pairs.
+const RE_PHP_SODIUM_X25519 =
+  /\bsodium_crypto_(?:box|kx)_(?:seed_)?keypair\s*\(|\bsodium_crypto_scalarmult(?:_base)?\s*\(/g;
+// Also the explicit-algorithm variant sodium_crypto_sign_ed25519_keypair().
+const RE_PHP_SODIUM_ED25519 = /\bsodium_crypto_sign_(?:ed25519_|seed_)?keypair\s*\(/g;
+
+/** Key-type classification for `openssl_pkey_new`, keyed by its config constant. */
+interface KeyInfo {
+  algo: Finding["algorithm"];
+  cat: Finding["category"];
+  sev: Finding["severity"];
+  hndl: boolean;
+  label: string;
+  remediation?: string;
+}
+const HYBRID = "hybrid X25519MLKEM768 (ML-KEM-768) for key agreement; ML-DSA-65 (FIPS 204) to sign";
+
+const RULE_PHP_KEYGEN: RuleMeta = {
+  id: "php-openssl-keygen",
+  title: "PHP openssl key generation",
+  description: "openssl_pkey_new (RSA/EC/DSA/DH, by OPENSSL_KEYTYPE_*)",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Generates a classical key pair via PHP openssl_pkey_new — not quantum-safe.",
+};
+const RULE_PHP_RSA_CRYPT: RuleMeta = {
+  id: "php-openssl-rsa-crypt",
+  title: "PHP openssl RSA public-key encryption",
+  description: "openssl_public_encrypt / openssl_private_decrypt / openssl_seal / openssl_open",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "RSA public-key encryption/decryption (PHP openssl) is harvest-now-decrypt-later exposed.",
+};
+const RULE_PHP_SIGN: RuleMeta = {
+  id: "php-openssl-sign",
+  title: "PHP openssl signature",
+  description: "openssl_sign / openssl_verify",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "unknown",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Classical signature via PHP openssl (RSA/ECDSA/DSA) is forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_PHP_SECLIB: RuleMeta = {
+  id: "php-phpseclib-keygen",
+  title: "PHP phpseclib key generation",
+  description: "phpseclib3 RSA/EC/DSA/DH ::createKey",
+  category: "kem",
+  severity: "high",
+  confidence: "medium",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Generates a classical key pair via phpseclib3 (createKey) — not quantum-safe.",
+};
+const RULE_PHP_SODIUM_X25519: RuleMeta = {
+  id: "php-sodium-x25519",
+  title: "PHP libsodium X25519 key agreement",
+  description: "sodium_crypto_box/kx keypair + scalarmult",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "X25519",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "libsodium crypto_box/kx (PHP) uses X25519 key agreement — modern but classical, harvest-now-decrypt-later exposed.",
+};
+const RULE_PHP_SODIUM_ED25519: RuleMeta = {
+  id: "php-sodium-ed25519",
+  title: "PHP libsodium Ed25519 signature",
+  description: "sodium_crypto_sign keypair",
+  category: "signature",
+  severity: "low",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "libsodium crypto_sign (PHP) uses Ed25519 — classical and forgeable by a quantum attacker.",
+};
+
+/** phpseclib class name → its classification. */
+const SECLIB_INFO: Record<string, KeyInfo> = {
+  RSA: { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" },
+  EC: {
+    algo: "ECDH",
+    cat: "key-exchange",
+    sev: "high",
+    hndl: true,
+    label: "EC (ECDSA/ECDH)",
+    remediation: HYBRID,
+  },
+  DSA: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
+  DH: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
+};
+
+/** Classify `openssl_pkey_new` by the `OPENSSL_KEYTYPE_*` constant in its config.
+ * The window is bounded to the current statement (up to the next `;`, capped at
+ * 300 chars) so it can't bleed into a following `openssl_pkey_new` call's key
+ * type. Defaults to RSA — openssl_pkey_new's own default private_key_type is RSA
+ * when none is given. */
+function classifyPkeyNew(content: string, index: number): KeyInfo {
+  const semi = content.indexOf(";", index);
+  const end = Math.min(index + 300, semi === -1 ? content.length : semi);
+  const w = content.slice(index, end);
+  if (/\bOPENSSL_KEYTYPE_EC\b/.test(w)) return SECLIB_INFO.EC;
+  if (/\bOPENSSL_KEYTYPE_DSA\b/.test(w)) return SECLIB_INFO.DSA;
+  if (/\bOPENSSL_KEYTYPE_DH\b/.test(w)) return SECLIB_INFO.DH;
+  return SECLIB_INFO.RSA;
+}
+
+/** Detects classical asymmetric crypto in PHP (openssl, phpseclib, libsodium). */
+export const phpDetector: Detector = {
+  id: "php-crypto",
+  description: "Classical asymmetric crypto in PHP (openssl, phpseclib3, libsodium)",
+  scope: "source",
+  language: "php",
+  rules: [
+    RULE_PHP_KEYGEN,
+    RULE_PHP_RSA_CRYPT,
+    RULE_PHP_SIGN,
+    RULE_PHP_SECLIB,
+    RULE_PHP_SODIUM_X25519,
+    RULE_PHP_SODIUM_ED25519,
+  ],
+  appliesTo: (f) => hasExtension(f, PHP_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta): void =>
+      eachMatch(re, content, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+
+    // openssl_pkey_new — one finding per call, classified by its key-type config.
+    eachMatch(RE_PHP_PKEY_NEW, content, (m) => {
+      const info = classifyPkeyNew(content, m.index);
+      findings.push(
+        findingFromRule(
+          RULE_PHP_KEYGEN,
+          { file, content, index: m.index, matchLength: m[0].length },
+          {
+            title: `PHP openssl ${info.label} key generation`,
+            category: info.cat,
+            severity: info.sev,
+            algorithm: info.algo,
+            hndl: info.hndl,
+            message: `Generates a classical ${info.label} key pair via PHP openssl_pkey_new — not quantum-safe.`,
+            ...(info.remediation ? { remediation: info.remediation } : {}),
+          },
+        ),
+      );
+    });
+
+    add(RE_PHP_RSA_CRYPT, RULE_PHP_RSA_CRYPT);
+    add(RE_PHP_SIGN, RULE_PHP_SIGN);
+
+    // phpseclib3 ::createKey — classify by the class (RSA/EC/DSA/DH).
+    eachMatch(RE_PHP_SECLIB, content, (m) => {
+      const info = SECLIB_INFO[m[1]];
+      findings.push(
+        findingFromRule(
+          RULE_PHP_SECLIB,
+          { file, content, index: m.index, matchLength: m[0].length },
+          {
+            title: `PHP phpseclib ${info.label} key generation`,
+            category: info.cat,
+            severity: info.sev,
+            algorithm: info.algo,
+            hndl: info.hndl,
+            message: `Generates a classical ${info.label} key pair via phpseclib3 createKey — not quantum-safe.`,
+            ...(info.remediation ? { remediation: info.remediation } : {}),
+          },
+        ),
+      );
+    });
+
+    add(RE_PHP_SODIUM_X25519, RULE_PHP_SODIUM_X25519);
+    add(RE_PHP_SODIUM_ED25519, RULE_PHP_SODIUM_ED25519);
+    return findings;
+  },
+};