@quantakrypto/core 0.4.3 → 0.5.0

package/src/detectors/pkcs11.ts

@@ -0,0 +1,113 @@
+/**
+ * Config detector: classical asymmetric keys held in / generated by a PKCS#11 HSM
+ * or token. HSMs hold an organization's longest-lived roots (CA keys, code-signing
+ * keys), so they are exactly the keys a PQC migration must find first — yet they
+ * live behind a PKCS#11 layer the source packs never see.
+ *
+ * Covered, distinctive lexical surfaces:
+ *  - `pkcs11-tool --keypairgen --key-type rsa:2048 | EC:secp256r1` — the standard
+ *    OpenSC keygen invocation recorded in ops scripts / runbooks.
+ *  - `CKM_RSA_PKCS(_KEY_PAIR_GEN|_OAEP|_PSS)` / `CKM_EC(DSA|DH)` / `CKM_DSA` — the
+ *    PKCS#11 mechanism constants (SoftHSM, SunPKCS11, pkcs11js, python-pkcs11), which
+ *    name the exact algorithm.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+// `pkcs11-tool --keypairgen --key-type rsa:2048` / `EC:secp256r1` (OpenSC).
+const RE_PKCS11_TOOL_RSA = /--key-type\s+rsa:\d+/gi;
+const RE_PKCS11_TOOL_EC = /--key-type\s+EC:[A-Za-z0-9]+/gi;
+// PKCS#11 mechanism constants (CKM_*), which name the algorithm exactly.
+const RE_CKM_RSA = /\bCKM_RSA_(?:PKCS(?:_KEY_PAIR_GEN|_OAEP|_PSS)?|X_509|9796)\b/g;
+const RE_CKM_EC = /\bCKM_EC(?:DSA(?:_SHA\d+)?|DH1?_DERIVE|_KEY_PAIR_GEN)\b/g;
+const RE_CKM_DSA = /\bCKM_DSA(?:_SHA\d+|_KEY_PAIR_GEN)?\b/g;
+const RE_CKM_DH = /\bCKM_DH_PKCS_(?:KEY_PAIR_GEN|DERIVE)\b/g;
+
+const RULE_PKCS11_RSA: RuleMeta = {
+  id: "pkcs11-rsa",
+  title: "PKCS#11 (HSM) RSA key",
+  description: "PKCS#11 RSA key generation / mechanism (pkcs11-tool, CKM_RSA_*)",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "A classical RSA key in a PKCS#11 HSM / token — likely a long-lived root (CA / code-signing), and not quantum-safe.",
+  remediation:
+    "Inventory HSM-held RSA keys first (longest-lived); plan re-keying to PQC (ML-KEM-768 / ML-DSA-65) as HSM firmware adds support.",
+};
+const RULE_PKCS11_EC: RuleMeta = {
+  id: "pkcs11-ec",
+  title: "PKCS#11 (HSM) EC key",
+  description: "PKCS#11 EC key generation / mechanism (CKM_EC*, --key-type EC)",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "A classical EC key in a PKCS#11 HSM / token; EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204). Prioritise HSM-held keys.",
+};
+const RULE_PKCS11_DSA: RuleMeta = {
+  id: "pkcs11-dsa",
+  title: "PKCS#11 (HSM) DSA key",
+  description: "PKCS#11 DSA key generation / mechanism (CKM_DSA*)",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "DSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "A classical DSA key in a PKCS#11 HSM / token — deprecated and quantum-forgeable.",
+  remediation: "Rotate off DSA; migrate to ML-DSA-65 (FIPS 204).",
+};
+const RULE_PKCS11_DH: RuleMeta = {
+  id: "pkcs11-dh",
+  title: "PKCS#11 (HSM) Diffie-Hellman",
+  description: "PKCS#11 finite-field DH key generation / derive (CKM_DH_PKCS_*)",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "DH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Finite-field Diffie-Hellman in a PKCS#11 HSM / token; classical key agreement, harvest-now-decrypt-later exposed.",
+  remediation: "Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768).",
+};
+
+/** Detects classical asymmetric keys behind a PKCS#11 HSM / token. */
+export const pkcs11Detector: Detector = {
+  id: "pkcs11-crypto",
+  description: "Classical asymmetric keys in a PKCS#11 HSM / token",
+  scope: "config",
+  language: "any",
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+  rules: [RULE_PKCS11_RSA, RULE_PKCS11_EC, RULE_PKCS11_DSA, RULE_PKCS11_DH],
+  detect({ file, content }): Finding[] {
+    // Fast reject: only proceed on a distinctive PKCS#11 marker.
+    if (!content.includes("CKM_") && !content.includes("--key-type")) {
+      return [];
+    }
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta): void =>
+      eachMatch(re, content, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    add(RE_PKCS11_TOOL_RSA, RULE_PKCS11_RSA);
+    add(RE_PKCS11_TOOL_EC, RULE_PKCS11_EC);
+    add(RE_CKM_RSA, RULE_PKCS11_RSA);
+    add(RE_CKM_EC, RULE_PKCS11_EC);
+    add(RE_CKM_DSA, RULE_PKCS11_DSA);
+    add(RE_CKM_DH, RULE_PKCS11_DH);
+    return findings;
+  },
+};

package/src/detectors/proxy.ts

@@ -0,0 +1,236 @@
+/**
+ * Config detector: classical-certificate TLS termination in standalone
+ * reverse-proxy / load-balancer configuration and in-code gRPC channel
+ * credentials.
+ *
+ * A standalone Envoy, Nginx, HAProxy, Traefik, or Caddy config that terminates
+ * TLS with an RSA/ECDSA leaf certificate and negotiates an ECDHE key exchange is
+ * the canonical harvest-now-decrypt-later (HNDL) surface: an attacker who
+ * records today's handshake + ciphertext can decrypt it retroactively once a
+ * cryptographically-relevant quantum computer (CRQC) can break the ephemeral
+ * (EC)DHE secret. The Kubernetes / service-mesh detectors (`k8s.ts`, `mesh.ts`)
+ * cover the CLUSTER-managed cert + mesh-mTLS surfaces; the STANDALONE proxy
+ * config FILES and the in-code gRPC credential constructors below are seen by
+ * neither them nor the language packs, so they are covered here.
+ *
+ * Because the config token itself does not name the cert's key algorithm (the
+ * key lives in a referenced PEM file, out of band), these findings use
+ * `algorithm: "unknown"` — the evidence is "a classical-cert TLS channel is
+ * configured HERE", not a specific family. They are `category: "key-exchange"`
+ * (the ECDHE handshake is the harvestable primitive) and `hndl: true`.
+ * Confidence is `medium`: a config-level indicator of a classical TLS channel,
+ * not a matched algorithm string.
+ *
+ * PRECISION / fast-reject: several of the matched tokens (`ssl_certificate`,
+ * `private_key:`, `certificates:`) are generic enough to appear in unrelated
+ * YAML/config, so `detect()` bails unless the file carries a distinctive
+ * proxy/gRPC marker (see `hasProxyMarker`). This keeps a random YAML that merely
+ * has a `private_key:` key, or a Traefik-shaped `certificates:` list that isn't
+ * a Traefik config, from firing. Comments are masked (YAML/nginx/HCL `#`, plus
+ * `//` and C-style `/* … *\/` blocks) so a commented-out directive can't fire.
+ *
+ * Covered surfaces:
+ *  - Envoy   — `common_tls_context:` / `DownstreamTlsContext` /
+ *              `UpstreamTlsContext` with `tls_certificates:` carrying a
+ *              `certificate_chain:` + `private_key:` (and the
+ *              `envoy.transport_sockets.tls` transport socket).
+ *  - Nginx   — `ssl_certificate` + `ssl_certificate_key` directives.
+ *  - HAProxy — `bind … ssl crt …` lines and `crt-store` sections.
+ *  - Traefik — a `tls:` block's `certificates:` with `certFile:` + `keyFile:`
+ *              (dynamic config) or a `certResolver` (ACME) reference.
+ *  - gRPC    — in-code TLS channel credentials: `grpc.ssl_channel_credentials(`
+ *              (Python), `grpc.credentials.createSsl(` (Node),
+ *              `TlsChannelCredentials` (Java), `credentials.NewTLS(` (Go).
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import {
+  DOC_EXTENSIONS,
+  eachMatch,
+  findingFromRule,
+  hasExtension,
+  maskBlockComments,
+  maskCommentLines,
+} from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+// --- Envoy: match ONLY the Envoy-DISTINCTIVE tokens (`common_tls_context:`, the
+// `*TlsContext` type names, `tls_certificates:`, the `envoy.transport_sockets.tls`
+// transport socket). The generic `certificate_chain:` / `private_key:` fields are
+// deliberately NOT matched here — they appear in unrelated YAML and would
+// cross-label a non-Envoy file as Envoy (audit L2). A distinctive token IS the
+// evidence, so no separate marker gate is needed for this rule (audit L1).
+const RE_ENVOY_TLS =
+  /\b(?:DownstreamTlsContext|UpstreamTlsContext|common_tls_context\s*:|tls_certificates\s*:|envoy\.transport_sockets\.tls)/g;
+
+// --- Nginx: the classic `ssl_certificate` / `ssl_certificate_key` directive
+// pair. `ssl_certificate_key` is matched first-class; `ssl_certificate` requires
+// a following space so it doesn't also swallow `ssl_certificate_key` as a second
+// hit on the same directive (kept as a single rule regardless).
+const RE_NGINX_TLS = /\bssl_certificate(?:_key)?\s+\S/g;
+
+// --- HAProxy: a `bind` line that terminates TLS (`ssl crt <path>`) or a
+// `crt-store` section (HAProxy 2.8+ certificate store). `ssl` and `crt` may be
+// separated by other bind args, so match them independently on a bind context.
+const RE_HAPROXY_TLS =
+  /\bcrt-store\b|\bbind\b[^\n]*\bssl\b[^\n]*\bcrt\b|\bbind\b[^\n]*\bcrt\b[^\n]*\bssl\b/g;
+
+// --- Traefik: dynamic-config TLS certificate entries (`certFile:` + `keyFile:`)
+// or an ACME `certResolver` reference. `certFile`/`keyFile` are Traefik-specific
+// enough (paired with the `certResolver`/`tls:` marker gate) to anchor on.
+const RE_TRAEFIK_TLS = /\bcertResolver\b|\b(?:certFile|keyFile)\s*:/g;
+
+// --- gRPC in-code TLS channel credentials across languages.
+const RE_GRPC_TLS =
+  /grpc\.ssl_channel_credentials\s*\(|grpc\.credentials\.createSsl\s*\(|\bTlsChannelCredentials\b|\bcredentials\.NewTLS\s*\(/g;
+
+const MESSAGE = (proxy: string): string =>
+  `${proxy} terminates TLS with a classical certificate + ECDHE key exchange; the recorded handshake is harvest-now-decrypt-later exposed — verify the cert key algorithm and plan a PQC-hybrid (X25519MLKEM768) TLS migration.`;
+
+const REMEDIATION =
+  "Enable hybrid PQC key exchange (X25519MLKEM768) once the proxy/gRPC stack supports it; re-key certificates to PQC signatures (ML-DSA) when available.";
+
+const RULE_ENVOY: RuleMeta = {
+  id: "proxy-envoy-tls",
+  title: "Envoy classical TLS termination",
+  description: "Envoy TLS context terminates TLS with a classical certificate + ECDHE key exchange",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "medium",
+  algorithm: "unknown",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: MESSAGE("Envoy"),
+  remediation: REMEDIATION,
+};
+const RULE_NGINX: RuleMeta = {
+  id: "proxy-nginx-tls",
+  title: "Nginx classical TLS termination",
+  description:
+    "Nginx ssl_certificate/ssl_certificate_key terminates TLS with a classical cert + ECDHE",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "medium",
+  algorithm: "unknown",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: MESSAGE("Nginx"),
+  remediation: REMEDIATION,
+};
+const RULE_HAPROXY: RuleMeta = {
+  id: "proxy-haproxy-tls",
+  title: "HAProxy classical TLS termination",
+  description: "HAProxy bind ssl crt / crt-store terminates TLS with a classical cert + ECDHE",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "medium",
+  algorithm: "unknown",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: MESSAGE("HAProxy"),
+  remediation: REMEDIATION,
+};
+const RULE_TRAEFIK: RuleMeta = {
+  id: "proxy-traefik-tls",
+  title: "Traefik classical TLS termination",
+  description:
+    "Traefik tls certificates (certFile/keyFile) or certResolver terminate TLS with a classical cert + ECDHE",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "medium",
+  algorithm: "unknown",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: MESSAGE("Traefik"),
+  remediation: REMEDIATION,
+};
+const RULE_GRPC: RuleMeta = {
+  id: "grpc-tls-credentials",
+  title: "gRPC classical TLS channel credentials",
+  description: "gRPC channel established with classical TLS credentials (RSA/ECDSA cert + ECDHE)",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "medium",
+  algorithm: "unknown",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: MESSAGE("gRPC"),
+  remediation: REMEDIATION,
+};
+
+/**
+ * PERF fast-reject only — a superset of substrings that appear in every rule's
+ * matchable input, so it can never drop a file a rule would flag. Correctness is
+ * in the per-rule regexes (each is distinctive enough to self-gate); this list
+ * exists purely to skip the regex work on files with no proxy/gRPC token at all.
+ */
+const PROXY_FAST_REJECT: readonly string[] = [
+  // Envoy
+  "tls_context",
+  "TlsContext",
+  "tls_certificates",
+  "transport_sockets.tls",
+  // Nginx
+  "ssl_certificate",
+  // HAProxy (`crt-store` and `bind … ssl … crt` both contain "crt")
+  "crt",
+  // Traefik
+  "certResolver",
+  "certFile",
+  "keyFile",
+  // gRPC
+  "ssl_channel_credentials",
+  "createSsl",
+  "TlsChannelCredentials",
+  "credentials.NewTLS",
+];
+
+interface ProxyRule {
+  meta: RuleMeta;
+  re: RegExp;
+}
+
+const PROXY_RULES: readonly ProxyRule[] = [
+  { meta: RULE_ENVOY, re: RE_ENVOY_TLS },
+  { meta: RULE_NGINX, re: RE_NGINX_TLS },
+  { meta: RULE_HAPROXY, re: RE_HAPROXY_TLS },
+  { meta: RULE_TRAEFIK, re: RE_TRAEFIK_TLS },
+  { meta: RULE_GRPC, re: RE_GRPC_TLS },
+];
+
+/**
+ * Detects classical-cert TLS termination in standalone reverse-proxy /
+ * load-balancer config files and in-code gRPC channel credentials. See the
+ * module docstring for the covered surfaces and the fast-reject rationale.
+ */
+export const proxyDetector: Detector = {
+  id: "proxy-tls-crypto",
+  description:
+    "Classical-cert TLS termination in reverse-proxy / load-balancer config (Envoy, Nginx, HAProxy, Traefik) and gRPC channel credentials",
+  scope: "config",
+  language: "any",
+  rules: PROXY_RULES.map((r) => r.meta),
+  // Config + source files are all in scope (gRPC creds live in code); only prose
+  // documentation is excluded, so a README mentioning `ssl_certificate` in a
+  // sentence can't fire (the marker gate already handles most of this).
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    // Mask comments first so a directive that only appears inside a commented-out
+    // block cannot fire.
+    const scan = maskCommentLines(maskBlockComments(content), ["#", "//"]);
+    // Cheap fast-reject: skip files with none of the distinctive tokens. This is a
+    // perf gate only — each rule's regex is distinctive enough to SELF-GATE (a
+    // separate too-narrow marker list previously dropped canonical HAProxy/Traefik
+    // configs entirely — audit H1/H2), so correctness lives in the per-rule regexes.
+    if (!PROXY_FAST_REJECT.some((mk) => scan.includes(mk))) return [];
+
+    const findings: Finding[] = [];
+    for (const { meta, re } of PROXY_RULES) {
+      eachMatch(re, scan, (m) =>
+        findings.push(
+          findingFromRule(meta, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    }
+    return findings;
+  },
+};

package/src/detectors/pulumi.ts

@@ -0,0 +1,106 @@
+/**
+ * IaC detector: classical asymmetric keys provisioned by Pulumi's `tls` provider
+ * (`@pulumi/tls` / `pulumi_tls` / `pulumi-tls`), across the languages Pulumi programs
+ * are written in (TS/JS, Python, Go). A `tls.PrivateKey` resource mints real key
+ * material at deploy time — the IaC surface, like Terraform's `tls_private_key`, but
+ * expressed as SDK calls in a general-purpose source file rather than HCL.
+ *
+ * Detection is gated to files that actually use the pulumi-tls provider (a
+ * `@pulumi/tls` / `pulumi_tls` / `pulumi-tls` import or a `tls.PrivateKey` /
+ * `tls.NewPrivateKey` construction), then classifies each `algorithm` value:
+ *  - `"RSA"`     → RSA key (kem, HNDL)
+ *  - `"ECDSA"`   → EC signing key (signature)
+ *  - `"ED25519"` → Ed25519 signing key (signature)
+ * Comment/string suppression is handled centrally for the host languages.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+const PULUMI_EXTENSIONS: readonly string[] = [".ts", ".js", ".mjs", ".cjs", ".py", ".go"];
+
+// The `algorithm` value of a pulumi-tls PrivateKey, in the TS/Python (`algorithm:
+// "RSA"` / `algorithm="RSA"`) and Go (`Algorithm: pulumi.String("RSA")`) spellings.
+const RE_PULUMI_TLS_ALG =
+  /\b[Aa]lgorithm\s*[:=]\s*(?:pulumi\.String\(\s*)?["'](RSA|ECDSA|ED25519)["']/g;
+
+/** True when the file actually uses the pulumi-tls provider (gate against FPs). */
+function usesPulumiTls(content: string): boolean {
+  return (
+    content.includes("@pulumi/tls") ||
+    content.includes("pulumi_tls") ||
+    content.includes("pulumi-tls") ||
+    content.includes("tls.PrivateKey") ||
+    content.includes("tls.NewPrivateKey")
+  );
+}
+
+const RULE_PULUMI_RSA: RuleMeta = {
+  id: "pulumi-tls-rsa",
+  title: "Pulumi tls.PrivateKey RSA key",
+  description: 'Pulumi tls.PrivateKey with algorithm "RSA"',
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Pulumi provisions a classical RSA key (tls.PrivateKey), which is not quantum-safe.",
+  remediation: "Plan migration to PQC (ML-KEM-768 for encryption, ML-DSA-65 for signatures).",
+};
+const RULE_PULUMI_ECDSA: RuleMeta = {
+  id: "pulumi-tls-ecdsa",
+  title: "Pulumi tls.PrivateKey ECDSA key",
+  description: 'Pulumi tls.PrivateKey with algorithm "ECDSA"',
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Pulumi provisions a classical ECDSA key (tls.PrivateKey), forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+};
+const RULE_PULUMI_ED25519: RuleMeta = {
+  id: "pulumi-tls-ed25519",
+  title: "Pulumi tls.PrivateKey Ed25519 key",
+  description: 'Pulumi tls.PrivateKey with algorithm "ED25519"',
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Pulumi provisions a classical Ed25519 key (tls.PrivateKey), forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+};
+
+const RULE_BY_ALG: Record<string, RuleMeta> = {
+  RSA: RULE_PULUMI_RSA,
+  ECDSA: RULE_PULUMI_ECDSA,
+  ED25519: RULE_PULUMI_ED25519,
+};
+
+/** Detects classical asymmetric keys provisioned by Pulumi's tls provider. */
+export const pulumiDetector: Detector = {
+  id: "pulumi-crypto",
+  description: "Classical asymmetric keys provisioned by Pulumi's tls provider (IaC)",
+  scope: "config",
+  language: "any",
+  rules: [RULE_PULUMI_RSA, RULE_PULUMI_ECDSA, RULE_PULUMI_ED25519],
+  appliesTo: (f) => hasExtension(f, PULUMI_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    if (!usesPulumiTls(content)) return [];
+    const findings: Finding[] = [];
+    eachMatch(RE_PULUMI_TLS_ALG, content, (m) => {
+      const rule = RULE_BY_ALG[m[1]];
+      if (!rule) return;
+      findings.push(
+        findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+      );
+    });
+    return findings;
+  },
+};

package/src/detectors/python.ts

@@ -241,6 +241,63 @@ const RULE_PY_TLS_LEGACY: RuleMeta = {
     "Use ssl.PROTOCOL_TLS_CLIENT with minimum_version = ssl.TLSVersion.TLSv1_3 and prefer PQC-hybrid key exchange.",
 };
 
+/**
+ * Aliasable `cryptography` / PyCryptodome modules → the (method, rule) pairs
+ * reachable through them. Lets an aliased module import
+ * (`from ... import rsa as _rsa` → `_rsa.generate_private_key(`) resolve back to
+ * the same rule the direct `rsa.generate_private_key(` would fire, since the
+ * detector's regexes are module-qualified and miss a renamed prefix.
+ */
+const PY_MODULE_RULES: Record<string, ReadonlyArray<{ method: string; rule: RuleMeta }>> = {
+  rsa: [{ method: "generate_private_key", rule: RULE_PY_RSA_KEYGEN }],
+  ec: [
+    { method: "generate_private_key", rule: RULE_PY_EC_KEYGEN },
+    { method: "ECDSA", rule: RULE_PY_ECDSA },
+    { method: "ECDH", rule: RULE_PY_ECDH },
+  ],
+  dsa: [{ method: "generate_private_key", rule: RULE_PY_HAZMAT_DSA }],
+  dh: [{ method: "generate_parameters", rule: RULE_PY_DH }],
+  padding: [{ method: "OAEP", rule: RULE_PY_RSA_ENCRYPT }],
+  // PyCryptodome factory modules (`.generate(`).
+  RSA: [{ method: "generate", rule: RULE_PY_RSA_KEYGEN }],
+  ECC: [{ method: "generate", rule: RULE_PY_EC_KEYGEN }],
+  DSA: [{ method: "generate", rule: RULE_PY_DSA }],
+};
+
+/** Escape a string for interpolation into a dynamically-built RegExp. */
+function escapePyRe(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/**
+ * Collect module aliases for the aliasable crypto modules, so a later
+ * `<alias>.<method>(` call still resolves. Handles both `from <path> import
+ * <mod> as <alias>` (including comma-separated specifiers) and the bare
+ * `import <path.mod> as <alias>`. Returns Map<module, alias[]>; an alias equal to
+ * its own module name is skipped (matched directly already).
+ */
+function collectPyModuleAliases(content: string): Map<string, string[]> {
+  const out = new Map<string, string[]>();
+  const add = (mod: string, alias: string): void => {
+    if (!alias || alias === mod || !(mod in PY_MODULE_RULES)) return;
+    const list = out.get(mod) ?? [];
+    if (!list.includes(alias)) list.push(alias);
+    out.set(mod, list);
+  };
+  // `from <path> import a as b, c as d` — scan the import list for `X as Y`.
+  const fromRe = /(?:^|\n)[ \t]*from\s+[\w.]+\s+import\s+([^\n#]+)/g;
+  for (let m = fromRe.exec(content); m; m = fromRe.exec(content)) {
+    const specRe = /([A-Za-z_]\w*)\s+as\s+([A-Za-z_]\w*)/g;
+    for (let s = specRe.exec(m[1]); s; s = specRe.exec(m[1])) add(s[1], s[2]);
+  }
+  // `import <path.mod> as <alias>` — the aliased module is the last dotted segment.
+  const impRe = /(?:^|\n)[ \t]*import\s+([\w.]+)\s+as\s+([A-Za-z_]\w*)/g;
+  for (let m = impRe.exec(content); m; m = impRe.exec(content)) {
+    add(m[1].split(".").pop() ?? m[1], m[2]);
+  }
+  return out;
+}
+
 /** Detects classical asymmetric crypto in Python source. */
 export const pythonDetector: Detector = {
   id: "python-crypto",
@@ -286,6 +343,20 @@ export const pythonDetector: Detector = {
     add(RE_PY_TLS_REJECT, RULE_PY_TLS_REJECT);
     add(RE_PY_TLS_LEGACY, RULE_PY_TLS_LEGACY);
 
+    // Module-alias resolution: `from ... import rsa as _rsa` then
+    // `_rsa.generate_private_key(` — the direct regexes are module-qualified
+    // (`\brsa\.`) and miss a renamed prefix. Runs on the ORIGINAL content so
+    // locations stay exact; fires only for an alias explicitly bound to a known
+    // crypto module, so precision is unaffected.
+    for (const [mod, aliasList] of collectPyModuleAliases(content)) {
+      for (const alias of aliasList) {
+        const a = escapePyRe(alias);
+        for (const { method, rule } of PY_MODULE_RULES[mod]) {
+          add(new RegExp(`\\b${a}\\.${method}\\s*\\(`, "g"), rule);
+        }
+      }
+    }
+
     return findings;
   },
 };

package/src/detectors/rust.ts

@@ -27,6 +27,10 @@ const RE_RUST_ECDH = /\becdh::EphemeralSecret\b|\bagreement::ECDH_P(?:256|384)\b
 const RE_RUST_ED25519 = /\bed25519_dalek::(?:SigningKey|Keypair|SecretKey)\b|\bEd25519KeyPair::/g;
 // X25519 key agreement (dalek).
 const RE_RUST_X25519 = /\bx25519_dalek::(?:EphemeralSecret|StaticSecret)\b/g;
+// X448 key agreement (`x448` crate). The qualified `x448::Secret` path — covers the
+// plain `use x448::Secret;` / fully-qualified form the alias mechanism (which only
+// fires on a RENAMED `use … as`) misses.
+const RE_RUST_X448 = /\bx448::Secret\b/g;
 // openssl crate bindings — the `Type::generate(` / `Dh::` call forms, distinct
 // from the ring / RustCrypto path syntax above (audit F5/F9 false-negatives).
 const RE_RUST_OPENSSL_RSA = /\bRsa::generate\s*\(/g;
@@ -115,6 +119,18 @@ const RULE_RUST_X25519: RuleMeta = {
   cwe: CWE_BROKEN_CRYPTO,
   message: "X25519 (Rust) is modern but still classical key agreement — harvest-now-decrypt-later.",
 };
+const RULE_RUST_X448: RuleMeta = {
+  id: "rust-x448",
+  title: "Rust X448 key agreement",
+  description: "the `x448` crate Secret key agreement",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "X448",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "X448 (Rust) is modern but still classical key agreement — harvest-now-decrypt-later.",
+};
 const RULE_RUST_OPENSSL_RSA: RuleMeta = {
   id: "rust-openssl-rsa",
   title: "Rust openssl RSA key generation",
@@ -251,6 +267,51 @@ const RULE_RUST_TLS_DANGEROUS: RuleMeta = {
   remediation: "Avoid the dangerous() escape hatch; keep the default certificate verifier.",
 };
 
+/**
+ * Aliasable Rust crypto types (`<crate>::<OrigType>` → rule). A renamed `use`
+ * (`use x25519_dalek::{EphemeralSecret as MontgomerySecret}`) binds the alias to a
+ * classical-key type; a later `MontgomerySecret::<ctor>(` is that key's
+ * construction. The `::`-qualified and braced rules above miss this because the
+ * call site uses the renamed identifier, not the original path.
+ */
+const RUST_ALIASABLE: Record<string, RuleMeta> = {
+  "x25519_dalek::EphemeralSecret": RULE_RUST_X25519,
+  "x25519_dalek::StaticSecret": RULE_RUST_X25519,
+  "x448::Secret": RULE_RUST_X448,
+  "ed25519_dalek::SigningKey": RULE_RUST_ED25519,
+  "ed25519_dalek::Keypair": RULE_RUST_ED25519,
+  "ed25519_dalek::SecretKey": RULE_RUST_ED25519,
+};
+
+/** Escape a string for interpolation into a dynamically-built RegExp. */
+function escapeRustRe(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/**
+ * Collect `use <crate>::<OrigType> as <Alias>` bindings (braced or single) that
+ * rename an aliasable crypto type, returning {alias, rule} pairs. An alias equal
+ * to its own type name is skipped (the qualified/bare rules already catch it).
+ */
+function collectRustTypeAliases(content: string): Array<{ alias: string; rule: RuleMeta }> {
+  const out: Array<{ alias: string; rule: RuleMeta }> = [];
+  const push = (crate: string, orig: string, alias: string): void => {
+    if (!alias || alias === orig) return;
+    const rule = RUST_ALIASABLE[`${crate}::${orig}`];
+    if (rule) out.push({ alias, rule });
+  };
+  // Braced: `use <crate>::{ Orig as Alias, ... }`.
+  const braced = /\buse\s+([\w:]+)::\{([^}]*)\}/g;
+  for (let m = braced.exec(content); m; m = braced.exec(content)) {
+    const specRe = /([A-Za-z_]\w*)\s+as\s+([A-Za-z_]\w*)/g;
+    for (let s = specRe.exec(m[2]); s; s = specRe.exec(m[2])) push(m[1], s[1], s[2]);
+  }
+  // Single: `use <crate>::Orig as Alias;`.
+  const single = /\buse\s+([\w:]+)::([A-Za-z_]\w*)\s+as\s+([A-Za-z_]\w*)/g;
+  for (let m = single.exec(content); m; m = single.exec(content)) push(m[1], m[2], m[3]);
+  return out;
+}
+
 /** Detects classical asymmetric crypto in Rust (rsa, ring, dalek, p256/k256). */
 export const rustDetector: Detector = {
   id: "rust-crypto",
@@ -263,6 +324,7 @@ export const rustDetector: Detector = {
     RULE_RUST_ECDH,
     RULE_RUST_ED25519,
     RULE_RUST_X25519,
+    RULE_RUST_X448,
     RULE_RUST_OPENSSL_RSA,
     RULE_RUST_OPENSSL_EC,
     RULE_RUST_OPENSSL_DSA,
@@ -288,6 +350,7 @@ export const rustDetector: Detector = {
     add(RE_RUST_ECDH, RULE_RUST_ECDH);
     add(RE_RUST_ED25519, RULE_RUST_ED25519);
     add(RE_RUST_X25519, RULE_RUST_X25519);
+    add(RE_RUST_X448, RULE_RUST_X448);
     add(RE_RUST_OPENSSL_RSA, RULE_RUST_OPENSSL_RSA);
     add(RE_RUST_OPENSSL_EC, RULE_RUST_OPENSSL_EC);
     add(RE_RUST_OPENSSL_DSA, RULE_RUST_OPENSSL_DSA);
@@ -311,6 +374,19 @@ export const rustDetector: Detector = {
     });
     add(RE_RUST_TLS_ACCEPT_INVALID, RULE_RUST_TLS_ACCEPT_INVALID);
     add(RE_RUST_TLS_DANGEROUS, RULE_RUST_TLS_DANGEROUS);
+
+    // Type-alias resolution: `use x25519_dalek::{EphemeralSecret as MontgomerySecret}`
+    // then `MontgomerySecret::random_from_rng(` — the braced+renamed `use` defeats
+    // the `::`-qualified rules. Match the aliased type's construction calls; runs
+    // on the ORIGINAL content so locations stay exact, and fires only for an alias
+    // explicitly bound to a known crypto type (precision-safe).
+    for (const { alias, rule } of collectRustTypeAliases(content)) {
+      const a = escapeRustRe(alias);
+      add(
+        new RegExp(`\\b${a}::(?:new|random|random_from_rng|generate|from_bytes)\\s*\\(`, "g"),
+        rule,
+      );
+    }
     return findings;
   },
 };