@quantakrypto/core 0.4.3 → 0.5.0

package/src/detectors/source.ts

@@ -32,6 +32,7 @@ import {
   DOC_EXTENSIONS,
   JWT_HOST_EXTENSIONS,
   eachMatch,
+  enclosingObject,
   findingFromRule,
   hasExtension,
   nearSortedCall,
@@ -46,6 +47,135 @@ import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cw
 // (ordered alternation would otherwise match `rsa` and reject the `-pss` tail).
 const RE_GENERATE_KEYPAIR =
   /generateKeyPair(?:Sync)?\s*\(\s*['"`](rsa-pss|rsa|ec|dsa|dh|x25519|x448|ed25519|ed448)['"`]/g;
+
+/** Per-key-type classification for `generateKeyPair(Sync)('<type>', …)`. Hoisted
+ * to module scope so the direct matcher AND the import-alias pass (below) share
+ * one source of truth for how each key type is classified. */
+interface KeygenInfo {
+  algo: Finding["algorithm"];
+  cat: Finding["category"];
+  sev: Finding["severity"];
+  hndl: boolean;
+  label: string;
+  message?: string;
+  remediation?: string;
+}
+const KEYGEN_INFO: Record<string, KeygenInfo> = {
+  rsa: { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" },
+  // RSA-PSS is signature-only, so classify it as a (forgeable) signature
+  // rather than a KEM — no HNDL confidentiality exposure.
+  "rsa-pss": {
+    algo: "RSA",
+    cat: "signature",
+    sev: "high",
+    hndl: false,
+    label: "RSA-PSS",
+    message: "Generates a classical RSA-PSS signing key, which is forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+  },
+  // EC keys feed BOTH ECDSA (sign) and ECDH (key agreement). ECDH is
+  // HNDL-exposed, so classify conservatively as key-exchange-capable and
+  // surface both concerns rather than asserting signature-only (P0-4).
+  ec: {
+    algo: "ECDH",
+    cat: "key-exchange",
+    sev: "high",
+    hndl: true,
+    label: "EC (ECDSA/ECDH)",
+    message:
+      "Generates a classical EC key pair. EC keys feed BOTH ECDSA signatures " +
+      "and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
+    remediation:
+      "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+  },
+  dsa: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
+  dh: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
+  x25519: { algo: "X25519", cat: "key-exchange", sev: "medium", hndl: true, label: "X25519" },
+  x448: { algo: "X448", cat: "key-exchange", sev: "medium", hndl: true, label: "X448" },
+  ed25519: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed25519" },
+  ed448: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed448" },
+};
+
+/** Emit a keygen finding for `generateKeyPair(Sync)('<type>')` at [index]. Shared
+ * by the direct matcher and the import-alias pass so both classify identically. */
+function pushKeygenFinding(
+  findings: Finding[],
+  rawType: string,
+  file: string,
+  content: string,
+  index: number,
+  matchLength: number,
+): void {
+  const info = KEYGEN_INFO[rawType.toLowerCase()];
+  if (!info) return;
+  findings.push(
+    findingFromRule(
+      RULE_NODE_KEYGEN,
+      { file, content, index, matchLength },
+      {
+        title: `${info.label} key generation`,
+        category: info.cat,
+        severity: info.sev,
+        algorithm: info.algo,
+        hndl: info.hndl,
+        message:
+          info.message ??
+          `Generates a classical ${info.label} key pair, which is not quantum-safe.`,
+        ...(info.remediation ? { remediation: info.remediation } : {}),
+      },
+    ),
+  );
+}
+
+/** Canonical Node-crypto call names whose import-aliases we resolve. */
+const ALIASABLE: readonly string[] = [
+  "generateKeyPairSync",
+  "generateKeyPair",
+  "createECDH",
+  "createDiffieHellman",
+  "createDiffieHellmanGroup",
+];
+
+/**
+ * Collect import-aliases for the canonical crypto calls we resolve, so
+ * `import { generateKeyPairSync as gk } from 'node:crypto'` (or the CommonJS
+ * `const { generateKeyPairSync: gk } = require('crypto')`) is followed when `gk`
+ * is called later. Returns Map<canonical, alias[]>. An alias equal to its own
+ * canonical name is skipped (already matched directly). Precision-safe: the
+ * alias is only ever bound to a known crypto symbol, so a later `gk(` call is
+ * unambiguously that symbol.
+ */
+function collectCryptoAliases(content: string): Map<string, string[]> {
+  const out = new Map<string, string[]>();
+  const add = (canonical: string, alias: string): void => {
+    if (!alias || alias === canonical) return;
+    const list = out.get(canonical) ?? [];
+    if (!list.includes(alias)) list.push(alias);
+    out.set(canonical, list);
+  };
+  // ESM named imports: `import { A as B, C as D } from '...'`.
+  const esm = /import\s*(?:type\s+)?\{([^}]*)\}\s*from\s*['"][^'"]*['"]/g;
+  for (let m = esm.exec(content); m; m = esm.exec(content)) {
+    const spec = /([A-Za-z_$][\w$]*)\s+as\s+([A-Za-z_$][\w$]*)/g;
+    for (let s = spec.exec(m[1]); s; s = spec.exec(m[1])) {
+      if (ALIASABLE.includes(s[1])) add(s[1], s[2]);
+    }
+  }
+  // CommonJS destructure-rename: `const { A: B } = require('...')`.
+  const cjs = /(?:const|let|var)\s*\{([^}]*)\}\s*=\s*require\s*\(\s*['"][^'"]*['"]\s*\)/g;
+  for (let m = cjs.exec(content); m; m = cjs.exec(content)) {
+    const spec = /([A-Za-z_$][\w$]*)\s*:\s*([A-Za-z_$][\w$]*)/g;
+    for (let s = spec.exec(m[1]); s; s = spec.exec(m[1])) {
+      if (ALIASABLE.includes(s[1])) add(s[1], s[2]);
+    }
+  }
+  return out;
+}
+
+/** Escape a string for safe interpolation into a dynamically-built RegExp. */
+function escapeRe(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 const RE_CREATE_SIGN_VERIFY = /create(?:Sign|Verify)\s*\(/g;
 // One-shot crypto.sign/verify(algorithm, data, key). A LOOKBEHIND (not a
 // consumed char) anchors it so it doesn't fire inside identifiers like `assign(`
@@ -82,7 +212,7 @@ const RE_JSRSASIGN_SIGN = /KJUR\.crypto\.(?:Signature|ECDSA)\b/g;
 const RE_NODE_RSA = /new\s+NodeRSA\s*\(/g;
 // secp256k1 — direct @noble/secp256k1 / secp256k1-style API usage in source.
 const RE_SECP256K1 =
-  /\b(?:secp(?:256k1)?|secp)\s*\.\s*(?:sign|verify|getPublicKey|getSharedSecret|ecdh|recoverPublicKey)\s*\(/g;
+  /\b(?:secp(?:256k1)?|secp)\s*\.\s*(sign|verify|getPublicKey|getSharedSecret|ecdh|recoverPublicKey)\s*\(/g;
 
 // JWT/JOSE.
 const RE_JWT_ALG = /['"`](RS(?:256|384|512)|PS(?:256|384|512)|ES(?:256|384|512|256K)|EdDSA)['"`]/g;
@@ -96,11 +226,15 @@ const RE_TLS_REJECT = /rejectUnauthorized\s*:\s*false/g;
 // Hardened cipher regex: bounded spans (no unbounded `[^'"`]*` straddling the
 // alternation), single-quote-style anchoring removed in favour of {0,256} bounds
 // so worst-case backtracking is linear in the bound, not the file (P0-6).
-// The `(?<![!-])` lookbehind skips OpenSSL EXCLUSION syntax — `!MD5` / `-RC4`
-// DISABLE those ciphers, so a hardened list like `...:!aNULL:!MD5:!RC4` must not
-// be flagged as weak (audit: crypto #7). A genuinely-enabled `RC4` still matches.
+// Skip OpenSSL EXCLUSION syntax — `!MD5` / `:-RC4` / `!ECDHE-RSA-RC4-SHA` DISABLE
+// those ciphers, so a hardened list must not be flagged as weak (audit: crypto #7). The
+// single variable-length lookbehind walks back over the suite-name chars to the
+// ELEMENT boundary (`:` / whitespace / comma / quote / start) and rejects the match
+// when that element begins with `!` or `-` — covering a bare `!RC4`, a space-separated
+// `HIGH !RC4`, and a full-suite `!ECDHE-RSA-RC4-SHA`. The intra-name hyphen in a
+// genuinely-enabled `ECDHE-RSA-RC4-SHA` (no leading `!`/`-`) still matches.
 const RE_TLS_WEAK_CIPHER =
-  /ciphers\s*:\s*['"`][^'"`\n]{0,256}?\b(?<![!-])(RC4|DES|3DES|MD5|NULL|EXPORT|aNULL|eNULL)\b[^'"`\n]{0,256}?['"`]/gi;
+  /ciphers\s*:\s*['"`][^'"`\n]{0,256}?\b(?<![:'"`,\s]\s*[!-][\w-]{0,64})(RC4|DES|3DES|MD5|NULL|EXPORT|aNULL|eNULL)\b[^'"`\n]{0,256}?['"`]/gi;
 
 /* -------------------------------------------------------------------------- */
 /* Node.js `crypto` module                                                    */
@@ -238,74 +372,54 @@ const nodeCryptoDetector: Detector = {
 
     // generateKeyPair(Sync)('rsa' | 'ec' | 'dsa' | 'dh' | 'x25519' | 'ed25519', ...)
     eachMatch(RE_GENERATE_KEYPAIR, content, (m) => {
-      const type = m[1].toLowerCase();
-      const map: Record<
-        string,
-        {
-          algo: Finding["algorithm"];
-          cat: Finding["category"];
-          sev: Finding["severity"];
-          hndl: boolean;
-          label: string;
-          message?: string;
-          remediation?: string;
-        }
-      > = {
-        rsa: { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" },
-        // RSA-PSS is signature-only, so classify it as a (forgeable) signature
-        // rather than a KEM — no HNDL confidentiality exposure.
-        "rsa-pss": {
-          algo: "RSA",
-          cat: "signature",
-          sev: "high",
-          hndl: false,
-          label: "RSA-PSS",
-          message:
-            "Generates a classical RSA-PSS signing key, which is forgeable by a quantum attacker.",
-          remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
-        },
-        // EC keys feed BOTH ECDSA (sign) and ECDH (key agreement). ECDH is
-        // HNDL-exposed, so classify conservatively as key-exchange-capable and
-        // surface both concerns rather than asserting signature-only (P0-4).
-        ec: {
-          algo: "ECDH",
-          cat: "key-exchange",
-          sev: "high",
-          hndl: true,
-          label: "EC (ECDSA/ECDH)",
-          message:
-            "Generates a classical EC key pair. EC keys feed BOTH ECDSA signatures " +
-            "and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
-          remediation:
-            "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
-        },
-        dsa: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
-        dh: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
-        x25519: { algo: "X25519", cat: "key-exchange", sev: "medium", hndl: true, label: "X25519" },
-        x448: { algo: "X448", cat: "key-exchange", sev: "medium", hndl: true, label: "X448" },
-        ed25519: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed25519" },
-        ed448: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed448" },
-      };
-      const info = map[type];
-      findings.push(
-        findingFromRule(
-          RULE_NODE_KEYGEN,
-          { file, content, index: m.index, matchLength: m[0].length },
-          {
-            title: `${info.label} key generation`,
-            category: info.cat,
-            severity: info.sev,
-            algorithm: info.algo,
-            hndl: info.hndl,
-            message:
-              info.message ??
-              `Generates a classical ${info.label} key pair, which is not quantum-safe.`,
-            ...(info.remediation ? { remediation: info.remediation } : {}),
-          },
-        ),
-      );
+      pushKeygenFinding(findings, m[1], file, content, m.index, m[0].length);
     });
 
+    // Import-alias resolution: follow `import { generateKeyPairSync as gk }` (and
+    // the CommonJS destructure-rename) so an aliased call still detects. Only the
+    // keygen / ECDH / DH constructors are resolved — their classification is
+    // unambiguous. The alias regexes run on the ORIGINAL content, so locations
+    // stay exact; it fires only when the alias was explicitly bound to a known
+    // crypto symbol, so precision is unaffected.
+    const aliases = collectCryptoAliases(content);
+    for (const [canonical, names] of aliases) {
+      for (const alias of names) {
+        const a = escapeRe(alias);
+        if (canonical === "generateKeyPairSync" || canonical === "generateKeyPair") {
+          const re = new RegExp(
+            `\\b${a}\\s*\\(\\s*['"\`](rsa-pss|rsa|ec|dsa|dh|x25519|x448|ed25519|ed448)['"\`]`,
+            "g",
+          );
+          eachMatch(re, content, (m) =>
+            pushKeygenFinding(findings, m[1], file, content, m.index, m[0].length),
+          );
+        } else if (canonical === "createECDH") {
+          eachMatch(new RegExp(`\\b${a}\\s*\\(`, "g"), content, (m) =>
+            findings.push(
+              findingFromRule(RULE_NODE_ECDH, {
+                file,
+                content,
+                index: m.index,
+                matchLength: m[0].length,
+              }),
+            ),
+          );
+        } else {
+          // createDiffieHellman / createDiffieHellmanGroup.
+          eachMatch(new RegExp(`\\b${a}\\s*\\(`, "g"), content, (m) =>
+            findings.push(
+              findingFromRule(RULE_NODE_DH, {
+                file,
+                content,
+                index: m.index,
+                matchLength: m[0].length,
+              }),
+            ),
+          );
+        }
+      }
+    }
+
     // createSign / createVerify — RSA / ECDSA / DSA signatures.
     eachMatch(RE_CREATE_SIGN_VERIFY, content, (m) => {
       findings.push(
@@ -452,7 +566,9 @@ const webCryptoDetector: Detector = {
         algorithm = name === "X448" ? "X448" : "X25519";
         category = "key-exchange";
         hndl = true;
-        severity = "low"; // modern but classical
+        // `medium`, aligned with X25519/X448 key agreement in node/rust/go — HNDL-exposed
+        // key agreement scores the same regardless of which surface uses it.
+        severity = "medium";
       } else if (name === "ED25519" || name === "ED448") {
         algorithm = "EdDSA";
         category = "signature";
@@ -611,7 +727,27 @@ const libraryDetector: Detector = {
     add(RE_FORGE_RSA, RULE_FORGE_RSA); // node-forge: pki.rsa.generateKeyPair(...)
     add(RE_FORGE_ED25519, RULE_FORGE_ED25519); // node-forge: forge.ed25519.*
     add(RE_ELLIPTIC_EC, RULE_ELLIPTIC_EC); // elliptic: new EC('secp256k1')
-    add(RE_SECP256K1, RULE_SECP256K1); // secp.sign / getPublicKey / getSharedSecret
+    // secp256k1: classify per method — getSharedSecret/ecdh are key AGREEMENT
+    // (ECDH, harvest-now-decrypt-later); sign/verify/getPublicKey/recover are
+    // ECDSA signatures (not HNDL). The old rule flagged everything as ECDSA.
+    eachMatch(RE_SECP256K1, content, (m) => {
+      const kex = m[1] === "getSharedSecret" || m[1] === "ecdh";
+      findings.push(
+        findingFromRule(
+          RULE_SECP256K1,
+          { file, content, index: m.index, matchLength: m[0].length },
+          kex
+            ? {
+                title: "secp256k1 ECDH key agreement",
+                category: "key-exchange",
+                algorithm: "ECDH",
+                hndl: true,
+                message: `secp256k1 ECDH key agreement (.${m[1]}()) is classical and harvest-now-decrypt-later exposed.`,
+              }
+            : undefined,
+        ),
+      );
+    });
     add(RE_JSRSASIGN_KEYGEN, RULE_JSRSASIGN_KEYGEN); // jsrsasign: KEYUTIL.generateKeypair(...)
     add(RE_JSRSASIGN_SIGN, RULE_JSRSASIGN_SIGN); // jsrsasign: KJUR.crypto.*
     add(RE_NODE_RSA, RULE_NODE_RSA_LIB); // node-rsa: new NodeRSA(...)
@@ -689,8 +825,21 @@ const jwtDetector: Detector = {
   detect({ file, content }): Finding[] {
     const findings: Finding[] = [];
 
+    // Deferral guards against double-counting:
+    //  - webCryptoDetector owns a quoted `RSA-OAEP`/`ECDH-ES` sitting next to a
+    //    `subtle.*(` call (it matches the `RSA-OAEP`/`ECDH` name). Collect the subtle
+    //    call offsets so the JOSE key-management loops can skip those. (In non-JS host
+    //    files there are no subtle calls, so nothing is skipped.)
+    //  - jwkDetector owns any alg/`kty` that lives inside a JWK object; skip a token
+    //    whose enclosing `{…}` carries a `"kty"` so a JWK's own `alg` is not counted by
+    //    both detectors. Mirrors the same guard jose.ts applies for other languages.
+    const subtleCalls: number[] = [];
+    eachMatch(RE_SUBTLE_CALL, content, (m) => subtleCalls.push(m.index));
+    const inJwk = (index: number): boolean => enclosingObject(content, index).includes('"kty"');
+
     // Classical JWS signature alg tokens. Anchored to quotes to avoid words.
     eachMatch(RE_JWT_ALG, content, (m) => {
+      if (inJwk(m.index)) return; // jwk-{rsa,ec,eddsa} owns a JWK's own alg
       const alg = m[1];
       let algorithm: Finding["algorithm"];
       if (alg.startsWith("RS") || alg.startsWith("PS")) algorithm = "RSA";
@@ -711,6 +860,8 @@ const jwtDetector: Detector = {
 
     // JOSE ECDH-ES key agreement (and ECDH-ES+A*KW) — confidentiality, HNDL.
     eachMatch(RE_JOSE_ECDH, content, (m) => {
+      if (inJwk(m.index)) return; // jwk-ec owns a JWK's own alg
+      if (nearSortedCall(subtleCalls, m.index, 400)) return; // webcrypto owns it
       findings.push(
         findingFromRule(
           RULE_JOSE_ECDH,
@@ -725,6 +876,10 @@ const jwtDetector: Detector = {
 
     // JOSE RSA key transport (RSA-OAEP / RSA1_5) — classical RSA encryption, HNDL.
     eachMatch(RE_JOSE_KEM, content, (m) => {
+      if (inJwk(m.index)) return; // jwk-rsa owns a JWK's own alg
+      // webCryptoDetector's regex matches `RSA-OAEP` but NOT `RSA1_5`, so only defer the
+      // OAEP form near a subtle call — deferring RSA1_5 would drop it entirely.
+      if (m[1].startsWith("RSA-OAEP") && nearSortedCall(subtleCalls, m.index, 400)) return;
       findings.push(
         findingFromRule(
           RULE_JOSE_RSA_OAEP,
@@ -852,6 +1007,56 @@ const RE_CERT_SIG_ALG =
 const RE_SSH_KEX =
   /\b(diffie-hellman-group(?:1|14|15|16|17|18)(?:-sha1|-sha256|-sha512)?|diffie-hellman-group-exchange-sha(?:1|256)|ecdh-sha2-nistp(?:256|384|521)|curve25519-sha256)\b/g;
 
+/**
+ * True when the match at `index` sits inside a DOCUMENTATION field value — a
+ * `description` / `help` / `summary` / `doc` / `comment` / `note` assignment
+ * (`key = "…"` or `key: "…"`), as used by Terraform/Packer variable descriptions,
+ * JSON-schema docs, etc. Classical KEX/cipher algorithm names LISTED in such a field
+ * are prose ("acceptable values include ecdh-sha2-nistp256, …"), not an active
+ * setting, so a transport-token rule must not fire on them. Scans the current line's
+ * prefix only (cheap; the common single-line description case).
+ */
+function inDocFieldValue(content: string, index: number): boolean {
+  const lineStart = content.lastIndexOf("\n", index - 1) + 1;
+  const prefix = content.slice(lineStart, index);
+  return /\b(?:description|help|summary|doc|comment|note)\b\s*[:=]/i.test(prefix);
+}
+
+// A bare key-type token (`ssh-rsa`, `ssh-ed25519`, …) is real SSH crypto only
+// when it is EITHER (a) followed by base64 key material — an actual
+// authorized_keys / known_hosts entry — OR (b) one of ≥2 DISTINCT ssh key/host-key
+// algorithm tokens on the same line — an algorithm-preference list
+// (`HostKeyAlgorithms ssh-ed25519,ecdsa-sha2-nistp256,ssh-rsa`, `%w[…]`, …). A
+// lone token, e.g. a UI label / i18n value like `"ssh-rsa": "ssh-rsa"`, is
+// neither, so it must NOT be flagged. `RE_SSH_ALGO_TOKEN` is a separate (cloned-
+// on-use) copy so counting per line never disturbs the outer `eachMatch` state.
+const RE_SSH_ALGO_TOKEN = /\b(ssh-rsa|ssh-ed25519|ssh-dss|ecdsa-sha2-nistp(?:256|384|521))\b/g;
+/** How far around a token we look for a sibling algorithm on the same line. A
+ * real `HostKeyAlgorithms` list is short; bounding the window keeps the per-token
+ * work O(1) so a pathological single huge line can't make detection quadratic. */
+const SSH_LINE_WINDOW = 512;
+function isRealSshKeyOrAlgoList(content: string, index: number, matchLen: number): boolean {
+  // (a) base64 key material immediately after the token → a real SSH public key.
+  if (/^\s+[A-Za-z0-9+/]{20,}/.test(content.slice(index + matchLen, index + matchLen + 80))) {
+    return true;
+  }
+  // (b) ≥2 distinct ssh key/host-key algorithm tokens on the same line → a list.
+  // Bound both the back-scan for the line start and the window itself so the work
+  // is constant per token and never crosses a line boundary (i18n entries live on
+  // separate lines, so a lone repeated token stays a single distinct token).
+  const from = Math.max(0, index - SSH_LINE_WINDOW);
+  const pre = content.slice(from, index);
+  const preNl = pre.lastIndexOf("\n");
+  const lineStart = preNl === -1 ? from : from + preNl + 1;
+  const to = Math.min(content.length, index + matchLen + SSH_LINE_WINDOW);
+  const post = content.slice(index, to);
+  const postNl = post.indexOf("\n");
+  const lineEnd = postNl === -1 ? to : index + postNl;
+  const distinct = new Set<string>();
+  for (const t of content.slice(lineStart, lineEnd).matchAll(RE_SSH_ALGO_TOKEN)) distinct.add(t[1]);
+  return distinct.size >= 2;
+}
+
 const RULE_SSH_PUBKEY: RuleMeta = {
   id: "ssh-public-key",
   title: "Classical SSH public key",
@@ -917,6 +1122,9 @@ const sshCertDetector: Detector = {
 
     // SSH public keys: ssh-rsa AAAA…, ecdsa-sha2-nistp256 …, ssh-ed25519 …
     eachMatch(RE_SSH_PUBKEY, content, (m) => {
+      // Skip a bare token that is neither a real key nor an algorithm list (e.g.
+      // a `"ssh-rsa": "ssh-rsa"` i18n label) — see `isRealSshKeyOrAlgoList`.
+      if (!isRealSshKeyOrAlgoList(content, m.index, m[0].length)) return;
       const tok = m[1];
       const algorithm: Finding["algorithm"] = tok.startsWith("ssh-rsa")
         ? "RSA"
@@ -961,6 +1169,7 @@ const sshCertDetector: Detector = {
 
     // SSH key-exchange algorithm identifiers (finite-field DH / ECDH / X25519).
     eachMatch(RE_SSH_KEX, content, (m) => {
+      if (inDocFieldValue(content, m.index)) return; // names listed in a doc string
       const tok = m[1];
       const algorithm: Finding["algorithm"] = tok.startsWith("diffie-hellman")
         ? "DH"
@@ -1029,6 +1238,7 @@ const tlsClassicalKexDetector: Detector = {
   detect({ file, content }): Finding[] {
     const findings: Finding[] = [];
     eachMatch(RE_TLS_CLASSICAL_KEX, content, (m) => {
+      if (inDocFieldValue(content, m.index)) return; // names listed in a doc string
       const tok = m[0];
       const algorithm: Finding["algorithm"] = tok.includes("ECDH") ? "ECDH" : "DH";
       findings.push(

package/src/detectors/spire.ts

@@ -0,0 +1,143 @@
+/**
+ * Config detector: classical key types configured for SPIFFE X.509 SVIDs in
+ * SPIRE server/agent configuration (HCL, and the `.conf`/YAML/JSON variants
+ * SPIRE deployments ship).
+ *
+ * SPIRE is the reference SPIFFE implementation: it issues each workload a
+ * short-lived X.509-SVID certificate, signed by the SPIRE server's CA (itself
+ * often chained to an UpstreamAuthority). The SVID leaf key and the CA signing
+ * key are configured by explicit key-type strings:
+ *  - server `ca_key_type = "rsa-2048" | "rsa-4096" | "ec-p256" | "ec-p384"` —
+ *    the CA that signs every workload SVID in the trust domain (the identity
+ *    ROOT: forge this and you forge the whole trust domain).
+ *  - agent/server `svid_key_type = "rsa-2048" | "ec-p256"` — the per-workload
+ *    leaf key type.
+ *  - per-plugin `key_type = "rsa-2048" | "ec-p256"` on UpstreamAuthority /
+ *    KeyManager plugins.
+ *
+ * These are SIGNING / identity keys, not confidentiality keys: an SVID X.509
+ * signature is verified, never used to wrap harvestable ciphertext. So there is
+ * nothing to "harvest now, decrypt later" — `hndl: false` — but every SVID
+ * signature (and the CA signature over it) becomes FORGEABLE the moment a
+ * cryptographically-relevant quantum computer (CRQC) exists, letting an attacker
+ * mint certificates for any SPIFFE ID in the trust domain. Findings are
+ * therefore `category: "certificate"` (X.509 / PKI material), `severity:
+ * "medium"`, `confidence: "high"`.
+ *
+ * Algorithm mapping (SPIRE key-type value → {@link AlgorithmFamily}):
+ *  - `rsa-2048` / `rsa-4096` / any `rsa-*`  → RSA
+ *  - `ec-p256` / `ec-p384` / `ecdsa`        → ECDSA
+ *
+ * Match shape: the key-type attribute name (`ca_key_type`, `svid_key_type`, or
+ * the bare per-plugin `key_type`) followed by `=`/`:` and a quoted value, in
+ * both HCL (`=`) and YAML/JSON (`:`) forms. The `\b(?:ca_|svid_)?key_type\b`
+ * anchor covers all three names in one pattern — the leading `\b` won't fire
+ * inside `ca_key_type`/`svid_key_type` for the bare `key_type` alternative
+ * because `_` is a word character, so those longer names are matched whole.
+ *
+ * Fast reject: `detect()` bails unless the file carries a SPIFFE/SPIRE-specific
+ * marker (`spiffe`, `spire`, the distinctive `ca_key_type`, or `svid`). A bare
+ * `key_type = "rsa-2048"` is deliberately NOT a sufficient marker — `key_type`
+ * is a generic attribute (Vault PKI roles, cloud IaC, …), so without a
+ * spiffe/spire/svid/ca_key_type anchor an unrelated config must not fire. This
+ * keeps the generic per-plugin `key_type` rule precise while still catching a
+ * real SPIRE config, which always names its trust domain / server / SVIDs.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import {
+  DOC_EXTENSIONS,
+  eachMatch,
+  findingFromRule,
+  hasExtension,
+  maskCommentLines,
+} from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+// SPIRE config is HCL/conf, but deployments also template it as YAML (Helm
+// values / ConfigMaps) or JSON. Prose (`.md`, …) is excluded in `appliesTo`.
+const SPIRE_EXTENSIONS: readonly string[] = [".conf", ".hcl", ".yaml", ".yml", ".json"];
+
+// The three SPIRE key-type attribute names in one anchor: `ca_key_type`,
+// `svid_key_type`, and the bare per-plugin `key_type`.
+const KEY_ATTR = "(?:ca_|svid_)?key_type";
+// HCL `=`, unquoted YAML `:`, and JSON `"key_type": "..."` assignment forms. The
+// attribute-name and value quotes are BOTH optional (`"?`): HCL uses `key_type =
+// "rsa-2048"`, Helm/YAML uses the unquoted `key_type: rsa-2048`, and JSON quotes
+// the key (`"key_type": "rsa-2048"`) — a required-quote regex missed the latter
+// two entirely. Case-insensitive, though SPIRE writes these lowercase.
+const RE_SPIRE_RSA = new RegExp(`\\b${KEY_ATTR}"?\\s*[:=]\\s*"?rsa-\\d+`, "gi");
+const RE_SPIRE_ECDSA = new RegExp(`\\b${KEY_ATTR}"?\\s*[:=]\\s*"?(?:ec-p\\d+|ecdsa)\\b`, "gi");
+
+const RULE_SPIRE_RSA: RuleMeta = {
+  id: "spire-rsa-key",
+  title: "SPIRE/SPIFFE RSA SVID key type",
+  description: 'SPIRE ca_key_type/svid_key_type/key_type = "rsa-*" (classical X.509-SVID key)',
+  category: "certificate",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "SPIRE issues SPIFFE X.509-SVIDs with a classical RSA key; the SVID (and CA) signatures become forgeable once a CRQC exists, letting an attacker mint identities for the trust domain.",
+  remediation:
+    "SPIFFE/SPIRE has no PQC SVID key type yet — track the SPIFFE roadmap for PQC signature support. Prioritise the SPIRE server ca_key_type: the classical CA is the identity root, so its forgeability compromises every workload SVID.",
+};
+const RULE_SPIRE_ECDSA: RuleMeta = {
+  id: "spire-ec-key",
+  title: "SPIRE/SPIFFE ECDSA SVID key type",
+  description:
+    'SPIRE ca_key_type/svid_key_type/key_type = "ec-p256|ec-p384|ecdsa" (classical X.509-SVID key)',
+  category: "certificate",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "SPIRE issues SPIFFE X.509-SVIDs with a classical ECDSA (P-256/P-384) key; the SVID (and CA) signatures become forgeable once a CRQC exists, letting an attacker mint identities for the trust domain.",
+  remediation:
+    "SPIFFE/SPIRE has no PQC SVID key type yet — track the SPIFFE roadmap for PQC signature support. Prioritise the SPIRE server ca_key_type: the classical CA is the identity root, so its forgeability compromises every workload SVID.",
+};
+
+/**
+ * True when `content` carries a SPIFFE/SPIRE-specific marker. A bare generic
+ * `key_type` is intentionally NOT enough — only `spiffe`/`spire` context, the
+ * distinctive `ca_key_type`, or an `svid` token qualifies — so an unrelated
+ * config that merely sets `key_type = "rsa-2048"` cannot fire.
+ */
+function hasSpireMarker(content: string): boolean {
+  // Word-anchored so `inspired` / `aspire` / a `svid` substring inside a longer
+  // token don't qualify; `ca_key_type` is distinctive enough to match unanchored.
+  return /\b(?:spiffe|spire|svid)\b/i.test(content) || content.includes("ca_key_type");
+}
+
+/** Detects classical key types configured for SPIFFE X.509 SVIDs in SPIRE config. */
+export const spireDetector: Detector = {
+  id: "spire-crypto",
+  description: "Classical key types for SPIFFE X.509 SVIDs in SPIRE server/agent config",
+  scope: "config",
+  language: "any",
+  rules: [RULE_SPIRE_RSA, RULE_SPIRE_ECDSA],
+  // Gate to SPIRE's config extensions, and never run on prose (a README that
+  // describes `ca_key_type = "rsa-2048"` is documentation, not live config).
+  appliesTo: (f) => hasExtension(f, SPIRE_EXTENSIONS) && !hasExtension(f, DOC_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    if (!hasSpireMarker(content)) return [];
+
+    // Mask whole comment lines (HCL/YAML `#`, HCL/JSON5 `//`) so a commented-out
+    // key-type directive can't fire. Offsets are preserved, so finding
+    // line/column/snippet for the remaining live config stay exact.
+    const scan = maskCommentLines(content, ["#", "//"]);
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, scan, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    add(RE_SPIRE_RSA, RULE_SPIRE_RSA);
+    add(RE_SPIRE_ECDSA, RULE_SPIRE_ECDSA);
+    return findings;
+  },
+};