@quantakrypto/core 0.4.3 → 0.5.0

package/src/detectors/ssh-ca.ts

@@ -0,0 +1,215 @@
+/**
+ * Config detector: classical SSH **certificate-authority** cryptography — the
+ * OpenSSH certificate mechanism, in which a CA key signs host/user certificates
+ * (`*-cert-v01@openssh.com`) that servers and clients then trust in place of
+ * bare public keys.
+ *
+ * This is DIFFERENT from the `ssh-kex-classical` rule in `source.ts`, and from
+ * the `ssh-public-key` rule there — deliberately non-overlapping:
+ *  - `ssh-kex-classical` is about the SSH *key-exchange* (finite-field DH, ECDH,
+ *    curve25519): session-key *agreement*, `category: "key-exchange"`,
+ *    `hndl: true` — a passively-recorded handshake is decryptable once a CRQC
+ *    exists (harvest-now-decrypt-later confidentiality loss).
+ *  - `ssh-public-key` flags bare `ssh-rsa AAAA…` / `ecdsa-sha2-* …` key lines.
+ *  - THIS detector flags the SSH **certificate / CA signing** surface: the
+ *    `*-cert-v01@openssh.com` cert key types, the `@cert-authority` known_hosts
+ *    marker, the `TrustedUserCAKeys` / `HostCertificate` sshd directives, and
+ *    `ssh-keygen -s` (the command that signs a certificate with a CA key).
+ *
+ * WHY it matters for PQC: an SSH certificate is a *signature* made by a CA key
+ * over a principal's public key + validity constraints. There is no
+ * confidentiality to harvest (so `hndl: false`), but every such signature
+ * becomes FORGEABLE the moment a cryptographically-relevant quantum computer
+ * (CRQC) can recover the classical CA private key from its public key. Forging a
+ * CA signature lets an attacker mint host or user certificates that every relying
+ * party accepts — a full trust-root compromise. SSH CA keys are also unusually
+ * long-lived (they are the anchor an entire fleet trusts and are rotated
+ * rarely), so the exposure window is large. Hence `category: "signature"`,
+ * `severity: "medium"`, `confidence: "high"`.
+ *
+ * Two match shapes:
+ *  1. The cert key type, which NAMES the signing algorithm → an accurate
+ *     {@link AlgorithmFamily}:
+ *      - `ssh-rsa-cert-v01@openssh.com`, `rsa-sha2-256/512-cert-v01@openssh.com` → RSA
+ *      - `ecdsa-sha2-nistp256/384/521-cert-v01@openssh.com`                      → ECDSA
+ *      - `ssh-ed25519-cert-v01@openssh.com`                                      → EdDSA
+ *  2. The CA *deployment* directives — `TrustedUserCAKeys` / `HostCertificate`
+ *     (sshd_config) and `ssh-keygen -s` (the CA signing command). These are the
+ *     MOST COMMON way an SSH CA is configured, but they don't name the algorithm
+ *     (that lives in the referenced key file), so they emit the `ssh-ca-config`
+ *     rule with `algorithm: "unknown"` and `confidence: "medium"`.
+ *
+ * Precision:
+ *  - Fast reject: `detect()` bails unless the file carries an SSH-CA marker
+ *    (`cert-v01@openssh.com`, `@cert-authority`, `TrustedUserCAKeys`,
+ *    `HostCertificate`, or `ssh-keygen -s`) — so the algorithm tokens can't be
+ *    reached on unrelated config.
+ *  - The cert-type tokens are the full `*-cert-v01@openssh.com` strings. The
+ *    trailing `-cert-v01@openssh.com` suffix distinguishes a CA certificate type
+ *    from the plain `ssh-rsa` / `ssh-ed25519` public-key tokens handled by
+ *    `ssh-public-key`, so a non-cert `ssh-ed25519 AAAA…` line NEVER fires a cert
+ *    rule here.
+ *  - Comment lines (`#`) are masked with {@link maskCommentLines} (offsets
+ *    preserved) so a commented-out cert line can't fire. Known_hosts
+ *    `@cert-authority` lines start with `@`, not `#`, so masking leaves them
+ *    live — exactly what we want.
+ *  - Doc/prose files are excluded ({@link DOC_EXTENSIONS}), and so are program
+ *    SOURCE files ({@link ANALYZABLE_SOURCE_EXTENSIONS}) — a vendored SSH library
+ *    or constants table that spells a cert type as a string literal is not live
+ *    CA config. SSH CA config lives in extensionless / `.conf` / `.pub` files.
+ *
+ * The matched line frequently carries the CA public key's base64 blob (a
+ * `@cert-authority` known_hosts entry), so findings are marked `sensitive` and
+ * reporters drop the snippet, consistent with `ssh-public-key`.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import {
+  eachMatch,
+  findingFromRule,
+  hasExtension,
+  maskCommentLines,
+  DOC_EXTENSIONS,
+  ANALYZABLE_SOURCE_EXTENSIONS,
+} from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+// --- OpenSSH certificate key types (`*-cert-v01@openssh.com`), by signing family. ---
+// The `\b` after `.com` is a real boundary (`m` is a word char); the leading `\b`
+// keeps `ssh-rsa-cert-v01@…` from matching inside a longer token. RSA covers the
+// legacy `ssh-rsa` cert type plus the SHA-2 RSA cert types (`rsa-sha2-256/512`)
+// OpenSSH emits for RSA CA/host certificates.
+const RE_CERT_RSA = /\b(?:ssh-rsa|rsa-sha2-(?:256|512))-cert-v01@openssh\.com\b/g;
+const RE_CERT_ECDSA = /\becdsa-sha2-nistp(?:256|384|521)-cert-v01@openssh\.com\b/g;
+const RE_CERT_EDDSA = /\bssh-ed25519-cert-v01@openssh\.com\b/g;
+// The canonical CA *deployment* directives — the most common way an SSH CA is
+// configured (sshd_config `TrustedUserCAKeys` / `HostCertificate`, and the CA
+// signing command `ssh-keygen -s`). These name the CA usage but not the algorithm
+// (that lives in the referenced key file), so the finding is `algorithm: "unknown"`.
+const RE_CA_DIRECTIVE = /\bTrustedUserCAKeys\b|\bHostCertificate\b|\bssh-keygen\s+-s\b/g;
+
+const REMEDIATION =
+  "No post-quantum SSH certificate format is standardized yet — track OpenSSH release notes and IETF work on PQC signatures for SSH. SSH CA keys are long-lived trust roots, so plan for their rotation to a PQC signing algorithm (e.g. ML-DSA) as soon as a cert format lands, and keep validity periods short in the interim.";
+
+const RULE_CA_RSA: RuleMeta = {
+  id: "ssh-ca-rsa-cert",
+  title: "SSH certificate authority — RSA signing",
+  description: "OpenSSH RSA certificate key type (ssh-rsa/rsa-sha2-*-cert-v01@openssh.com)",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  sensitive: true,
+  message:
+    "SSH certificate uses a classical RSA key type (ssh-rsa/rsa-sha2-*-cert-v01@openssh.com); the CA signature is forgeable once a CRQC can recover the RSA CA key.",
+  remediation: REMEDIATION,
+};
+const RULE_CA_ECDSA: RuleMeta = {
+  id: "ssh-ca-ecdsa-cert",
+  title: "SSH certificate authority — ECDSA signing",
+  description: "OpenSSH ECDSA certificate key type (ecdsa-sha2-nistp*-cert-v01@openssh.com)",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  sensitive: true,
+  message:
+    "SSH certificate uses a classical ECDSA key type (ecdsa-sha2-nistp*-cert-v01@openssh.com); the CA signature is forgeable once a CRQC can recover the ECDSA CA key.",
+  remediation: REMEDIATION,
+};
+const RULE_CA_EDDSA: RuleMeta = {
+  id: "ssh-ca-ed25519-cert",
+  title: "SSH certificate authority — EdDSA signing",
+  description: "OpenSSH Ed25519 certificate key type (ssh-ed25519-cert-v01@openssh.com)",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  sensitive: true,
+  message:
+    "SSH certificate uses a classical Ed25519 key type (ssh-ed25519-cert-v01@openssh.com); modern but still classical — the CA signature is forgeable once a CRQC can recover the Ed25519 CA key.",
+  remediation: REMEDIATION,
+};
+
+const RULE_CA_CONFIG: RuleMeta = {
+  id: "ssh-ca-config",
+  title: "SSH certificate authority configured",
+  description:
+    "OpenSSH CA deployment directive (TrustedUserCAKeys / HostCertificate / ssh-keygen -s)",
+  category: "signature",
+  severity: "medium",
+  // The directive names CA usage, not the algorithm — hence a lower confidence and
+  // an unknown family; the CA key file itself carries the specific algorithm.
+  confidence: "medium",
+  algorithm: "unknown",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "SSH certificate authority is configured (TrustedUserCAKeys / HostCertificate / ssh-keygen -s); the CA signing key is a long-lived classical trust root whose signatures become forgeable once a CRQC exists — verify the CA key's algorithm.",
+  remediation: REMEDIATION,
+};
+
+interface SshCaRule {
+  meta: RuleMeta;
+  re: RegExp;
+}
+
+const SSH_CA_RULES: readonly SshCaRule[] = [
+  { meta: RULE_CA_RSA, re: RE_CERT_RSA },
+  { meta: RULE_CA_ECDSA, re: RE_CERT_ECDSA },
+  { meta: RULE_CA_EDDSA, re: RE_CERT_EDDSA },
+  { meta: RULE_CA_CONFIG, re: RE_CA_DIRECTIVE },
+];
+
+/** True when `content` carries some SSH-CA-specific marker (not just a bare token). */
+function hasSshCaMarker(content: string): boolean {
+  return (
+    content.includes("cert-v01@openssh.com") ||
+    content.includes("@cert-authority") ||
+    content.includes("TrustedUserCAKeys") ||
+    content.includes("HostCertificate") ||
+    content.includes("ssh-keygen -s")
+  );
+}
+
+/**
+ * Detects classical SSH certificate-authority signing (OpenSSH cert key types)
+ * in SSH config, sshd_config, and known_hosts files. Distinct from SSH
+ * key-exchange (`ssh-kex-classical`): this is the certificate SIGNATURE surface.
+ */
+export const sshCaDetector: Detector = {
+  id: "ssh-ca",
+  description: "Classical SSH certificate-authority signing (OpenSSH *-cert-v01@openssh.com)",
+  scope: "config",
+  language: "any",
+  rules: SSH_CA_RULES.map((r) => r.meta),
+  // Apply broadly (SSH CA config lives in many differently-named / extensionless
+  // files: sshd_config, known_hosts, *.pub) but never on prose/docs OR on program
+  // SOURCE files — a vendored SSH library or a constants table that spells out
+  // `ssh-ed25519-cert-v01@openssh.com` as a string literal is not a live CA config.
+  // The strict fast-reject in detect() is the remaining gate.
+  appliesTo: (f) =>
+    !hasExtension(f, DOC_EXTENSIONS) && !hasExtension(f, ANALYZABLE_SOURCE_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    if (!hasSshCaMarker(content)) return [];
+
+    // Mask `#` comment lines so a commented-out cert line can't fire; offsets are
+    // preserved. `@cert-authority` known_hosts lines start with `@`, not `#`, so
+    // they are intentionally left live.
+    const scan = maskCommentLines(content, ["#"]);
+    const findings: Finding[] = [];
+    for (const { meta, re } of SSH_CA_RULES) {
+      eachMatch(re, scan, (m) =>
+        findings.push(
+          findingFromRule(meta, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    }
+    return findings;
+  },
+};

package/src/detectors/stateful-hbs.ts

@@ -39,8 +39,9 @@ interface HbsRule {
 
 const HBS_RULES: HbsRule[] = [
   {
-    // LMS parameter set, e.g. LMS_SHA256_M32_H10 (RFC 8554 / SP 800-208).
-    re: /\bLMS_SHA256_[MN]\d+_[HW]\d+\b/g,
+    // LMS parameter set, e.g. LMS_SHA256_M32_H10 / LMS_SHAKE_M24_H10 (SP 800-208
+    // adds SHAKE256 and the 192-bit M24/N24 sets to RFC 8554's SHA-256 sets).
+    re: /\bLMS_(?:SHA256|SHAKE(?:256)?)_[MN]\d+_[HW]\d+\b/g,
     meta: {
       id: "stateful-hbs-lms-param",
       title: "LMS parameter set (stateful hash-based signature)",
@@ -93,8 +94,9 @@ const HBS_RULES: HbsRule[] = [
     },
   },
   {
-    // XMSS parameter set, e.g. XMSS-SHA2_10_256 (RFC 8391 / SP 800-208).
-    re: /\bXMSS-SHA2_\d+_256\b/g,
+    // XMSS parameter set, e.g. XMSS-SHA2_10_256 / XMSS-SHAKE256_10_192 (SP 800-208
+    // adds the SHAKE256 and 192-bit variants to RFC 8391's SHA-2/256 sets).
+    re: /\bXMSS-(?:SHA2|SHAKE(?:256)?)_\d+_(?:192|256)\b/g,
     meta: {
       id: "stateful-hbs-xmss-param",
       title: "XMSS parameter set (stateful hash-based signature)",
@@ -111,8 +113,9 @@ const HBS_RULES: HbsRule[] = [
     },
   },
   {
-    // XMSSMT (multi-tree XMSS) parameter set, e.g. XMSSMT-SHA2_20/2_256.
-    re: /\bXMSSMT-SHA2_\d+\b/g,
+    // XMSSMT (multi-tree XMSS) parameter set, e.g. XMSSMT-SHA2_20/2_256 or the
+    // SP 800-208 SHAKE256 variant XMSSMT-SHAKE256_20/2_256.
+    re: /\bXMSSMT-(?:SHA2|SHAKE(?:256)?)_\d+\b/g,
     meta: {
       id: "stateful-hbs-xmssmt-param",
       title: "XMSSMT parameter set (stateful hash-based signature)",

package/src/detectors/supply-chain.ts

@@ -0,0 +1,117 @@
+/**
+ * Config detector: classical supply-chain / artifact signing beyond the cosign +
+ * GPG cases the `cicd` detector covers — Docker Content Trust (Notary v1 / TUF),
+ * CNCF Notation, and in-toto. These sign container images, OCI artifacts, and
+ * build provenance with classical keys (ECDSA / RSA / Ed25519). Like all signing,
+ * this is the signature-side analogue of harvest-now-decrypt-later: a signature
+ * produced today is forgeable once a CRQC exists, and the signed artifact keeps
+ * verifying against that classical key for years — so these are `hndl:false` but
+ * real quantum-migration debt.
+ *
+ * Gated to CI pipeline files, Dockerfiles, and shell scripts, over comment-masked
+ * content, and keyed on distinctive command/env tokens to keep false positives low.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule, maskCommentLines } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+/** CI pipeline files, Dockerfiles, and shell scripts — where signing runs. */
+function isSigningContext(filePath: string): boolean {
+  const lower = filePath.toLowerCase();
+  const base = lower.split("/").pop() ?? lower;
+  return (
+    (lower.includes(".github/workflows/") && (lower.endsWith(".yml") || lower.endsWith(".yaml"))) ||
+    base === ".gitlab-ci.yml" ||
+    lower.endsWith(".gitlab-ci.yml") ||
+    base === "jenkinsfile" ||
+    lower.endsWith(".jenkinsfile") ||
+    base === "dockerfile" ||
+    base.startsWith("dockerfile.") ||
+    lower.endsWith(".dockerfile") ||
+    lower.endsWith(".sh") ||
+    lower.endsWith(".bash")
+  );
+}
+
+interface ScRule {
+  re: RegExp;
+  meta: RuleMeta;
+}
+
+const SC_RULES: ScRule[] = [
+  {
+    re: /\bDOCKER_CONTENT_TRUST\s*[:=]\s*["']?1\b|\bdocker\s+trust\s+sign\b/g,
+    meta: {
+      id: "sc-docker-content-trust",
+      title: "Docker Content Trust signing (Notary v1)",
+      description: "Docker Content Trust / docker trust sign — Notary v1 (TUF) classical keys",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "ECDSA",
+      hndl: false,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "Docker Content Trust signs images with Notary v1 (TUF) classical keys (ECDSA/Ed25519); signatures are forgeable once a CRQC exists.",
+      remediation: "Track sigstore/Notary v2 (Notation) PQC roadmap; plan hybrid image signing.",
+    },
+  },
+  {
+    re: /\bnotation\s+(?:sign|key\s+generate|cert\s+generate)\b/g,
+    meta: {
+      id: "sc-notation-sign",
+      title: "Notation artifact signing",
+      description: "CNCF Notation signing of OCI artifacts with classical keys",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "RSA",
+      hndl: false,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "Notation signs OCI artifacts with a classical key (RSA/ECDSA); signatures are forgeable once a CRQC exists.",
+      remediation: "Track Notation's PQC signature support (ML-DSA) and plan migration.",
+    },
+  },
+  {
+    re: /\bin[-_]toto[-_]?run\b|\bin-toto\b/g,
+    meta: {
+      id: "sc-in-toto",
+      title: "in-toto supply-chain signing",
+      description: "in-toto build provenance signed with classical keys",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "RSA",
+      hndl: false,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "in-toto signs build provenance with a classical key (RSA/Ed25519); the attestation is forgeable once a CRQC exists.",
+      remediation: "Track in-toto/DSSE PQC signature support and plan migration.",
+    },
+  },
+];
+
+/** Detects classical Docker Content Trust / Notation / in-toto signing. */
+export const supplyChainDetector: Detector = {
+  id: "supply-chain-signing",
+  description: "Classical container/artifact signing (Docker Content Trust, Notation, in-toto)",
+  scope: "config",
+  language: "any",
+  rules: SC_RULES.map((r) => r.meta),
+  appliesTo: isSigningContext,
+  detect({ file, content }): Finding[] {
+    // `#` covers YAML/Dockerfile/shell; `//` covers Jenkinsfile (Groovy), which has no
+    // extension so it is never centrally comment-stripped.
+    const scan = maskCommentLines(content, ["#", "//"]);
+    const findings: Finding[] = [];
+    for (const rule of SC_RULES) {
+      eachMatch(rule.re, scan, (m) => {
+        findings.push(
+          findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }),
+        );
+      });
+    }
+    return findings;
+  },
+};

package/src/detectors/swift.ts

@@ -0,0 +1,149 @@
+/**
+ * Source detector for classical asymmetric cryptography in Swift (Apple platforms) —
+ * Apple CryptoKit and the older Security framework (`SecKey*`). Lexical, same strategy
+ * as the other language packs; the API names are distinctive enough to keep the
+ * false-positive risk low. Comment/string suppression is handled centrally
+ * (`.swift` is a C-style comment language).
+ *
+ * CryptoKit:
+ *  - `P256|P384|P521.Signing.PrivateKey`            → ECDSA signature (hndl:false)
+ *  - `P256|P384|P521.KeyAgreement.PrivateKey`       → ECDH key agreement (hndl:true)
+ *  - `Curve25519.Signing.PrivateKey`                → Ed25519 signature (hndl:false)
+ *  - `Curve25519.KeyAgreement.PrivateKey`           → X25519 key agreement (hndl:true)
+ * (`SecureEnclave.P256.…` forms are covered by the same P-curve regexes.)
+ *
+ * Security framework:
+ *  - `SecKeyCreateRandomKey` with `kSecAttrKeyTypeRSA`                 → RSA
+ *  - … with `kSecAttrKeyTypeEC` / `kSecAttrKeyTypeECSECPrimeRandom`    → EC
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { SWIFT_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+// CryptoKit P-curve keys, split by usage (Signing vs KeyAgreement). `SecureEnclave.`
+// may prefix the P-curve type, so it is allowed optionally.
+const RE_SWIFT_P_SIGN = /\b(?:SecureEnclave\.)?P(?:256|384|521)\.Signing\.PrivateKey\b/g;
+const RE_SWIFT_P_KEX = /\b(?:SecureEnclave\.)?P(?:256|384|521)\.KeyAgreement\.PrivateKey\b/g;
+// CryptoKit Curve25519: Signing = Ed25519 (EdDSA); KeyAgreement = X25519.
+const RE_SWIFT_ED25519 = /\bCurve25519\.Signing\.PrivateKey\b/g;
+const RE_SWIFT_X25519 = /\bCurve25519\.KeyAgreement\.PrivateKey\b/g;
+// Security framework key-type attributes (used with SecKeyCreateRandomKey).
+const RE_SWIFT_SEC_RSA = /\bkSecAttrKeyTypeRSA\b/g;
+const RE_SWIFT_SEC_EC = /\bkSecAttrKeyType(?:EC|ECSECPrimeRandom)\b/g;
+
+const RULE_SWIFT_ECDSA: RuleMeta = {
+  id: "swift-ecdsa",
+  title: "Swift CryptoKit ECDSA signing key",
+  description: "CryptoKit P256/P384/P521 Signing.PrivateKey",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "CryptoKit P-curve ECDSA signing (Swift) is forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+};
+const RULE_SWIFT_ECDH: RuleMeta = {
+  id: "swift-ecdh",
+  title: "Swift CryptoKit ECDH key agreement",
+  description: "CryptoKit P256/P384/P521 KeyAgreement.PrivateKey",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "CryptoKit P-curve ECDH key agreement (Swift) is harvest-now-decrypt-later exposed.",
+  remediation: "Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768).",
+};
+const RULE_SWIFT_ED25519: RuleMeta = {
+  id: "swift-ed25519",
+  title: "Swift CryptoKit Ed25519 signing key",
+  description: "CryptoKit Curve25519.Signing.PrivateKey (Ed25519)",
+  category: "signature",
+  // `low`, aligned with Ed25519 in every other source pack (go/rust/ruby/python/node)
+  // — the same primitive must not flip CI exit codes based on which language wrote it.
+  severity: "low",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "CryptoKit Ed25519 signing (Swift) is classical and forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+};
+const RULE_SWIFT_X25519: RuleMeta = {
+  id: "swift-x25519",
+  title: "Swift CryptoKit X25519 key agreement",
+  description: "CryptoKit Curve25519.KeyAgreement.PrivateKey (X25519)",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "X25519",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "CryptoKit X25519 key agreement (Swift) is classical and harvest-now-decrypt-later exposed.",
+  remediation: "Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768).",
+};
+const RULE_SWIFT_RSA: RuleMeta = {
+  id: "swift-rsa",
+  title: "Swift Security-framework RSA key",
+  description: "SecKeyCreateRandomKey with kSecAttrKeyTypeRSA",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Security-framework RSA key (Swift) is classical and not quantum-safe.",
+  remediation: "Plan migration to PQC (ML-KEM-768 for encryption, ML-DSA-65 for signatures).",
+};
+const RULE_SWIFT_SEC_EC: RuleMeta = {
+  id: "swift-sec-ec",
+  title: "Swift Security-framework EC key",
+  description: "SecKeyCreateRandomKey with kSecAttrKeyTypeEC",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Security-framework EC key (Swift); EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+
+/** Detects classical asymmetric crypto in Swift (CryptoKit + Security framework). */
+export const swiftDetector: Detector = {
+  id: "swift-crypto",
+  description: "Classical asymmetric crypto in Swift (CryptoKit, Security framework)",
+  scope: "source",
+  language: "swift",
+  rules: [
+    RULE_SWIFT_ECDSA,
+    RULE_SWIFT_ECDH,
+    RULE_SWIFT_ED25519,
+    RULE_SWIFT_X25519,
+    RULE_SWIFT_RSA,
+    RULE_SWIFT_SEC_EC,
+  ],
+  appliesTo: (f) => hasExtension(f, SWIFT_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, content, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    add(RE_SWIFT_P_SIGN, RULE_SWIFT_ECDSA);
+    add(RE_SWIFT_P_KEX, RULE_SWIFT_ECDH);
+    add(RE_SWIFT_ED25519, RULE_SWIFT_ED25519);
+    add(RE_SWIFT_X25519, RULE_SWIFT_X25519);
+    add(RE_SWIFT_SEC_RSA, RULE_SWIFT_RSA);
+    add(RE_SWIFT_SEC_EC, RULE_SWIFT_SEC_EC);
+    return findings;
+  },
+};