@quantakrypto/core 0.4.4 → 0.5.0

package/src/detectors/dart.ts

@@ -0,0 +1,237 @@
+/**
+ * Source detector for classical asymmetric cryptography in Dart / Flutter.
+ *
+ * Dart has no asymmetric crypto in its standard library, so real-world code
+ * reaches for one of the two dominant pub.dev packages, and both expose their
+ * primitives through distinctive class names — which makes a lexical scan (the
+ * same zero-dependency strategy as every other language pack here) precise:
+ *
+ *  - package:pointycastle (a Bouncy Castle port). RSA via `RSAKeyGenerator`,
+ *    `RSAEngine`, `RSASigner`, `PSSSigner`; EC via `ECKeyGenerator`,
+ *    `ECDSASigner`, `ECDHBasicAgreement`; Edwards via `Ed25519`.
+ *  - package:cryptography (Dart-native). RSA via `RsaPss`, `RsaSsaPkcs1v15`;
+ *    EC via `Ecdsa`, `Ecdh`; modern curves via `Ed25519`, `X25519`.
+ *
+ * HNDL (harvest-now-decrypt-later) reasoning — the field that drives urgency:
+ *  - RSA encryption (`RSAEngine`) and RSA key generation (`RSAKeyGenerator`,
+ *    which yields keys that can decrypt) are confidentiality surfaces → hndl:true.
+ *  - (EC)DH key agreement (`ECDHBasicAgreement`, `Ecdh`, `X25519`) is the classic
+ *    HNDL target — recorded ciphertext is decryptable once the curve falls → hndl:true.
+ *  - Signatures (`RSASigner`/`PSSSigner`/`RsaPss`/`RsaSsaPkcs1v15`, `ECDSASigner`/
+ *    `Ecdsa`, `Ed25519`) are forgeable by a quantum attacker but not retroactively
+ *    breakable → hndl:false.
+ *  - `ECKeyGenerator` is ambiguous (an EC key can feed either ECDSA or ECDH); it is
+ *    classified conservatively as an ECDSA signing key (hndl:false), the Dart default.
+ *
+ * Comment suppression is C-style (`//` line + `/* … *\/` block), matching Dart's
+ * lexer, so commented-out crypto is not reported. The regexes are `\b`-anchored on
+ * the library-specific identifiers above; none matches a bare `RSA`/`EC` substring,
+ * keeping false positives low. A cheap substring fast-reject skips the regex work on
+ * the overwhelming majority of `.dart` files that touch no asymmetric crypto.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import {
+  eachMatch,
+  findingFromRule,
+  hasExtension,
+  maskBlockComments,
+  maskCommentLines,
+  DART_EXTENSIONS,
+} from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+// RSA key generation / raw RSA encryption engine (pointycastle). Both are
+// confidentiality-capable (a keypair can decrypt; the engine encrypts) → kem.
+const RE_DART_RSA_KEYGEN = /\b(?:RSAKeyGenerator|RSAEngine)\b/g;
+// RSA signature schemes: pointycastle `RSASigner`/`PSSSigner`, cryptography
+// `RsaPss`/`RsaSsaPkcs1v15`. Distinct casing keeps these off the keygen rule.
+const RE_DART_RSA_SIGN = /\b(?:RSASigner|PSSSigner|RsaPss|RsaSsaPkcs1v15)\b/g;
+// ECDSA SIGNING: pointycastle `ECDSASigner`, cryptography `Ecdsa`. `\bEcdsa\b`
+// requires a boundary, so `EcdsaP256`-style concatenations (rare) and the all-caps
+// `ECDSASigner` don't double-fire here. (EC keygen is a SEPARATE, HNDL-exposed rule.)
+const RE_DART_ECDSA = /\b(?:ECDSASigner|Ecdsa)\b/g;
+// EC KEY GENERATION (pointycastle `ECKeyGenerator`) is ambiguous — an EC key can
+// feed ECDSA signing OR ECDH agreement — so it is classified key-exchange/ECDH/
+// hndl:true (the fleet's HNDL-safe convention), NOT folded into the signing rule.
+const RE_DART_EC_KEYGEN = /\bECKeyGenerator\b/g;
+// ECDH key agreement: pointycastle `ECDHBasicAgreement`, cryptography `Ecdh`.
+// `\bEcdh\b` cannot match inside `Ecdsa` (different letters), so no overlap.
+const RE_DART_ECDH = /\b(?:ECDHBasicAgreement|Ecdh)\b/g;
+// Ed25519 signer (both packages spell it `Ed25519`).
+const RE_DART_ED25519 = /\bEd25519\b/g;
+// X25519 key agreement (cryptography `X25519`).
+const RE_DART_X25519 = /\bX25519\b/g;
+
+// Cheap fast-reject: distinctive substrings that gate the (precise) regex work.
+// If none is present the file cannot contain any of the tracked identifiers.
+const DART_FAST_REJECT: readonly string[] = [
+  "RSA",
+  "Rsa",
+  "ECDSA",
+  "Ecdsa",
+  "ECDH",
+  "Ecdh",
+  "ECKeyGenerator",
+  "PSSSigner",
+  "Ed25519",
+  "X25519",
+];
+
+const RULE_DART_RSA_KEYGEN: RuleMeta = {
+  id: "dart-rsa-keygen",
+  title: "Dart RSA key generation / encryption",
+  description: "pointycastle RSAKeyGenerator / RSAEngine",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Classical RSA key generation / encryption (Dart, pointycastle) is not quantum-safe and RSA encryption is harvest-now-decrypt-later exposed.",
+  remediation:
+    "Migrate to PQC (ML-KEM-768 for encryption / key transport) as Dart crypto packages add support.",
+};
+const RULE_DART_RSA_SIGN: RuleMeta = {
+  id: "dart-rsa-sign",
+  title: "Dart RSA signature",
+  description: "pointycastle RSASigner/PSSSigner, cryptography RsaPss/RsaSsaPkcs1v15",
+  category: "signature",
+  // `high`, consistent with every sibling pack's signature severity (go/java/php/
+  // objc/elixir RSA-sign) — the same primitive must not flip CI exit codes by language.
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical RSA signature (Dart) is forgeable by a quantum attacker.",
+  remediation:
+    "Migrate to PQC signatures (ML-DSA-65, FIPS 204) as Dart crypto packages add support.",
+};
+const RULE_DART_ECDSA: RuleMeta = {
+  id: "dart-ecdsa",
+  title: "Dart ECDSA signature",
+  description: "pointycastle ECDSASigner, cryptography Ecdsa",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Classical ECDSA signing (Dart) is forgeable by a quantum attacker.",
+  remediation:
+    "Migrate to PQC signatures (ML-DSA-65, FIPS 204) as Dart crypto packages add support.",
+};
+const RULE_DART_EC_KEYGEN: RuleMeta = {
+  id: "dart-ec-keygen",
+  title: "Dart EC key generation",
+  description: "pointycastle ECKeyGenerator (ambiguous EC key: ECDSA or ECDH)",
+  // Ambiguous EC keygen → key-exchange/ECDH/hndl:true (fleet HNDL-safe convention),
+  // since the key may feed ECDH agreement (harvest-now-decrypt-later exposed).
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "EC key generation (Dart, pointycastle); an EC key can feed ECDH key agreement (harvest-now-decrypt-later exposed) as well as ECDSA signing, and is not quantum-safe.",
+  remediation:
+    "For key agreement migrate to hybrid X25519MLKEM768 (ML-KEM-768); for signatures ML-DSA-65 — as Dart crypto packages add support.",
+};
+const RULE_DART_ECDH: RuleMeta = {
+  id: "dart-ecdh",
+  title: "Dart ECDH key agreement",
+  description: "pointycastle ECDHBasicAgreement, cryptography Ecdh",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Elliptic-curve Diffie-Hellman key agreement (Dart) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+  remediation:
+    "Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768) as Dart crypto packages add support.",
+};
+const RULE_DART_ED25519: RuleMeta = {
+  id: "dart-ed25519",
+  title: "Dart Ed25519 signature",
+  description: "pointycastle / cryptography Ed25519 signer",
+  category: "signature",
+  // `low`, aligned with Ed25519 across the other source packs (swift/rust/go/…) —
+  // the same primitive must not flip CI exit codes based on which language wrote it.
+  severity: "low",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Ed25519 (Dart) is a modern but still classical signature scheme, forgeable by a quantum attacker.",
+  remediation:
+    "Migrate to PQC signatures (ML-DSA-65, FIPS 204) as Dart crypto packages add support.",
+};
+const RULE_DART_X25519: RuleMeta = {
+  id: "dart-x25519",
+  title: "Dart X25519 key agreement",
+  description: "cryptography X25519 key agreement",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "X25519",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "X25519 (Dart) is modern but still classical key agreement — harvest-now-decrypt-later exposed.",
+  remediation:
+    "Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768) as Dart crypto packages add support.",
+};
+
+/** Detects classical asymmetric crypto in Dart / Flutter (pointycastle, cryptography). */
+export const dartDetector: Detector = {
+  id: "dart-crypto",
+  description: "Classical asymmetric crypto in Dart / Flutter (pointycastle, cryptography)",
+  scope: "source",
+  language: "dart",
+  rules: [
+    RULE_DART_RSA_KEYGEN,
+    RULE_DART_RSA_SIGN,
+    RULE_DART_ECDSA,
+    RULE_DART_EC_KEYGEN,
+    RULE_DART_ECDH,
+    RULE_DART_ED25519,
+    RULE_DART_X25519,
+  ],
+  appliesTo: (f) => hasExtension(f, DART_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    // Fast-reject: nothing to do unless a distinctive token appears.
+    if (!DART_FAST_REJECT.some((t) => content.includes(t))) return [];
+
+    // Suppress C-style comments so commented-out crypto isn't reported. Offsets
+    // are preserved (chars → spaces), so finding line/column stay exact.
+    const masked = maskCommentLines(maskBlockComments(content), ["//"]);
+
+    const findings: Finding[] = [];
+    // Scan the masked text, but build the finding (its snippet) from the ORIGINAL
+    // `content` so a line with a trailing comment renders live, not blanked.
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, masked, (m) =>
+        findings.push(
+          findingFromRule(rule, {
+            file,
+            content,
+            index: m.index,
+            matchLength: m[0].length,
+          }),
+        ),
+      );
+    add(RE_DART_RSA_KEYGEN, RULE_DART_RSA_KEYGEN);
+    add(RE_DART_RSA_SIGN, RULE_DART_RSA_SIGN);
+    add(RE_DART_ECDSA, RULE_DART_ECDSA);
+    add(RE_DART_EC_KEYGEN, RULE_DART_EC_KEYGEN);
+    add(RE_DART_ECDH, RULE_DART_ECDH);
+    add(RE_DART_ED25519, RULE_DART_ED25519);
+    add(RE_DART_X25519, RULE_DART_X25519);
+    return findings;
+  },
+};

package/src/detectors/database.ts

@@ -7,16 +7,34 @@
  * Covered:
  *  - pgcrypto `pgp_pub_encrypt` / `pgp_pub_decrypt` in `.sql` (RSA/ElGamal public-key
  *    encryption of column data) → `hndl:true`.
- *  - libpq `sslmode = disable | allow | prefer | require` in any config/connection
- *    file — a mode that does NOT verify the server certificate, so the classical
- *    TLS session it does (or doesn't) negotiate is both MITM-able and harvestable.
+ *  - libpq `sslmode = allow | prefer | require` in any config/connection file — a
+ *    mode that does NOT verify the server certificate, so the classical TLS session
+ *    it negotiates is both MITM-able and harvestable. `disable` is excluded: it
+ *    negotiates no TLS at all, so there is no key exchange to harvest (a plaintext
+ *    concern, out of scope for a PQC-readiness scanner).
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
-import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import {
+  DOC_EXTENSIONS,
+  eachMatch,
+  findingFromRule,
+  hasExtension,
+  maskCommentLines,
+} from "../detect-utils.js";
 import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION } from "../cwe.js";
 
 const RE_PGCRYPTO = /\bpgp_pub_(?:encrypt|decrypt)\b/g;
-const RE_WEAK_SSLMODE = /\bsslmode\s*=\s*["']?(?:disable|allow|prefer|require)\b/gi;
+// Matches the no-verification TLS modes across libpq (`sslmode=require`), the
+// `PGSSLMODE` env var, MySQL (`ssl-mode=PREFERRED`/`REQUIRED`, hyphenated), and YAML
+// connection config (`sslmode: require`) — i.e. an optional `pg` prefix, `-`/`_` or no
+// separator, `:` or `=`, and the libpq/MySQL value spellings.
+const RE_WEAK_SSLMODE =
+  /\b(?:pg)?ssl[-_]?mode\s*[:=]\s*["']?(?:allow|prefer(?:red)?|require[d]?)\b/gi;
+// SQL Server TDE: the database encryption key is protected by a classical RSA
+// asymmetric key / certificate. `CREATE ASYMMETRIC KEY … WITH ALGORITHM = RSA_2048`
+// is the distinctive form; the span between the two clauses is lazily bounded to keep
+// matching linear.
+const RE_MSSQL_TDE_RSA = /\bCREATE\s+ASYMMETRIC\s+KEY\b[\s\S]{0,300}?\bALGORITHM\s*=\s*RSA_\d+/gi;
 
 const RULE_PGCRYPTO: RuleMeta = {
   id: "db-pgcrypto-pubkey",
@@ -33,10 +51,25 @@ const RULE_PGCRYPTO: RuleMeta = {
   remediation:
     "Plan migration to a post-quantum KEM (ML-KEM-768) envelope for at-rest data; re-encrypt long-lived rows.",
 };
+const RULE_MSSQL_TDE_RSA: RuleMeta = {
+  id: "db-tde-rsa",
+  title: "SQL Server TDE RSA key",
+  description: "SQL Server CREATE ASYMMETRIC KEY ... WITH ALGORITHM = RSA_* (TDE key protection)",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Transparent Data Encryption protects the database encryption key with a classical RSA asymmetric key; the at-rest data is harvest-now-decrypt-later exposed once the RSA key falls.",
+  remediation:
+    "Plan migration to a PQC KEM (ML-KEM-768) for TDE key protection as the database engine adds support; re-key long-lived encrypted databases.",
+};
 const RULE_WEAK_SSLMODE: RuleMeta = {
   id: "db-weak-sslmode",
   title: "Database sslmode without verification",
-  description: "libpq sslmode is disable/allow/prefer/require (no certificate verification)",
+  description: "libpq sslmode is allow/prefer/require (no certificate verification)",
   category: "tls",
   severity: "medium",
   confidence: "high",
@@ -51,16 +84,20 @@ const RULE_WEAK_SSLMODE: RuleMeta = {
 /** Detects classical database at-rest / transport crypto. */
 export const databaseDetector: Detector = {
   id: "database-crypto",
-  description: "Classical crypto in database usage (pgcrypto public-key, weak client sslmode)",
+  description:
+    "Classical crypto in database usage (pgcrypto public-key, SQL Server TDE, weak client sslmode)",
   scope: "config",
   language: "any",
-  rules: [RULE_PGCRYPTO, RULE_WEAK_SSLMODE],
+  rules: [RULE_PGCRYPTO, RULE_MSSQL_TDE_RSA, RULE_WEAK_SSLMODE],
   // Skip prose/docs: a README showing `sslmode=require` is not a live connection string.
   appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
   detect({ file, content }): Finding[] {
     const findings: Finding[] = [];
+    // Mask SQL (`--`, single-line `/* … */`), shell/ini (`#`), and ini (`;`) line
+    // comments: a commented `-- pgp_pub_encrypt` or `; sslmode=require` is not active.
+    const scan = maskCommentLines(content, ["#", "--", ";", "/*"]);
     if (file.toLowerCase().endsWith(".sql") && content.includes("pgp_pub_")) {
-      eachMatch(RE_PGCRYPTO, content, (m) =>
+      eachMatch(RE_PGCRYPTO, scan, (m) =>
         findings.push(
           findingFromRule(RULE_PGCRYPTO, {
             file,
@@ -71,8 +108,11 @@ export const databaseDetector: Detector = {
         ),
       );
     }
-    if (content.includes("sslmode")) {
-      eachMatch(RE_WEAK_SSLMODE, content, (m) =>
+    const lc = content.toLowerCase();
+    // Cheap prefilter; matches the separators the RE_WEAK_SSLMODE regex accepts
+    // (`sslmode`, `ssl-mode`, `ssl_mode`) so no supported form is gated out.
+    if (lc.includes("sslmode") || lc.includes("ssl-mode") || lc.includes("ssl_mode")) {
+      eachMatch(RE_WEAK_SSLMODE, scan, (m) =>
         findings.push(
           findingFromRule(RULE_WEAK_SSLMODE, {
             file,
@@ -83,6 +123,19 @@ export const databaseDetector: Detector = {
         ),
       );
     }
+    // SQL Server TDE: a classical RSA asymmetric key protecting the DEK.
+    if (lc.includes("asymmetric key")) {
+      eachMatch(RE_MSSQL_TDE_RSA, scan, (m) =>
+        findings.push(
+          findingFromRule(RULE_MSSQL_TDE_RSA, {
+            file,
+            content,
+            index: m.index,
+            matchLength: m[0].length,
+          }),
+        ),
+      );
+    }
     return findings;
   },
 };

package/src/detectors/dkim.ts

@@ -0,0 +1,172 @@
+/**
+ * Config detector: classical DKIM email-signing keys and algorithms in DNS
+ * zone files, mail-server signer config (OpenDKIM), and captured
+ * `DKIM-Signature:` header fields (RFC 6376 + RFC 8463).
+ *
+ * DKIM (DomainKeys Identified Mail) authenticates the *origin* of email: the
+ * sending MTA signs selected header/body content with a private key, publishes
+ * the matching public key as a DNS TXT record at
+ * `<selector>._domainkey.<domain>`, and receivers verify the `DKIM-Signature`
+ * header against that published key. Like DNSSEC (see `dnssec.ts`), this is a
+ * pure *signature* surface: there is no confidentiality to harvest, so a DKIM
+ * key is NOT harvest-now-decrypt-later exposed (`hndl: false`). What breaks
+ * once a cryptographically-relevant quantum computer (CRQC) exists is
+ * unforgeability — an attacker who can derive the private key from the
+ * published public key can mint valid `DKIM-Signature` headers and spoof mail
+ * that passes DKIM/DMARC. So these findings are `category: "signature"`.
+ *
+ * Crypto surface, mapped to {@link AlgorithmFamily}:
+ *  - `k=rsa` DNS key-type tag / `a=rsa-sha256` / `a=rsa-sha1` (DKIM-Signature
+ *    algorithm tag) / OpenDKIM `SigningAlgorithm rsa-sha256|rsa-sha1`   → RSA
+ *  - `k=ed25519` DNS key-type tag / `a=ed25519-sha256` / OpenDKIM
+ *    `SigningAlgorithm ed25519-sha256` (RFC 8463)                        → EdDSA
+ *
+ * Ed25519 DKIM (RFC 8463) is MODERN but still CLASSICAL: rotating an RSA DKIM
+ * key to Ed25519 shrinks the DNS record and is good hygiene, but it is NOT a
+ * post-quantum fix — an Ed25519 signature is just as forgeable under a CRQC.
+ * The remediation text says so honestly: there is no standardized PQC DKIM yet;
+ * the only real action is to track IETF work.
+ *
+ * Two match shapes are covered per family, both gated to a small config
+ * extension set AND to a file-level DKIM marker (see `hasDkimMarker`) so the
+ * short tag tokens (`k=rsa`, `a=rsa-sha256`) can't fire on unrelated config:
+ *
+ *  1. DNS KEY-TYPE tag — `k=rsa` / `k=ed25519` inside a published DKIM TXT
+ *     record (`v=DKIM1; k=rsa; p=MIGf...`). Whitespace around `=` is tolerated.
+ *  2. SIGNING-ALGORITHM tag — the `a=` tag of a `DKIM-Signature` header
+ *     (`a=rsa-sha256`, `a=ed25519-sha256`) and the OpenDKIM `SigningAlgorithm`
+ *     directive (`SigningAlgorithm rsa-sha256`). The RSA variant deliberately
+ *     also matches the legacy `rsa-sha1`.
+ *
+ * Fast reject: `detect()` bails unless the file carries a DKIM-specific marker
+ * (`v=DKIM1`, `_domainkey`, a `DKIM-Signature` field, an OpenDKIM
+ * `SigningAlgorithm` directive, or a bare `k=rsa`/`k=ed25519` key-type tag).
+ * This stops the generic-looking `k=rsa` / `a=rsa-sha256` tokens from firing on
+ * an unrelated `.conf` that happens to contain an `a=`/`k=` assignment for its
+ * own reasons. Prose is excluded twice over: `appliesTo` restricts to config
+ * extensions (README/`.md` never applies), and `detect()` re-guards against
+ * {@link DOC_EXTENSIONS} defensively so a docs file that slipped through a
+ * broader gate could never be flagged for mentioning `k=rsa` in a sentence.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import {
+  DOC_EXTENSIONS,
+  eachMatch,
+  findingFromRule,
+  hasExtension,
+  maskCommentLines,
+} from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+// DKIM records live in DNS zone files (`.zone`/`.db`), mail-server signer config
+// (`.conf`), and captured header/TXT fixtures (`.txt`). Gated further by
+// `hasDkimMarker` so the short tag tokens can't fire on unrelated config.
+const DKIM_EXTENSIONS: readonly string[] = [".zone", ".db", ".conf", ".txt"];
+
+// --- RSA (k=rsa / rsa-sha256 / rsa-sha1) ---
+// DNS key-type tag: `k=rsa` in a published DKIM TXT record. Whitespace tolerated
+// around `=`; case-insensitive since tags are conventionally lowercase but not
+// required to be. `\b` after `rsa` keeps it from matching `rsa-...` substrings.
+const RE_RSA_KEYTAG = /\bk\s*=\s*rsa\b/gi;
+// DKIM-Signature `a=` tag: `a=rsa-sha256` / `a=rsa-sha1`.
+const RE_RSA_ALGTAG = /\ba\s*=\s*rsa-sha(?:256|1)\b/gi;
+// OpenDKIM signer directive: `SigningAlgorithm rsa-sha256` / `rsa-sha1`.
+const RE_RSA_OPENDKIM = /\bSigningAlgorithm\s+rsa-sha(?:256|1)\b/gi;
+
+// --- EdDSA (k=ed25519 / ed25519-sha256, RFC 8463) ---
+const RE_EDDSA_KEYTAG = /\bk\s*=\s*ed25519\b/gi;
+const RE_EDDSA_ALGTAG = /\ba\s*=\s*ed25519-sha256\b/gi;
+const RE_EDDSA_OPENDKIM = /\bSigningAlgorithm\s+ed25519-sha256\b/gi;
+
+const RULE_DKIM_RSA: RuleMeta = {
+  id: "dkim-rsa-key",
+  title: "DKIM RSA signing key/algorithm",
+  description:
+    "DKIM email signing configured with a classical RSA key/algorithm (k=rsa, a=rsa-sha256/rsa-sha1)",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "DKIM email signing uses a classical RSA key/algorithm (k=rsa / rsa-sha256 / rsa-sha1); DKIM-Signature headers become forgeable once a CRQC exists, allowing DKIM/DMARC-passing spoofed mail.",
+  remediation:
+    "There is no standardized post-quantum DKIM algorithm yet — track IETF work; note that rotating RSA to Ed25519 (RFC 8463) is good hygiene but NOT a PQC fix, since Ed25519 is still classical and equally forgeable under a CRQC.",
+};
+
+const RULE_DKIM_EDDSA: RuleMeta = {
+  id: "dkim-ed25519-key",
+  title: "DKIM Ed25519 signing key/algorithm",
+  description:
+    "DKIM email signing configured with a classical Ed25519 key/algorithm (k=ed25519, a=ed25519-sha256, RFC 8463)",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "DKIM email signing uses an Ed25519 key/algorithm (k=ed25519 / ed25519-sha256, RFC 8463) — modern but still classical; DKIM-Signature headers become forgeable once a CRQC exists.",
+  remediation:
+    "There is no standardized post-quantum DKIM algorithm yet — track IETF work. Ed25519 is already the smaller/modern DKIM choice but is NOT post-quantum: it stays forgeable under a CRQC, so no rotation today resolves the quantum exposure.",
+};
+
+/**
+ * True when `content` carries a DKIM-specific marker. Deliberately does NOT accept
+ * a bare `k=rsa` / `k=ed25519` tag as its own marker: that tag is exactly what the
+ * RSA/EdDSA rules match, so treating it as the gate would be self-satisfying and
+ * fire on unrelated prose ("set `k=rsa` for the legacy importer"). A real DKIM
+ * record always also carries `v=DKIM1`, `_domainkey`, a `DKIM-Signature` field, or
+ * the OpenDKIM `SigningAlgorithm` directive — one of those must be present.
+ */
+function hasDkimMarker(content: string): boolean {
+  return (
+    /\bDKIM1\b/i.test(content) ||
+    content.includes("_domainkey") ||
+    /DKIM-Signature/i.test(content) ||
+    /\bSigningAlgorithm\b/i.test(content)
+  );
+}
+
+interface DkimRule {
+  meta: RuleMeta;
+  res: readonly RegExp[];
+}
+
+const DKIM_RULES: readonly DkimRule[] = [
+  { meta: RULE_DKIM_RSA, res: [RE_RSA_KEYTAG, RE_RSA_ALGTAG, RE_RSA_OPENDKIM] },
+  { meta: RULE_DKIM_EDDSA, res: [RE_EDDSA_KEYTAG, RE_EDDSA_ALGTAG, RE_EDDSA_OPENDKIM] },
+];
+
+/** Detects classical DKIM signing keys/algorithms in zone files and mail signer config. */
+export const dkimDetector: Detector = {
+  id: "dkim-crypto",
+  description: "Classical DKIM email signing keys/algorithms in zone files / mail signer config",
+  scope: "config",
+  language: "any",
+  rules: DKIM_RULES.map((r) => r.meta),
+  appliesTo: (f) => hasExtension(f, DKIM_EXTENSIONS) && !hasExtension(f, DOC_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    // Defensive doc guard: even if a broader gate ever let a prose file through,
+    // a README mentioning `k=rsa` in a sentence must never be flagged.
+    if (hasExtension(file, DOC_EXTENSIONS)) return [];
+    if (!hasDkimMarker(content)) return [];
+
+    // Mask whole comment lines so a commented-out record can't fire: zone files
+    // use `;`, mail/OpenDKIM config uses `#` and `//`. Offsets are preserved so
+    // finding line/column/snippet stay exact for the live lines that remain.
+    const scan = maskCommentLines(content, [";", "#", "//"]);
+    const findings: Finding[] = [];
+    for (const { meta, res } of DKIM_RULES) {
+      for (const re of res) {
+        eachMatch(re, scan, (m) =>
+          findings.push(
+            findingFromRule(meta, { file, content, index: m.index, matchLength: m[0].length }),
+          ),
+        );
+      }
+    }
+    return findings;
+  },
+};

package/src/detectors/dnssec.ts

@@ -50,7 +50,7 @@
  * mention `ED25519` or `DSA` for its own reasons.
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
-import { eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { eachMatch, findingFromRule, hasExtension, maskCommentLines } from "../detect-utils.js";
 import { CWE_BROKEN_CRYPTO } from "../cwe.js";
 
 const DNSSEC_EXTENSIONS: readonly string[] = [".zone", ".db", ".conf"];
@@ -62,19 +62,24 @@ const NUM_EDDSA = "15|16"; // ED25519, ED448
 const NUM_DSA = "3|6"; // DSA, DSA-NSEC3-SHA1
 
 // --- NAMED form: mnemonic algorithm names in signer/policy config or CLI args. ---
-const RE_NAMED_RSA = /\bRSASHA(?:256|512|1(?:-NSEC3-SHA1)?)\b/g;
-const RE_NAMED_ECDSA = /\bECDSAP(?:256SHA256|384SHA384)\b/g;
-const RE_NAMED_EDDSA = /\bED(?:25519|448)\b/g;
+// Case-insensitive: BIND `dnssec-policy` and Knot config conventionally write the
+// mnemonics in lowercase (`algorithm rsasha256;`, `algorithm ed25519;`), so a
+// case-sensitive match would miss the primary real-world signer-config syntax. Still
+// gated by `hasDnssecMarker` + the DNSSEC extensions, so generic tokens can't fire.
+const RE_NAMED_RSA = /\bRSASHA(?:256|512|1(?:-NSEC3-SHA1)?)\b/gi;
+const RE_NAMED_ECDSA = /\bECDSAP(?:256SHA256|384SHA384)\b/gi;
+const RE_NAMED_EDDSA = /\bED(?:25519|448)\b/gi;
 // Bare "DSA" is too generic to key off alone; require it right after an
 // `algorithm` keyword (Knot/BIND config / dnssec-policy style), optionally
 // quoted or separated by `:`/`=`.
 const RE_NAMED_DSA = /\balgorithm\s*[:=]?\s*"?DSA(?:-NSEC3-SHA1)?"?\b/gi;
 
-// --- STRUCTURAL form: `DNSKEY <flags> 3 <algorithm>` presentation RDATA (RFC 4034 §2). ---
-const RE_DNSKEY_RSA = new RegExp(`\\bDNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_RSA})\\b`, "g");
-const RE_DNSKEY_ECDSA = new RegExp(`\\bDNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_ECDSA})\\b`, "g");
-const RE_DNSKEY_EDDSA = new RegExp(`\\bDNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_EDDSA})\\b`, "g");
-const RE_DNSKEY_DSA = new RegExp(`\\bDNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_DSA})\\b`, "g");
+// --- STRUCTURAL form: `[C]DNSKEY <flags> 3 <algorithm>` presentation RDATA (RFC 4034
+// §2). `C?` also matches CDNSKEY (child-zone key with identical RDATA, RFC 7344). ---
+const RE_DNSKEY_RSA = new RegExp(`\\bC?DNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_RSA})\\b`, "g");
+const RE_DNSKEY_ECDSA = new RegExp(`\\bC?DNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_ECDSA})\\b`, "g");
+const RE_DNSKEY_EDDSA = new RegExp(`\\bC?DNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_EDDSA})\\b`, "g");
+const RE_DNSKEY_DSA = new RegExp(`\\bC?DNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_DSA})\\b`, "g");
 
 const RULE_DNSSEC_RSA: RuleMeta = {
   id: "dnssec-rsa-sig",
@@ -171,10 +176,14 @@ export const dnssecDetector: Detector = {
   detect({ file, content }): Finding[] {
     if (!hasDnssecMarker(content)) return [];
 
+    // Mask whole comment lines so a commented-out algorithm can't fire: zone files
+    // use `;`, named.conf uses `#` and `//`. These extensions are not centrally
+    // stripped; offsets are preserved so finding locations stay exact.
+    const scan = maskCommentLines(content, [";", "#", "//"]);
     const findings: Finding[] = [];
     for (const { meta, res } of DNSSEC_RULES) {
       for (const re of res) {
-        eachMatch(re, content, (m) =>
+        eachMatch(re, scan, (m) =>
           findings.push(
             findingFromRule(meta, { file, content, index: m.index, matchLength: m[0].length }),
           ),

package/src/detectors/elixir.ts

@@ -19,6 +19,10 @@ import { ELIXIR_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../
 import { CWE_BROKEN_CRYPTO } from "../cwe.js";
 
 const RE_EX_GEN = /:crypto\.generate_key\s*\(\s*:(\w+)/g;
+// `:crypto.compute_key(:ecdh|:dh, PeerPub, MyKey, :curve)` is the DH/ECDH AGREEMENT
+// operation itself — the harvest-now-decrypt-later step — which generate_key alone
+// misses. Classified by the same type/curve logic as generate_key.
+const RE_EX_COMPUTE = /:crypto\.compute_key\s*\(\s*:(\w+)/g;
 const RE_EX_SIGN = /:crypto\.(?:sign|verify)\s*\(\s*:(\w+)/g;
 const RE_EX_X509_RSA = /\bX509\.PrivateKey\.new_rsa\s*\(/g;
 const RE_EX_X509_EC = /\bX509\.PrivateKey\.new_ec\s*\(/g;
@@ -146,6 +150,7 @@ function classifySign(type: string): AlgorithmFamily | null {
   if (type === "rsa") return "RSA";
   if (type === "ecdsa") return "ECDSA";
   if (type === "eddsa" || type === "ed25519") return "EdDSA";
+  if (type === "dss") return "DSA"; // Erlang's algorithm atom for DSA signatures
   return null;
 }
 
@@ -183,6 +188,23 @@ export const elixirDetector: Detector = {
       );
     });
 
+    // :crypto.compute_key(:type, …) — the (EC)DH agreement operation.
+    eachMatch(RE_EX_COMPUTE, content, (m) => {
+      const cls = classifyGen(m[1], content.slice(m.index, m.index + 120));
+      if (!cls) return;
+      findings.push(
+        findingFromRule(RULE_EX_KEYGEN, at(m), {
+          title: `Elixir :crypto ${cls.label} key agreement`,
+          category: cls.cat,
+          severity: cls.sev,
+          algorithm: cls.algo,
+          hndl: cls.hndl,
+          message: `Performs classical ${cls.label} key agreement via Erlang :crypto (Elixir) — harvest-now-decrypt-later exposed.`,
+          ...(cls.remediation ? { remediation: cls.remediation } : {}),
+        }),
+      );
+    });
+
     // :crypto.sign / :crypto.verify(:type, …).
     eachMatch(RE_EX_SIGN, content, (m) => {
       const algo = classifySign(m[1]);
@@ -213,11 +235,20 @@ export const elixirDetector: Detector = {
       ),
     );
 
-    // JOSE.JWK.generate_key({:rsa|:ec|:okp, …}).
+    // JOSE.JWK.generate_key({:rsa|:ec|:okp, …}). An OKP key is EdDSA (Ed25519/Ed448,
+    // signature) OR a Montgomery key-agreement key (X25519/X448, HNDL) — inspect the
+    // curve atom in a short window so an X25519 OKP is not mislabeled as an EdDSA
+    // signature.
     eachMatch(RE_EX_JOSE, content, (m) => {
       const kind = m[1];
+      let okpCls: Cls = EDDSA_CLS;
+      if (kind === "okp") {
+        const window = content.slice(m.index, m.index + 80);
+        if (/:x25519\b/i.test(window)) okpCls = X25519_CLS;
+        else if (/:x448\b/i.test(window)) okpCls = X448_CLS;
+      }
       const cls =
-        kind === "rsa" ? RSA_CLS : kind === "ec" ? EC_CLS : kind === "okp" ? EDDSA_CLS : null;
+        kind === "rsa" ? RSA_CLS : kind === "ec" ? EC_CLS : kind === "okp" ? okpCls : null;
       if (!cls) return;
       findings.push(
         findingFromRule(RULE_EX_JOSE, at(m), {