@quantakrypto/core 0.4.4 → 0.5.0

package/src/detectors/java.ts

@@ -35,7 +35,7 @@ const RE_JAVA_GETINSTANCE =
 
 // BouncyCastle lightweight-API class instantiations.
 const RE_JAVA_BC =
-  /\bnew\s+(RSAKeyPairGenerator|DSAKeyPairGenerator|ECKeyPairGenerator|ECDSASigner|Ed25519Signer|Ed448Signer|X25519Agreement|X448Agreement|ECDHBasicAgreement|DHBasicAgreement|X25519KeyPairGenerator|Ed25519KeyPairGenerator|RSAEngine|OAEPEncoding)\s*\(/g;
+  /\bnew\s+(RSAKeyPairGenerator|DSAKeyPairGenerator|ECKeyPairGenerator|ECDSASigner|Ed25519Signer|Ed448Signer|X25519Agreement|X448Agreement|ECDHBasicAgreement|DHBasicAgreement|X25519KeyPairGenerator|X448KeyPairGenerator|Ed25519KeyPairGenerator|Ed448KeyPairGenerator|X448PrivateKeyParameters|RSAEngine|OAEPEncoding)\s*\(/g;
 
 // BouncyCastle lightweight-API curve/EdDSA classes as a BARE constructor call —
 // the Kotlin form (`X448KeyPairGenerator()`, no `new` keyword). RE_JAVA_BC above
@@ -47,13 +47,30 @@ const RE_JAVA_BC =
 const RE_JAVA_BC_CURVE =
   /(?<!\bnew\s+)\b(X448KeyPairGenerator|X448Agreement|X448PrivateKeyParameters|X25519KeyPairGenerator|X25519Agreement|Ed448KeyPairGenerator|Ed448Signer|Ed25519KeyPairGenerator|Ed25519Signer)\s*\(/g;
 
+// The non-curve BouncyCastle classes (RSA/EC/DSA/DH keygen, signers, engines) as a
+// BARE constructor call — the Kotlin form, `ECKeyPairGenerator()` with no `new`. Java
+// and Scala instantiate Java classes with `new` (caught by RE_JAVA_BC), so bare calls
+// to these distinctive class names are Kotlin. The `(?<!\bnew\s+)` avoids double-
+// counting the `new` form; routed through the same BC_CLASS_RULES map.
+const RE_JAVA_BC_BARE =
+  /(?<!\bnew\s+)\b(RSAKeyPairGenerator|DSAKeyPairGenerator|ECKeyPairGenerator|ECDSASigner|ECDHBasicAgreement|DHBasicAgreement|RSAEngine|OAEPEncoding)\s*\(/g;
+
 // Insecure JSSE / TLS configuration expressed in Java source. Mirrors the JS
 // tlsDetector in source.ts (category "tls"): a legacy SSL/TLS protocol version
 // requested from SSLContext, and TLS hostname verification neutered via an
 // all-trusting verifier (Apache HttpClient's NoopHostnameVerifier /
 // ALLOW_ALL_HOSTNAME_VERIFIER).
-const RE_JAVA_TLS_LEGACY = /\bSSLContext\s*\.\s*getInstance\s*\(\s*"(SSL|SSLv3|TLSv1)"/g;
-const RE_JAVA_TLS_NOVERIFY = /\b(NoopHostnameVerifier|ALLOW_ALL_HOSTNAME_VERIFIER)\b/g;
+// `TLSv1(?:\.1)?` catches both TLS 1.0 and the equally-deprecated TLS 1.1 (RFC 8996),
+// mirroring the JS tlsDetector; the closing `"` keeps `"TLSv1.2"`/`"TLSv1.3"`/`"TLS"`
+// from matching. `SSLv2` is included alongside `SSLv3`.
+const RE_JAVA_TLS_LEGACY =
+  /\bSSLContext\s*\.\s*getInstance\s*\(\s*"(SSL|SSLv2|SSLv3|TLSv1(?:\.1)?)"/g;
+// Require a USAGE position, not a bare identifier: `NoopHostnameVerifier` followed by
+// `(` (construction) or `.` (`.INSTANCE`), and `ALLOW_ALL_HOSTNAME_VERIFIER` preceded
+// by `.` (member access). This keeps `new NoopHostnameVerifier()` and
+// `SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER` while dropping the common
+// false positive of a plain `import …NoopHostnameVerifier;` line.
+const RE_JAVA_TLS_NOVERIFY = /\bNoopHostnameVerifier\s*[.(]|\.\s*ALLOW_ALL_HOSTNAME_VERIFIER\b/g;
 
 // Identifier-form JWT/JOSE signature algorithms (audit F7). The quoted-string
 // alg token ("RS256") is caught by the language-agnostic jwt-jose detector, but
@@ -278,6 +295,10 @@ function classifyGetInstance(factory: string, rawAlg: string): RuleMeta | null {
   const isSignature = factory === "Signature";
 
   if (alg.includes("ECDSA")) return RULE_JAVA_ECDSA_SIGN;
+  // ECIES (EC Integrated Encryption Scheme, incl. `ECIESwithAES-CBC`) is classical EC
+  // public-key ENCRYPTION — harvest-now-decrypt-later exposed. Checked before the EC
+  // branches below (which would otherwise miss it) and the RSA/DSA checks.
+  if (alg.includes("ECIES")) return RULE_JAVA_ECDH;
   if (alg.includes("ECDH")) return RULE_JAVA_ECDH;
   if (alg === "EC") return isSignature ? RULE_JAVA_ECDSA_SIGN : RULE_JAVA_EC_KEYGEN;
   if (alg.includes("ED25519") || alg.includes("ED448") || alg.includes("EDDSA"))
@@ -307,7 +328,10 @@ const BC_CLASS_RULES: Record<string, RuleMeta> = {
   ECDHBasicAgreement: RULE_JAVA_ECDH,
   DHBasicAgreement: RULE_JAVA_DH,
   X25519KeyPairGenerator: RULE_JAVA_XDH,
+  X448KeyPairGenerator: RULE_JAVA_XDH,
+  X448PrivateKeyParameters: RULE_JAVA_XDH,
   Ed25519KeyPairGenerator: RULE_JAVA_EDDSA,
+  Ed448KeyPairGenerator: RULE_JAVA_EDDSA,
   RSAEngine: RULE_JAVA_RSA,
   OAEPEncoding: RULE_JAVA_RSA,
 };
@@ -381,6 +405,16 @@ export const javaDetector: Detector = {
       );
     });
 
+    // Bare (Kotlin-form) constructor calls to the non-curve BC classes — same rules
+    // as the `new` form, routed via BC_CLASS_RULES.
+    eachMatch(RE_JAVA_BC_BARE, content, (m) => {
+      const rule = BC_CLASS_RULES[m[1]];
+      if (!rule) return;
+      findings.push(
+        findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+      );
+    });
+
     // Legacy SSL/TLS protocol version requested from SSLContext.
     eachMatch(RE_JAVA_TLS_LEGACY, content, (m) => {
       findings.push(

package/src/detectors/jose.ts

@@ -15,7 +15,14 @@
  * the detector applies to any file (config, JSON, source) after a fast reject.
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
-import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import {
+  JWT_HOST_EXTENSIONS,
+  DOC_EXTENSIONS,
+  eachMatch,
+  enclosingObject,
+  findingFromRule,
+  hasExtension,
+} from "../detect-utils.js";
 import { CWE_BROKEN_CRYPTO } from "../cwe.js";
 
 interface JoseRule {
@@ -70,8 +77,12 @@ export const joseDetector: Detector = {
   scope: "config",
   language: "any",
   rules: JOSE_RULES.map((r) => r.meta),
-  // Prose examples (a README showing `"alg":"RSA-OAEP"`) are not JOSE config.
-  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+  // Prose examples (a README showing `"alg":"RSA-OAEP"`) are not JOSE config. In the
+  // JS/TS/Python/Go/Ruby source files that source.ts's `jose-rsa-oaep`/`jose-ecdh-es`
+  // token rules actually cover (JWT_HOST_EXTENSIONS), defer to them to avoid a
+  // double-count — but STILL run on other source languages (Java/C#/Rust/PHP/Elixir/
+  // C/C++), which source.ts does not cover for these tokens.
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS) && !hasExtension(f, JWT_HOST_EXTENSIONS),
   detect({ file, content }): Finding[] {
     // Fast reject: no JOSE key-management alg token present.
     if (
@@ -84,6 +95,11 @@ export const joseDetector: Detector = {
     const findings: Finding[] = [];
     for (const rule of JOSE_RULES) {
       eachMatch(rule.re, content, (m) => {
+        // If this `alg` belongs to a JWK (a `"kty"` sits in the SAME object), the jwk
+        // detector already reports the key — defer so it isn't counted twice. Scoped
+        // to the enclosing object so an unrelated nearby JWK doesn't suppress a real
+        // standalone JWE header.
+        if (enclosingObject(content, m.index).includes('"kty"')) return;
         findings.push(
           findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }),
         );

package/src/detectors/jwk.ts

@@ -10,17 +10,24 @@
  *  - `"crv":"Ed25519"|"Ed448"`              → EdDSA signing key.
  *  - `"crv":"X25519"|"X448"`                → classical Montgomery-curve key agreement.
  *
- * Keying EC/OKP off `crv` (present in every EC/OKP JWK) rather than `kty` avoids
- * double-counting a single key, and `"kty"`/`"crv"` are specific enough to RFC
- * 7517 that the false-positive risk on ordinary JSON is low.
+ * Usage-aware classification: when a key's surrounding `"use"` / `"alg"` marks it
+ * as a SIGNING key (`use:"sig"`, or an `RS`/`PS`/`ES` signature alg), the finding
+ * is a `signature` (`hndl:false`) — a signing key is forgeable at a CRQC but not
+ * harvest-now exposed. An encryption/unspecified key stays `hndl:true`.
  *
- * HNDL: RSA and (EC)DH / X25519 / X448 key agreement are harvest-now-decrypt-later
- * exposed (hndl:true); EdDSA signing keys are hndl:false but forgeable. A JWKS is
- * usually PUBLIC keys, so severity is medium — the exposure is a classical key
- * pair, not necessarily an embedded secret.
+ * Deferrals to avoid double-counting: skipped on doc extensions (a README JWK
+ * example is not live) and inside CloudFormation/ARM templates, where the
+ * cloudformation detector owns the `kty` of a `Microsoft.KeyVault` key resource.
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
-import { eachMatch, findingFromRule } from "../detect-utils.js";
+import {
+  DOC_EXTENSIONS,
+  eachMatch,
+  enclosingObject,
+  findingFromRule,
+  hasExtension,
+} from "../detect-utils.js";
+import { isCloudTemplateFile } from "./cloudformation.js";
 import { CWE_BROKEN_CRYPTO } from "../cwe.js";
 
 interface JwkRule {
@@ -99,6 +106,20 @@ const JWK_RULES: JwkRule[] = [
   },
 ];
 
+/**
+ * True when THIS key's own object marks it as a signing key via `use`/`alg`. The
+ * caller passes the enclosing `{…}` object so a neighbouring key in a JWKS array
+ * can't contaminate the result, and an explicit `"use":"enc"` on the key always
+ * wins (never classify an encryption key as a signature).
+ */
+function isSigningUse(objectText: string, sigAlg: RegExp): boolean {
+  if (/"use"\s*:\s*"enc"/.test(objectText)) return false;
+  return /"use"\s*:\s*"sig"/.test(objectText) || sigAlg.test(objectText);
+}
+
+const RSA_SIG_ALG = /"alg"\s*:\s*"(?:RS|PS)(?:256|384|512)"/;
+const EC_SIG_ALG = /"alg"\s*:\s*"ES(?:256K?|384|512)"/;
+
 /** Detects classical JSON Web Key (JWK/JWKS) material in any JSON/text file. */
 export const jwkDetector: Detector = {
   id: "jwk-material",
@@ -106,21 +127,42 @@ export const jwkDetector: Detector = {
   scope: "config",
   language: "any",
   rules: JWK_RULES.map((r) => r.meta),
-  appliesTo: () => true,
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
   detect({ file, content }): Finding[] {
     // Fast reject: a JWK always has one of these two members.
     if (!content.includes('"kty"') && !content.includes('"crv"')) return [];
+    // The ONLY overlap with the cloudformation detector is the ARM Key Vault key
+    // `kty:"RSA"` (cfn-arm-keyvault-rsa), which only fires when Microsoft.KeyVault is
+    // present. Defer just the RSA rule in that case — everything else (crv keys, and
+    // JWKs embedded in AWS CloudFormation, which cfn does not own) is still reported.
+    const isArm = isCloudTemplateFile(file, content) && content.includes("Microsoft.KeyVault");
+
     const findings: Finding[] = [];
     for (const rule of JWK_RULES) {
       eachMatch(rule.re, content, (m) => {
-        findings.push(
-          findingFromRule(rule.meta, {
-            file,
-            content,
-            index: m.index,
-            matchLength: m[0].length,
-          }),
-        );
+        if (rule.meta.id === "jwk-rsa" && isArm) return; // cfn-arm-keyvault-rsa owns it
+        const at = { file, content, index: m.index, matchLength: m[0].length };
+        // Analyse the key's OWN enclosing object so a neighbouring key in a JWKS
+        // array can't flip this key's sig/enc classification.
+        const obj = enclosingObject(content, m.index);
+        let overrides;
+        if (rule.meta.id === "jwk-rsa" && isSigningUse(obj, RSA_SIG_ALG)) {
+          overrides = {
+            category: "signature" as const,
+            hndl: false,
+            message:
+              "RSA JSON Web Key (JWK) used for signing (RS*/PS*); forgeable by a quantum attacker.",
+          };
+        } else if (rule.meta.id === "jwk-ec" && isSigningUse(obj, EC_SIG_ALG)) {
+          overrides = {
+            category: "signature" as const,
+            algorithm: "ECDSA" as const,
+            hndl: false,
+            message:
+              "Elliptic-curve JSON Web Key (JWK) used for ECDSA signing; forgeable by a quantum attacker.",
+          };
+        }
+        findings.push(findingFromRule(rule.meta, at, overrides));
       });
     }
     return findings;

package/src/detectors/k8s.ts

@@ -12,7 +12,7 @@
  *    traffic, whose (EC)DHE key exchange is classical and harvestable.
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
-import { eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { eachMatch, findingFromRule, hasExtension, maskCommentLines } from "../detect-utils.js";
 import { CWE_BROKEN_CRYPTO, CWE_RISKY_PRIMITIVE } from "../cwe.js";
 
 const K8S_EXTENSIONS: readonly string[] = [".yaml", ".yml", ".json"];
@@ -94,9 +94,12 @@ export const k8sDetector: Detector = {
     const isIstio = content.includes("minProtocolVersion");
     if (!isCertManager && !isIstio) return [];
 
+    // A `# algorithm: RSA` YAML comment is not an active setting; match over
+    // comment-masked content (offsets preserved).
+    const scan = maskCommentLines(content, ["#"]);
     const findings: Finding[] = [];
     const add = (re: RegExp, rule: RuleMeta) =>
-      eachMatch(re, content, (m) =>
+      eachMatch(re, scan, (m) =>
         findings.push(
           findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
         ),

package/src/detectors/keystore.ts

@@ -0,0 +1,109 @@
+/**
+ * Config detector: classical cryptographic KEYSTORES committed to a repository —
+ * Java KeyStore (JKS), JCEKS, PKCS#12 (.p12/.pfx), and BouncyCastle (.bks). These
+ * binary containers hold private keys and certificate chains, essentially always
+ * classical (RSA / EC / DSA). A keystore in version control is committed key
+ * material: harvest-now-decrypt-later exposed and retroactively un-fixable.
+ *
+ * The scan pipeline reads these extensions byte-preserving (latin1; see
+ * {@link ../walk.ts isKeystorePath} and scan.ts), so `content.charCodeAt(i)` is the
+ * i-th file byte and we can identify the container by its magic number. We do NOT
+ * parse the enclosed key algorithm (that needs full ASN.1 / proprietary parsing);
+ * flagging the presence of a classical keystore is the actionable signal.
+ *
+ * The match is sensitive key material, so reporters drop the (binary) snippet.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_HARDCODED_KEY } from "../cwe.js";
+
+const KEYSTORE_EXTENSIONS: readonly string[] = [
+  ".jks",
+  ".keystore",
+  ".jceks",
+  ".bks",
+  ".p12",
+  ".pfx",
+];
+
+function baseRule(id: string, title: string, message: string): RuleMeta {
+  return {
+    id,
+    title,
+    description: message,
+    category: "certificate",
+    severity: "high",
+    confidence: "high",
+    hndl: true,
+    cwe: CWE_HARDCODED_KEY,
+    sensitive: true,
+    message,
+    remediation:
+      "Remove key material from version control and rotate it; store keys in a secret manager / HSM. Plan re-issuance with PQC keys (ML-DSA-65 / ML-KEM-768) as tooling supports it.",
+  };
+}
+
+const RULE_JKS = baseRule(
+  "keystore-jks",
+  "Java KeyStore (JKS)",
+  "A Java KeyStore (JKS) holds classical private keys / certificates (RSA/EC/DSA); a keystore in version control is committed, harvest-now-decrypt-later exposed key material.",
+);
+const RULE_JCEKS = baseRule(
+  "keystore-jceks",
+  "Java JCEKS keystore",
+  "A JCEKS keystore holds classical key material (RSA/EC/DSA); committed to version control it is harvest-now-decrypt-later exposed.",
+);
+const RULE_PKCS12 = baseRule(
+  "keystore-pkcs12",
+  "PKCS#12 keystore",
+  "A PKCS#12 container (a `.p12`/`.pfx`, or a modern `.jks`/`.keystore` — keytool writes PKCS#12 by default since Java 9) holds classical private keys / certificate chains (RSA/EC); committed to version control it is harvest-now-decrypt-later exposed.",
+);
+const RULE_BKS = baseRule(
+  "keystore-bks",
+  "BouncyCastle keystore (.bks)",
+  "A BouncyCastle (.bks) keystore holds classical key material; committed to version control it is harvest-now-decrypt-later exposed.",
+);
+
+/** Bytes-equal check against `content` read as latin1 (charCodeAt == file byte). */
+function magic(content: string, ...bytes: number[]): boolean {
+  if (content.length < bytes.length) return false;
+  for (let i = 0; i < bytes.length; i++) {
+    if (content.charCodeAt(i) !== bytes[i]) return false;
+  }
+  return true;
+}
+
+/** Detects committed classical keystores by magic number / extension. */
+export const keystoreDetector: Detector = {
+  id: "keystore-material",
+  description: "Committed classical cryptographic keystores (JKS, JCEKS, PKCS#12, BKS)",
+  scope: "config",
+  language: "any",
+  rules: [RULE_JKS, RULE_JCEKS, RULE_PKCS12, RULE_BKS],
+  appliesTo: (f) => hasExtension(f, KEYSTORE_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const at = { file, content, index: 0, matchLength: 4 };
+    // JKS: 0xFEEDFEED. JCEKS: 0xCECECECE.
+    if (magic(content, 0xfe, 0xed, 0xfe, 0xed)) return [findingFromRule(RULE_JKS, at)];
+    if (magic(content, 0xce, 0xce, 0xce, 0xce)) return [findingFromRule(RULE_JCEKS, at)];
+    // PKCS#12 is a DER SEQUENCE. Since Java 9, `keytool` writes PKCS#12 BY DEFAULT
+    // even for files named `.jks`/`.keystore` (and Android release keystores are
+    // PKCS#12), so this runs for ANY keystore extension once the JKS/JCEKS magics
+    // fail. Accept the long-form length octets 0x81/0x82/0x83 (real PKCS#12 is
+    // always >127 bytes, so short-form would be a false positive).
+    if (content.length >= 2 && content.charCodeAt(0) === 0x30) {
+      const lenOctet = content.charCodeAt(1);
+      // Long-form DER length (0x81/0x82/0x83) or BER indefinite length (0x80, emitted
+      // by NSS/Firefox .p12 exports). Short-form is excluded (real PKCS#12 is >127 B).
+      if (lenOctet === 0x80 || lenOctet === 0x81 || lenOctet === 0x82 || lenOctet === 0x83) {
+        return [findingFromRule(RULE_PKCS12, { ...at, matchLength: 2 })];
+      }
+    }
+    // BouncyCastle keystores have no stable magic; key off the extension, but
+    // require some content so an empty `.bks` placeholder does not fire.
+    if (file.toLowerCase().endsWith(".bks") && content.length > 0) {
+      return [findingFromRule(RULE_BKS, { ...at, matchLength: 1 })];
+    }
+    return [];
+  },
+};

package/src/detectors/mesh.ts

@@ -18,17 +18,19 @@
  *  - HashiCorp Consul Connect: the `connect { ca_config { private_key_type =
  *    "ec" | "rsa" } } }` mesh CA provider setting (also `ca_provider`). Flagged
  *    as a classical mesh CA (certificate; ECDSA for "ec", RSA for "rsa").
- *  - Istio `DestinationRule` / `Gateway` `tls.cipherSuites:` listing a classical
- *    `ECDHE-RSA-*` / `ECDHE-ECDSA-*` suite — the (EC)DHE key exchange in these
- *    suites is classical and harvest-now-decrypt-later exposed (tls, ECDH,
- *    hndl:true). This complements, and does not duplicate, `k8s.ts`'s
- *    `minProtocolVersion` legacy-TLS-floor rule.
+ * Istio `tls.cipherSuites:` `ECDHE-RSA-*` / `ECDHE-ECDSA-*` suites are NOT handled
+ * here — the language-agnostic `tls-classical-kex` token rule in `source.ts`
+ * already flags those cipher strings in any config file, so a rule here would
+ * double-count.
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
-import { eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
-import { CWE_BROKEN_CRYPTO, CWE_RISKY_PRIMITIVE } from "../cwe.js";
+import { eachMatch, findingFromRule, hasExtension, maskCommentLines } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
 
-const MESH_EXTENSIONS: readonly string[] = [".yaml", ".yml", ".hcl"];
+// `.json` is included because Consul agent config is commonly JSON (the
+// `private_key_type` rules already support the JSON `:` form); the content gates
+// keep unrelated generic JSON/YAML out.
+const MESH_EXTENSIONS: readonly string[] = [".yaml", ".yml", ".hcl", ".json"];
 
 // Linkerd's default self-managed identity scheme (`linkerd.io/tls`, as opposed
 // to a `kubernetes.io/tls` bring-your-own-cert secret) mints its trust anchor
@@ -45,11 +47,6 @@ const RE_MESH_LINKERD_ECDSA =
 const RE_MESH_CONSUL_RSA = /(?<![\w"-])"?private_key_type"?\s*[:=]\s*"rsa"/gi;
 const RE_MESH_CONSUL_EC = /(?<![\w"-])"?private_key_type"?\s*[:=]\s*"ec"/gi;
 
-// Istio mesh TLS cipher suites: OpenSSL-style suite names naming classical
-// ECDHE key exchange combined with an RSA or ECDSA certificate. These are
-// distinctive tokens (no generic-config collision risk).
-const RE_MESH_ISTIO_CLASSICAL_CIPHER = /\bECDHE-(?:RSA|ECDSA)-[A-Z0-9_-]+\b/g;
-
 const RULE_MESH_LINKERD_ECDSA: RuleMeta = {
   id: "mesh-linkerd-identity-ecdsa",
   title: "Linkerd ECDSA identity issuer",
@@ -94,51 +91,31 @@ const RULE_MESH_CONSUL_EC: RuleMeta = {
     "Consul Connect's mesh CA issues leaf certificates from a classical EC private key, forgeable by a quantum attacker.",
   remediation: "Plan migration to ML-DSA-65 (FIPS 204) as the Connect CA provider adds support.",
 };
-const RULE_MESH_ISTIO_CLASSICAL_CIPHER: RuleMeta = {
-  id: "mesh-istio-classical-cipher",
-  title: "Istio classical ECDHE cipher suite",
-  description:
-    "Istio DestinationRule/Gateway tls.cipherSuites lists a classical ECDHE-RSA/ECDHE-ECDSA suite",
-  category: "tls",
-  severity: "medium",
-  confidence: "high",
-  algorithm: "ECDH",
-  hndl: true,
-  cwe: CWE_RISKY_PRIMITIVE,
-  message:
-    "Istio mesh TLS cipher suite allows classical ECDHE key exchange, which is harvest-now-decrypt-later exposed.",
-  remediation:
-    "Prefer TLS 1.3 AEAD suites and track PQC-hybrid mesh key exchange (X25519MLKEM768) as Envoy/BoringSSL adds support.",
-};
-
 /**
  * Detects classical asymmetric crypto in service-mesh configuration: Linkerd's
- * default ECDSA identity issuer, Consul Connect's mesh CA private key type,
- * and classical ECDHE cipher suites in Istio DestinationRule/Gateway TLS
- * policy.
+ * default ECDSA identity issuer and Consul Connect's mesh CA private key type.
+ * (Istio ECDHE cipher-suite strings are covered by `source.ts`'s
+ * `tls-classical-kex` token rule, so they are not duplicated here.)
  */
 export const meshDetector: Detector = {
   id: "service-mesh-crypto",
-  description:
-    "Classical crypto in service-mesh config (Linkerd identity, Consul Connect CA, Istio cipher suites)",
+  description: "Classical crypto in service-mesh config (Linkerd identity, Consul Connect CA)",
   scope: "config",
   language: "any",
-  rules: [
-    RULE_MESH_LINKERD_ECDSA,
-    RULE_MESH_CONSUL_RSA,
-    RULE_MESH_CONSUL_EC,
-    RULE_MESH_ISTIO_CLASSICAL_CIPHER,
-  ],
+  rules: [RULE_MESH_LINKERD_ECDSA, RULE_MESH_CONSUL_RSA, RULE_MESH_CONSUL_EC],
   appliesTo: (f) => hasExtension(f, MESH_EXTENSIONS),
   detect({ file, content }): Finding[] {
     const isLinkerd = content.includes("linkerd") || content.includes("identityTrustAnchors");
     const isConsulConnect = content.includes("consul") && content.includes("connect");
-    const isIstioCipher = content.includes("DestinationRule") || content.includes("cipherSuites");
-    if (!isLinkerd && !isConsulConnect && !isIstioCipher) return [];
+    if (!isLinkerd && !isConsulConnect) return [];
 
+    // Mask whole comment lines (YAML/HCL `#`, HCL/JSON5 `//`) so a commented-out
+    // directive can't fire — `.yaml`/`.hcl`/`.json` are not centrally stripped.
+    // Offsets are preserved, so the finding location stays exact.
+    const scan = maskCommentLines(content, ["#", "//"]);
     const findings: Finding[] = [];
     const add = (re: RegExp, rule: RuleMeta) =>
-      eachMatch(re, content, (m) =>
+      eachMatch(re, scan, (m) =>
         findings.push(
           findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
         ),
@@ -148,7 +125,6 @@ export const meshDetector: Detector = {
       add(RE_MESH_CONSUL_RSA, RULE_MESH_CONSUL_RSA);
       add(RE_MESH_CONSUL_EC, RULE_MESH_CONSUL_EC);
     }
-    if (isIstioCipher) add(RE_MESH_ISTIO_CLASSICAL_CIPHER, RULE_MESH_ISTIO_CLASSICAL_CIPHER);
     return findings;
   },
 };

package/src/detectors/messaging.ts

@@ -7,11 +7,11 @@
  * Covered in broker config files (`.properties`, `.conf`, `.cfg`, `.ini`):
  *  - Kafka `ssl.protocol` / `ssl.enabled.protocols = TLSv1 | TLSv1.1` (legacy).
  *  - MQTT/Mosquitto `tls_version tlsv1 | tlsv1.1` (legacy).
- *  - Kafka `ssl.cipher.suites` naming a classical `ECDHE_RSA` / `ECDHE_ECDSA` /
- *    `TLS_RSA` suite — the harvestable key-exchange path.
+ *  - Kafka `ssl.cipher.suites` naming a static-RSA `TLS_RSA_WITH_*` key-transport
+ *    suite (the ECDHE/DHE suites are owned by source.ts's `tls-classical-kex`).
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
-import { eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { eachMatch, findingFromRule, hasExtension, maskCommentLines } from "../detect-utils.js";
 import { CWE_RISKY_PRIMITIVE, CWE_BROKEN_CRYPTO } from "../cwe.js";
 
 const MQ_EXTENSIONS: readonly string[] = [".properties", ".conf", ".cfg", ".ini"];
@@ -25,7 +25,7 @@ const MQ_RULES: MqRule[] = [
   {
     // Match TLSv1 (=1.0) and TLSv1.1 but never TLSv1.2 / TLSv1.3: the negative
     // lookahead stops "TLSv1" from matching the "TLSv1" inside "TLSv1.3".
-    re: /\bssl\.(?:enabled\.)?protocols?\s*=\s*[^\n]*\bTLSv1(?:\.1)?(?![.\d])/gi,
+    re: /\bssl\.(?:enabled\.)?protocols?\s*=\s*[^\n]{0,80}?\bTLSv1(?:\.1)?(?![.\d])/gi,
     meta: {
       id: "mq-kafka-legacy-tls",
       title: "Kafka legacy TLS protocol",
@@ -36,7 +36,7 @@ const MQ_RULES: MqRule[] = [
       hndl: false,
       cwe: CWE_RISKY_PRIMITIVE,
       message:
-        "Kafka broker permits legacy TLS 1.0/1.1; its classical key exchange is weak and harvestable.",
+        "Kafka broker permits legacy TLS 1.0/1.1, an obsolete protocol; require TLS 1.3 (the harvestable classical key exchange is reported separately by the cipher-suite rule).",
       remediation: "Require TLS 1.3 and track PQC-hybrid KEX (X25519MLKEM768).",
     },
   },
@@ -52,24 +52,28 @@ const MQ_RULES: MqRule[] = [
       hndl: false,
       cwe: CWE_RISKY_PRIMITIVE,
       message:
-        "MQTT broker permits legacy TLS 1.0/1.1; its classical key exchange is weak and harvestable.",
+        "MQTT broker permits legacy TLS 1.0/1.1, an obsolete protocol; require TLS 1.3 (the harvestable classical key exchange is reported separately).",
       remediation: "Require TLS 1.3 and track PQC-hybrid KEX for device fleets.",
     },
   },
   {
-    re: /\bssl\.cipher\.suites\s*=\s*[^\n]*(?:ECDHE_RSA|ECDHE_ECDSA|TLS_RSA|_DHE_RSA)/g,
+    // Only static-RSA key transport (`TLS_RSA_WITH_…`) is flagged here: the ECDHE /
+    // DHE suites are owned by source.ts's language-agnostic `tls-classical-kex` token
+    // rule (which fires on `.properties` too), so flagging them here would double-count.
+    re: /\bssl\.cipher\.suites\s*=\s*[^\n]{0,200}?\bTLS_RSA_WITH_/g,
     meta: {
-      id: "mq-classical-cipher",
-      title: "Broker classical (EC)DHE cipher suite",
-      description: "Kafka ssl.cipher.suites names a classical ECDHE/DHE/RSA suite",
-      category: "tls",
+      id: "mq-rsa-key-transport",
+      title: "Broker static-RSA key transport cipher",
+      description:
+        "Kafka ssl.cipher.suites names a static-RSA (TLS_RSA_WITH_*) key-transport suite",
+      category: "kem",
+      algorithm: "RSA",
       severity: "medium",
       confidence: "high",
-      algorithm: "ECDH",
       hndl: true,
       cwe: CWE_BROKEN_CRYPTO,
       message:
-        "Broker TLS is pinned to a classical (EC)DHE/RSA cipher suite; the key exchange is harvest-now-decrypt-later exposed.",
+        "Broker TLS is pinned to a static-RSA (TLS_RSA_WITH_*) key-transport suite; the wrapped session key is harvest-now-decrypt-later exposed (and it has no forward secrecy).",
       remediation:
         "Move to TLS 1.3 with a PQC-hybrid group (X25519MLKEM768) once the broker/runtime supports it.",
     },
@@ -86,8 +90,12 @@ export const messagingDetector: Detector = {
   appliesTo: (f) => hasExtension(f, MQ_EXTENSIONS),
   detect({ file, content }): Finding[] {
     const findings: Finding[] = [];
+    // Broker config files ship large commented-out example blocks; a commented
+    // directive is not active. Match over comment-masked content (offsets preserved,
+    // so the snippet from the original `content` is still correct).
+    const scan = maskCommentLines(content, ["#", "!", ";"]);
     for (const rule of MQ_RULES) {
-      eachMatch(rule.re, content, (m) => {
+      eachMatch(rule.re, scan, (m) => {
         findings.push(
           findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }),
         );