@quantakrypto/core 0.4.4 → 0.5.0

package/src/detectors/objc.ts

@@ -0,0 +1,209 @@
+/**
+ * Source detector for classical asymmetric cryptography in Objective-C on Apple
+ * platforms (iOS / macOS / tvOS / watchOS), via the Security framework's
+ * `SecKey*` API (and, underneath it, CommonCrypto). This is the Objective-C
+ * sibling of the Swift pack: the same Security-framework surface, reached from
+ * `.m` / `.mm` translation units instead of `.swift`. Lexical, same strategy as
+ * the other language packs — the Security-framework identifiers
+ * (`kSecAttrKeyType*`, `kSecKeyAlgorithm*`) are distinctive enough to keep the
+ * false-positive risk low.
+ *
+ * WHY a dedicated Objective-C pack (and not the C/C++ pack):
+ *  - The C/C++ pack (`c.ts`) matches OpenSSL / libsodium / Mbed TLS / wolfSSL
+ *    symbols and is gated to `.c/.h/.cc/.cpp/...` (which INCLUDES `.h`). Apple's
+ *    Security framework is a different API surface entirely, so a separate pack
+ *    is the clean home for it.
+ *  - Objective-C headers are `.h` — shared with C/C++. To avoid double-scanning
+ *    a header the C pack already owns, this detector is gated to `.m` and `.mm`
+ *    ONLY (implementation files). Declarations of `SecKey*` usage live in the
+ *    implementation, not the interface, so no real coverage is lost.
+ *
+ * Security-framework surface mapped here:
+ *  - Key generation attributes (`SecKeyCreateRandomKey` / `SecKeyGeneratePair`):
+ *      `kSecAttrKeyTypeRSA`                         → RSA keygen (kem, hndl:true)
+ *      `kSecAttrKeyTypeEC` / `…ECSECPrimeRandom`    → EC keygen (ECDSA, signature,
+ *                                                     hndl:false — EC keys default
+ *                                                     to signing; conservative)
+ *  - Signing / verifying (`SecKeyCreateSignature` / `SecKeyVerifySignature`):
+ *      `kSecKeyAlgorithmRSASignature*`              → RSA signature (hndl:false)
+ *      `kSecKeyAlgorithmECDSASignature*`            → ECDSA signature (hndl:false)
+ *  - Encryption / key agreement (`SecKeyCreateEncryptedData` / `SecKeyCopyKeyExchangeResult`):
+ *      `kSecKeyAlgorithmRSAEncryption*`             → RSA encryption (kem, hndl:true)
+ *      `kSecKeyAlgorithmECDHKeyExchange*`           → ECDH key agreement (hndl:true)
+ *
+ * Comment suppression is handled inline here (Objective-C is a C-style comment
+ * language): C-style block comments and `//` line comments are masked before the
+ * regexes run, so commented-out crypto never fires.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import {
+  eachMatch,
+  findingFromRule,
+  hasExtension,
+  maskBlockComments,
+  maskCommentLines,
+  OBJC_EXTENSIONS,
+} from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+// Security-framework key-type attributes (used with SecKeyCreateRandomKey /
+// SecKeyGeneratePair). RSA vs EC. The EC form covers both the modern
+// `kSecAttrKeyTypeECSECPrimeRandom` and the legacy `kSecAttrKeyTypeEC` alias.
+const RE_OBJC_SEC_RSA = /\bkSecAttrKeyTypeRSA\b/g;
+const RE_OBJC_SEC_EC = /\bkSecAttrKeyType(?:ECSECPrimeRandom|EC)\b/g;
+// SecKey algorithm constants for signing / encryption / key agreement. The `\w*`
+// tail captures the full family suffix (…PKCS1v15SHA256, …OAEPSHA256, …Standard,
+// …CofactorX963SHA256, …) without needing to enumerate every variant.
+const RE_OBJC_RSA_SIGN = /\bkSecKeyAlgorithmRSASignature\w*/g;
+const RE_OBJC_RSA_ENCRYPT = /\bkSecKeyAlgorithmRSAEncryption\w*/g;
+const RE_OBJC_ECDSA_SIGN = /\bkSecKeyAlgorithmECDSASignature\w*/g;
+const RE_OBJC_ECDH = /\bkSecKeyAlgorithmECDHKeyExchange\w*/g;
+
+const RULE_OBJC_SEC_RSA: RuleMeta = {
+  id: "objc-seckey-rsa",
+  title: "Objective-C Security-framework RSA key",
+  description: "SecKeyCreateRandomKey / SecKeyGeneratePair with kSecAttrKeyTypeRSA",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Security-framework RSA key (Objective-C) is classical and not quantum-safe.",
+  remediation:
+    "Migrate to PQC as Apple's CryptoKit / Security add support: ML-KEM for encryption/key-agreement, ML-DSA for signatures.",
+};
+const RULE_OBJC_SEC_EC: RuleMeta = {
+  id: "objc-seckey-ec",
+  title: "Objective-C Security-framework EC key",
+  description: "SecKeyCreateRandomKey / SecKeyGeneratePair with kSecAttrKeyTypeECSECPrimeRandom",
+  // An EC key at generation is AMBIGUOUS (it can feed ECDSA signing OR ECDH key
+  // agreement). The fleet convention (java-ec-keygen, python-ec-keygen, swift-sec-ec,
+  // cloud-kms-ec, …) classifies ambiguous EC keygen as key-exchange/ECDH/hndl:true —
+  // the HNDL-SAFE choice, so a possible key-agreement use is never under-reported.
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Security-framework EC key (Objective-C); EC keys feed ECDH key agreement (harvest-now-decrypt-later exposed) as well as ECDSA signatures, and are not quantum-safe.",
+  remediation:
+    "Migrate to PQC as Apple's CryptoKit / Security add support: ML-KEM for the ECDH key-agreement path, ML-DSA for signatures.",
+};
+const RULE_OBJC_RSA_SIGN: RuleMeta = {
+  id: "objc-rsa-sign",
+  title: "Objective-C RSA signature",
+  description: "SecKeyCreateSignature / SecKeyVerifySignature with kSecKeyAlgorithmRSASignature*",
+  category: "signature",
+  // `high`, consistent with every sibling pack's signature severity (swift-rsa,
+  // go-rsa-sign, java-rsa-sign) — the same primitive must not flip CI exit codes
+  // based on which language wrote it.
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Classical RSA signing (Objective-C, Security framework) is forgeable by a quantum attacker.",
+  remediation: "Migrate to ML-DSA (FIPS 204) as Apple's CryptoKit / Security add PQC support.",
+};
+const RULE_OBJC_RSA_ENCRYPT: RuleMeta = {
+  id: "objc-rsa-encrypt",
+  title: "Objective-C RSA encryption",
+  description: "SecKeyCreateEncryptedData with kSecKeyAlgorithmRSAEncryption*",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Classical RSA encryption (Objective-C, Security framework) is harvest-now-decrypt-later exposed.",
+  remediation: "Migrate to ML-KEM (FIPS 203) as Apple's CryptoKit / Security add PQC support.",
+};
+const RULE_OBJC_ECDSA_SIGN: RuleMeta = {
+  id: "objc-ecdsa-sign",
+  title: "Objective-C ECDSA signature",
+  description: "SecKeyCreateSignature / SecKeyVerifySignature with kSecKeyAlgorithmECDSASignature*",
+  category: "signature",
+  // `high`, consistent with swift-ecdsa / go-ecdsa / java-ecdsa-sign / dart-ecdsa.
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Classical ECDSA signing (Objective-C, Security framework) is forgeable by a quantum attacker.",
+  remediation: "Migrate to ML-DSA (FIPS 204) as Apple's CryptoKit / Security add PQC support.",
+};
+const RULE_OBJC_ECDH: RuleMeta = {
+  id: "objc-ecdh",
+  title: "Objective-C ECDH key agreement",
+  description: "SecKeyCopyKeyExchangeResult with kSecKeyAlgorithmECDHKeyExchange*",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Elliptic-curve Diffie-Hellman (Objective-C, Security framework) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+  remediation:
+    "Migrate key agreement to ML-KEM (FIPS 203) as Apple's CryptoKit / Security add PQC support.",
+};
+
+/** Detects classical asymmetric crypto in Objective-C (Apple Security framework). */
+export const objcDetector: Detector = {
+  id: "objc-crypto",
+  description: "Classical asymmetric crypto in Objective-C (Apple Security framework / SecKey)",
+  scope: "source",
+  language: "objc",
+  rules: [
+    RULE_OBJC_SEC_RSA,
+    RULE_OBJC_SEC_EC,
+    RULE_OBJC_RSA_SIGN,
+    RULE_OBJC_RSA_ENCRYPT,
+    RULE_OBJC_ECDSA_SIGN,
+    RULE_OBJC_ECDH,
+  ],
+  appliesTo: (f) => hasExtension(f, OBJC_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    // Fast reject: none of the Security-framework surface can appear without one
+    // of these substrings, so most Objective-C files bail before any regex runs.
+    if (
+      !content.includes("SecKey") &&
+      !content.includes("kSecAttrKeyType") &&
+      !content.includes("kSecKeyAlgorithm")
+    ) {
+      return [];
+    }
+    // Mask C-style block comments then `//` line comments so commented-out crypto
+    // does not fire. Both maskers preserve byte offsets, so finding line/column
+    // stay exact.
+    const masked = maskCommentLines(maskBlockComments(content), ["//"]);
+
+    const findings: Finding[] = [];
+    // Scan the masked text, but build the finding (its snippet) from the ORIGINAL
+    // `content` so a line with a trailing comment renders live, not blanked.
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, masked, (m) =>
+        findings.push(
+          findingFromRule(rule, {
+            file,
+            content,
+            index: m.index,
+            matchLength: m[0].length,
+          }),
+        ),
+      );
+    add(RE_OBJC_SEC_RSA, RULE_OBJC_SEC_RSA);
+    add(RE_OBJC_SEC_EC, RULE_OBJC_SEC_EC);
+    add(RE_OBJC_RSA_SIGN, RULE_OBJC_RSA_SIGN);
+    add(RE_OBJC_RSA_ENCRYPT, RULE_OBJC_RSA_ENCRYPT);
+    add(RE_OBJC_ECDSA_SIGN, RULE_OBJC_ECDSA_SIGN);
+    add(RE_OBJC_ECDH, RULE_OBJC_ECDH);
+    return findings;
+  },
+};

package/src/detectors/openpgp.ts

@@ -0,0 +1,194 @@
+/**
+ * Config detector: BINARY OpenPGP key material and encrypted messages committed to
+ * a repository — `secring.gpg` / `pubring.gpg` / `.gpg` / `.pgp` / `.kbx`. Armored
+ * blocks (`-----BEGIN PGP …-----`, base64 text) are handled by the PEM/secrets
+ * detectors; this covers the BINARY packet form, which the scan pipeline now reads
+ * byte-preserving (latin1; see {@link ../walk.ts isKeystorePath}) so we can read
+ * packet tags and the public-key algorithm id.
+ *
+ * A committed OpenPGP SECRET key is the sharp finding: a classical private key
+ * (RSA/DSA/ElGamal/ECDSA/EdDSA/ECDH) in version control is exposed and
+ * retroactively un-fixable. A binary PGP-encrypted message (PKESK) is
+ * harvest-now-decrypt-later exposed. Secret-key matches are sensitive material, so
+ * reporters drop the (binary) snippet.
+ *
+ * Packet framing per RFC 4880/9580. The parser is pure and bounds-checked (fuzzed).
+ */
+import type { AlgorithmFamily, Detector, Finding, RuleMeta } from "../types.js";
+import { findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_HARDCODED_KEY, CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+const OPENPGP_EXTENSIONS: readonly string[] = [".gpg", ".pgp"];
+
+// Packet tags we care about.
+const TAG_PKESK = 1; // public-key encrypted session key (an encrypted message)
+const TAG_SECRET_KEY = 5;
+const TAG_PUBLIC_KEY = 6;
+const TAG_SECRET_SUBKEY = 7;
+const TAG_PUBLIC_SUBKEY = 14;
+
+interface Packet {
+  tag: number;
+  /** Offset where the packet body begins (after the length octets). */
+  bodyOffset: number;
+}
+
+/** Parse the FIRST OpenPGP packet header; return its tag and body offset. */
+function firstPacket(content: string): Packet | undefined {
+  if (content.length < 2) return undefined;
+  const b0 = content.charCodeAt(0);
+  if ((b0 & 0x80) === 0) return undefined; // high bit always set on a packet tag
+  if (b0 & 0x40) {
+    // New-format packet: tag is the low 6 bits; length octet(s) follow.
+    const tag = b0 & 0x3f;
+    const l = content.charCodeAt(1);
+    let bodyOffset: number;
+    if (l < 192) bodyOffset = 2;
+    else if (l < 224) bodyOffset = 3;
+    else if (l === 255) bodyOffset = 6;
+    else bodyOffset = 2; // partial-body length
+    return { tag, bodyOffset };
+  }
+  // Old-format packet: tag in bits 5-2; length-type in the low 2 bits.
+  const tag = (b0 >> 2) & 0x0f;
+  const lt = b0 & 0x03;
+  const bodyOffset = lt === 0 ? 2 : lt === 1 ? 3 : lt === 2 ? 5 : 1;
+  return { tag, bodyOffset };
+}
+
+/** Map an OpenPGP public-key algorithm id to a family + HNDL (confidentiality) flag. */
+function algo(id: number): { family: AlgorithmFamily; hndl: boolean } | undefined {
+  switch (id) {
+    case 1:
+    case 2:
+    case 3:
+      return { family: "RSA", hndl: true }; // RSA (encrypt-capable)
+    case 16:
+    case 20:
+      return { family: "unknown", hndl: true }; // ElGamal (encrypt)
+    case 17:
+      return { family: "DSA", hndl: false }; // DSA (sign only)
+    case 18:
+      return { family: "ECDH", hndl: true }; // ECDH (encrypt)
+    case 19:
+      return { family: "ECDSA", hndl: false }; // ECDSA (sign only)
+    case 22:
+      return { family: "EdDSA", hndl: false }; // EdDSA (sign only)
+    // RFC 9580 (crypto-refresh) v6 algorithm ids.
+    case 25:
+      return { family: "X25519", hndl: true }; // X25519 (encrypt / key agreement)
+    case 26:
+      return { family: "X448", hndl: true }; // X448 (encrypt / key agreement)
+    case 27:
+      return { family: "EdDSA", hndl: false }; // Ed25519 (sign only)
+    case 28:
+      return { family: "EdDSA", hndl: false }; // Ed448 (sign only)
+    default:
+      return undefined;
+  }
+}
+
+/** Read the public-key algorithm id from a key packet body, or undefined. */
+function keyPacketAlgo(content: string, bodyOffset: number): number | undefined {
+  if (bodyOffset >= content.length) return undefined;
+  const version = content.charCodeAt(bodyOffset);
+  // v2/v3: version(1) created(4) validity(2) algo; v4/v5/v6: version(1) created(4) algo.
+  const algoOffset = version === 2 || version === 3 ? bodyOffset + 7 : bodyOffset + 5;
+  if (algoOffset >= content.length) return undefined;
+  return content.charCodeAt(algoOffset);
+}
+
+/** Read the wrapping algorithm from a PKESK (encrypted-message) packet body. */
+function pkeskAlgo(content: string, bodyOffset: number): number | undefined {
+  if (bodyOffset >= content.length) return undefined;
+  const version = content.charCodeAt(bodyOffset);
+  // v3: version(1) keyid(8) algo. (v6 differs; v3 dominates on-disk.)
+  if (version !== 3) return undefined;
+  const algoOffset = bodyOffset + 9;
+  if (algoOffset >= content.length) return undefined;
+  return content.charCodeAt(algoOffset);
+}
+
+function rule(id: string, title: string, message: string, opts: Partial<RuleMeta>): RuleMeta {
+  return {
+    id,
+    title,
+    description: message,
+    category: "certificate",
+    severity: "high",
+    confidence: "high",
+    hndl: false,
+    cwe: CWE_HARDCODED_KEY,
+    message,
+    remediation:
+      "Remove key material from version control and rotate it; store keys in a secret manager / HSM. Plan re-issuance with PQC keys (ML-DSA-65 / ML-KEM-768) as OpenPGP tooling supports them.",
+    ...opts,
+  };
+}
+
+const RULE_SECRET = rule(
+  "openpgp-secret-key",
+  "OpenPGP secret key (binary)",
+  "A binary OpenPGP SECRET key is committed to version control — a classical private key that is exposed and retroactively un-fixable.",
+  { sensitive: true },
+);
+const RULE_PUBLIC = rule(
+  "openpgp-public-key",
+  "OpenPGP public key (binary)",
+  "A binary OpenPGP public key uses classical asymmetric crypto (RSA/DSA/EC); plan a PQC migration path.",
+  { severity: "medium" },
+);
+const RULE_PKESK = rule(
+  "openpgp-encrypted-message",
+  "OpenPGP-encrypted message (binary)",
+  "A binary OpenPGP-encrypted message wraps its session key with classical asymmetric crypto (RSA/ElGamal/ECDH); harvest-now-decrypt-later exposed.",
+  { category: "kem", hndl: true, cwe: CWE_BROKEN_CRYPTO },
+);
+const RULE_KEYBOX = rule(
+  "openpgp-keybox",
+  "GnuPG keybox (.kbx)",
+  "A GnuPG keybox (.kbx) is a database of classical OpenPGP/X.509 keys and certificates.",
+  { severity: "medium", cwe: CWE_BROKEN_CRYPTO },
+);
+
+/** Detects binary OpenPGP key material / messages and GnuPG keyboxes. */
+export const openpgpDetector: Detector = {
+  id: "openpgp-material",
+  description: "Binary OpenPGP key material / encrypted messages and GnuPG keyboxes",
+  scope: "config",
+  language: "any",
+  rules: [RULE_SECRET, RULE_PUBLIC, RULE_PKESK, RULE_KEYBOX],
+  appliesTo: (f) => hasExtension(f, OPENPGP_EXTENSIONS) || f.toLowerCase().endsWith(".kbx"),
+  detect({ file, content }): Finding[] {
+    const at = { file, content, index: 0, matchLength: Math.min(4, content.length) };
+
+    // GnuPG keybox: a key/cert database, identified by the "KBXf" magic in its
+    // first blob header (so a garbage/empty .kbx does not fire).
+    if (file.toLowerCase().endsWith(".kbx")) {
+      return content.includes("KBXf") ? [findingFromRule(RULE_KEYBOX, at)] : [];
+    }
+
+    const pkt = firstPacket(content);
+    if (!pkt) return [];
+    const { tag, bodyOffset } = pkt;
+
+    if (tag === TAG_SECRET_KEY || tag === TAG_SECRET_SUBKEY) {
+      const id = keyPacketAlgo(content, bodyOffset);
+      const a = id !== undefined ? algo(id) : undefined;
+      return [
+        findingFromRule(RULE_SECRET, at, a ? { algorithm: a.family, hndl: a.hndl } : undefined),
+      ];
+    }
+    if (tag === TAG_PUBLIC_KEY || tag === TAG_PUBLIC_SUBKEY) {
+      const id = keyPacketAlgo(content, bodyOffset);
+      const a = id !== undefined ? algo(id) : undefined;
+      return [findingFromRule(RULE_PUBLIC, at, a ? { algorithm: a.family } : undefined)];
+    }
+    if (tag === TAG_PKESK) {
+      const id = pkeskAlgo(content, bodyOffset);
+      const a = id !== undefined ? algo(id) : undefined;
+      return [findingFromRule(RULE_PKESK, at, a ? { algorithm: a.family } : undefined)];
+    }
+    return [];
+  },
+};

package/src/detectors/pem.ts

@@ -211,6 +211,31 @@ const PEM_RULES: PemRule[] = [
   },
 ];
 
+/**
+ * True when what follows the begin marker looks like a REAL PEM block rather than a
+ * `-----BEGIN …-----` header STRING LITERAL (as appears in PEM parsers, tests, and
+ * i18n messages). `from` points just past the begin marker. Three accepting signals:
+ *
+ *  (a) a full LINE of base64 (≥24 chars, optional `=` padding) — real multi-line PEM
+ *      bodies are line-wrapped base64; requiring the whole line to be base64 stops a
+ *      long camelCase identifier on a code line from validating a bare header constant.
+ *  (b) an ESCAPED-newline base64 run (`\n<base64>`, a LITERAL backslash-n) — a key
+ *      embedded in a single-line JSON/.env string (GCP service accounts, `PRIVATE_KEY=
+ *      "…\n…"`), whose body can run past the window before its `-----END`. The literal
+ *      `\n` escape distinguishes it from a source constant, which has a REAL newline.
+ *  (c) a matching `-----END …-----` marker with NO double-quote between it and the
+ *      begin marker. This admits short/placeholder bodies (`x`, `abc`, `MIIB` in tests)
+ *      while rejecting a parser's PAIRED header/footer constants, whose intervening
+ *      `";` … `= "` always contains a `"` — a char a real PEM body never holds.
+ */
+function hasBase64Body(content: string, from: number): boolean {
+  const window = content.slice(from, from + 800);
+  if (/^[ \t]*[A-Za-z0-9+/]{24,}={0,2}[ \t]*$/m.test(window)) return true;
+  if (/\\n[A-Za-z0-9+/]{24,}/.test(window)) return true;
+  const end = window.search(/-----END [A-Z0-9 ]+-----/);
+  return end >= 0 && !window.slice(0, end).includes('"');
+}
+
 /** Detects PEM key/certificate material in arbitrary files. */
 export const pemDetector: Detector = {
   id: "pem-material",
@@ -227,6 +252,11 @@ export const pemDetector: Detector = {
     const findings: Finding[] = [];
     for (const rule of PEM_RULES) {
       eachMatch(rule.re, content, (m) => {
+        // Require an actual base64 body after the marker, so a bare
+        // `-----BEGIN RSA PRIVATE KEY-----` string literal in a PEM parser / test /
+        // i18n message does NOT get reported as an embedded key. A real PEM block has
+        // a run of base64 within the next few hundred chars.
+        if (!hasBase64Body(content, m.index + m[0].length)) return;
         findings.push(
           findingFromRule(rule.meta, {
             file,

package/src/detectors/php.ts

@@ -5,7 +5,8 @@
  *
  *  - **ext/openssl** — `openssl_pkey_new()` (classified by its
  *    `OPENSSL_KEYTYPE_*` config, defaulting to RSA), `openssl_public_encrypt` /
- *    `openssl_private_decrypt` (RSA), and `openssl_sign` / `openssl_verify`.
+ *    `openssl_private_decrypt` / `openssl_seal` / `openssl_open` (RSA), and
+ *    `openssl_sign` / `openssl_verify`.
  *  - **phpseclib3** — `RSA::createKey()` / `EC::createKey()` / `DSA::createKey()`.
  *  - **libsodium** — `sodium_crypto_box`/`kx` keypairs (X25519) and
  *    `sodium_crypto_sign` keypairs (Ed25519).
@@ -23,14 +24,18 @@ import { PHP_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../det
 import { CWE_BROKEN_CRYPTO } from "../cwe.js";
 
 const RE_PHP_PKEY_NEW = /\bopenssl_pkey_new\s*\(/g;
-const RE_PHP_RSA_CRYPT = /\bopenssl_(?:public_encrypt|private_decrypt)\s*\(/g;
+// public_encrypt/private_decrypt (direct RSA) plus seal/open (RSA-envelope: seal
+// encrypts a random symmetric key under each recipient's RSA public key, open
+// decrypts it with the private key) — all RSA key transport, harvest-now exposed.
+const RE_PHP_RSA_CRYPT = /\bopenssl_(?:public_encrypt|private_decrypt|seal|open)\s*\(/g;
 const RE_PHP_SIGN = /\bopenssl_(?:sign|verify)\s*\(/g;
 // phpseclib3 factory methods. The class names are generic, so require `::createKey`.
 const RE_PHP_SECLIB = /\b(RSA|EC|DSA|DH)::createKey\s*\(/g;
 // libsodium X25519 (box / kx / scalarmult) and Ed25519 (sign) key pairs.
 const RE_PHP_SODIUM_X25519 =
   /\bsodium_crypto_(?:box|kx)_(?:seed_)?keypair\s*\(|\bsodium_crypto_scalarmult(?:_base)?\s*\(/g;
-const RE_PHP_SODIUM_ED25519 = /\bsodium_crypto_sign_(?:seed_)?keypair\s*\(/g;
+// Also the explicit-algorithm variant sodium_crypto_sign_ed25519_keypair().
+const RE_PHP_SODIUM_ED25519 = /\bsodium_crypto_sign_(?:ed25519_|seed_)?keypair\s*\(/g;
 
 /** Key-type classification for `openssl_pkey_new`, keyed by its config constant. */
 interface KeyInfo {
@@ -58,7 +63,7 @@ const RULE_PHP_KEYGEN: RuleMeta = {
 const RULE_PHP_RSA_CRYPT: RuleMeta = {
   id: "php-openssl-rsa-crypt",
   title: "PHP openssl RSA public-key encryption",
-  description: "openssl_public_encrypt / openssl_private_decrypt",
+  description: "openssl_public_encrypt / openssl_private_decrypt / openssl_seal / openssl_open",
   category: "kem",
   severity: "high",
   confidence: "high",

package/src/detectors/pkcs11.ts

@@ -0,0 +1,113 @@
+/**
+ * Config detector: classical asymmetric keys held in / generated by a PKCS#11 HSM
+ * or token. HSMs hold an organization's longest-lived roots (CA keys, code-signing
+ * keys), so they are exactly the keys a PQC migration must find first — yet they
+ * live behind a PKCS#11 layer the source packs never see.
+ *
+ * Covered, distinctive lexical surfaces:
+ *  - `pkcs11-tool --keypairgen --key-type rsa:2048 | EC:secp256r1` — the standard
+ *    OpenSC keygen invocation recorded in ops scripts / runbooks.
+ *  - `CKM_RSA_PKCS(_KEY_PAIR_GEN|_OAEP|_PSS)` / `CKM_EC(DSA|DH)` / `CKM_DSA` — the
+ *    PKCS#11 mechanism constants (SoftHSM, SunPKCS11, pkcs11js, python-pkcs11), which
+ *    name the exact algorithm.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+// `pkcs11-tool --keypairgen --key-type rsa:2048` / `EC:secp256r1` (OpenSC).
+const RE_PKCS11_TOOL_RSA = /--key-type\s+rsa:\d+/gi;
+const RE_PKCS11_TOOL_EC = /--key-type\s+EC:[A-Za-z0-9]+/gi;
+// PKCS#11 mechanism constants (CKM_*), which name the algorithm exactly.
+const RE_CKM_RSA = /\bCKM_RSA_(?:PKCS(?:_KEY_PAIR_GEN|_OAEP|_PSS)?|X_509|9796)\b/g;
+const RE_CKM_EC = /\bCKM_EC(?:DSA(?:_SHA\d+)?|DH1?_DERIVE|_KEY_PAIR_GEN)\b/g;
+const RE_CKM_DSA = /\bCKM_DSA(?:_SHA\d+|_KEY_PAIR_GEN)?\b/g;
+const RE_CKM_DH = /\bCKM_DH_PKCS_(?:KEY_PAIR_GEN|DERIVE)\b/g;
+
+const RULE_PKCS11_RSA: RuleMeta = {
+  id: "pkcs11-rsa",
+  title: "PKCS#11 (HSM) RSA key",
+  description: "PKCS#11 RSA key generation / mechanism (pkcs11-tool, CKM_RSA_*)",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "A classical RSA key in a PKCS#11 HSM / token — likely a long-lived root (CA / code-signing), and not quantum-safe.",
+  remediation:
+    "Inventory HSM-held RSA keys first (longest-lived); plan re-keying to PQC (ML-KEM-768 / ML-DSA-65) as HSM firmware adds support.",
+};
+const RULE_PKCS11_EC: RuleMeta = {
+  id: "pkcs11-ec",
+  title: "PKCS#11 (HSM) EC key",
+  description: "PKCS#11 EC key generation / mechanism (CKM_EC*, --key-type EC)",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "A classical EC key in a PKCS#11 HSM / token; EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204). Prioritise HSM-held keys.",
+};
+const RULE_PKCS11_DSA: RuleMeta = {
+  id: "pkcs11-dsa",
+  title: "PKCS#11 (HSM) DSA key",
+  description: "PKCS#11 DSA key generation / mechanism (CKM_DSA*)",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "DSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "A classical DSA key in a PKCS#11 HSM / token — deprecated and quantum-forgeable.",
+  remediation: "Rotate off DSA; migrate to ML-DSA-65 (FIPS 204).",
+};
+const RULE_PKCS11_DH: RuleMeta = {
+  id: "pkcs11-dh",
+  title: "PKCS#11 (HSM) Diffie-Hellman",
+  description: "PKCS#11 finite-field DH key generation / derive (CKM_DH_PKCS_*)",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "DH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Finite-field Diffie-Hellman in a PKCS#11 HSM / token; classical key agreement, harvest-now-decrypt-later exposed.",
+  remediation: "Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768).",
+};
+
+/** Detects classical asymmetric keys behind a PKCS#11 HSM / token. */
+export const pkcs11Detector: Detector = {
+  id: "pkcs11-crypto",
+  description: "Classical asymmetric keys in a PKCS#11 HSM / token",
+  scope: "config",
+  language: "any",
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+  rules: [RULE_PKCS11_RSA, RULE_PKCS11_EC, RULE_PKCS11_DSA, RULE_PKCS11_DH],
+  detect({ file, content }): Finding[] {
+    // Fast reject: only proceed on a distinctive PKCS#11 marker.
+    if (!content.includes("CKM_") && !content.includes("--key-type")) {
+      return [];
+    }
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta): void =>
+      eachMatch(re, content, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    add(RE_PKCS11_TOOL_RSA, RULE_PKCS11_RSA);
+    add(RE_PKCS11_TOOL_EC, RULE_PKCS11_EC);
+    add(RE_CKM_RSA, RULE_PKCS11_RSA);
+    add(RE_CKM_EC, RULE_PKCS11_EC);
+    add(RE_CKM_DSA, RULE_PKCS11_DSA);
+    add(RE_CKM_DH, RULE_PKCS11_DH);
+    return findings;
+  },
+};