@quantakrypto/core 0.4.4 → 0.6.0

package/src/detectors/proxy.ts

@@ -0,0 +1,236 @@
+/**
+ * Config detector: classical-certificate TLS termination in standalone
+ * reverse-proxy / load-balancer configuration and in-code gRPC channel
+ * credentials.
+ *
+ * A standalone Envoy, Nginx, HAProxy, Traefik, or Caddy config that terminates
+ * TLS with an RSA/ECDSA leaf certificate and negotiates an ECDHE key exchange is
+ * the canonical harvest-now-decrypt-later (HNDL) surface: an attacker who
+ * records today's handshake + ciphertext can decrypt it retroactively once a
+ * cryptographically-relevant quantum computer (CRQC) can break the ephemeral
+ * (EC)DHE secret. The Kubernetes / service-mesh detectors (`k8s.ts`, `mesh.ts`)
+ * cover the CLUSTER-managed cert + mesh-mTLS surfaces; the STANDALONE proxy
+ * config FILES and the in-code gRPC credential constructors below are seen by
+ * neither them nor the language packs, so they are covered here.
+ *
+ * Because the config token itself does not name the cert's key algorithm (the
+ * key lives in a referenced PEM file, out of band), these findings use
+ * `algorithm: "unknown"` — the evidence is "a classical-cert TLS channel is
+ * configured HERE", not a specific family. They are `category: "key-exchange"`
+ * (the ECDHE handshake is the harvestable primitive) and `hndl: true`.
+ * Confidence is `medium`: a config-level indicator of a classical TLS channel,
+ * not a matched algorithm string.
+ *
+ * PRECISION / fast-reject: several of the matched tokens (`ssl_certificate`,
+ * `private_key:`, `certificates:`) are generic enough to appear in unrelated
+ * YAML/config, so `detect()` bails unless the file carries a distinctive
+ * proxy/gRPC marker (see `hasProxyMarker`). This keeps a random YAML that merely
+ * has a `private_key:` key, or a Traefik-shaped `certificates:` list that isn't
+ * a Traefik config, from firing. Comments are masked (YAML/nginx/HCL `#`, plus
+ * `//` and C-style `/* … *\/` blocks) so a commented-out directive can't fire.
+ *
+ * Covered surfaces:
+ *  - Envoy   — `common_tls_context:` / `DownstreamTlsContext` /
+ *              `UpstreamTlsContext` with `tls_certificates:` carrying a
+ *              `certificate_chain:` + `private_key:` (and the
+ *              `envoy.transport_sockets.tls` transport socket).
+ *  - Nginx   — `ssl_certificate` + `ssl_certificate_key` directives.
+ *  - HAProxy — `bind … ssl crt …` lines and `crt-store` sections.
+ *  - Traefik — a `tls:` block's `certificates:` with `certFile:` + `keyFile:`
+ *              (dynamic config) or a `certResolver` (ACME) reference.
+ *  - gRPC    — in-code TLS channel credentials: `grpc.ssl_channel_credentials(`
+ *              (Python), `grpc.credentials.createSsl(` (Node),
+ *              `TlsChannelCredentials` (Java), `credentials.NewTLS(` (Go).
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import {
+  DOC_EXTENSIONS,
+  eachMatch,
+  findingFromRule,
+  hasExtension,
+  maskBlockComments,
+  maskCommentLines,
+} from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+// --- Envoy: match ONLY the Envoy-DISTINCTIVE tokens (`common_tls_context:`, the
+// `*TlsContext` type names, `tls_certificates:`, the `envoy.transport_sockets.tls`
+// transport socket). The generic `certificate_chain:` / `private_key:` fields are
+// deliberately NOT matched here — they appear in unrelated YAML and would
+// cross-label a non-Envoy file as Envoy (audit L2). A distinctive token IS the
+// evidence, so no separate marker gate is needed for this rule (audit L1).
+const RE_ENVOY_TLS =
+  /\b(?:DownstreamTlsContext|UpstreamTlsContext|common_tls_context\s*:|tls_certificates\s*:|envoy\.transport_sockets\.tls)/g;
+
+// --- Nginx: the classic `ssl_certificate` / `ssl_certificate_key` directive
+// pair. `ssl_certificate_key` is matched first-class; `ssl_certificate` requires
+// a following space so it doesn't also swallow `ssl_certificate_key` as a second
+// hit on the same directive (kept as a single rule regardless).
+const RE_NGINX_TLS = /\bssl_certificate(?:_key)?\s+\S/g;
+
+// --- HAProxy: a `bind` line that terminates TLS (`ssl crt <path>`) or a
+// `crt-store` section (HAProxy 2.8+ certificate store). `ssl` and `crt` may be
+// separated by other bind args, so match them independently on a bind context.
+const RE_HAPROXY_TLS =
+  /\bcrt-store\b|\bbind\b[^\n]*\bssl\b[^\n]*\bcrt\b|\bbind\b[^\n]*\bcrt\b[^\n]*\bssl\b/g;
+
+// --- Traefik: dynamic-config TLS certificate entries (`certFile:` + `keyFile:`)
+// or an ACME `certResolver` reference. `certFile`/`keyFile` are Traefik-specific
+// enough (paired with the `certResolver`/`tls:` marker gate) to anchor on.
+const RE_TRAEFIK_TLS = /\bcertResolver\b|\b(?:certFile|keyFile)\s*:/g;
+
+// --- gRPC in-code TLS channel credentials across languages.
+const RE_GRPC_TLS =
+  /grpc\.ssl_channel_credentials\s*\(|grpc\.credentials\.createSsl\s*\(|\bTlsChannelCredentials\b|\bcredentials\.NewTLS\s*\(/g;
+
+const MESSAGE = (proxy: string): string =>
+  `${proxy} terminates TLS with a classical certificate + ECDHE key exchange; the recorded handshake is harvest-now-decrypt-later exposed — verify the cert key algorithm and plan a PQC-hybrid (X25519MLKEM768) TLS migration.`;
+
+const REMEDIATION =
+  "Enable hybrid PQC key exchange (X25519MLKEM768) once the proxy/gRPC stack supports it; re-key certificates to PQC signatures (ML-DSA) when available.";
+
+const RULE_ENVOY: RuleMeta = {
+  id: "proxy-envoy-tls",
+  title: "Envoy classical TLS termination",
+  description: "Envoy TLS context terminates TLS with a classical certificate + ECDHE key exchange",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "medium",
+  algorithm: "unknown",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: MESSAGE("Envoy"),
+  remediation: REMEDIATION,
+};
+const RULE_NGINX: RuleMeta = {
+  id: "proxy-nginx-tls",
+  title: "Nginx classical TLS termination",
+  description:
+    "Nginx ssl_certificate/ssl_certificate_key terminates TLS with a classical cert + ECDHE",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "medium",
+  algorithm: "unknown",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: MESSAGE("Nginx"),
+  remediation: REMEDIATION,
+};
+const RULE_HAPROXY: RuleMeta = {
+  id: "proxy-haproxy-tls",
+  title: "HAProxy classical TLS termination",
+  description: "HAProxy bind ssl crt / crt-store terminates TLS with a classical cert + ECDHE",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "medium",
+  algorithm: "unknown",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: MESSAGE("HAProxy"),
+  remediation: REMEDIATION,
+};
+const RULE_TRAEFIK: RuleMeta = {
+  id: "proxy-traefik-tls",
+  title: "Traefik classical TLS termination",
+  description:
+    "Traefik tls certificates (certFile/keyFile) or certResolver terminate TLS with a classical cert + ECDHE",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "medium",
+  algorithm: "unknown",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: MESSAGE("Traefik"),
+  remediation: REMEDIATION,
+};
+const RULE_GRPC: RuleMeta = {
+  id: "grpc-tls-credentials",
+  title: "gRPC classical TLS channel credentials",
+  description: "gRPC channel established with classical TLS credentials (RSA/ECDSA cert + ECDHE)",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "medium",
+  algorithm: "unknown",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: MESSAGE("gRPC"),
+  remediation: REMEDIATION,
+};
+
+/**
+ * PERF fast-reject only — a superset of substrings that appear in every rule's
+ * matchable input, so it can never drop a file a rule would flag. Correctness is
+ * in the per-rule regexes (each is distinctive enough to self-gate); this list
+ * exists purely to skip the regex work on files with no proxy/gRPC token at all.
+ */
+const PROXY_FAST_REJECT: readonly string[] = [
+  // Envoy
+  "tls_context",
+  "TlsContext",
+  "tls_certificates",
+  "transport_sockets.tls",
+  // Nginx
+  "ssl_certificate",
+  // HAProxy (`crt-store` and `bind … ssl … crt` both contain "crt")
+  "crt",
+  // Traefik
+  "certResolver",
+  "certFile",
+  "keyFile",
+  // gRPC
+  "ssl_channel_credentials",
+  "createSsl",
+  "TlsChannelCredentials",
+  "credentials.NewTLS",
+];
+
+interface ProxyRule {
+  meta: RuleMeta;
+  re: RegExp;
+}
+
+const PROXY_RULES: readonly ProxyRule[] = [
+  { meta: RULE_ENVOY, re: RE_ENVOY_TLS },
+  { meta: RULE_NGINX, re: RE_NGINX_TLS },
+  { meta: RULE_HAPROXY, re: RE_HAPROXY_TLS },
+  { meta: RULE_TRAEFIK, re: RE_TRAEFIK_TLS },
+  { meta: RULE_GRPC, re: RE_GRPC_TLS },
+];
+
+/**
+ * Detects classical-cert TLS termination in standalone reverse-proxy /
+ * load-balancer config files and in-code gRPC channel credentials. See the
+ * module docstring for the covered surfaces and the fast-reject rationale.
+ */
+export const proxyDetector: Detector = {
+  id: "proxy-tls-crypto",
+  description:
+    "Classical-cert TLS termination in reverse-proxy / load-balancer config (Envoy, Nginx, HAProxy, Traefik) and gRPC channel credentials",
+  scope: "config",
+  language: "any",
+  rules: PROXY_RULES.map((r) => r.meta),
+  // Config + source files are all in scope (gRPC creds live in code); only prose
+  // documentation is excluded, so a README mentioning `ssl_certificate` in a
+  // sentence can't fire (the marker gate already handles most of this).
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    // Mask comments first so a directive that only appears inside a commented-out
+    // block cannot fire.
+    const scan = maskCommentLines(maskBlockComments(content), ["#", "//"]);
+    // Cheap fast-reject: skip files with none of the distinctive tokens. This is a
+    // perf gate only — each rule's regex is distinctive enough to SELF-GATE (a
+    // separate too-narrow marker list previously dropped canonical HAProxy/Traefik
+    // configs entirely — audit H1/H2), so correctness lives in the per-rule regexes.
+    if (!PROXY_FAST_REJECT.some((mk) => scan.includes(mk))) return [];
+
+    const findings: Finding[] = [];
+    for (const { meta, re } of PROXY_RULES) {
+      eachMatch(re, scan, (m) =>
+        findings.push(
+          findingFromRule(meta, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    }
+    return findings;
+  },
+};

package/src/detectors/pulumi.ts

@@ -0,0 +1,106 @@
+/**
+ * IaC detector: classical asymmetric keys provisioned by Pulumi's `tls` provider
+ * (`@pulumi/tls` / `pulumi_tls` / `pulumi-tls`), across the languages Pulumi programs
+ * are written in (TS/JS, Python, Go). A `tls.PrivateKey` resource mints real key
+ * material at deploy time — the IaC surface, like Terraform's `tls_private_key`, but
+ * expressed as SDK calls in a general-purpose source file rather than HCL.
+ *
+ * Detection is gated to files that actually use the pulumi-tls provider (a
+ * `@pulumi/tls` / `pulumi_tls` / `pulumi-tls` import or a `tls.PrivateKey` /
+ * `tls.NewPrivateKey` construction), then classifies each `algorithm` value:
+ *  - `"RSA"`     → RSA key (kem, HNDL)
+ *  - `"ECDSA"`   → EC signing key (signature)
+ *  - `"ED25519"` → Ed25519 signing key (signature)
+ * Comment/string suppression is handled centrally for the host languages.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+const PULUMI_EXTENSIONS: readonly string[] = [".ts", ".js", ".mjs", ".cjs", ".py", ".go"];
+
+// The `algorithm` value of a pulumi-tls PrivateKey, in the TS/Python (`algorithm:
+// "RSA"` / `algorithm="RSA"`) and Go (`Algorithm: pulumi.String("RSA")`) spellings.
+const RE_PULUMI_TLS_ALG =
+  /\b[Aa]lgorithm\s*[:=]\s*(?:pulumi\.String\(\s*)?["'](RSA|ECDSA|ED25519)["']/g;
+
+/** True when the file actually uses the pulumi-tls provider (gate against FPs). */
+function usesPulumiTls(content: string): boolean {
+  return (
+    content.includes("@pulumi/tls") ||
+    content.includes("pulumi_tls") ||
+    content.includes("pulumi-tls") ||
+    content.includes("tls.PrivateKey") ||
+    content.includes("tls.NewPrivateKey")
+  );
+}
+
+const RULE_PULUMI_RSA: RuleMeta = {
+  id: "pulumi-tls-rsa",
+  title: "Pulumi tls.PrivateKey RSA key",
+  description: 'Pulumi tls.PrivateKey with algorithm "RSA"',
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Pulumi provisions a classical RSA key (tls.PrivateKey), which is not quantum-safe.",
+  remediation: "Plan migration to PQC (ML-KEM-768 for encryption, ML-DSA-65 for signatures).",
+};
+const RULE_PULUMI_ECDSA: RuleMeta = {
+  id: "pulumi-tls-ecdsa",
+  title: "Pulumi tls.PrivateKey ECDSA key",
+  description: 'Pulumi tls.PrivateKey with algorithm "ECDSA"',
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Pulumi provisions a classical ECDSA key (tls.PrivateKey), forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+};
+const RULE_PULUMI_ED25519: RuleMeta = {
+  id: "pulumi-tls-ed25519",
+  title: "Pulumi tls.PrivateKey Ed25519 key",
+  description: 'Pulumi tls.PrivateKey with algorithm "ED25519"',
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Pulumi provisions a classical Ed25519 key (tls.PrivateKey), forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+};
+
+const RULE_BY_ALG: Record<string, RuleMeta> = {
+  RSA: RULE_PULUMI_RSA,
+  ECDSA: RULE_PULUMI_ECDSA,
+  ED25519: RULE_PULUMI_ED25519,
+};
+
+/** Detects classical asymmetric keys provisioned by Pulumi's tls provider. */
+export const pulumiDetector: Detector = {
+  id: "pulumi-crypto",
+  description: "Classical asymmetric keys provisioned by Pulumi's tls provider (IaC)",
+  scope: "config",
+  language: "any",
+  rules: [RULE_PULUMI_RSA, RULE_PULUMI_ECDSA, RULE_PULUMI_ED25519],
+  appliesTo: (f) => hasExtension(f, PULUMI_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    if (!usesPulumiTls(content)) return [];
+    const findings: Finding[] = [];
+    eachMatch(RE_PULUMI_TLS_ALG, content, (m) => {
+      const rule = RULE_BY_ALG[m[1]];
+      if (!rule) return;
+      findings.push(
+        findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+      );
+    });
+    return findings;
+  },
+};

package/src/detectors/rust.ts

@@ -27,6 +27,10 @@ const RE_RUST_ECDH = /\becdh::EphemeralSecret\b|\bagreement::ECDH_P(?:256|384)\b
 const RE_RUST_ED25519 = /\bed25519_dalek::(?:SigningKey|Keypair|SecretKey)\b|\bEd25519KeyPair::/g;
 // X25519 key agreement (dalek).
 const RE_RUST_X25519 = /\bx25519_dalek::(?:EphemeralSecret|StaticSecret)\b/g;
+// X448 key agreement (`x448` crate). The qualified `x448::Secret` path — covers the
+// plain `use x448::Secret;` / fully-qualified form the alias mechanism (which only
+// fires on a RENAMED `use … as`) misses.
+const RE_RUST_X448 = /\bx448::Secret\b/g;
 // openssl crate bindings — the `Type::generate(` / `Dh::` call forms, distinct
 // from the ring / RustCrypto path syntax above (audit F5/F9 false-negatives).
 const RE_RUST_OPENSSL_RSA = /\bRsa::generate\s*\(/g;
@@ -346,6 +350,7 @@ export const rustDetector: Detector = {
     add(RE_RUST_ECDH, RULE_RUST_ECDH);
     add(RE_RUST_ED25519, RULE_RUST_ED25519);
     add(RE_RUST_X25519, RULE_RUST_X25519);
+    add(RE_RUST_X448, RULE_RUST_X448);
     add(RE_RUST_OPENSSL_RSA, RULE_RUST_OPENSSL_RSA);
     add(RE_RUST_OPENSSL_EC, RULE_RUST_OPENSSL_EC);
     add(RE_RUST_OPENSSL_DSA, RULE_RUST_OPENSSL_DSA);

package/src/detectors/secrets.ts

@@ -8,15 +8,24 @@
  * Covered:
  *  - Mozilla SOPS / age recipients: `age1…` bech32 public keys (X25519 key
  *    agreement wrapping the data key).
- *  - PGP-encrypted payloads: `-----BEGIN PGP MESSAGE-----` (RSA/ElGamal ESK).
  *  - Bitnami Sealed Secrets: `kind: SealedSecret` (controller wraps with RSA-OAEP).
  *
+ * Armored PGP blocks (`-----BEGIN PGP MESSAGE-----` and PGP private keys) are owned
+ * by the PEM detector (`pem-pgp-message` / `pem-pgp-private-key`), so they are not
+ * duplicated here.
+ *
  * Symmetric-only schemes (ansible-vault AES, age with a scrypt passphrase) are
  * intentionally NOT flagged: a strong symmetric key is only Grover-weakened, not
  * broken, so it is out of scope for a *classical-asymmetric* readiness signal.
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
-import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import {
+  DOC_EXTENSIONS,
+  eachMatch,
+  findingFromRule,
+  hasExtension,
+  maskCommentLines,
+} from "../detect-utils.js";
 import { CWE_BROKEN_CRYPTO } from "../cwe.js";
 
 interface SecretRule {
@@ -44,24 +53,6 @@ const SECRET_RULES: SecretRule[] = [
         "Track a post-quantum age recipient / KMS (ML-KEM) and re-encrypt; rotate any secret whose ciphertext has left your control.",
     },
   },
-  {
-    re: /-----BEGIN PGP MESSAGE-----/g,
-    meta: {
-      id: "secrets-pgp-message",
-      title: "PGP-encrypted secret (RSA/ElGamal)",
-      description: "A PGP MESSAGE block: the session key is wrapped with classical RSA/ElGamal",
-      category: "kem",
-      severity: "high",
-      confidence: "high",
-      algorithm: "RSA",
-      hndl: true,
-      cwe: CWE_BROKEN_CRYPTO,
-      message:
-        "A PGP-encrypted secret whose session key is wrapped with classical RSA/ElGamal; harvest-now-decrypt-later exposed.",
-      remediation:
-        "Re-encrypt with a post-quantum KEM (ML-KEM-768) once available; rotate the underlying secret.",
-    },
-  },
   {
     re: /\bkind:\s*["']?SealedSecret\b/g,
     meta: {
@@ -94,16 +85,14 @@ export const secretsDetector: Detector = {
   appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
   detect({ file, content }): Finding[] {
     // Fast reject: none of the distinctive markers present.
-    if (
-      !content.includes("age1") &&
-      !content.includes("BEGIN PGP MESSAGE") &&
-      !content.includes("SealedSecret")
-    ) {
+    if (!content.includes("age1") && !content.includes("SealedSecret")) {
       return [];
     }
+    // A commented `# kind: SealedSecret` / `# age1…` is not an active setting.
+    const scan = maskCommentLines(content, ["#"]);
     const findings: Finding[] = [];
     for (const rule of SECRET_RULES) {
-      eachMatch(rule.re, content, (m) => {
+      eachMatch(rule.re, scan, (m) => {
         findings.push(
           findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }),
         );

package/src/detectors/solidity.ts

@@ -0,0 +1,176 @@
+/**
+ * Source detector for classical asymmetric cryptography in smart-contract /
+ * blockchain source languages: Solidity (`.sol`), Move (`.move`), and Cairo
+ * (`.cairo`). On-chain signature verification is pure classical elliptic-curve
+ * cryptography — secp256k1 ECDSA on the EVM, Ed25519 / secp256k1 on Sui & Aptos
+ * (Move), and STARK-curve ECDSA on Starknet (Cairo). A cryptographically-relevant
+ * quantum computer (CRQC) could forge any of these on-chain authorizations.
+ *
+ * HNDL: unlike a KEM or key-agreement finding, an on-chain signature check has no
+ * confidentiality to harvest — there is nothing to decrypt later — so every rule
+ * here is `hndl: false`. The exposure is nonetheless SEVERE: on-chain keys often
+ * ARE the custody of the asset (an account's authorization to move funds), so a
+ * forged signature is a direct loss, not a downgraded confidentiality guarantee.
+ * That is why the findings are `severity: high` despite `hndl: false`.
+ *
+ * There is no `secp256k1` value in {@link AlgorithmFamily}; secp256k1 usage is
+ * mapped to `ECDSA` (the scheme), and the specific curve is named in the message.
+ * The STARK-curve check is likewise `ECDSA` (ECDSA over the STARK-friendly curve).
+ *
+ * Patterns (verified against OpenZeppelin, Solady, Sui/Aptos Move, Starknet docs):
+ *  - Solidity / EVM (secp256k1 ECDSA → `sol-ecrecover`):
+ *      `ecrecover(` (the secp256k1 precompile), OpenZeppelin/Solady
+ *      `ECDSA.recover(` / `ECDSA.tryRecover(`,
+ *      `SignatureChecker.isValidSignatureNow(`, and imports of the
+ *      `.../cryptography/ECDSA.sol` / `SignatureChecker.sol` (OZ) or Solady
+ *      `utils/ECDSA.sol` libraries. Consolidated under one rule; each distinct
+ *      token/import is its own finding (evidence), but they cannot double-fire on
+ *      the same span.
+ *  - Move / Sui & Aptos:
+ *      `ed25519::signature_verify_strict(` / `ed25519_verify(` → EdDSA
+ *      (`sol-ed25519`); `ecdsa_k1::secp256k1_verify(` /
+ *      `ecdsa_k1::secp256k1_ecrecover(` → ECDSA secp256k1
+ *      (`sol-secp256k1-verify`).
+ *  - Cairo / Starknet:
+ *      `check_ecdsa_signature(` (also the `ecdsa::check_ecdsa_signature(`
+ *      qualified form) → ECDSA over the STARK curve (`cairo-ecdsa`).
+ *
+ * Comment suppression is done in-detector (Solidity/Move/Cairo all use C-style
+ * `//` line comments and `/* … *\/` block comments), so a commented-out
+ * verification call cannot fire. Offsets are preserved by the maskers, so finding
+ * line/column stay exact.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import {
+  eachMatch,
+  findingFromRule,
+  hasExtension,
+  maskBlockComments,
+  maskCommentLines,
+  SMART_CONTRACT_EXTENSIONS,
+} from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+// Shared remediation: no PQC on-chain signature scheme is standardized on these
+// chains yet, so the actionable step today is to inventory the exposure and track
+// each chain's roadmap for an alternative (quantum-safe) signature scheme.
+const REMEDIATION_ONCHAIN =
+  "No PQC on-chain signature scheme is standardized on these chains yet; inventory this on-chain " +
+  "signature verification now and track chain roadmaps (e.g. account abstraction enabling " +
+  "alternative signature schemes) for a quantum-safe migration path.";
+
+// --- Solidity / EVM: secp256k1 ECDSA. ---
+// The secp256k1 recovery precompile. `\b` before `ecrecover` keeps it off the
+// Move `secp256k1_ecrecover` token (preceded by `_`, a word char → no boundary).
+const RE_SOL_ECRECOVER = /\becrecover\s*\(/g;
+// OpenZeppelin / Solady library calls: `ECDSA.recover(` / `ECDSA.tryRecover(`
+// and `SignatureChecker.isValidSignatureNow(`.
+const RE_SOL_ECDSA_LIB =
+  /\bECDSA\.(?:recover|tryRecover)\s*\(|\bSignatureChecker\.isValidSignatureNow\s*\(/g;
+// Import of the classical-signature libraries: OZ `.../cryptography/ECDSA.sol` /
+// `.../cryptography/SignatureChecker.sol`, and Solady `.../utils/ECDSA.sol`.
+const RE_SOL_ECDSA_IMPORT = /(?:cryptography|utils)\/(?:ECDSA|SignatureChecker)\.sol\b/g;
+
+// --- Move / Sui & Aptos. ---
+// Ed25519 verification: Aptos `ed25519::signature_verify_strict(`, Sui
+// `ed25519::ed25519_verify(` (matched via the bare `ed25519_verify(` token).
+const RE_MOVE_ED25519 = /\bed25519::signature_verify_strict\s*\(|\bed25519_verify\s*\(/g;
+// secp256k1 ECDSA verification / recovery via the Sui `ecdsa_k1` module.
+const RE_MOVE_SECP256K1 = /\becdsa_k1::secp256k1_(?:verify|ecrecover)\s*\(/g;
+
+// --- Cairo / Starknet: STARK-curve ECDSA. ---
+// `check_ecdsa_signature(` — also matches the qualified `ecdsa::check_ecdsa_signature(`
+// (the preceding `:` is a non-word char, so the `\b` boundary still holds).
+const RE_CAIRO_ECDSA = /\bcheck_ecdsa_signature\s*\(/g;
+
+const RULE_SOL_ECRECOVER: RuleMeta = {
+  id: "sol-ecrecover",
+  title: "EVM on-chain ECDSA signature verification (secp256k1)",
+  description:
+    "Solidity ecrecover / OpenZeppelin-Solady ECDSA.recover / SignatureChecker (secp256k1)",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "On-chain ECDSA over secp256k1 (Solidity/EVM: ecrecover, OpenZeppelin/Solady ECDSA / SignatureChecker) is forgeable by a quantum attacker; on-chain keys often ARE asset custody.",
+  remediation: REMEDIATION_ONCHAIN,
+};
+const RULE_MOVE_ED25519: RuleMeta = {
+  id: "sol-ed25519",
+  title: "Move on-chain Ed25519 signature verification",
+  description: "Move (Sui/Aptos) ed25519::signature_verify_strict / ed25519_verify",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "On-chain Ed25519 signature verification (Move / Sui / Aptos) is classical and forgeable by a quantum attacker; on-chain keys often ARE asset custody.",
+  remediation: REMEDIATION_ONCHAIN,
+};
+const RULE_MOVE_SECP256K1: RuleMeta = {
+  id: "sol-secp256k1-verify",
+  title: "Move on-chain ECDSA signature verification (secp256k1)",
+  description: "Move (Sui) ecdsa_k1::secp256k1_verify / secp256k1_ecrecover",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "On-chain ECDSA over secp256k1 (Move / Sui ecdsa_k1) is forgeable by a quantum attacker; on-chain keys often ARE asset custody.",
+  remediation: REMEDIATION_ONCHAIN,
+};
+const RULE_CAIRO_ECDSA: RuleMeta = {
+  id: "cairo-ecdsa",
+  title: "Cairo/Starknet on-chain ECDSA signature verification (STARK curve)",
+  description: "Cairo check_ecdsa_signature (STARK-curve ECDSA)",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "On-chain ECDSA over the STARK curve (Cairo/Starknet check_ecdsa_signature) is forgeable by a quantum attacker; on-chain keys often ARE asset custody.",
+  remediation: REMEDIATION_ONCHAIN,
+};
+
+/**
+ * Detects classical (quantum-vulnerable) on-chain signature verification in
+ * smart-contract source: Solidity/EVM secp256k1 ECDSA, Move Ed25519 & secp256k1,
+ * and Cairo/Starknet STARK-curve ECDSA.
+ */
+export const solidityDetector: Detector = {
+  id: "solidity-crypto",
+  description:
+    "Classical on-chain signature verification in smart-contract source (Solidity, Move, Cairo)",
+  scope: "source",
+  language: "solidity",
+  rules: [RULE_SOL_ECRECOVER, RULE_MOVE_ED25519, RULE_MOVE_SECP256K1, RULE_CAIRO_ECDSA],
+  appliesTo: (f) => hasExtension(f, SMART_CONTRACT_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    // Mask C-style comments (line `//` + block `/* */`) so commented-out
+    // verification calls can't fire; the maskers preserve byte offsets.
+    const scan = maskCommentLines(maskBlockComments(content), ["//"]);
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, scan, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    add(RE_SOL_ECRECOVER, RULE_SOL_ECRECOVER);
+    add(RE_SOL_ECDSA_LIB, RULE_SOL_ECRECOVER);
+    add(RE_SOL_ECDSA_IMPORT, RULE_SOL_ECRECOVER);
+    add(RE_MOVE_ED25519, RULE_MOVE_ED25519);
+    add(RE_MOVE_SECP256K1, RULE_MOVE_SECP256K1);
+    add(RE_CAIRO_ECDSA, RULE_CAIRO_ECDSA);
+    return findings;
+  },
+};