@quantakrypto/core 0.4.4 → 0.6.0

package/src/detectors/supply-chain.ts

@@ -0,0 +1,117 @@
+/**
+ * Config detector: classical supply-chain / artifact signing beyond the cosign +
+ * GPG cases the `cicd` detector covers — Docker Content Trust (Notary v1 / TUF),
+ * CNCF Notation, and in-toto. These sign container images, OCI artifacts, and
+ * build provenance with classical keys (ECDSA / RSA / Ed25519). Like all signing,
+ * this is the signature-side analogue of harvest-now-decrypt-later: a signature
+ * produced today is forgeable once a CRQC exists, and the signed artifact keeps
+ * verifying against that classical key for years — so these are `hndl:false` but
+ * real quantum-migration debt.
+ *
+ * Gated to CI pipeline files, Dockerfiles, and shell scripts, over comment-masked
+ * content, and keyed on distinctive command/env tokens to keep false positives low.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule, maskCommentLines } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+/** CI pipeline files, Dockerfiles, and shell scripts — where signing runs. */
+function isSigningContext(filePath: string): boolean {
+  const lower = filePath.toLowerCase();
+  const base = lower.split("/").pop() ?? lower;
+  return (
+    (lower.includes(".github/workflows/") && (lower.endsWith(".yml") || lower.endsWith(".yaml"))) ||
+    base === ".gitlab-ci.yml" ||
+    lower.endsWith(".gitlab-ci.yml") ||
+    base === "jenkinsfile" ||
+    lower.endsWith(".jenkinsfile") ||
+    base === "dockerfile" ||
+    base.startsWith("dockerfile.") ||
+    lower.endsWith(".dockerfile") ||
+    lower.endsWith(".sh") ||
+    lower.endsWith(".bash")
+  );
+}
+
+interface ScRule {
+  re: RegExp;
+  meta: RuleMeta;
+}
+
+const SC_RULES: ScRule[] = [
+  {
+    re: /\bDOCKER_CONTENT_TRUST\s*[:=]\s*["']?1\b|\bdocker\s+trust\s+sign\b/g,
+    meta: {
+      id: "sc-docker-content-trust",
+      title: "Docker Content Trust signing (Notary v1)",
+      description: "Docker Content Trust / docker trust sign — Notary v1 (TUF) classical keys",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "ECDSA",
+      hndl: false,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "Docker Content Trust signs images with Notary v1 (TUF) classical keys (ECDSA/Ed25519); signatures are forgeable once a CRQC exists.",
+      remediation: "Track sigstore/Notary v2 (Notation) PQC roadmap; plan hybrid image signing.",
+    },
+  },
+  {
+    re: /\bnotation\s+(?:sign|key\s+generate|cert\s+generate)\b/g,
+    meta: {
+      id: "sc-notation-sign",
+      title: "Notation artifact signing",
+      description: "CNCF Notation signing of OCI artifacts with classical keys",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "RSA",
+      hndl: false,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "Notation signs OCI artifacts with a classical key (RSA/ECDSA); signatures are forgeable once a CRQC exists.",
+      remediation: "Track Notation's PQC signature support (ML-DSA) and plan migration.",
+    },
+  },
+  {
+    re: /\bin[-_]toto[-_]?run\b|\bin-toto\b/g,
+    meta: {
+      id: "sc-in-toto",
+      title: "in-toto supply-chain signing",
+      description: "in-toto build provenance signed with classical keys",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "RSA",
+      hndl: false,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "in-toto signs build provenance with a classical key (RSA/Ed25519); the attestation is forgeable once a CRQC exists.",
+      remediation: "Track in-toto/DSSE PQC signature support and plan migration.",
+    },
+  },
+];
+
+/** Detects classical Docker Content Trust / Notation / in-toto signing. */
+export const supplyChainDetector: Detector = {
+  id: "supply-chain-signing",
+  description: "Classical container/artifact signing (Docker Content Trust, Notation, in-toto)",
+  scope: "config",
+  language: "any",
+  rules: SC_RULES.map((r) => r.meta),
+  appliesTo: isSigningContext,
+  detect({ file, content }): Finding[] {
+    // `#` covers YAML/Dockerfile/shell; `//` covers Jenkinsfile (Groovy), which has no
+    // extension so it is never centrally comment-stripped.
+    const scan = maskCommentLines(content, ["#", "//"]);
+    const findings: Finding[] = [];
+    for (const rule of SC_RULES) {
+      eachMatch(rule.re, scan, (m) => {
+        findings.push(
+          findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }),
+        );
+      });
+    }
+    return findings;
+  },
+};

package/src/detectors/swift.ts

@@ -0,0 +1,149 @@
+/**
+ * Source detector for classical asymmetric cryptography in Swift (Apple platforms) —
+ * Apple CryptoKit and the older Security framework (`SecKey*`). Lexical, same strategy
+ * as the other language packs; the API names are distinctive enough to keep the
+ * false-positive risk low. Comment/string suppression is handled centrally
+ * (`.swift` is a C-style comment language).
+ *
+ * CryptoKit:
+ *  - `P256|P384|P521.Signing.PrivateKey`            → ECDSA signature (hndl:false)
+ *  - `P256|P384|P521.KeyAgreement.PrivateKey`       → ECDH key agreement (hndl:true)
+ *  - `Curve25519.Signing.PrivateKey`                → Ed25519 signature (hndl:false)
+ *  - `Curve25519.KeyAgreement.PrivateKey`           → X25519 key agreement (hndl:true)
+ * (`SecureEnclave.P256.…` forms are covered by the same P-curve regexes.)
+ *
+ * Security framework:
+ *  - `SecKeyCreateRandomKey` with `kSecAttrKeyTypeRSA`                 → RSA
+ *  - … with `kSecAttrKeyTypeEC` / `kSecAttrKeyTypeECSECPrimeRandom`    → EC
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { SWIFT_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+// CryptoKit P-curve keys, split by usage (Signing vs KeyAgreement). `SecureEnclave.`
+// may prefix the P-curve type, so it is allowed optionally.
+const RE_SWIFT_P_SIGN = /\b(?:SecureEnclave\.)?P(?:256|384|521)\.Signing\.PrivateKey\b/g;
+const RE_SWIFT_P_KEX = /\b(?:SecureEnclave\.)?P(?:256|384|521)\.KeyAgreement\.PrivateKey\b/g;
+// CryptoKit Curve25519: Signing = Ed25519 (EdDSA); KeyAgreement = X25519.
+const RE_SWIFT_ED25519 = /\bCurve25519\.Signing\.PrivateKey\b/g;
+const RE_SWIFT_X25519 = /\bCurve25519\.KeyAgreement\.PrivateKey\b/g;
+// Security framework key-type attributes (used with SecKeyCreateRandomKey).
+const RE_SWIFT_SEC_RSA = /\bkSecAttrKeyTypeRSA\b/g;
+const RE_SWIFT_SEC_EC = /\bkSecAttrKeyType(?:EC|ECSECPrimeRandom)\b/g;
+
+const RULE_SWIFT_ECDSA: RuleMeta = {
+  id: "swift-ecdsa",
+  title: "Swift CryptoKit ECDSA signing key",
+  description: "CryptoKit P256/P384/P521 Signing.PrivateKey",
+  category: "signature",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "CryptoKit P-curve ECDSA signing (Swift) is forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+};
+const RULE_SWIFT_ECDH: RuleMeta = {
+  id: "swift-ecdh",
+  title: "Swift CryptoKit ECDH key agreement",
+  description: "CryptoKit P256/P384/P521 KeyAgreement.PrivateKey",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "CryptoKit P-curve ECDH key agreement (Swift) is harvest-now-decrypt-later exposed.",
+  remediation: "Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768).",
+};
+const RULE_SWIFT_ED25519: RuleMeta = {
+  id: "swift-ed25519",
+  title: "Swift CryptoKit Ed25519 signing key",
+  description: "CryptoKit Curve25519.Signing.PrivateKey (Ed25519)",
+  category: "signature",
+  // `low`, aligned with Ed25519 in every other source pack (go/rust/ruby/python/node)
+  // — the same primitive must not flip CI exit codes based on which language wrote it.
+  severity: "low",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "CryptoKit Ed25519 signing (Swift) is classical and forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+};
+const RULE_SWIFT_X25519: RuleMeta = {
+  id: "swift-x25519",
+  title: "Swift CryptoKit X25519 key agreement",
+  description: "CryptoKit Curve25519.KeyAgreement.PrivateKey (X25519)",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "X25519",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "CryptoKit X25519 key agreement (Swift) is classical and harvest-now-decrypt-later exposed.",
+  remediation: "Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768).",
+};
+const RULE_SWIFT_RSA: RuleMeta = {
+  id: "swift-rsa",
+  title: "Swift Security-framework RSA key",
+  description: "SecKeyCreateRandomKey with kSecAttrKeyTypeRSA",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Security-framework RSA key (Swift) is classical and not quantum-safe.",
+  remediation: "Plan migration to PQC (ML-KEM-768 for encryption, ML-DSA-65 for signatures).",
+};
+const RULE_SWIFT_SEC_EC: RuleMeta = {
+  id: "swift-sec-ec",
+  title: "Swift Security-framework EC key",
+  description: "SecKeyCreateRandomKey with kSecAttrKeyTypeEC",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Security-framework EC key (Swift); EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+
+/** Detects classical asymmetric crypto in Swift (CryptoKit + Security framework). */
+export const swiftDetector: Detector = {
+  id: "swift-crypto",
+  description: "Classical asymmetric crypto in Swift (CryptoKit, Security framework)",
+  scope: "source",
+  language: "swift",
+  rules: [
+    RULE_SWIFT_ECDSA,
+    RULE_SWIFT_ECDH,
+    RULE_SWIFT_ED25519,
+    RULE_SWIFT_X25519,
+    RULE_SWIFT_RSA,
+    RULE_SWIFT_SEC_EC,
+  ],
+  appliesTo: (f) => hasExtension(f, SWIFT_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, content, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    add(RE_SWIFT_P_SIGN, RULE_SWIFT_ECDSA);
+    add(RE_SWIFT_P_KEX, RULE_SWIFT_ECDH);
+    add(RE_SWIFT_ED25519, RULE_SWIFT_ED25519);
+    add(RE_SWIFT_X25519, RULE_SWIFT_X25519);
+    add(RE_SWIFT_SEC_RSA, RULE_SWIFT_RSA);
+    add(RE_SWIFT_SEC_EC, RULE_SWIFT_SEC_EC);
+    return findings;
+  },
+};

package/src/detectors/terraform.ts

@@ -16,7 +16,13 @@
  * (hndl:true) since a provisioned EC key can feed ECDH.
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
-import { eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import {
+  eachMatch,
+  findingFromRule,
+  hasExtension,
+  maskBlockComments,
+  maskCommentLines,
+} from "../detect-utils.js";
 import { CWE_BROKEN_CRYPTO } from "../cwe.js";
 
 const TF_EXTENSIONS: readonly string[] = [".tf", ".tf.json"];
@@ -29,12 +35,21 @@ const TF_EXTENSIONS: readonly string[] = [".tf", ".tf.json"];
 const RE_TF_RSA = /(?<![\w"-])"?algorithm"?\s*[:=]\s*"RSA(?:_[A-Z0-9_]+)?"/g;
 // ECDSA / EC signing: tls_private_key `"ECDSA"` and Google KMS `"EC_SIGN_…"`.
 const RE_TF_ECDSA = /(?<![\w"-])"?algorithm"?\s*[:=]\s*"(?:ECDSA|EC_SIGN_[A-Z0-9_]+)"/g;
-// AWS KMS customer master key specs.
-const RE_TF_KMS_RSA = /(?<![\w"-])"?customer_master_key_spec"?\s*[:=]\s*"RSA_\d+"/g;
-const RE_TF_KMS_EC = /(?<![\w"-])"?customer_master_key_spec"?\s*[:=]\s*"ECC_[A-Z0-9_]+"/g;
-// Azure Key Vault key type (incl. the `-HSM` variants).
-const RE_TF_AZ_RSA = /(?<![\w"-])"?key_type"?\s*[:=]\s*"RSA(?:-HSM)?"/g;
-const RE_TF_AZ_EC = /(?<![\w"-])"?key_type"?\s*[:=]\s*"EC(?:-HSM)?"/g;
+// EdDSA signing: hashicorp/tls `tls_private_key` `algorithm = "ED25519"` (a supported,
+// classical algorithm the RSA/ECDSA rules miss).
+const RE_TF_ED25519 = /(?<![\w"-])"?algorithm"?\s*[:=]\s*"ED25519"/g;
+// AWS KMS key specs: the legacy `customer_master_key_spec` and the modern `key_spec`
+// alias (aws provider v4+). The `(?<![\w"-])` lookbehind rejects the `key_spec` suffix
+// inside `customer_master_key_spec` (preceded by `_`), so no double-count.
+const RE_TF_KMS_RSA = /(?<![\w"-])"?(?:customer_master_key_spec|key_spec)"?\s*[:=]\s*"RSA_\d+"/g;
+const RE_TF_KMS_EC =
+  /(?<![\w"-])"?(?:customer_master_key_spec|key_spec)"?\s*[:=]\s*"ECC_[A-Z0-9_]+"/g;
+// `key_type` key material: Azure Key Vault (`"RSA"` / `"EC"`, incl. `-HSM`) and
+// HashiCorp Vault PKI, which uses the lowercase `"rsa"` / `"ec"` tokens — so the value
+// is matched case-insensitively. The `"…"` bound keeps `"ec"` from matching `"ecc"`,
+// and `customer_master_key_spec` (AWS) is a different attribute handled above.
+const RE_TF_AZ_RSA = /(?<![\w"-])"?key_type"?\s*[:=]\s*"RSA(?:-HSM)?"/gi;
+const RE_TF_AZ_EC = /(?<![\w"-])"?key_type"?\s*[:=]\s*"EC(?:-HSM)?"/gi;
 
 const RULE_TF_RSA: RuleMeta = {
   id: "tf-rsa-key",
@@ -62,6 +77,19 @@ const RULE_TF_ECDSA: RuleMeta = {
   message: "Terraform provisions a classical ECDSA key, forgeable by a quantum attacker.",
   remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
 };
+const RULE_TF_ED25519: RuleMeta = {
+  id: "tf-ed25519-key",
+  title: "Terraform Ed25519 key",
+  description: 'Terraform tls_private_key algorithm = "ED25519"',
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Terraform provisions a classical Ed25519 key, forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+};
 const RULE_TF_KMS_RSA: RuleMeta = {
   id: "tf-kms-rsa",
   title: "Terraform AWS KMS RSA CMK",
@@ -129,6 +157,7 @@ export const terraformDetector: Detector = {
   rules: [
     RULE_TF_RSA,
     RULE_TF_ECDSA,
+    RULE_TF_ED25519,
     RULE_TF_KMS_RSA,
     RULE_TF_KMS_EC,
     RULE_TF_AZ_RSA,
@@ -137,14 +166,19 @@ export const terraformDetector: Detector = {
   appliesTo: (f) => hasExtension(f, TF_EXTENSIONS),
   detect({ file, content }): Finding[] {
     const findings: Finding[] = [];
+    // A commented HCL argument (`# algorithm = "RSA"`, `//` lines, and `/* … */` block
+    // comments) is not an active resource argument. Mask block comments then line
+    // comments; offsets preserved.
+    const scan = maskCommentLines(maskBlockComments(content), ["#", "//"]);
     const add = (re: RegExp, rule: RuleMeta) =>
-      eachMatch(re, content, (m) =>
+      eachMatch(re, scan, (m) =>
         findings.push(
           findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
         ),
       );
     add(RE_TF_RSA, RULE_TF_RSA);
     add(RE_TF_ECDSA, RULE_TF_ECDSA);
+    add(RE_TF_ED25519, RULE_TF_ED25519);
     add(RE_TF_KMS_RSA, RULE_TF_KMS_RSA);
     add(RE_TF_KMS_EC, RULE_TF_KMS_EC);
     add(RE_TF_AZ_RSA, RULE_TF_AZ_RSA);

package/src/detectors/vault.ts

@@ -0,0 +1,120 @@
+/**
+ * Config detector: classical asymmetric keys in native HashiCorp Vault server
+ * config / policy (HCL). Terraform-provisioned Vault is caught by the terraform
+ * detector (`.tf`); this covers Vault's OWN `.hcl` config — the `transit` and
+ * `pki` secrets engines, whose keys sign and wrap real production data.
+ *
+ * Covered (gated to a `transit`/`pki` marker to avoid firing on unrelated HCL):
+ *  - transit key `type = "rsa-2048|3072|4096"` (RSA — key wrapping / signing).
+ *  - transit key `type = "ecdsa-p256|p384|p521"` / `"ed25519"` (classical signing).
+ *  - pki role `key_type = "rsa" | "ec"`.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule, hasExtension, maskCommentLines } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+const HCL_EXTENSIONS: readonly string[] = [".hcl"];
+
+const RE_TRANSIT_RSA = /\btype\s*=\s*"rsa-\d+"/g;
+const RE_TRANSIT_ECDSA = /\btype\s*=\s*"ecdsa-p\d+"/g;
+const RE_TRANSIT_ED25519 = /\btype\s*=\s*"ed25519"/g;
+const RE_PKI_RSA = /\bkey_type\s*=\s*"rsa"/g;
+const RE_PKI_EC = /\bkey_type\s*=\s*"ec"/g;
+
+const RULE_TRANSIT_RSA: RuleMeta = {
+  id: "vault-transit-rsa",
+  title: "Vault transit RSA key",
+  description: 'Vault transit secrets engine key type = "rsa-*"',
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Vault transit provisions a classical RSA key (signing / key wrapping), not quantum-safe.",
+  remediation:
+    "Plan migration to PQC (ML-KEM-768 for wrapping, ML-DSA-65 for signing) as Vault adds support.",
+};
+const RULE_TRANSIT_ECDSA: RuleMeta = {
+  id: "vault-transit-ecdsa",
+  title: "Vault transit ECDSA key",
+  description: 'Vault transit secrets engine key type = "ecdsa-p*"',
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Vault transit provisions a classical ECDSA signing key, forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+};
+const RULE_TRANSIT_ED25519: RuleMeta = {
+  id: "vault-transit-ed25519",
+  title: "Vault transit Ed25519 key",
+  description: 'Vault transit secrets engine key type = "ed25519"',
+  category: "signature",
+  severity: "low",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Vault transit provisions a classical Ed25519 signing key, forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+};
+const RULE_PKI_RSA: RuleMeta = {
+  id: "vault-pki-rsa",
+  title: "Vault PKI RSA role",
+  description: 'Vault pki secrets engine role key_type = "rsa"',
+  category: "certificate",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Vault PKI mints certificates with a classical RSA key, not quantum-safe.",
+  remediation: "Plan migration to PQC certificate keys (ML-DSA-65) as the CA chain adds support.",
+};
+const RULE_PKI_EC: RuleMeta = {
+  id: "vault-pki-ec",
+  title: "Vault PKI EC role",
+  description: 'Vault pki secrets engine role key_type = "ec"',
+  category: "certificate",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Vault PKI mints certificates with a classical EC key, forgeable by a quantum attacker.",
+  remediation: "Plan migration to ML-DSA-65 (FIPS 204) certificate keys.",
+};
+
+/** Detects classical asymmetric keys in native Vault HCL config. */
+export const vaultDetector: Detector = {
+  id: "vault-crypto",
+  description: "Classical asymmetric keys in native HashiCorp Vault config (transit, pki)",
+  scope: "config",
+  language: "any",
+  rules: [RULE_TRANSIT_RSA, RULE_TRANSIT_ECDSA, RULE_TRANSIT_ED25519, RULE_PKI_RSA, RULE_PKI_EC],
+  appliesTo: (f) => hasExtension(f, HCL_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    // Gate: only inside a Vault transit / pki context.
+    if (!content.includes("transit") && !content.includes("pki")) return [];
+    const scan = maskCommentLines(content, ["#", "//"]);
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, scan, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    add(RE_TRANSIT_RSA, RULE_TRANSIT_RSA);
+    add(RE_TRANSIT_ECDSA, RULE_TRANSIT_ECDSA);
+    add(RE_TRANSIT_ED25519, RULE_TRANSIT_ED25519);
+    add(RE_PKI_RSA, RULE_PKI_RSA);
+    add(RE_PKI_EC, RULE_PKI_EC);
+    return findings;
+  },
+};

package/src/detectors/vpn.ts

@@ -1,9 +1,8 @@
 /**
  * Config detector: classical key exchange in network transport / VPN config —
- * WireGuard, IPsec (strongSwan), and OpenSSH server config. These are the tunnels
- * carrying "communication between things"; their key exchange is classical and so
- * harvest-now-decrypt-later exposed (a recorded tunnel is decryptable once a CRQC
- * exists).
+ * WireGuard and IPsec (strongSwan). These are the tunnels carrying "communication
+ * between things"; their key exchange is classical and so harvest-now-decrypt-later
+ * exposed (a recorded tunnel is decryptable once a CRQC exists).
  *
  * Covered (each gated so it only fires inside the relevant config):
  *  - **WireGuard** — `[Interface]`/`[Peer]` sections with `PrivateKey`/`PublicKey`.
@@ -12,18 +11,20 @@
  *    tunnel-wrapping layer. The private key is treated as sensitive key material.
  *  - **IPsec / strongSwan** — IKE/ESP proposals naming classical DH groups
  *    (`modp*` = finite-field DH, `ecp*` = ECDH).
- *  - **sshd_config / ssh_config** — a `KexAlgorithms` line that offers no PQC hybrid
- *    KEX (`sntrup761x25519-*`, `mlkem768x25519-*`). If a PQC KEX IS listed the line
- *    is left alone, so a hardened server stays silent.
+ *
+ * `sshd_config` / `ssh_config` KexAlgorithms are intentionally NOT handled here —
+ * the language-agnostic SSH token detector in `source.ts` (`ssh-kex-classical`)
+ * already covers them; a rule here would double-count.
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
-import { eachMatch, findingFromRule } from "../detect-utils.js";
+import { eachMatch, findingFromRule, hasExtension, maskCommentLines } from "../detect-utils.js";
 import { CWE_BROKEN_CRYPTO } from "../cwe.js";
 
+const CONF_EXTENSIONS: readonly string[] = [".conf"];
+
 const RE_WG_KEY = /\b(?:PrivateKey|PublicKey)\s*=\s*[A-Za-z0-9+/]{42,}=/g;
 const RE_IPSEC_MODP = /\bmodp\d+\b/gi;
 const RE_IPSEC_ECP = /\becp\d+(?:bp)?\b/gi;
-const RE_SSHD_KEX = /^[ \t]*KexAlgorithms[ \t]+([^\n]*)/gm;
 
 const RULE_WG: RuleMeta = {
   id: "net-wireguard-x25519",
@@ -70,61 +71,32 @@ const RULE_IPSEC_EC: RuleMeta = {
   remediation:
     "Add a PQC/hybrid IKE proposal (X25519MLKEM768 / ML-KEM) as your IPsec stack supports it.",
 };
-const RULE_SSHD_KEX: RuleMeta = {
-  id: "net-sshd-classical-kex",
-  title: "SSH server offers no PQC key exchange",
-  description:
-    "sshd_config KexAlgorithms lists only classical key exchange (no sntrup761/mlkem768)",
-  category: "key-exchange",
-  severity: "medium",
-  confidence: "high",
-  algorithm: "ECDH",
-  hndl: true,
-  cwe: CWE_BROKEN_CRYPTO,
-  message:
-    "SSH server's KexAlgorithms offers only classical key exchange (no sntrup761x25519 / mlkem768x25519); sessions are harvest-now-decrypt-later exposed.",
-  remediation: "Add a PQC hybrid KEX: sntrup761x25519-sha512@openssh.com or mlkem768x25519-sha256.",
-};
-
-/** True when a KexAlgorithms value already offers a post-quantum hybrid KEX. */
-function offersPqKex(kexLine: string): boolean {
-  return /sntrup761x25519|mlkem768/.test(kexLine);
-}
 
-/** Detects classical key exchange in WireGuard / IPsec / sshd network config. */
+/** Detects classical key exchange in WireGuard / IPsec network config. */
 export const vpnDetector: Detector = {
   id: "network-transport-crypto",
-  description: "Classical key exchange in network transport / VPN config (WireGuard, IPsec, sshd)",
+  description: "Classical key exchange in network transport / VPN config (WireGuard, IPsec)",
   scope: "config",
   language: "any",
-  rules: [RULE_WG, RULE_IPSEC_DH, RULE_IPSEC_EC, RULE_SSHD_KEX],
-  appliesTo: (f) => {
-    const lower = f.toLowerCase();
-    const base = lower.split("/").pop() ?? lower;
-    return lower.endsWith(".conf") || base === "sshd_config" || base === "ssh_config";
-  },
+  rules: [RULE_WG, RULE_IPSEC_DH, RULE_IPSEC_EC],
+  appliesTo: (f) => hasExtension(f, CONF_EXTENSIONS),
   detect({ file, content }): Finding[] {
     const findings: Finding[] = [];
     const push = (rule: RuleMeta, index: number, length: number) =>
       findings.push(findingFromRule(rule, { file, content, index, matchLength: length }));
+    // ipsec.conf / wg configs use `#` line comments. Match over comment-masked
+    // content (offsets preserved); gates stay on the original.
+    const scan = maskCommentLines(content, ["#"]);
 
     // WireGuard: gated to a WireGuard config section.
     if (content.includes("[Interface]") || content.includes("[Peer]")) {
-      eachMatch(RE_WG_KEY, content, (m) => push(RULE_WG, m.index, m[0].length));
+      eachMatch(RE_WG_KEY, scan, (m) => push(RULE_WG, m.index, m[0].length));
     }
 
     // IPsec / strongSwan: gated to a proposal assignment.
     if (/\b(?:ike|esp|proposals?|keyexchange)\s*=/i.test(content)) {
-      eachMatch(RE_IPSEC_MODP, content, (m) => push(RULE_IPSEC_DH, m.index, m[0].length));
-      eachMatch(RE_IPSEC_ECP, content, (m) => push(RULE_IPSEC_EC, m.index, m[0].length));
-    }
-
-    // sshd_config / ssh_config: KexAlgorithms line with no PQC hybrid offered.
-    const base = file.toLowerCase().split("/").pop() ?? "";
-    if (base === "sshd_config" || base === "ssh_config") {
-      eachMatch(RE_SSHD_KEX, content, (m) => {
-        if (!offersPqKex(m[1])) push(RULE_SSHD_KEX, m.index, m[0].length);
-      });
+      eachMatch(RE_IPSEC_MODP, scan, (m) => push(RULE_IPSEC_DH, m.index, m[0].length));
+      eachMatch(RE_IPSEC_ECP, scan, (m) => push(RULE_IPSEC_EC, m.index, m[0].length));
     }
     return findings;
   },