@quantakrypto/core 0.4.4 → 0.6.0

package/src/detectors/weak-hash.ts

@@ -0,0 +1,217 @@
+/**
+ * Config/source detector: weak hash functions (SHA-1, MD5) used specifically in
+ * a DIGITAL-SIGNATURE or X.509 CERTIFICATE algorithm — NOT generic hashing and
+ * NOT password hashing.
+ *
+ * WHY THIS LIVES IN A PQC-READINESS TOOL (quantum-adjacent, not quantum-broken).
+ * SHA-1/MD5 are not "quantum-broken" — Grover only halves preimage strength and
+ * a CRQC does not conjure signature-hash collisions. We flag them anyway, and
+ * frame them as *quantum-adjacent: same migration window*:
+ *   - NIST SP 800-131A Rev 3 disallows SHA-1 for generating digital signatures
+ *     and retires SHA-1 entirely by 2030 — the SAME transition window the same
+ *     document sets for the classical→PQC migration. One standard, one deadline.
+ *   - CNSA 2.0 pairs its PQC mandate (ML-KEM / ML-DSA) with SHA-384/512; a
+ *     CNSA-2.0 target that re-keys to PQC must also drop SHA-1 from its
+ *     signature/certificate chain in the same effort.
+ *   - A quantum-readiness migration RE-KEYS and RE-SIGNS every certificate and
+ *     signature anyway. Surfacing weak signature hashes in that same pass costs
+ *     nothing extra and closes a today-exploitable gap (SHA-1/MD5 signature
+ *     forgery via chosen-prefix collisions) alongside the future one.
+ * We deliberately do NOT claim these hashes are broken by quantum computers.
+ *
+ * WHY THE SCOPE IS NARROW (signature/certificate ONLY).
+ * A bare `sha1(x)` or `sha1sum file` is often a perfectly acceptable
+ * non-security checksum (ETags, cache keys, content addressing, Git object ids).
+ * PASSWORD hashing with a weak/fast hash is a real weakness too, but it is a
+ * DIFFERENT weakness (CWE-916, needs a slow KDF like Argon2/bcrypt/scrypt), a
+ * different remediation, and — crucially — is NOT on the PQC migration path, so
+ * it does not belong in this detector. We only fire when the weak hash is bound
+ * to a signature/certificate algorithm, where "move to SHA-256+ while you re-key
+ * for PQC" is exactly the right, single remediation. That binding is enforced by
+ * a file-level fast-reject marker (see `hasSignatureMarker`) plus regexes that
+ * only match signature/cert *algorithm identifiers*, never a lone hash call.
+ *
+ * SURFACES COVERED (all verified signature/certificate contexts):
+ *  1. Java JCA standard names — `Signature.getInstance("SHA1withRSA")`,
+ *     `"MD5withRSA"`, `"SHA1withDSA"`, `"SHA1withECDSA"` (JDK Standard Algorithm
+ *     Names). Regex anchors on the `…with(RSA|DSA|ECDSA)` shape, so the token is
+ *     unambiguously a signature algorithm, never a bare digest.
+ *  2. .NET signing calls — a weak hash passed to `.SignData(…)` / `.SignHash(…)`
+ *     as `HashAlgorithmName.SHA1` or the legacy string `"SHA1"` (e.g.
+ *     `RSACryptoServiceProvider.SignData(data, "SHA1")`). Matched only INSIDE the
+ *     sign call, so an unrelated `HashAlgorithmName.SHA1` used for a checksum is
+ *     not flagged.
+ *  3. X.509 / ASN.1 signature-algorithm identifiers — the OID *names*
+ *     (`sha1WithRSAEncryption`, `md5WithRSAEncryption`, `ecdsa-with-SHA1`,
+ *     `dsaWithSHA1`) and their dotted OIDs (`1.2.840.113549.1.1.5` =
+ *     sha1WithRSAEncryption, `1.2.840.113549.1.1.4` = md5WithRSAEncryption,
+ *     `1.2.840.10045.4.1` = ecdsa-with-SHA1). These are certificate
+ *     signatureAlgorithm values by definition.
+ *  4. OpenSSL CLI in a signing/cert context — `-sha1` / `-md5` on the same line
+ *     as `openssl` AND a certificate/signing subcommand or flag
+ *     (`req` / `x509` / `ca` / `-sign` / `-signkey`). A bare `openssl dgst -sha1
+ *     file` (a checksum, no `-sign`) is intentionally NOT matched.
+ *
+ * NOT DUPLICATED: XML-DSig `rsa-sha1` (see `xmldsig.ts`) and DKIM `rsa-sha1`
+ * (see `dkim.ts`) already emit SIGNATURE findings on their own surfaces; this
+ * detector deliberately does not touch those and focuses on the Java / .NET /
+ * X.509 / OpenSSL surfaces above.
+ *
+ * Category is `hash` (weak/pre-quantum hash usage — the previously-unused
+ * category). `hndl: false` — a signature has no confidentiality to harvest.
+ * `algorithm: "unknown"` — the weak *hash* is not itself an asymmetric family;
+ * the signature it weakens is (RSA/ECDSA/DSA), but the finding is about the hash.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import {
+  DOC_EXTENSIONS,
+  eachMatch,
+  findingFromRule,
+  hasExtension,
+  maskBlockComments,
+  maskCommentLines,
+} from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+// --- SHA-1 in a signature/certificate algorithm identifier ---------------------
+// Java JCA standard names: `SHA1withRSA`, `SHA1withDSA`, `SHA1withECDSA`. The
+// `…with(RSA|DSA|ECDSA)` shape makes the token unambiguously a signature alg.
+// `-?` tolerates the `SHA-1` spelling; `i` covers case variation in real code.
+const RE_SHA1_JAVA = /\bSHA-?1with(?:RSA|DSA|ECDSA)\b/gi;
+// X.509 / ASN.1 signature-algorithm OID *names*.
+const RE_SHA1_X509 = /\b(?:sha-?1WithRSAEncryption|ecdsa-with-SHA-?1|dsaWithSHA-?1)\b/gi;
+// X.509 signature-algorithm dotted OIDs (sha1WithRSAEncryption, ecdsa-with-SHA1).
+// Lookarounds keep the id from matching inside a longer OID.
+const RE_SHA1_OID = /(?<![\d.])(?:1\.2\.840\.113549\.1\.1\.5|1\.2\.840\.10045\.4\.1)(?![\d.])/g;
+// OpenSSL CLI: `-sha1` on the same line as `openssl` AND an actual SIGNING marker
+// (`req` / `ca` subcommand, or `-sign`/`-signkey`/`-CA`/`-CAkey`), in either order.
+// A bare `x509` subcommand is NOT a signing marker — `openssl x509 -fingerprint
+// -sha1` / `-subject_hash` are read-only thumbprint/identifier ops, not signature
+// generation (audit M1). `openssl dgst -sha1 file` (checksum) is likewise unmatched.
+const OPENSSL_SIGN = String.raw`(?:\breq\b|\bca\b|-sign(?:key)?\b|-CA(?:key)?\b)`;
+const RE_SHA1_OPENSSL = new RegExp(
+  `openssl\\b[^\\n]*?${OPENSSL_SIGN}[^\\n]*?-sha1\\b|openssl\\b[^\\n]*?-sha1\\b[^\\n]*?${OPENSSL_SIGN}`,
+  "gi",
+);
+// .NET: a weak hash bound to a signing call (`.SignData(…)` / `.SignHash(…)`), as
+// `HashAlgorithmName.SHA1` or the legacy `"SHA1"` string arg. Bounded by `;` (the
+// statement), NOT `)` — the first argument is often itself a call
+// (`.SignData(Encoding.UTF8.GetBytes(m), HashAlgorithmName.SHA1, …)`), so a
+// `[^)]` span would stop at the inner `)` and miss it (audit H3).
+const RE_SHA1_DOTNET =
+  /\.Sign(?:Data|Hash)\s*\([^;]*?(?:HashAlgorithmName\.SHA-?1|["']SHA-?1["'])/gi;
+
+// --- MD5 in a signature/certificate algorithm identifier -----------------------
+const RE_MD5_JAVA = /\bMD5with(?:RSA|DSA|ECDSA)\b/gi;
+const RE_MD5_X509 = /\bmd5WithRSAEncryption\b/gi;
+const RE_MD5_OID = /(?<![\d.])1\.2\.840\.113549\.1\.1\.4(?![\d.])/g;
+const RE_MD5_OPENSSL = new RegExp(
+  `openssl\\b[^\\n]*?${OPENSSL_SIGN}[^\\n]*?-md5\\b|openssl\\b[^\\n]*?-md5\\b[^\\n]*?${OPENSSL_SIGN}`,
+  "gi",
+);
+const RE_MD5_DOTNET = /\.Sign(?:Data|Hash)\s*\([^;]*?(?:HashAlgorithmName\.MD5|["']MD5["'])/gi;
+
+const RULE_SHA1: RuleMeta = {
+  id: "weak-hash-sha1-signature",
+  title: "SHA-1 in a signature / certificate algorithm",
+  description:
+    "SHA-1 used in a digital-signature or X.509 certificate algorithm (Java/.NET/X.509/OpenSSL)",
+  category: "hash",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "unknown",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "SHA-1 used in a digital-signature/certificate algorithm; SHA-1 is disallowed for signatures (NIST SP 800-131A Rev 3, fully retired 2030 — the same window as the PQC migration) and enables collision-based signature forgery. Quantum-adjacent: migrate the hash alongside the signature algorithm.",
+  remediation:
+    "Move signature/certificate hashes to SHA-256 or stronger (SHA-384/512 for CNSA 2.0 targets) and re-issue affected certificates; fold the PQC signature migration (ML-DSA) into the same re-key/re-sign effort.",
+};
+const RULE_MD5: RuleMeta = {
+  id: "weak-hash-md5-signature",
+  title: "MD5 in a signature / certificate algorithm",
+  description:
+    "MD5 used in a digital-signature or X.509 certificate algorithm (Java/.NET/X.509/OpenSSL)",
+  category: "hash",
+  severity: "high",
+  confidence: "high",
+  algorithm: "unknown",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "MD5 used in a digital-signature/certificate algorithm; MD5 signatures are catastrophically broken today (practical chosen-prefix collisions have forged CA certificates) and must be replaced immediately. Quantum-adjacent: migrate the hash alongside the signature algorithm in the PQC re-sign pass.",
+  remediation:
+    "Replace MD5 signature/certificate hashes with SHA-256 or stronger (SHA-384/512 for CNSA 2.0 targets) and re-issue affected certificates immediately; fold the PQC signature migration (ML-DSA) into the same re-key/re-sign effort.",
+};
+
+interface WeakHashRule {
+  meta: RuleMeta;
+  res: readonly RegExp[];
+}
+
+const WEAK_HASH_RULES: readonly WeakHashRule[] = [
+  {
+    meta: RULE_SHA1,
+    res: [RE_SHA1_JAVA, RE_SHA1_X509, RE_SHA1_OID, RE_SHA1_OPENSSL, RE_SHA1_DOTNET],
+  },
+  { meta: RULE_MD5, res: [RE_MD5_JAVA, RE_MD5_X509, RE_MD5_OID, RE_MD5_OPENSSL, RE_MD5_DOTNET] },
+];
+
+/**
+ * True when `content` carries a signature/certificate marker — a signal that any
+ * weak hash present is bound to a signature or cert, not a bare checksum. This is
+ * the guard that keeps `sha1(x)` / `sha1sum` / a password hash from ever firing:
+ * without one of these markers the file is not scanned at all.
+ */
+function hasSignatureMarker(content: string): boolean {
+  if (
+    /with\s?RSA|with\s?DSA|with\s?ECDSA|WithRSAEncryption|ecdsa-with-SHA-?1|dsaWithSHA-?1/i.test(
+      content,
+    )
+  ) {
+    return true;
+  }
+  if (/1\.2\.840\.113549\.1\.1\.[45]|1\.2\.840\.10045\.4\.1/.test(content)) return true;
+  if (/Signature\.getInstance|\.Sign(?:Data|Hash)\s*\(/.test(content)) return true;
+  // OpenSSL only counts as a marker with a cert/signing subcommand or flag.
+  if (/openssl/i.test(content) && /\b(?:req|x509|ca|-signkey|-sign|dgst)\b/i.test(content)) {
+    return true;
+  }
+  return false;
+}
+
+/**
+ * Detects SHA-1 / MD5 used specifically in signature or certificate algorithms
+ * (Java JCA, .NET signing calls, X.509 OID names/OIDs, OpenSSL cert/signing CLI).
+ */
+export const weakHashDetector: Detector = {
+  id: "weak-hash-signature",
+  description: "Weak hash (SHA-1/MD5) in a digital-signature or X.509 certificate algorithm",
+  scope: "config",
+  language: "any",
+  rules: WEAK_HASH_RULES.map((r) => r.meta),
+  // Skip prose/docs: a page explaining `SHA1withRSA` is not live config/code.
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    // Fast reject on the ORIGINAL content: only scan files whose weak hash is
+    // bound to a signature/cert context. A lone `sha1(...)` checksum or a
+    // password hash has no such marker and is skipped wholesale.
+    if (!hasSignatureMarker(content)) return [];
+
+    // Mask C-style block comments and `//` / `#` / `;` line comments so a
+    // commented-out algorithm can't fire. Offsets are preserved, so finding
+    // line/column/snippet for the live lines stay exact.
+    const scan = maskCommentLines(maskBlockComments(content), ["//", "#", ";"]);
+    const findings: Finding[] = [];
+    for (const { meta, res } of WEAK_HASH_RULES) {
+      for (const re of res) {
+        eachMatch(re, scan, (m) =>
+          findings.push(
+            findingFromRule(meta, { file, content, index: m.index, matchLength: m[0].length }),
+          ),
+        );
+      }
+    }
+    return findings;
+  },
+};

package/src/detectors/webauthn.ts

@@ -0,0 +1,205 @@
+/**
+ * Config detector: classical asymmetric signature algorithms pinned by
+ * WebAuthn / FIDO2 / passkey attestation & assertion, expressed as COSE
+ * algorithm identifiers in relying-party code and config
+ * (@simplewebauthn/server, py_webauthn, go-webauthn, webauthn4j).
+ *
+ * WHY WebAuthn is PQC-relevant: a WebAuthn credential is an asymmetric key
+ * pair whose PUBLIC key the authenticator returns (COSE-encoded) at
+ * registration; every subsequent assertion is a classical signature over the
+ * authentication challenge, and attestation statements are classical
+ * signatures over the credential. These are AUTHENTICATION signatures, not
+ * confidentiality — there is nothing to "harvest now" — but the moment a
+ * cryptographically-relevant quantum computer (CRQC) exists, an attacker who
+ * has a user's registered public key (or an attestation CA's key) can FORGE
+ * assertions/attestations and impersonate the user or a genuine authenticator.
+ * So every finding here is `category: "signature"`, `hndl: false`.
+ *
+ * The relying party pins which algorithms it will accept: `pubKeyCredParams`
+ * (registration) and `supportedAlgorithmIDs` (verification) enumerate COSE
+ * `alg` values, and the classical ones — ES256 (COSE -7, ECDSA P-256),
+ * RS256 (-257, RSA), EdDSA (-8) and their P-384/P-521/RSA-2048+ siblings — are
+ * exactly the ones a PQC migration must inventory and replace once FIDO/COSE
+ * standardise post-quantum algorithm identifiers.
+ *
+ * WHY numeric COSE ids need their own detector: the existing JWT/JOSE rule
+ * only matches QUOTED alg strings (`"ES256"`, `"RS256"`). WebAuthn libraries
+ * almost never write those strings — they use the NUMERIC COSE ids
+ * (`alg: -7`, `supportedAlgorithmIDs: [-7, -257]`) and language-level enum
+ * identifiers (`COSEAlgorithmIdentifier.ES256`, `webauthncose.AlgES256`,
+ * `COSEAlgorithmIdentifier.EDDSA`). None of those carry the quote characters
+ * the JWT rule keys off, so the entire WebAuthn surface is invisible today.
+ *
+ * Two independent match shapes per family, both gated by a file-level WebAuthn
+ * marker (see `hasWebauthnMarker`) so the generic numeric `alg: -7` form can't
+ * fire on unrelated code that happens to assign a small negative number:
+ *
+ *  1. NUMERIC form — the COSE `alg` value as an integer, either as an object
+ *     member (`alg: -7`, `alg = -257`) or inside a `supportedAlgorithmIDs`
+ *     array (`supportedAlgorithmIDs: [-7, -257]`). Restricted to the classical
+ *     COSE numbers only; symmetric / KDF / "direct" ids (e.g. -6, HS*) are
+ *     never in the alternation, so they cannot match.
+ *  2. ENUM form — the COSE algorithm's identifier as written in each library:
+ *     `COSEAlgorithmIdentifier.ES256|RS256|EdDSA|ECDSA_SHA_256` (webauthn4j,
+ *     py_webauthn) and Go's `webauthncose.AlgES256` / `AlgRS256` / `AlgEdDSA`
+ *     constants.
+ *
+ * COSE algorithm numbers → {@link AlgorithmFamily} (per the COSE registry, using
+ * the mapping this detector is specified against):
+ *  - ES256 (-7), ES384 (-35), ES512 (-36)      → ECDSA
+ *  - RS256 (-257), RS384 (-258), RS512 (-259)  → RSA
+ *  - EdDSA (-8)                                 → EdDSA
+ *
+ * Fast reject: `detect()` bails unless the file carries a distinctive WebAuthn
+ * API token (`pubKeyCredParams`, `PublicKeyCredential`, `webauthn`,
+ * `COSEAlgorithm`, `supportedAlgorithmIDs`, `navigator.credentials`). Those
+ * tokens are the marker gate ONLY — they never produce a standalone finding.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import {
+  DOC_EXTENSIONS,
+  eachMatch,
+  findingFromRule,
+  hasExtension,
+  maskBlockComments,
+  maskCommentLines,
+} from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+// Classical COSE algorithm numbers, grouped by family (see module docstring).
+const NUM_ECDSA = "7|35|36"; // ES256, ES384, ES512
+const NUM_RSA = "257|258|259"; // RS256, RS384, RS512
+const NUM_EDDSA = "8"; // EdDSA
+
+// --- NUMERIC form: a COSE `alg` value written as an integer. ---
+// (a) object member: `alg: -7`, `alg = -257` (JS/JSON, Python `alg=-7`).
+// `["']?alg["']?` tolerates the JSON/serialized form `"alg": -7` (the WebAuthn
+// options object is JSON-serializable and often stored/transmitted/tested as JSON
+// with a quoted key), as well as the unquoted `alg: -7` / `alg = -7` (audit M2).
+const RE_NUM_ECDSA = new RegExp(`["']?\\balg\\b["']?\\s*[:=]\\s*-(?:${NUM_ECDSA})\\b`, "g");
+const RE_NUM_RSA = new RegExp(`["']?\\balg\\b["']?\\s*[:=]\\s*-(?:${NUM_RSA})\\b`, "g");
+const RE_NUM_EDDSA = new RegExp(`["']?\\balg\\b["']?\\s*[:=]\\s*-(?:${NUM_EDDSA})\\b`, "g");
+// (b) `supportedAlgorithmIDs: [-7, -257]` array (@simplewebauthn verify option).
+// `[^\]]*` stays inside a single array literal; one match per family even when
+// the array lists several ids of that family.
+const RE_IDS_ECDSA = new RegExp(
+  `supportedAlgorithmIDs\\s*[:=]\\s*\\[[^\\]]*-(?:${NUM_ECDSA})\\b`,
+  "g",
+);
+const RE_IDS_RSA = new RegExp(`supportedAlgorithmIDs\\s*[:=]\\s*\\[[^\\]]*-(?:${NUM_RSA})\\b`, "g");
+const RE_IDS_EDDSA = new RegExp(
+  `supportedAlgorithmIDs\\s*[:=]\\s*\\[[^\\]]*-(?:${NUM_EDDSA})\\b`,
+  "g",
+);
+
+// --- ENUM form: the COSE algorithm's language-level identifier. ---
+// webauthn4j / py_webauthn: `COSEAlgorithmIdentifier.<name>`; go-webauthn:
+// `webauthncose.Alg<name>` (matched bare as `Alg<name>`).
+const RE_ENUM_ECDSA =
+  /\bCOSEAlgorithmIdentifier\.(?:ES(?:256|384|512)|ECDSA_SHA_(?:256|384|512))\b|\bAlgES(?:256|384|512)\b/g;
+const RE_ENUM_RSA =
+  /\bCOSEAlgorithmIdentifier\.(?:RS(?:256|384|512)|RSASSA_[A-Za-z0-9_]+)\b|\bAlgRS(?:256|384|512)\b/g;
+const RE_ENUM_EDDSA = /\bCOSEAlgorithmIdentifier\.(?:EdDSA|EDDSA)\b|\bAlgEdDSA\b/g;
+
+const REMEDIATION =
+  "WebAuthn/FIDO2 is standardizing PQC COSE algorithms; inventory the classical attestation/assertion algs now and plan migration.";
+
+const RULE_WEBAUTHN_ECDSA: RuleMeta = {
+  id: "webauthn-ecdsa",
+  title: "WebAuthn ECDSA COSE algorithm",
+  description:
+    "WebAuthn/FIDO2 credential pins a classical ECDSA COSE algorithm (ES256/ES384/ES512)",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "WebAuthn/FIDO2 relying party accepts a classical ECDSA COSE algorithm (ES256/ES384/ES512); attestation/assertion signatures become forgeable once a CRQC exists.",
+  remediation: REMEDIATION,
+};
+const RULE_WEBAUTHN_RSA: RuleMeta = {
+  id: "webauthn-rsa",
+  title: "WebAuthn RSA COSE algorithm",
+  description: "WebAuthn/FIDO2 credential pins a classical RSA COSE algorithm (RS256/RS384/RS512)",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "WebAuthn/FIDO2 relying party accepts a classical RSA COSE algorithm (RS256/RS384/RS512); attestation/assertion signatures become forgeable once a CRQC exists.",
+  remediation: REMEDIATION,
+};
+const RULE_WEBAUTHN_EDDSA: RuleMeta = {
+  id: "webauthn-eddsa",
+  title: "WebAuthn EdDSA COSE algorithm",
+  description: "WebAuthn/FIDO2 credential pins the classical EdDSA COSE algorithm (COSE -8)",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "WebAuthn/FIDO2 relying party accepts the classical EdDSA COSE algorithm (Ed25519); modern but still classical — attestation/assertion signatures become forgeable once a CRQC exists.",
+  remediation: REMEDIATION,
+};
+
+interface WebauthnRule {
+  meta: RuleMeta;
+  res: readonly RegExp[];
+}
+
+const WEBAUTHN_RULES: readonly WebauthnRule[] = [
+  { meta: RULE_WEBAUTHN_ECDSA, res: [RE_NUM_ECDSA, RE_IDS_ECDSA, RE_ENUM_ECDSA] },
+  { meta: RULE_WEBAUTHN_RSA, res: [RE_NUM_RSA, RE_IDS_RSA, RE_ENUM_RSA] },
+  { meta: RULE_WEBAUTHN_EDDSA, res: [RE_NUM_EDDSA, RE_IDS_EDDSA, RE_ENUM_EDDSA] },
+];
+
+/**
+ * True when `content` carries a distinctive WebAuthn API token. Used ONLY as
+ * the fast-reject marker gate — none of these tokens produce a finding — so the
+ * generic numeric `alg: -7` form can't fire on unrelated code.
+ */
+function hasWebauthnMarker(content: string): boolean {
+  return (
+    content.includes("pubKeyCredParams") ||
+    content.includes("PublicKeyCredential") ||
+    content.includes("COSEAlgorithm") ||
+    content.includes("supportedAlgorithmIDs") ||
+    content.includes("navigator.credentials") ||
+    /webauthn/i.test(content)
+  );
+}
+
+/** Detects classical COSE signature algorithms pinned by WebAuthn/FIDO2 relying parties. */
+export const webauthnDetector: Detector = {
+  id: "webauthn-crypto",
+  description: "Classical COSE signature algorithms in WebAuthn/FIDO2/passkey relying-party code",
+  scope: "config",
+  language: "any",
+  rules: WEBAUTHN_RULES.map((r) => r.meta),
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    if (!hasWebauthnMarker(content)) return [];
+
+    // Mask C-style (`//`, `/* */`) and hash (`#`) comments so a commented-out
+    // options object can't fire. Offsets are preserved so finding locations stay
+    // exact.
+    const scan = maskCommentLines(maskBlockComments(content), ["//", "#"]);
+    const findings: Finding[] = [];
+    for (const { meta, res } of WEBAUTHN_RULES) {
+      for (const re of res) {
+        eachMatch(re, scan, (m) =>
+          findings.push(
+            findingFromRule(meta, { file, content, index: m.index, matchLength: m[0].length }),
+          ),
+        );
+      }
+    }
+    return findings;
+  },
+};

package/src/detectors/xmldsig.ts

@@ -0,0 +1,115 @@
+/**
+ * Config detector: classical crypto in XML Digital Signature / XML Encryption
+ * (W3C XML-DSig / XML-Enc), the algorithm layer under SAML SSO, WS-Security /
+ * SOAP, and signed XML documents. Enterprise identity is ubiquitous and its IdP
+ * signing keys are long-lived, so a forged SAML assertion is a prime quantum
+ * forgery surface; an encrypted SAML assertion (RSA key transport) is
+ * harvest-now-decrypt-later exposed.
+ *
+ * Detection keys off the W3C algorithm URIs, which are globally-unique constant
+ * strings (RFC-precise, so a lexical match is exact):
+ *  - `…xmldsig#rsa-sha1` / `…xmldsig-more#rsa-sha256` …  → RSA signature (forgeable)
+ *  - `…xmldsig11#dsa-sha256` / `…xmldsig#dsa-sha1`       → DSA signature
+ *  - `…xmldsig-more#ecdsa-sha256` …                      → ECDSA signature
+ *  - `…xmlenc#rsa-oaep(-mgf1p)` / `…xmlenc#rsa-1_5`      → RSA key transport (HNDL)
+ *
+ * These URIs appear both in XML config (`.xml`) and as string constants in SAML
+ * library code (python3-saml, xml-crypto, OpenSAML), so the detector runs on any
+ * non-doc file.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+// The `#fragment` of the W3C XML-DSig / XML-Enc algorithm URIs. Anchored on the
+// namespace fragment (`xmldsig…#` / `xmlenc#`) so a bare `rsa-sha256` elsewhere
+// doesn't misfire.
+const RE_XMLDSIG_RSA = /\bxmldsig(?:-more|11)?#rsa-sha(?:1|224|256|384|512)\b/g;
+const RE_XMLDSIG_DSA = /\bxmldsig(?:11)?#dsa-sha(?:1|256)\b/g;
+const RE_XMLDSIG_ECDSA = /\bxmldsig-more#ecdsa-sha(?:1|224|256|384|512)\b/g;
+const RE_XMLENC_RSA = /\bxmlenc#rsa-(?:oaep(?:-mgf1p)?|1_5)\b/g;
+
+const RULE_XMLDSIG_RSA: RuleMeta = {
+  id: "xmldsig-rsa-sign",
+  title: "XML-DSig RSA signature",
+  description: "XML Digital Signature with an RSA-SHA* algorithm (SAML/WS-Security)",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "XML signatures (SAML / WS-Security) use classical RSA (rsa-sha*); a quantum attacker could forge assertions signed with this key.",
+  remediation:
+    "Track PQC XML-DSig / SAML profiles (ML-DSA); rotate to a PQC signing key as tooling and IdPs add support.",
+};
+const RULE_XMLDSIG_DSA: RuleMeta = {
+  id: "xmldsig-dsa-sign",
+  title: "XML-DSig DSA signature",
+  description: "XML Digital Signature with a DSA-SHA* algorithm",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "DSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "XML signatures use classical DSA (dsa-sha*) — deprecated and quantum-forgeable.",
+  remediation: "Migrate off DSA now; track PQC XML-DSig profiles (ML-DSA).",
+};
+const RULE_XMLDSIG_ECDSA: RuleMeta = {
+  id: "xmldsig-ecdsa-sign",
+  title: "XML-DSig ECDSA signature",
+  description: "XML Digital Signature with an ECDSA-SHA* algorithm",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "XML signatures use classical ECDSA (ecdsa-sha*); forgeable by a quantum attacker.",
+  remediation:
+    "Track PQC XML-DSig / SAML profiles (ML-DSA); rotate the signing key when supported.",
+};
+const RULE_XMLENC_RSA: RuleMeta = {
+  id: "xmlenc-rsa-keytransport",
+  title: "XML-Enc RSA key transport",
+  description: "XML Encryption with RSA-OAEP / RSA-1_5 key transport (encrypted SAML assertions)",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "XML Encryption wraps the content key with classical RSA (rsa-oaep / rsa-1_5); encrypted XML (e.g. SAML assertions) is harvest-now-decrypt-later exposed.",
+  remediation:
+    "Plan migration to a post-quantum KEM (ML-KEM-768) for key transport as XML-Enc / SAML PQC profiles mature.",
+};
+
+/** Detects classical XML-DSig / XML-Enc algorithms (SAML, WS-Security, signed XML). */
+export const xmldsigDetector: Detector = {
+  id: "xmldsig-crypto",
+  description: "Classical XML-DSig / XML-Enc algorithms (SAML, WS-Security, signed XML)",
+  scope: "config",
+  language: "any",
+  // Skip prose/docs: a page explaining the SAML algorithm URIs is not live config.
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+  rules: [RULE_XMLDSIG_RSA, RULE_XMLDSIG_DSA, RULE_XMLDSIG_ECDSA, RULE_XMLENC_RSA],
+  detect({ file, content }): Finding[] {
+    // Fast reject: only proceed if an XML-DSig / XML-Enc namespace fragment is present.
+    if (!content.includes("xmldsig") && !content.includes("xmlenc")) return [];
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta): void =>
+      eachMatch(re, content, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    add(RE_XMLDSIG_RSA, RULE_XMLDSIG_RSA);
+    add(RE_XMLDSIG_DSA, RULE_XMLDSIG_DSA);
+    add(RE_XMLDSIG_ECDSA, RULE_XMLDSIG_ECDSA);
+    add(RE_XMLENC_RSA, RULE_XMLENC_RSA);
+    return findings;
+  },
+};

package/src/evidence.ts

@@ -52,10 +52,21 @@ export interface ReadinessReport {
   attestation: {
     /** sha256 over the canonicalized deterministic body (excludes scanTimeUtc). */
     contentHash: string;
-    /** RFC-3161 / transparency-log token — filled by an external signer. */
-    timestamp: null;
-    /** Detached signature over `contentHash` — filled by an external signer. */
-    signature: null;
+    /**
+     * RFC-3161 / transparency-log token over `contentHash`, produced by an EXTERNAL
+     * timestamper (opaque string, e.g. base64). `null` until {@link signReadinessReport}
+     * runs one.
+     */
+    timestamp: string | null;
+    /**
+     * Detached signature over `contentHash`, produced by an EXTERNAL signer (opaque
+     * string, e.g. base64/PEM). `null` until {@link signReadinessReport} runs one.
+     */
+    signature: string | null;
+    /** Non-sensitive provenance label of the signer (e.g. "openssl", "cosign"). */
+    signedWith?: string;
+    /** Non-sensitive provenance label of the timestamper (e.g. "openssl-ts"). */
+    timestampedWith?: string;
   };
 }
 
@@ -133,3 +144,115 @@ export function buildReadinessReport(
     attestation: { contentHash, timestamp: null, signature: null },
   } as ReadinessReport;
 }
+
+/** The result of {@link verifyReadinessReport}. */
+export interface VerifyReadinessResult {
+  /** True iff the recomputed body hash equals the hash claimed in the attestation. */
+  valid: boolean;
+  /** The hash recomputed over the report's CURRENT body. */
+  computedHash: string;
+  /** The hash claimed in the report's attestation (`attestation.contentHash`). */
+  claimedHash: string;
+  /** A short human reason; present only when `valid` is false. */
+  reason?: string;
+}
+
+/**
+ * Recompute the deterministic content hash over a readiness report's body and
+ * compare it to the hash the attestation claims. Detects tampering with ANY
+ * hashed field — a finding, the inventory, a policy verdict, or subject/tool
+ * metadata: editing it after the fact changes the recomputed hash, so `valid`
+ * becomes false.
+ *
+ * By construction the scan timestamp, the CBOM envelope, and the attestation
+ * block itself are EXCLUDED from the hash (see {@link buildReadinessReport}), so
+ * touching those does not fail verification — their integrity follows from their
+ * hashed inputs. The body is reconstructed from the report's OWN stored fields
+ * (including `tool.version`), so a report built by an older qScan still verifies.
+ *
+ * This checks the INTEGRITY hash only. It does NOT validate the detached
+ * signature or RFC-3161 timestamp: those are opaque tokens from an external
+ * signer (ADR-0004) and are verified with that signer's own tooling.
+ */
+export function verifyReadinessReport(report: ReadinessReport): VerifyReadinessResult {
+  const hashableBody = {
+    reportType: report.reportType,
+    specVersion: report.specVersion,
+    subject: {
+      repository: report.subject.repository,
+      commit: report.subject.commit,
+      scannedRoot: report.subject.scannedRoot,
+    },
+    tool: { name: report.tool.name, version: report.tool.version },
+    inventory: report.inventory,
+    findings: report.findings,
+    ...(report.policyMapping ? { policyMapping: report.policyMapping } : {}),
+  };
+  const computedHash =
+    "sha256:" +
+    createHash("sha256")
+      .update(JSON.stringify(canonicalize(hashableBody)))
+      .digest("hex");
+  const claimedHash = report.attestation.contentHash;
+  if (computedHash === claimedHash) {
+    return { valid: true, computedHash, claimedHash };
+  }
+  return {
+    valid: false,
+    computedHash,
+    claimedHash,
+    reason: "content-hash mismatch: the report body was modified after it was built",
+  };
+}
+
+/**
+ * An EXTERNAL signer/timestamper the tool orchestrates. Per ADR-0004 the tool
+ * implements no cryptography: it hands the payload to an operator-provided signer
+ * (an `openssl`/`cosign` invocation, an RFC-3161 TSA client, …) and records what
+ * comes back. `label` is a short, non-sensitive provenance string (e.g. the signer
+ * program name) — NOT the full command, which may contain a key path.
+ */
+export interface EvidenceSigner {
+  label: string;
+  /**
+   * Produce a detached signature / timestamp token (opaque string) over `payload`.
+   * May be async so a future signer can shell out OR call a KMS / RFC-3161 TSA over
+   * the network without foreclosing that once this contract freezes at 1.0.
+   */
+  sign(payload: string): string | Promise<string>;
+}
+
+/** Options for {@link signReadinessReport}: a detached-signature and/or a timestamp signer. */
+export interface SignEvidenceOptions {
+  signer?: EvidenceSigner;
+  timestamper?: EvidenceSigner;
+}
+
+/**
+ * Fill a readiness report's attestation with a detached signature and/or RFC-3161
+ * timestamp, produced by EXTERNAL signers over the report's `contentHash`. Pure
+ * orchestration: it invokes the injected signers and records their opaque output
+ * plus a provenance label — it performs no cryptography itself (ADR-0004). Returns a
+ * NEW report; the hashed body is untouched (attestation is excluded from the hash),
+ * so signing never changes `contentHash`.
+ */
+export async function signReadinessReport(
+  report: ReadinessReport,
+  opts: SignEvidenceOptions,
+): Promise<ReadinessReport> {
+  const payload = report.attestation.contentHash;
+  const signature = opts.signer ? await opts.signer.sign(payload) : report.attestation.signature;
+  const timestamp = opts.timestamper
+    ? await opts.timestamper.sign(payload)
+    : report.attestation.timestamp;
+  return {
+    ...report,
+    attestation: {
+      ...report.attestation,
+      signature,
+      timestamp,
+      ...(opts.signer ? { signedWith: opts.signer.label } : {}),
+      ...(opts.timestamper ? { timestampedWith: opts.timestamper.label } : {}),
+    },
+  };
+}