@sebastienrousseau/crypto-cbom 0.0.9 → 0.0.25

package/dist/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,eAAe,EACf,WAAW,EACX,aAAa,EACb,QAAQ,EACR,sBAAsB,EACvB,MAAM,SAAS,CAAC;AAGjB,eAAO,MAAM,gBAAgB,uHACyF,CAAC;AAgBvH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAO3E;AA0GD,wBAAgB,SAAS,CACvB,KAAK,EAAE,aAAa,GAAG,QAAQ,GAAG,WAAW,EAAE,GAC9C,eAAe,CA+BjB"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,eAAe,EACf,WAAW,EACX,aAAa,EACb,QAAQ,EACR,sBAAsB,EACvB,MAAM,SAAS,CAAC;AAGjB,eAAO,MAAM,gBAAgB,uHACyF,CAAC;AA0BvH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAQ3E;AA0GD,wBAAgB,SAAS,CACvB,KAAK,EAAE,aAAa,GAAG,QAAQ,GAAG,WAAW,EAAE,GAC9C,eAAe,CA+BjB"}

package/dist/audit.js

@@ -5,13 +5,24 @@ exports.classifyPrimitive = classifyPrimitive;
 exports.auditCbom = auditCbom;
 exports.AUDIT_DISCLAIMER = "Heuristic cryptographic posture score derived from algorithm names; it is not a DORA or CRA compliance assessment.";
 const BROKEN_MARKERS = ["MD5", "SHA-1", "DES", "RC4", "ECB"];
-const QUANTUM_VULNERABLE_MARKERS = ["RSA", "ECC", "ECDSA", "ED25519"];
+const HYBRID_MARKERS = ["HYBRID", "+ML-KEM", "+ML-DSA", "PQ-STREAM"];
+const QUANTUM_VULNERABLE_MARKERS = [
+    "RSA",
+    "ECC",
+    "ECDSA",
+    "ED25519",
+    "X25519",
+    "X448",
+    "DIFFIE-HELLMAN",
+];
 const TRANSITIONAL_MARKERS = ["AES-128", "CBC"];
 function classifyPrimitive(primitive) {
     const upper = primitive.toUpperCase();
     const has = (markers) => markers.some((m) => upper.includes(m));
     if (has(BROKEN_MARKERS))
         return "DEPRECATED_BROKEN";
+    if (has(HYBRID_MARKERS))
+        return "TRANSITIONAL_HYBRID";
     if (has(QUANTUM_VULNERABLE_MARKERS))
         return "VULNERABLE_CRQC";
     if (has(TRANSITIONAL_MARKERS))

package/dist/scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,WAAW,EAGZ,MAAM,SAAS,CAAC;AA8OjB,wBAAgB,QAAQ,CACtB,UAAU,EAAE,MAAM,EAClB,QAAQ,SAAY,GACnB,WAAW,EAAE,CA8Bf;AAKD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE,CA6C5D"}
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,WAAW,EAGZ,MAAM,SAAS,CAAC;AAuQjB,wBAAgB,QAAQ,CACtB,UAAU,EAAE,MAAM,EAClB,QAAQ,SAAY,GACnB,WAAW,EAAE,CA8Bf;AAKD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE,CA6C5D"}

package/dist/scanner.js

@@ -18,7 +18,7 @@ const ASSET_RULES = [
         standard: "NIST FIPS 203",
     },
     {
-        pattern: /\bml[-_]?kem[-_]?768\b/i,
+        pattern: /(?<!(?:x25519|x448)[-_])\bml[-_]?kem[-_]?768\b/i,
         name: "ML-KEM-768",
         algorithm: "ML-KEM",
         type: "kem",
@@ -67,6 +67,22 @@ const ASSET_RULES = [
         resistanceLevel: "QUANTUM_SAFE",
         standard: "NIST FIPS 205",
     },
+    {
+        pattern: /\bfn[-_]?dsa\b/i,
+        name: "FN-DSA",
+        algorithm: "FN-DSA",
+        type: "signature",
+        resistanceLevel: "QUANTUM_SAFE",
+        standard: "NIST FIPS 206",
+    },
+    {
+        pattern: /\bx25519[-_]ml[-_]?kem[-_]?768\b/i,
+        name: "X25519 + ML-KEM-768",
+        algorithm: "Hybrid KEM",
+        type: "kem",
+        resistanceLevel: "QUANTUM_SAFE",
+        standard: "IETF Hybrid / NIST IR 8547",
+    },
     {
         pattern: /\baes[-_]?256[-_]?gcm\b/i,
         name: "AES-256-GCM",
@@ -140,6 +156,15 @@ const ASSET_RULES = [
         resistanceLevel: "VULNERABLE_CRQC",
         standard: "RFC 8032",
     },
+    {
+        pattern: /\bx25519\b(?![-_]ml[-_]?kem)/i,
+        name: "X25519",
+        algorithm: "X25519",
+        type: "algorithm",
+        keySize: 256,
+        resistanceLevel: "VULNERABLE_CRQC",
+        standard: "RFC 7748",
+    },
     {
         pattern: /\b(?:ecdsa|ecdh|prime256v1|secp256r1|secp384r1)\b/i,
         name: "ECDSA / ECDH",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienrousseau/crypto-cbom",
-  "version": "0.0.9",
+  "version": "0.0.25",
   "description": "Cryptographic Bill of Materials (CBOM) generator and auditor compliant with CycloneDX 1.6, SPDX 3.0, EU DORA Articles 9/13, and CRA Article 14.",
   "author": "Sebastien Rousseau <sebastienrousseau@users.noreply.github.com>",
   "license": "MIT OR Apache-2.0",
@@ -37,7 +37,7 @@
     "dist/**/*.d.ts.map"
   ],
   "dependencies": {
-    "@sebastienrousseau/crypto-lib": "0.0.9"
+    "@sebastienrousseau/crypto-lib": "0.0.25"
   },
   "devDependencies": {
     "@types/chai": "^5.2.3",