rules:
  - id: swift-md5-hash
    patterns:
      - pattern-either:
          - pattern: CC_MD5(...)
          - pattern: "Insecure.MD5.hash(data: ...)"
    message: >-
      QUANTUM VULNERABILITY: MD5 is cryptographically broken and quantum-vulnerable
      via Grover's algorithm. Use SHA256 or SHA512 from CryptoKit instead.
    severity: ERROR
    languages: [swift]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: swift-sha1-hash
    patterns:
      - pattern-either:
          - pattern: CC_SHA1(...)
          - pattern: "Insecure.SHA1.hash(data: ...)"
    message: >-
      QUANTUM VULNERABILITY: SHA-1 is deprecated and quantum-vulnerable via
      Grover's algorithm. Use SHA256 or SHA512 from CryptoKit instead.
    severity: ERROR
    languages: [swift]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: swift-des-cipher
    patterns:
      - pattern-either:
          - pattern: CCCrypt($OP, kCCAlgorithmDES, ...)
          - pattern: CCCrypt($OP, CCAlgorithm(kCCAlgorithmDES), ...)
          - pattern: CCCrypt($OP, kCCAlgorithm3DES, ...)
          - pattern: CCCrypt($OP, CCAlgorithm(kCCAlgorithm3DES), ...)
          - pattern: CCCryptorCreate($OP, kCCAlgorithmDES, ...)
          - pattern: CCCryptorCreate($OP, kCCAlgorithm3DES, ...)
    message: >-
      QUANTUM VULNERABILITY: DES/3DES is broken classically and quantum-vulnerable.
      Use AES.GCM from CryptoKit instead.
    severity: ERROR
    languages: [swift]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 10

  - id: swift-aes-small-key
    patterns:
      - pattern-either:
          - pattern: CCCrypt($OP, kCCAlgorithmAES, $OPT, $KEY, kCCKeySizeAES128, ...)
          - pattern: CCCrypt($OP, kCCAlgorithmAES, $OPT, $KEY, kCCKeySizeAES192, ...)
          - pattern: CCCryptorCreate($OP, kCCAlgorithmAES, $OPT, $KEY, kCCKeySizeAES128, ...)
          - pattern: CCCryptorCreate($OP, kCCAlgorithmAES, $OPT, $KEY, kCCKeySizeAES192, ...)
    message: >-
      QUANTUM VULNERABILITY: AES-128 provides 64-bit and AES-192 provides 96-bit
      quantum security via Grover's algorithm. Use kCCKeySizeAES256 for 128-bit
      quantum security.
    severity: WARNING
    languages: [swift]
    metadata:
      category: security
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 7
