rules:
  - id: jsonnet-use-of-md5-quantum
    pattern-regex: '(?i)["\s:]md5["\s,]'
    message: >-
      MD5 is cryptographically broken and quantum-weakened by Grover's algorithm -- effective security
      drops from 128 to 64 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [jsonnet, post-quantum]
      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
      owasp: ["A02:2021 - Cryptographic Failures"]
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: jsonnet-use-of-sha1-quantum
    pattern-regex: '(?i)["\s:]sha-?1["\s,]'
    message: >-
      SHA-1 is deprecated and quantum-weakened by Grover's algorithm -- effective security drops from 160
      to 80 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [jsonnet, post-quantum]
      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
      owasp: ["A02:2021 - Cryptographic Failures"]
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: jsonnet-use-of-des-quantum
    pattern-regex: '(?i)["\s:](?:des|3des|triple-?des)["\s,-]'
    message: >-
      3DES has 112-bit effective key strength -- broken classically and quantum-vulnerable. NIST deprecated
      3DES in 2023. Migrate to AES-256-GCM.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [jsonnet, post-quantum]
      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
      owasp: ["A02:2021 - Cryptographic Failures"]
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: jsonnet-use-of-rc4-quantum
    pattern-regex: '(?i)["\s:]rc4["\s,]'
    message: >-
      RC4 is completely broken and banned by RFC 7465. Migrate to AES-256-GCM or ChaCha20-Poly1305.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [jsonnet, post-quantum]
      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
      owasp: ["A02:2021 - Cryptographic Failures"]
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: jsonnet-use-of-rsa-quantum
    pattern-regex: '(?i)["\s:](?:rsa|rs256|rs384|rs512)["\s,]'
    message: >-
      RSA is broken by Shor's algorithm regardless of key size. Migrate to ML-KEM (FIPS 203) for key
      encapsulation or ML-DSA (FIPS 204) for signatures.
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [jsonnet, post-quantum]
      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
      owasp: ["A02:2021 - Cryptographic Failures"]
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: jsonnet-use-of-ecc-quantum
    pattern-regex: '(?i)["\s:](?:ecdsa|ecdh|es256|es384|es512|ec)["\s,]'
    message: >-
      QUANTUM VULNERABILITY: ECC/ECDSA algorithm detected in Jsonnet config. Shor's algorithm breaks
      elliptic curve cryptography.
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [jsonnet, post-quantum]
      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
      owasp: ["A02:2021 - Cryptographic Failures"]
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: jsonnet-use-of-aes128-quantum
    pattern-regex: '(?i)["\s:]aes-?128["\s,-]'
    message: >-
      AES-128/192 provide only 64/96-bit quantum security under Grover's algorithm. Use AES-256 for
      128-bit post-quantum security.
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [jsonnet, post-quantum]
      cwe: ["CWE-326: Inadequate Encryption Strength"]
      owasp: ["A02:2021 - Cryptographic Failures"]
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 7

  - id: jsonnet-use-of-aes192-quantum
    pattern-regex: '(?i)["\s:]aes-?192["\s,-]'
    message: >-
      AES-128/192 provide only 64/96-bit quantum security under Grover's algorithm. Use AES-256 for
      128-bit post-quantum security.
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [jsonnet, post-quantum]
      cwe: ["CWE-326: Inadequate Encryption Strength"]
      owasp: ["A02:2021 - Cryptographic Failures"]
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 6
