rules:
- id: bash-md5sum-usage
  message: >-
    Detected use of MD5 hash function via `md5sum`. MD5 is cryptographically
    broken and vulnerable to collision attacks. It is also quantum-vulnerable.
    Use SHA256 or SHA3 instead for cryptographic purposes.
  metadata:
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A02:2021 - Cryptographic Failures
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: HIGH
    quantum_safe: false
    references:
    - https://en.wikipedia.org/wiki/MD5
    - https://www.nist.gov/publications/post-quantum-cryptography
  severity: ERROR
  languages: [bash]
  pattern-either:
    - pattern: md5sum
    - pattern: md5
    - pattern: openssl md5

- id: bash-sha1sum-usage
  message: >-
    Detected use of SHA-1 hash function via `sha1sum`. SHA-1 is cryptographically
    broken and vulnerable to collision attacks. It is also quantum-vulnerable.
    Use SHA256, SHA384, SHA512, or SHA3 instead.
  metadata:
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A02:2021 - Cryptographic Failures
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: HIGH
    quantum_safe: false
    references:
    - https://shattered.io/
    - https://www.nist.gov/publications/post-quantum-cryptography
  severity: ERROR
  languages: [bash]
  pattern-either:
    - pattern: sha1sum
    - pattern: openssl sha1
    - pattern: openssl sha

- id: bash-des-encryption
  message: >-
    Detected use of DES encryption. DES is a deprecated encryption algorithm
    with a 56-bit key size that can be broken in hours. Use AES-256 instead.
  metadata:
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A02:2021 - Cryptographic Failures
    category: security
    technology:
    - bash
    - openssl
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: HIGH
    quantum_safe: false
    references:
    - https://en.wikipedia.org/wiki/Data_Encryption_Standard
  severity: ERROR
  languages: [bash]
  pattern-either:
    - pattern: openssl des ...
    - pattern: openssl des-ecb ...
    - pattern: openssl des-cbc ...
    - pattern: openssl des-cfb ...
    - pattern: openssl des-ofb ...
    - pattern: |
        openssl des ...
    - pattern: |
        openssl des-ecb ...
    - pattern: |
        openssl des-cbc ...

- id: bash-3des-encryption
  message: >-
    Detected use of 3DES (Triple DES) encryption. 3DES is deprecated by NIST
    and vulnerable to practical attacks. Use AES-256 instead.
  metadata:
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A02:2021 - Cryptographic Failures
    category: security
    technology:
    - bash
    - openssl
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: HIGH
    quantum_safe: false
    quantum_vulnerable: true
    quantum_attack: "Grover's Algorithm"
    quantum_risk_score: 8
    references:
    - https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA
  severity: ERROR
  languages: [bash]
  pattern-either:
    - pattern: openssl des3 ...
    - pattern: openssl des-ede ...
    - pattern: openssl des-ede3 ...
    - pattern: openssl des-ede-cbc ...
    - pattern: openssl des-ede3-cbc ...
    - pattern: openssl enc -des3 ...
    - pattern: |
        openssl des3 ...
    - pattern: |
        openssl enc -des3

- id: bash-rc4-encryption
  message: >-
    Detected use of RC4 encryption. RC4 is completely broken and must not be
    used. Multiple practical attacks exist. Use AES-256-GCM instead.
  metadata:
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A02:2021 - Cryptographic Failures
    category: security
    technology:
    - bash
    - openssl
    subcategory:
    - vuln
    likelihood: HIGH
    impact: CRITICAL
    confidence: HIGH
    quantum_safe: false
    references:
    - https://en.wikipedia.org/wiki/RC4
  severity: ERROR
  languages: [bash]
  pattern-either:
    - pattern: openssl rc4 ...
    - pattern: openssl rc4-40 ...
    - pattern: |
        openssl rc4 ...

- id: bash-weak-random-generation
  message: >-
    Detected use of $RANDOM for generating values. $RANDOM is not
    cryptographically secure and predictable. Use /dev/urandom or
    `openssl rand` for cryptographic purposes.
  metadata:
    cwe:
    - 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator'
    owasp:
    - A02:2021 - Cryptographic Failures
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: HIGH
    references:
    - https://www.gnu.org/software/bash/manual/html_node/Bash-Variables.html
  severity: WARNING
  languages: [bash]
  pattern-regex: \$RANDOM\b

- id: bash-blowfish-encryption
  message: >-
    Detected use of Blowfish encryption. Blowfish has a 64-bit block size
    making it vulnerable to birthday attacks. Use AES-256 instead.
  metadata:
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A02:2021 - Cryptographic Failures
    category: security
    technology:
    - bash
    - openssl
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: HIGH
    quantum_safe: false
  severity: WARNING
  languages: [bash]
  pattern-either:
    - pattern: openssl bf ...
    - pattern: openssl bf-cbc ...
    - pattern: |
        openssl bf ...

- id: bash-rsa-key-generation
  message: >-
    RSA key generation detected. RSA is broken by Shor's algorithm on a
    quantum computer regardless of key size. Plan migration to post-quantum
    alternatives.
  metadata:
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    category: security
    technology: [bash, openssl]
    quantum_vulnerable: true
    quantum_attack: "Shor's Algorithm"
    quantum_risk_score: 8
  severity: WARNING
  languages: [bash]
  pattern-either:
    - pattern: openssl genrsa ...
    - pattern: openssl genpkey -algorithm RSA ...
    - pattern: |
        openssl genrsa ...

- id: bash-ecc-key-generation
  message: >-
    ECC key generation detected. All elliptic curves are broken by Shor's
    algorithm on a quantum computer. Plan migration to post-quantum alternatives.
  metadata:
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    category: security
    technology: [bash, openssl]
    quantum_vulnerable: true
    quantum_attack: "Shor's Algorithm"
    quantum_risk_score: 8
  severity: WARNING
  languages: [bash]
  pattern-either:
    - pattern: openssl ecparam ...
    - pattern: openssl genpkey -algorithm EC ...
    - pattern: |
        openssl ecparam ...

- id: bash-dh-params
  message: >-
    Diffie-Hellman parameter generation detected. DH key exchange is broken
    by Shor's algorithm on a quantum computer. Plan migration to post-quantum
    key encapsulation (CRYSTALS-Kyber).
  metadata:
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    category: security
    technology: [bash, openssl]
    quantum_vulnerable: true
    quantum_attack: "Shor's Algorithm"
    quantum_risk_score: 8
  severity: WARNING
  languages: [bash]
  pattern-either:
    - pattern: openssl dhparam ...
    - pattern: |
        openssl dhparam ...

- id: bash-aes128-encryption
  message: >-
    AES-128 encryption detected. Grover's algorithm reduces AES-128 to
    64-bit quantum security. Use AES-256 for quantum resistance.
  metadata:
    cwe:
    - 'CWE-326: Inadequate Encryption Strength'
    category: security
    technology: [bash, openssl]
    quantum_vulnerable: true
    quantum_attack: "Grover's Algorithm"
    quantum_risk_score: 7
  severity: WARNING
  languages: [bash]
  pattern-either:
    - pattern: openssl enc -aes-128-cbc ...
    - pattern: openssl enc -aes-128-gcm ...
    - pattern: openssl enc -aes128 ...
    - pattern: |
        openssl enc -aes-128-cbc ...

- id: bash-aes192-encryption
  message: >-
    AES-192 encryption detected. Grover's algorithm reduces AES-192 to
    96-bit quantum security. Use AES-256 for full quantum resistance.
  metadata:
    cwe:
    - 'CWE-326: Inadequate Encryption Strength'
    category: security
    technology: [bash, openssl]
    quantum_vulnerable: true
    quantum_attack: "Grover's Algorithm"
    quantum_risk_score: 7
  severity: WARNING
  languages: [bash]
  pattern-either:
    - pattern: openssl enc -aes-192-cbc ...
    - pattern: openssl enc -aes-192-gcm ...
    - pattern: openssl enc -aes192 ...
    - pattern: |
        openssl enc -aes-192-cbc ...
