rules:
  - id: csharp-weak-symmetric-cipher
    pattern-either:
      - pattern: |
          $AES = Aes.Create()
          ...
          $AES.KeySize = 128
      - pattern: |
          $AES = Aes.Create()
          ...
          $AES.KeySize = 192
      - pattern: new DESCryptoServiceProvider()
      - pattern: DES.Create()
      - pattern: new TripleDESCryptoServiceProvider()
      - pattern: TripleDES.Create()
      - pattern: new RC2CryptoServiceProvider()
      - pattern: RC2.Create()
    message: >-
      QUANTUM VULNERABILITY: AES-128/192 provide only 64/96-bit quantum security
      via Grover's algorithm. DES/3DES/RC2 are classically broken and quantum-vulnerable.
      Use AES-256 for quantum resistance.
    severity: WARNING
    languages:
      - csharp
    metadata:
      category: security
      quantum_vulnerable: true
      quantum_risk_score: 75
