rules:
  - id: java-ecc-quantum-vulnerable
    pattern-either:
      - pattern: KeyPairGenerator.getInstance("EC")
      - pattern: KeyPairGenerator.getInstance("ECDH")
      - pattern: KeyPairGenerator.getInstance("ECDSA")
      - pattern: new ECGenParameterSpec(...)
      - pattern: KeyAgreement.getInstance("ECDH")
      - pattern: Signature.getInstance("SHA256withECDSA")
      - pattern: Signature.getInstance("SHA384withECDSA")
      - pattern: Signature.getInstance("SHA512withECDSA")
    message: >-
      ECC (ECDSA/ECDH) is broken by Shor's algorithm -- all curves (P-256, P-384, secp256k1, Curve25519)
      are equally vulnerable regardless of key size. Migrate: ECDSA  ML-DSA (FIPS 204)  ECDH  ML-KEM
      (FIPS 203).
    severity: ERROR
    languages: [java]
    metadata:
      category: security
      technology: [java, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 10
      post_quantum_alternatives:
        - "CRYSTALS-Dilithium / ML-DSA"
        - "CRYSTALS-Kyber / ML-KEM"
      subcategory: [vuln]
      likelihood: HIGH
      impact: CRITICAL
      confidence: HIGH
