rules:
  - id: java-weak-ecc-curve
    pattern-either:
      - pattern: KeyPairGenerator.getInstance("EC")
      - pattern: KeyPairGenerator.getInstance("ECDH")
      - pattern: KeyPairGenerator.getInstance("ECDSA")
      - pattern: new ECGenParameterSpec("secp256r1")
      - pattern: new ECGenParameterSpec("secp384r1")
      - pattern: new ECGenParameterSpec("secp521r1")
      - pattern: new ECGenParameterSpec("prime256v1")
    message: Quantum-vulnerable ECC curve detected
    severity: WARNING
    languages:
      - java
    metadata:
      category: security
      quantum_vulnerable: true
      quantum_risk_score: 85
