# Scheme quantum-crypto vulnerability rules
# All rules use pattern-regex: (not pattern: or patterns:) for opengrep compatibility.
# Language key: scheme

rules:
  - id: scheme-use-of-md5-quantum
    pattern-regex: '\(md5\b|\(md5-string\b|\(digest->string\s+\(make-md5-generator\b'
    message: >-
      MD5 is cryptographically broken and quantum-weakened by Grover's algorithm -- effective security
      drops from 128 to 64 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: ERROR
    languages: [scheme]
    metadata:
      category: security
      technology: [scheme, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: scheme-use-of-sha1-quantum
    pattern-regex: '\(sha1\b|\(sha1-string\b|\(digest->string\s+\(make-sha1-generator\b'
    message: >-
      SHA-1 is deprecated and quantum-weakened by Grover's algorithm -- effective security drops from 160
      to 80 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: ERROR
    languages: [scheme]
    metadata:
      category: security
      technology: [scheme, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: scheme-use-of-des-quantum
    pattern-regex: '\(des-\w*\s|\(crypt-des\b|\(make-des-\w+'
    message: >-
      DES has a 56-bit key -- completely broken classically and trivially quantum-vulnerable. Migrate to
      AES-256-GCM.
    severity: ERROR
    languages: [scheme]
    metadata:
      category: security
      technology: [scheme, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 10

  - id: scheme-use-of-rsa-quantum
    pattern-regex: '\(rsa-\w+\s|\(generate-rsa-\w+\b|\(rsa-decrypt\b|\(rsa-encrypt\b'
    message: >-
      RSA is broken by Shor's algorithm regardless of key size. Migrate to ML-KEM (FIPS 203) for key
      encapsulation or ML-DSA (FIPS 204) for signatures.
    severity: WARNING
    languages: [scheme]
    metadata:
      category: security
      technology: [scheme, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8
