rules:
  - id: kotlin-weak-dh-dsa
    pattern-either:
      - pattern: KeyPairGenerator.getInstance("DH")
      - pattern: KeyPairGenerator.getInstance("DSA")
      - pattern: KeyAgreement.getInstance("DH")
      - pattern: AlgorithmParameterGenerator.getInstance("DH")
    message: >-
      QUANTUM VULNERABILITY: DH/DSA is broken by Shor's algorithm.
      Migrate to CRYSTALS-Kyber (ML-KEM) for key exchange or
      CRYSTALS-Dilithium (ML-DSA) for signatures.
    severity: ERROR
    languages: [kotlin]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 10
