rules:
  - id: c-rsa-quantum-vulnerable
    pattern-either:
      - pattern: RSA_generate_key($SIZE, ...)
      - pattern: RSA_generate_key_ex($RSA, $SIZE, ...)
    message: >-
      QUANTUM VULNERABILITY: RSA is broken by Shor's algorithm regardless of
      key size. Plan migration to post-quantum alternatives (liboqs).
    severity: ERROR
    languages: [c, cpp]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 10

  - id: c-md5-hash
    pattern-either:
      - pattern: MD5($DATA, $LEN, $DIGEST)
      - pattern: MD5_Init(...)
      - pattern: MD5_Update(...)
      - pattern: MD5_Final(...)
    message: >-
      QUANTUM VULNERABILITY: MD5 is cryptographically broken and quantum-vulnerable
      via Grover's algorithm. Use SHA-256 (EVP_sha256) or SHA-3 instead.
    severity: ERROR
    languages: [c, cpp]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: c-sha1-hash
    pattern-either:
      - pattern: SHA1($DATA, $LEN, $DIGEST)
      - pattern: SHA1_Init(...)
      - pattern: SHA1_Update(...)
      - pattern: SHA1_Final(...)
    message: >-
      QUANTUM VULNERABILITY: SHA-1 is deprecated and quantum-vulnerable via
      Grover's algorithm. Use SHA-256 (EVP_sha256) or SHA-3 instead.
    severity: ERROR
    languages: [c, cpp]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: c-des-cipher
    pattern-either:
      - pattern: DES_set_key(...)
      - pattern: DES_ecb_encrypt(...)
      - pattern: DES_cbc_encrypt(...)
      - pattern: DES_ecb3_encrypt(...)
      - pattern: EVP_des_ecb()
      - pattern: EVP_des_cbc()
      - pattern: EVP_des_ede3_cbc()
    message: >-
      QUANTUM VULNERABILITY: DES/3DES is broken classically and quantum-vulnerable.
      Use EVP_aes_256_gcm() instead.
    severity: ERROR
    languages: [c, cpp]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 10

  - id: c-rc4-cipher
    pattern-either:
      - pattern: RC4_set_key(...)
      - pattern: RC4(...)
      - pattern: EVP_rc4()
    message: >-
      RC4 is completely broken and banned by RFC 7465. Use AES-256-GCM instead.
    severity: ERROR
    languages: [c, cpp]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_risk_score: 10

  - id: c-ecc-quantum-vulnerable
    pattern-either:
      - pattern: EC_KEY_new_by_curve_name(...)
      - pattern: EC_KEY_generate_key(...)
      - pattern: ECDSA_sign(...)
      - pattern: ECDSA_verify(...)
      - pattern: ECDH_compute_key(...)
    message: >-
      QUANTUM VULNERABILITY: ECC/ECDSA/ECDH is broken by Shor's algorithm.
      Plan migration to post-quantum alternatives via liboqs or OpenSSL 3.x PQC.
    severity: ERROR
    languages: [c, cpp]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 10

  - id: c-aes-small-key
    pattern-either:
      - pattern: EVP_aes_128_cbc()
      - pattern: EVP_aes_128_gcm()
      - pattern: EVP_aes_128_ecb()
      - pattern: EVP_aes_128_cfb()
      - pattern: EVP_aes_192_cbc()
      - pattern: EVP_aes_192_gcm()
      - pattern: EVP_aes_192_ecb()
      - pattern: EVP_aes_192_cfb()
      - pattern: AES_set_encrypt_key($KEY, 128, ...)
      - pattern: AES_set_encrypt_key($KEY, 192, ...)
      - pattern: AES_set_decrypt_key($KEY, 128, ...)
      - pattern: AES_set_decrypt_key($KEY, 192, ...)
    message: >-
      QUANTUM VULNERABILITY: AES-128 provides 64-bit and AES-192 provides 96-bit
      quantum security via Grover's algorithm. Use EVP_aes_256_gcm() or
      AES_set_encrypt_key with 256-bit key for 128-bit quantum security.
    severity: WARNING
    languages: [c, cpp]
    metadata:
      category: security
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 7
