rules:
  - id: rust-md5-hash
    pattern-either:
      - pattern: Md5::new()
      - pattern: md5::compute(...)
    message: >-
      QUANTUM VULNERABILITY: MD5 is cryptographically broken and quantum-vulnerable
      via Grover's algorithm. Use SHA-256 (sha2 crate) or SHA-3 instead.
    severity: ERROR
    languages: [rust]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: rust-sha1-hash
    pattern-either:
      - pattern: Sha1::new()
    message: >-
      QUANTUM VULNERABILITY: SHA-1 is deprecated and quantum-vulnerable via
      Grover's algorithm. Use SHA-256 (sha2 crate) or SHA-3 instead.
    severity: ERROR
    languages: [rust]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: rust-des-cipher
    pattern-either:
      - pattern: Des::new(...)
      - pattern: TdesEde3::new(...)
      - pattern: TdesEde2::new(...)
    message: >-
      QUANTUM VULNERABILITY: DES/3DES is broken classically and quantum-vulnerable.
      Use AES-256-GCM (aes-gcm crate) instead.
    severity: ERROR
    languages: [rust]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 10

  - id: rust-rc4-cipher
    pattern-either:
      - pattern: Rc4::new(...)
    message: >-
      RC4 is completely broken and banned by RFC 7465. Use AES-256-GCM instead.
    severity: ERROR
    languages: [rust]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_risk_score: 10

  - id: rust-ecc-quantum-vulnerable
    pattern-either:
      - pattern: p256::SecretKey::random(...)
      - pattern: p384::SecretKey::random(...)
      - pattern: k256::SecretKey::random(...)
      - pattern: p256::ecdsa::SigningKey::random(...)
      - pattern: p384::ecdsa::SigningKey::random(...)
    message: >-
      QUANTUM VULNERABILITY: ECC (P-256/P-384/secp256k1) is broken by Shor's
      algorithm. Plan migration to post-quantum alternatives (pqcrypto crate).
    severity: ERROR
    languages: [rust]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 10
