# ============================================================
# Quantum Cryptography Vulnerability Rules -- HCL
# ============================================================
# Language: HCL (HashiCorp Configuration Language)
# Rule format: pattern-regex (NOT pattern: or patterns:)
#
# Why pattern-regex:
#   opengrep's AST parser for HCL is designed for Terraform resource
#   block structure and does not reliably match attribute assignments
#   inside nested blocks with arbitrary nesting depth (e.g., Vault
#   PKI backend roles, listener blocks). Using pattern-regex provides
#   consistent detection of key_type, key_algorithm, and tls_min_version
#   attribute values regardless of block nesting or whitespace style.
#
# Approach:
#   Rules target specific HCL attribute assignments commonly found in
#   HashiCorp Vault PKI secret backend role configurations and Vault
#   listener (TCP) blocks. These are the primary locations in
#   infrastructure-as-code where quantum-vulnerable cryptographic
#   algorithm choices are hard-coded into deployment configuration.
#   The tls_min_version rule targets outdated TLS versions that
#   block PQC cipher suite negotiation, making quantum-safe migration
#   impossible without a minimum of TLS 1.3.
# ============================================================

rules:
  - id: hcl-rsa-key-type-quantum
    pattern-regex: "key_type\\s*=\\s*[\"'](?:rsa-2048|rsa-4096|rsa-1024|rsa)[\"']"
    message: >-
      RSA is broken by Shor's algorithm regardless of key size. Migrate to ML-KEM (FIPS 203) for key
      encapsulation or ML-DSA (FIPS 204) for signatures.
    severity: WARNING
    languages: [hcl]
    metadata:
      category: security
      technology: [hcl, vault, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: hcl-ecdsa-key-type-quantum
    pattern-regex: "key_type\\s*=\\s*[\"'](?:ec|ecdsa|EC)[\"']"
    message: >-
      ECC (ECDSA/ECDH) is broken by Shor's algorithm -- all curves (P-256, P-384, secp256k1, Curve25519)
      are equally vulnerable regardless of key size. Migrate: ECDSA  ML-DSA (FIPS 204)  ECDH  ML-KEM
      (FIPS 203).
    severity: WARNING
    languages: [hcl]
    metadata:
      category: security
      technology: [hcl, vault, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: hcl-rsa-algorithm-quantum
    pattern-regex: "key_algorithm\\s*=\\s*[\"'](?:RSA|rsa)[\"']"
    message: >-
      RSA is broken by Shor's algorithm regardless of key size. Migrate to ML-KEM (FIPS 203) for key
      encapsulation or ML-DSA (FIPS 204) for signatures.
    severity: WARNING
    languages: [hcl]
    metadata:
      category: security
      technology: [hcl, vault, terraform, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: hcl-weak-tls-version-quantum
    pattern-regex: "tls_min_version\\s*=\\s*[\"'](?:tls10|tls11|TLS10|TLS11)[\"']"
    message: >-
      TLS 1.0/1.1 use broken cipher suites (RC4, 3DES, EXPORT) and are prohibited by RFC 8996. Upgrade to
      TLS 1.3.
    severity: ERROR
    languages: [hcl]
    metadata:
      category: security
      technology: [hcl, vault, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 10

  - id: hcl-ecdsa-cert-role-quantum
    pattern-regex: "key_bits\\s*=\\s*(?:256|384|521)\\b"
    message: >-
      QUANTUM VULNERABILITY: Elliptic Curve key bit size detected in PKI configuration.
      All EC curves are broken by Shor's algorithm.
    severity: WARNING
    languages: [hcl]
    metadata:
      category: security
      technology: [hcl, vault, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: hcl-weak-hash-quantum
    pattern-regex: "(?:hash_algorithm|password_hash|digest)\\s*=\\s*[\"'](?:MD5|md5|SHA1|sha1|SHA-1)[\"']"
    message: >-
      QUANTUM VULNERABILITY: Weak hash algorithm (MD5/SHA1) configured in HCL.
      Grover's algorithm reduces MD5 to 64-bit and SHA1 to 80-bit quantum security.
      Use SHA-256 or SHA-3 instead.
    severity: ERROR
    languages: [hcl]
    metadata:
      category: security
      technology: [hcl, vault, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: hcl-weak-cipher-quantum
    pattern-regex: "cipher\\s*=\\s*[\"'](?:DES|des|3DES|3des|RC4|rc4|AES-128|aes-128|AES-192|aes-192)[\"']"
    message: >-
      QUANTUM VULNERABILITY: Weak cipher configured in HCL.
      DES/3DES/RC4 are classically broken. AES-128/192 provide insufficient
      post-quantum security. Use AES-256-GCM.
    severity: ERROR
    languages: [hcl]
    metadata:
      category: security
      technology: [hcl, vault, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 10
