# Protocol Buffers (proto) quantum-crypto vulnerability rules
# All rules use pattern-regex: (not pattern: or patterns:) for opengrep compatibility.
# Language key: proto

rules:
  - id: proto-rsa-algorithm-quantum
    pattern-regex: '["''](?:RSA-?(?:2048|4096|1024|SHA256|SHA1)|sha1WithRSAEncryption|sha256WithRSAEncryption)["'']'
    message: >-
      RSA is broken by Shor's algorithm regardless of key size. Migrate to ML-KEM (FIPS 203) for key
      encapsulation or ML-DSA (FIPS 204) for signatures.
    severity: WARNING
    languages: [proto]
    metadata:
      category: security
      technology: [proto, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: proto-ecdsa-algorithm-quantum
    pattern-regex: '["''](?:ecdsa-with-SHA(?:256|384|512)|ecPublicKey|ECDSA-P256|ECDSA-P384)["'']'
    message: >-
      QUANTUM VULNERABILITY: ECDSA algorithm reference detected in protobuf definition. Elliptic curve
      cryptography (ECDSA) is vulnerable to Shor's algorithm on a sufficiently powerful quantum computer,
      making all key sizes insecure regardless of curve parameters.
    severity: WARNING
    languages: [proto]
    metadata:
      category: security
      technology: [proto, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: proto-weak-hash-quantum
    pattern-regex: '["''](?:MD5|SHA1|SHA-1|md5|sha1)["'']'
    message: >-
      QUANTUM VULNERABILITY: Weak hash algorithm (MD5 or SHA-1) detected in protobuf definition.
      Use SHA-256 or SHA-3 instead.
    severity: ERROR
    languages: [proto]
    metadata:
      category: security
      technology: [proto, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: proto-weak-symmetric-quantum
    pattern-regex: '["''](?:DES|3DES|DES-CBC|DES-ECB|RC4|ARCFOUR|AES-128|AES128|aes-128|aes128|AES-192|AES192|aes-192|aes192)["'']'
    message: >-
      QUANTUM VULNERABILITY: Weak symmetric cipher detected in protobuf definition.
      DES/3DES/RC4 are classically broken. AES-128/192 provide insufficient post-quantum security.
      Use AES-256-GCM instead.
    severity: ERROR
    languages: [proto]
    metadata:
      category: security
      technology: [proto, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 10

  - id: proto-dh-dsa-quantum
    pattern-regex: '["''](?:DH|DiffieHellman|diffie-hellman|DSA|dsa)["'']'
    message: >-
      QUANTUM VULNERABILITY: DH/DSA algorithm reference detected in protobuf definition.
      Both are broken by Shor's algorithm. Migrate to CRYSTALS-Kyber (DH replacement)
      or CRYSTALS-Dilithium (DSA replacement).
    severity: WARNING
    languages: [proto]
    metadata:
      category: security
      technology: [proto, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 10

  - id: proto-weak-tls-version-quantum
    pattern-regex: '(?:tls_version|min_tls_version|ssl_version)\s*[=:]\s*["'']?(?:TLS_?1_?[01]|SSLv3)'
    message: >-
      ECC (ECDSA/ECDH) is broken by Shor's algorithm -- all curves (P-256, P-384, secp256k1, Curve25519)
      are equally vulnerable regardless of key size. Migrate: ECDSA  ML-DSA (FIPS 204)  ECDH  ML-KEM
      (FIPS 203).
    severity: ERROR
    languages: [proto]
    metadata:
      category: security
      technology: [proto, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 10
