# ============================================================
# Quantum Cryptography Vulnerability Rules -- Visual Basic (VB)
# ============================================================
# Language: Visual Basic (.NET)
# Rule format: pattern-regex (NOT pattern: or patterns:)
#
# Why pattern-regex:
#   opengrep's AST parser support for Visual Basic is limited and
#   may not reliably parse VB.NET's verbose object instantiation
#   syntax (e.g., "New MD5CryptoServiceProvider()" or
#   "Dim x As New SHA1Managed"). Using pattern-regex provides
#   robust, whitespace-tolerant detection directly against source
#   text without relying on AST construction.
#
# Approach:
#   Each rule targets the .NET cryptographic class name as it
#   appears in VB.NET source: constructor calls, type declarations,
#   and "As New" patterns. Patterns use word-boundary anchors (\b)
#   to avoid matching partial class names (e.g., HMACSHA1 when
#   scanning for SHA1CryptoServiceProvider).
# ============================================================

rules:
  - id: vb-use-of-md5-quantum
    pattern-regex: "(?:MD5CryptoServiceProvider|MD5\\.Create\\s*\\(\\s*\\)|New\\s+MD5CryptoServiceProvider)"
    message: >-
      MD5 is cryptographically broken and quantum-weakened by Grover's algorithm -- effective security
      drops from 128 to 64 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: ERROR
    languages: [vb]
    metadata:
      category: security
      technology: [vb, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-328: Use of Weak Hash"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: vb-use-of-sha1-quantum
    pattern-regex: "(?:SHA1CryptoServiceProvider|SHA1Managed|SHA1\\.Create\\s*\\(\\s*\\)|New\\s+SHA1(?:CryptoServiceProvider|Managed))"
    message: >-
      SHA-1 is deprecated and quantum-weakened by Grover's algorithm -- effective security drops from 160
      to 80 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: ERROR
    languages: [vb]
    metadata:
      category: security
      technology: [vb, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-328: Use of Weak Hash"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: vb-use-of-rsa-quantum
    pattern-regex: "RSACryptoServiceProvider\\b"
    message: >-
      RSA key size $SIZE bits is too small and quantum-vulnerable. RSA is broken by Shor's algorithm
      regardless of key size. Migrate to ML-KEM (FIPS 203) for key encapsulation or ML-DSA (FIPS 204) for
      signatures.
    severity: WARNING
    languages: [vb]
    metadata:
      category: security
      technology: [vb, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: vb-use-of-dsa-quantum
    pattern-regex: "DSACryptoServiceProvider\\b"
    message: >-
      DH/DSA is broken by Shor's algorithm. Migrate to ML-KEM (FIPS 203) for key exchange or ML-DSA (FIPS
      204) for signatures.
    severity: WARNING
    languages: [vb]
    metadata:
      category: security
      technology: [vb, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: vb-use-of-des-quantum
    pattern-regex: "DESCryptoServiceProvider\\b"
    message: >-
      DES has a 56-bit key -- completely broken classically and trivially quantum-vulnerable. Migrate to
      AES-256-GCM.
    severity: ERROR
    languages: [vb]
    metadata:
      category: security
      technology: [vb, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 10

  - id: vb-use-of-3des-quantum
    pattern-regex: "TripleDESCryptoServiceProvider\\b"
    message: >-
      3DES has 112-bit effective key strength -- broken classically and quantum-vulnerable. NIST deprecated
      3DES in 2023. Migrate to AES-256-GCM.
    severity: ERROR
    languages: [vb]
    metadata:
      category: security
      technology: [vb, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 8

  - id: vb-use-of-rc2-quantum
    pattern-regex: "RC2CryptoServiceProvider\\b"
    message: >-
      QUANTUM VULNERABILITY: RC2 stream cipher detected via RC2CryptoServiceProvider. RC2 has a maximum
      effective key size of 128 bits but is known to be weak and has been broken by classical
      cryptanalysis. Grover's algorithm further reduces its quantum security margin, making it completely
      unsuitable for any security-sensitive application.
    severity: ERROR
    languages: [vb]
    metadata:
      category: security
      technology: [vb, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 8

  - id: vb-use-of-ecdh-quantum
    pattern-regex: "ECDiffieHellman\\b"
    message: >-
      QUANTUM VULNERABILITY: ECDH key exchange detected. All elliptic curves
      are broken by Shor's algorithm. Migrate to CRYSTALS-Kyber (ML-KEM).
    severity: WARNING
    languages: [vb]
    metadata:
      category: security
      technology: [vb, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: vb-use-of-ecdsa-quantum
    pattern-regex: "ECDsaCng\\b"
    message: >-
      QUANTUM VULNERABILITY: ECDSA detected. All elliptic curves are broken
      by Shor's algorithm. Migrate to CRYSTALS-Dilithium (ML-DSA).
    severity: WARNING
    languages: [vb]
    metadata:
      category: security
      technology: [vb, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: vb-aes-ecb-mode
    pattern-regex: "\\.Mode\\s*=\\s*CipherMode\\.ECB\\b"
    message: >-
      AES in ECB mode leaks data patterns -- identical plaintext blocks produce identical ciphertext. Use
      AES-256-GCM for authenticated encryption.
    severity: ERROR
    languages: [vb]
    metadata:
      category: security
      technology: [vb, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 8

  - id: vb-aes-small-key-quantum
    pattern-regex: "\\.KeySize\\s*=\\s*(?:128|192)\\b"
    message: >-
      QUANTUM VULNERABILITY: AES-128 provides 64-bit and AES-192 provides
      96-bit quantum security via Grover's algorithm. Use KeySize = 256
      for 128-bit quantum security.
    severity: WARNING
    languages: [vb]
    metadata:
      category: security
      technology: [vb, post-quantum]
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 7
