rules:
  - id: javascript-weak-rsa-key-size
    patterns:
      - pattern-inside: |
          crypto.generateKeyPairSync('rsa', { ... })
      - pattern: |
          { modulusLength: $SIZE, ... }
      - metavariable-comparison:
          metavariable: $SIZE
          comparison: $SIZE < 2048
    message: >-
      Weak RSA key size detected ($SIZE bits). RSA keys smaller than 2048 bits
      are vulnerable to quantum attacks. NIST recommends minimum 2048 bits,
      preferably 3072+ bits for quantum resistance. Consider migrating to
      post-quantum cryptography (PQC) algorithms.
    severity: ERROR
    languages:
      - javascript
      - typescript
    metadata:
      category: security
      technology:
        - nodejs
        - crypto
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      references:
        - https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final
        - https://www.keylength.com/
