rules:
  - id: scala-weak-rsa-key-size
    patterns:
      - pattern: $KG.initialize($SIZE)
      - pattern-inside: |
          val $KG = KeyPairGenerator.getInstance("RSA")
          ...
      - metavariable-comparison:
          metavariable: $SIZE
          comparison: $SIZE < 2048
    message: >-
      QUANTUM VULNERABILITY: RSA key size $SIZE bits. RSA is broken by Shor's
      algorithm. Migrate to CRYSTALS-Kyber (ML-KEM) or CRYSTALS-Dilithium (ML-DSA).
    severity: ERROR
    languages: [scala]
    metadata:
      category: security
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 10

  - id: scala-weak-ecc-curve
    pattern-either:
      - pattern: KeyPairGenerator.getInstance("EC")
      - pattern: KeyPairGenerator.getInstance("ECDH")
      - pattern: KeyPairGenerator.getInstance("ECDSA")
      - pattern: new ECGenParameterSpec(...)
      - pattern: KeyAgreement.getInstance("ECDH")
    message: >-
      QUANTUM VULNERABILITY: ECC/ECDSA/ECDH is broken by Shor's algorithm.
      Migrate to CRYSTALS-Dilithium (ML-DSA) or CRYSTALS-Kyber (ML-KEM).
    severity: ERROR
    languages: [scala]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 10

  - id: scala-weak-dh-dsa
    pattern-either:
      - pattern: KeyPairGenerator.getInstance("DH")
      - pattern: KeyPairGenerator.getInstance("DSA")
      - pattern: KeyAgreement.getInstance("DH")
    message: >-
      QUANTUM VULNERABILITY: DH/DSA is broken by Shor's algorithm.
      Migrate to CRYSTALS-Kyber (ML-KEM) or CRYSTALS-Dilithium (ML-DSA).
    severity: ERROR
    languages: [scala]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 10

  - id: scala-weak-symmetric-cipher
    pattern-either:
      - pattern: Cipher.getInstance("DES")
      - pattern: Cipher.getInstance("DES/...")
      - pattern: Cipher.getInstance("DESede")
      - pattern: Cipher.getInstance("DESede/...")
      - pattern: Cipher.getInstance("RC4")
      - pattern: SecretKeyFactory.getInstance("DES")
      - pattern: SecretKeyFactory.getInstance("DESede")
    message: >-
      QUANTUM VULNERABILITY: DES/3DES are quantum-vulnerable (Grover's algorithm)
      and classically broken. RC4 is banned by RFC 7465. Use AES-256-GCM.
    severity: ERROR
    languages: [scala]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_risk_score: 10

  - id: scala-aes-small-key
    patterns:
      - pattern-either:
          - patterns:
              - pattern: $KG.init($SIZE)
              - pattern-inside: |
                  val $KG = KeyGenerator.getInstance("AES")
                  ...
              - metavariable-comparison:
                  metavariable: $SIZE
                  comparison: $SIZE < 256
    message: >-
      QUANTUM VULNERABILITY: AES key size $SIZE bits is insufficient for post-quantum security.
      AES-128 provides 64-bit and AES-192 provides 96-bit quantum security via Grover's algorithm.
      Use AES-256 (256-bit key) for 128-bit quantum security.
    severity: WARNING
    languages: [scala]
    metadata:
      category: security
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 7
