rules:
  - id: go-rsa-quantum-vulnerable
    pattern-either:
      - pattern: rsa.GenerateKey($RAND, $SIZE)
      - pattern: rsa.GenerateMultiPrimeKey($RAND, $PRIMES, $SIZE)
    message: >-
      QUANTUM VULNERABILITY: RSA is completely broken by Shor's algorithm
      regardless of key size. Migrate to post-quantum alternatives:
      - Key encapsulation: golang.org/x/crypto (Kyber/ML-KEM when available)
      - Signatures: CRYSTALS-Dilithium / ML-DSA
    severity: ERROR
    languages: [go]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 10

  - id: go-ecdsa-ecdh-quantum-vulnerable
    pattern-either:
      - pattern: ecdsa.GenerateKey($CURVE, $RAND)
      - pattern: ecdh.P256()
      - pattern: ecdh.P384()
      - pattern: ecdh.P521()
      - pattern: ecdh.X25519()
      - pattern: elliptic.P224()
      - pattern: elliptic.P256()
      - pattern: elliptic.P384()
      - pattern: elliptic.P521()
    message: >-
      QUANTUM VULNERABILITY: Elliptic Curve Cryptography (ECDSA/ECDH) is broken
      by Shor's algorithm. All curves are equally vulnerable.
      Migrate to CRYSTALS-Kyber (ML-KEM) or CRYSTALS-Dilithium (ML-DSA).
    severity: ERROR
    languages: [go]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 10

  - id: go-dsa-quantum-vulnerable
    pattern-either:
      - pattern: dsa.GenerateKey($PARAMS, $RAND)
      - pattern: dsa.GenerateParameters($PARAMS, $RAND, $SIZE)
    message: >-
      QUANTUM VULNERABILITY: DSA is broken by Shor's algorithm.
      Migrate to CRYSTALS-Dilithium (ML-DSA) for digital signatures.
    severity: ERROR
    languages: [go]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 10

  - id: go-des-cipher
    pattern-either:
      - pattern: des.NewCipher($KEY)
      - pattern: des.NewTripleDESCipher($KEY)
    message: >-
      QUANTUM VULNERABILITY: DES/3DES is broken classically and quantum-vulnerable.
      Use AES-256-GCM (crypto/aes + crypto/cipher) instead.
    severity: ERROR
    languages: [go]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 10

  - id: go-rc4-cipher
    pattern-either:
      - pattern: rc4.NewCipher($KEY)
    message: >-
      RC4 is completely broken and banned by RFC 7465. Use AES-256-GCM instead.
    severity: ERROR
    languages: [go]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_risk_score: 10

  - id: go-md5-hash
    pattern-either:
      - pattern: md5.New()
      - pattern: md5.Sum($DATA)
    message: >-
      QUANTUM VULNERABILITY: MD5 is cryptographically broken and quantum-vulnerable
      via Grover's algorithm. Use SHA-256 or SHA-3 instead.
    severity: ERROR
    languages: [go]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: go-sha1-hash
    pattern-either:
      - pattern: sha1.New()
      - pattern: sha1.Sum($DATA)
    message: >-
      QUANTUM VULNERABILITY: SHA-1 is deprecated and quantum-vulnerable via
      Grover's algorithm. Use SHA-256 or SHA-3 instead.
    severity: ERROR
    languages: [go]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: go-aes-small-key
    patterns:
      - pattern: aes.NewCipher($KEY)
      - metavariable-comparison:
          metavariable: $KEY
          comparison: len($KEY) < 32
    message: >-
      QUANTUM VULNERABILITY: AES key shorter than 256 bits detected.
      AES-128 provides 64-bit and AES-192 provides 96-bit quantum security
      via Grover's algorithm. Use a 32-byte (256-bit) key for quantum resistance.
    severity: WARNING
    languages: [go]
    metadata:
      category: security
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 7
