# =============================================================================
# Cerebion Rivet -- TOML Quantum Cryptography Vulnerability Rules
# =============================================================================
# IMPORTANT: TOML has NO native opengrep parser.
# All rules in this file MUST use:
#   languages: [generic]
#   pattern-regex: "<regex>"
#
# The `generic` language mode performs line-by-line regex matching against
# raw source text, which is the correct approach for languages without a
# dedicated AST parser in opengrep. TOML configuration files commonly
# contain algorithm names, TLS versions, and key type specifications as
# string values -- regex matching on key = "value" patterns is the reliable
# detection strategy for quantum-vulnerable cryptographic configurations.
# =============================================================================

rules:
  - id: toml-jwt-rsa-algorithm-quantum
    pattern-regex: "algorithm\\s*=\\s*[\"'](?:RS256|RS384|RS512)[\"']"
    message: >-
      RSA is broken by Shor's algorithm regardless of key size. Migrate to ML-KEM (FIPS 203) for key
      encapsulation or ML-DSA (FIPS 204) for signatures.
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [toml, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: toml-jwt-ecdsa-algorithm-quantum
    pattern-regex: "algorithm\\s*=\\s*[\"'](?:ES256|ES384|ES512)[\"']"
    message: >-
      ECC (ECDSA/ECDH) is broken by Shor's algorithm -- all curves (P-256, P-384, secp256k1, Curve25519)
      are equally vulnerable regardless of key size. Migrate: ECDSA  ML-DSA (FIPS 204)  ECDH  ML-KEM
      (FIPS 203).
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [toml, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: toml-weak-hash-quantum
    pattern-regex: "hash\\s*=\\s*[\"'](?:md5|sha1|MD5|SHA1)[\"']"
    message: >-
      MD5 is cryptographically broken and quantum-weakened by Grover's algorithm -- effective security
      drops from 128 to 64 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [toml, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-328: Use of Weak Hash"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: toml-ecb-mode-quantum
    pattern-regex: "(?i)(?:cipher|mode|encryption_mode|cipher_mode)\\s*=\\s*[\"'][^\"']*ecb[^\"']*[\"']"
    message: >-
      AES in ECB mode leaks data patterns -- identical plaintext blocks produce identical ciphertext. Use
      AES-256-GCM for authenticated encryption.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [toml, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 8

  - id: toml-weak-cipher-quantum
    pattern-regex: "cipher\\s*=\\s*[\"'](?:des|3des|rc4|DES|RC4)[\"']"
    message: >-
      3DES has 112-bit effective key strength -- broken classically and quantum-vulnerable. NIST deprecated
      3DES in 2023. Migrate to AES-256-GCM.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [toml, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 10

  - id: toml-weak-tls-version-quantum
    pattern-regex: "(?:min_version|tls_version|minimum_version)\\s*=\\s*[\"'](?:TLSv?1\\.?[01]|1\\.0|1\\.1)[\"']"
    message: >-
      ECC (ECDSA/ECDH) is broken by Shor's algorithm -- all curves (P-256, P-384, secp256k1, Curve25519)
      are equally vulnerable regardless of key size. Migrate: ECDSA  ML-DSA (FIPS 204)  ECDH  ML-KEM
      (FIPS 203).
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [toml, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 10

  - id: toml-rsa-key-type-quantum
    pattern-regex: "(?:key_type|signing_method|key_algorithm)\\s*=\\s*[\"'](?:rsa|RSA|rsa-2048|rsa-4096)[\"']"
    message: >-
      RSA is broken by Shor's algorithm regardless of key size. Migrate to ML-KEM (FIPS 203) for key
      encapsulation or ML-DSA (FIPS 204) for signatures.
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [toml, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8
