# =============================================================================
# Cerebion Rivet -- PowerShell Quantum Cryptography Vulnerability Rules
# =============================================================================
# IMPORTANT: PowerShell has NO native opengrep parser.
# All rules in this file MUST use:
#   languages: [generic]
#   pattern-regex: "<regex>"
#
# The `generic` language mode performs line-by-line regex matching against
# raw source text, which is the correct approach for languages without a
# dedicated AST parser in opengrep.
# =============================================================================

rules:
  - id: powershell-use-of-md5-quantum
    pattern-regex: "(?:MD5CryptoServiceProvider|\\[System\\.Security\\.Cryptography\\.MD5\\]::Create\\s*\\(\\s*\\)|Get-FileHash\\s+.*-Algorithm\\s+MD5\\b)"
    message: >-
      MD5 is cryptographically broken and quantum-weakened by Grover's algorithm -- effective security
      drops from 128 to 64 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [powershell, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-328: Use of Weak Hash"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: powershell-use-of-sha1-quantum
    pattern-regex: "(?:SHA1CryptoServiceProvider|SHA1Managed|\\[System\\.Security\\.Cryptography\\.SHA1\\]::Create\\s*\\(\\s*\\)|Get-FileHash\\s+.*-Algorithm\\s+SHA1\\b)"
    message: >-
      SHA-1 is deprecated and quantum-weakened by Grover's algorithm -- effective security drops from 160
      to 80 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [powershell, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-328: Use of Weak Hash"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: powershell-use-of-rsa-quantum
    pattern-regex: "RSACryptoServiceProvider\\b"
    message: >-
      RSA is broken by Shor's algorithm regardless of key size. Migrate to ML-KEM (FIPS 203) for key
      encapsulation or ML-DSA (FIPS 204) for signatures.
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [powershell, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: powershell-use-of-des-quantum
    pattern-regex: "DESCryptoServiceProvider\\b"
    message: >-
      DES has a 56-bit key -- completely broken classically and trivially quantum-vulnerable. Migrate to
      AES-256-GCM.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [powershell, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 10

  - id: powershell-use-of-3des-quantum
    pattern-regex: "TripleDESCryptoServiceProvider\\b"
    message: >-
      3DES has 112-bit effective key strength -- broken classically and quantum-vulnerable. NIST deprecated
      3DES in 2023. Migrate to AES-256-GCM.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [powershell, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 8

  - id: powershell-weak-tls-version-quantum
    pattern-regex: "\\[System\\.Net\\.SecurityProtocolType\\]::Tls(?:10|11|12)\\b"
    message: >-
      QUANTUM VULNERABILITY: TLS 1.0/1.1/1.2 cannot negotiate post-quantum cipher suites.
      Upgrade to TLS 1.3.
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [powershell, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 7

  - id: powershell-use-of-ecc-quantum
    pattern-regex: "(?:ECDsaCng|ECDiffieHellmanCng|ECDsa\\.Create|ECDiffieHellman\\.Create)\\b"
    message: >-
      QUANTUM VULNERABILITY: Elliptic Curve Cryptography (ECC/ECDSA/ECDH) is broken
      by Shor's algorithm. Migrate to CRYSTALS-Dilithium (signatures) or
      CRYSTALS-Kyber (key exchange).
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [powershell, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: powershell-use-of-dsa-quantum
    pattern-regex: "DSACryptoServiceProvider\\b"
    message: >-
      QUANTUM VULNERABILITY: DSA is broken by Shor's algorithm.
      Migrate to CRYSTALS-Dilithium (ML-DSA) for digital signatures.
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [powershell, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: powershell-aes-small-key-quantum
    pattern-regex: "KeySize\\s*=\\s*(?:128|192)\\b"
    message: >-
      QUANTUM VULNERABILITY: AES-128 provides 64-bit and AES-192 provides 96-bit
      quantum security via Grover's algorithm. Use KeySize = 256 for 128-bit
      quantum security.
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [powershell, post-quantum]
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 7
