Skip to content

Feat/python crypto detection #495

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
san-zrl wants to merge 9 commits into
base: main
Choose a base branch
from
Open

Feat/python crypto detection #495

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
5b5065f
python crypto/cryptodome detections rules, translations and tests
san-zrl Jul 18, 2026
81c0702
spotless reformatting
san-zrl Jul 18, 2026
e90c91f
Reorganized python detection rules, tests and test files
san-zrl Jul 21, 2026
85beb72
added memoization
san-zrl Jul 21, 2026
760703e
Fixed test after rebase
san-zrl Jul 21, 2026
383d73c
Improved HPKE test
san-zrl Jul 22, 2026
f4b206a
Improved HPKE test
san-zrl Jul 22, 2026
e4d246f
Updated EdDSA, ECDSA and HPKE rules and tests
san-zrl Jul 22, 2026
a448f65
Added optional iv parameter to block ciphers
san-zrl Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion mapper/ciphersuites.json
View file
Open in desktop

Large diffs are not rendered by default.

18 changes: 15 additions & 3 deletions mapper/src/main/java/com/ibm/mapper/mapper/pyca/PycaCipherMapper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,14 +26,18 @@
import com.ibm.mapper.model.algorithms.Camellia;
import com.ibm.mapper.model.algorithms.ChaCha20;
import com.ibm.mapper.model.algorithms.ChaCha20Poly1305;
import com.ibm.mapper.model.algorithms.DES;
import com.ibm.mapper.model.algorithms.Fernet;
import com.ibm.mapper.model.algorithms.IDEA;
import com.ibm.mapper.model.algorithms.RC2;
import com.ibm.mapper.model.algorithms.RC4;
import com.ibm.mapper.model.algorithms.RSA;
import com.ibm.mapper.model.algorithms.SEED;
import com.ibm.mapper.model.algorithms.SM4;
import com.ibm.mapper.model.algorithms.Salsa20;
import com.ibm.mapper.model.algorithms.TripleDES;
import com.ibm.mapper.model.algorithms.cast.CAST128;
import com.ibm.mapper.model.mode.GCM;
import com.ibm.mapper.utils.DetectionLocation;
import java.util.Optional;
import javax.annotation.Nonnull;
Expand All @@ -52,18 +56,26 @@ public final class PycaCipherMapper implements IMapper {
case "AES" -> Optional.of(new AES(detectionLocation));
case "AES128" -> Optional.of(new AES(128, detectionLocation));
case "AES256" -> Optional.of(new AES(256, detectionLocation));
case "AES128_GCM" ->
Optional.of(new AES(128, new GCM(detectionLocation), detectionLocation));
case "AES256_GCM" ->
Optional.of(new AES(256, new GCM(detectionLocation), detectionLocation));
case "CAMELLIA" -> Optional.of(new Camellia(detectionLocation));
case "TRIPLEDES" -> Optional.of(new TripleDES(detectionLocation));
case "TRIPLEDES", "3DES" -> Optional.of(new TripleDES(detectionLocation));
case "DES" -> Optional.of(new DES(detectionLocation));
case "CAST5" -> Optional.of(new CAST128(detectionLocation));
case "SEED" -> Optional.of(new SEED(detectionLocation));
case "SM4" -> Optional.of(new SM4(detectionLocation));
case "BLOWFISH" -> Optional.of(new Blowfish(detectionLocation));
case "IDEA" -> Optional.of(new IDEA(detectionLocation));
case "CHACHA20" -> Optional.of(new ChaCha20(detectionLocation));
case "ARC4" -> Optional.of(new RC4(detectionLocation));
case "SALSA20" -> Optional.of(new Salsa20(detectionLocation));
case "ARC4", "RC4" -> Optional.of(new RC4(detectionLocation));
case "RC2" -> Optional.of(new RC2(detectionLocation));
case "FERNET" -> Optional.of(new Fernet(detectionLocation));
case "RSA" -> Optional.of(new RSA(detectionLocation));
case "CHACHA20POLY1305" -> Optional.of(new ChaCha20Poly1305(detectionLocation));
case "CHACHA20POLY1305", "CHACHA20_POLY1305" ->
Optional.of(new ChaCha20Poly1305(detectionLocation));
default -> Optional.empty();
};
}
Expand Down
105 changes: 105 additions & 0 deletions mapper/src/main/java/com/ibm/mapper/mapper/pyca/PycaCurveMapper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,105 @@
/*
* Sonar Cryptography Plugin
* Copyright (C) 2024 PQCA
*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to you under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.ibm.mapper.mapper.pyca;

import com.ibm.mapper.mapper.IMapper;
import com.ibm.mapper.model.Algorithm;
import com.ibm.mapper.model.EllipticCurveAlgorithm;
import com.ibm.mapper.model.curves.Brainpoolp256r1;
import com.ibm.mapper.model.curves.Brainpoolp384r1;
import com.ibm.mapper.model.curves.Brainpoolp512r1;
import com.ibm.mapper.model.curves.Curve25519;
import com.ibm.mapper.model.curves.Curve448;
import com.ibm.mapper.model.curves.Secp192r1;
import com.ibm.mapper.model.curves.Secp224r1;
import com.ibm.mapper.model.curves.Secp256r1;
import com.ibm.mapper.model.curves.Secp384r1;
import com.ibm.mapper.model.curves.Secp521r1;
import com.ibm.mapper.model.curves.Sect163k1;
import com.ibm.mapper.model.curves.Sect163r2;
import com.ibm.mapper.model.curves.Sect233k1;
import com.ibm.mapper.model.curves.Sect233r1;
import com.ibm.mapper.model.curves.Sect283k1;
import com.ibm.mapper.model.curves.Sect283r1;
import com.ibm.mapper.model.curves.Sect409k1;
import com.ibm.mapper.model.curves.Sect409r1;
import com.ibm.mapper.model.curves.Sect571k1;
import com.ibm.mapper.model.curves.Sect571r1;
import com.ibm.mapper.utils.DetectionLocation;
import java.util.Optional;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;

public final class PycaCurveMapper implements IMapper {

@Nonnull
@Override
public Optional<? extends Algorithm> parse(
@Nullable String str, @Nonnull DetectionLocation detectionLocation) {
if (str == null) {
return Optional.empty();
}

@Nonnull String curve = str;
return switch (curve.toUpperCase().trim()) {
case "SECP192R1", "PRIME192V1", "P-192", "P192", "NIST P-192" ->
Optional.of(new EllipticCurveAlgorithm(new Secp192r1(detectionLocation)));
case "SECP224R1", "PRIME224V1", "P-224", "P224", "NIST P-224" ->
Optional.of(new EllipticCurveAlgorithm(new Secp224r1(detectionLocation)));
case "SECP256R1", "PRIME256V1", "P-256", "P256", "NIST P-256" ->
Optional.of(new EllipticCurveAlgorithm(new Secp256r1(detectionLocation)));
case "SECP384R1", "PRIME384V1", "P-384", "P384", "NIST P-384" ->
Optional.of(new EllipticCurveAlgorithm(new Secp384r1(detectionLocation)));
case "SECP512R1", "PRIME512V1", "P-512", "P512", "NIST P-512" ->
Optional.of(new EllipticCurveAlgorithm(new Secp521r1(detectionLocation)));
case "ED25519", "CURVE25519" ->
Optional.of(new EllipticCurveAlgorithm(new Curve25519(detectionLocation)));
case "ED448", "CURVE448" ->
Optional.of(new EllipticCurveAlgorithm(new Curve448(detectionLocation)));
case "BRAINPOOLP256R1" ->
Optional.of(new EllipticCurveAlgorithm(new Brainpoolp256r1(detectionLocation)));
case "BRAINPOOLP384R1" ->
Optional.of(new EllipticCurveAlgorithm(new Brainpoolp384r1(detectionLocation)));
case "BRAINPOOLP512R1" ->
Optional.of(new EllipticCurveAlgorithm(new Brainpoolp512r1(detectionLocation)));
case "SECT571K1" ->
Optional.of(new EllipticCurveAlgorithm(new Sect571k1(detectionLocation)));
case "SECT409K1" ->
Optional.of(new EllipticCurveAlgorithm(new Sect409k1(detectionLocation)));
case "SECT283K1" ->
Optional.of(new EllipticCurveAlgorithm(new Sect283k1(detectionLocation)));
case "SECT233K1" ->
Optional.of(new EllipticCurveAlgorithm(new Sect233k1(detectionLocation)));
case "SECT163K1" ->
Optional.of(new EllipticCurveAlgorithm(new Sect163k1(detectionLocation)));
case "SECT571R1" ->
Optional.of(new EllipticCurveAlgorithm(new Sect571r1(detectionLocation)));
case "SECT409R1" ->
Optional.of(new EllipticCurveAlgorithm(new Sect409r1(detectionLocation)));
case "SECT283R1" ->
Optional.of(new EllipticCurveAlgorithm(new Sect283r1(detectionLocation)));
case "SECT233R1" ->
Optional.of(new EllipticCurveAlgorithm(new Sect233r1(detectionLocation)));
case "SECT163R2" ->
Optional.of(new EllipticCurveAlgorithm(new Sect163r2(detectionLocation)));
default -> Optional.empty();
};
}
}
19 changes: 19 additions & 0 deletions mapper/src/main/java/com/ibm/mapper/mapper/pyca/PycaDigestMapper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,14 +21,22 @@

import com.ibm.mapper.mapper.IMapper;
import com.ibm.mapper.model.MessageDigest;
import com.ibm.mapper.model.algorithms.KMAC;
import com.ibm.mapper.model.algorithms.KangarooTwelve;
import com.ibm.mapper.model.algorithms.Keccak;
import com.ibm.mapper.model.algorithms.MD2;
import com.ibm.mapper.model.algorithms.MD4;
import com.ibm.mapper.model.algorithms.MD5;
import com.ibm.mapper.model.algorithms.Poly1305;
import com.ibm.mapper.model.algorithms.RIPEMD;
import com.ibm.mapper.model.algorithms.SHA;
import com.ibm.mapper.model.algorithms.SHA2;
import com.ibm.mapper.model.algorithms.SHA3;
import com.ibm.mapper.model.algorithms.SM3;
import com.ibm.mapper.model.algorithms.TupleHash;
import com.ibm.mapper.model.algorithms.blake.BLAKE2b;
import com.ibm.mapper.model.algorithms.blake.BLAKE2s;
import com.ibm.mapper.model.algorithms.shake.CSHAKE;
import com.ibm.mapper.model.algorithms.shake.SHAKE;
import com.ibm.mapper.utils.DetectionLocation;
import java.util.Optional;
Expand Down Expand Up @@ -59,11 +67,22 @@ public final class PycaDigestMapper implements IMapper {
case "SHA3_512" -> Optional.of(new SHA3(512, detectionLocation));
case "SHAKE128" -> Optional.of(new SHAKE(128, detectionLocation));
case "SHAKE256" -> Optional.of(new SHAKE(256, detectionLocation));
case "MD2" -> Optional.of(new MD2(detectionLocation));
case "MD4" -> Optional.of(new MD4(detectionLocation));
case "MD5" -> Optional.of(new MD5(detectionLocation));
case "BLAKE2B" -> Optional.of(new BLAKE2b(false, detectionLocation));
case "BLAKE2S" -> Optional.of(new BLAKE2s(false, detectionLocation));
case "SM3" -> Optional.of(new SM3(detectionLocation));
case "POLY1305" -> Optional.of(new Poly1305(detectionLocation));
case "RIPEMD160" -> Optional.of(new RIPEMD(160, detectionLocation));
case "TUPLEHASH128" -> Optional.of(new TupleHash(128, detectionLocation));
case "TUPLEHASH256" -> Optional.of(new TupleHash(256, detectionLocation));
case "KMAC128" -> Optional.of(new KMAC(128, detectionLocation));
case "KMAC256" -> Optional.of(new KMAC(256, detectionLocation));
case "KECCAK" -> Optional.of(new Keccak(detectionLocation));
case "CSHAKE128" -> Optional.of(new CSHAKE(128, detectionLocation));
case "CSHAKE256" -> Optional.of(new CSHAKE(256, detectionLocation));
case "KANGAROOTWELVE" -> Optional.of(new KangarooTwelve(detectionLocation));
default -> Optional.empty();
};
}
Expand Down
10 changes: 10 additions & 0 deletions mapper/src/main/java/com/ibm/mapper/mapper/pyca/PycaMacMapper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,11 @@
import com.ibm.mapper.model.algorithms.ChaCha20;
import com.ibm.mapper.model.algorithms.Fernet;
import com.ibm.mapper.model.algorithms.IDEA;
import com.ibm.mapper.model.algorithms.MD2;
import com.ibm.mapper.model.algorithms.MD5;
import com.ibm.mapper.model.algorithms.Poly1305;
import com.ibm.mapper.model.algorithms.RC4;
import com.ibm.mapper.model.algorithms.RIPEMD;
import com.ibm.mapper.model.algorithms.RSA;
import com.ibm.mapper.model.algorithms.SEED;
import com.ibm.mapper.model.algorithms.SHA;
Expand All @@ -42,6 +44,7 @@
import com.ibm.mapper.model.algorithms.blake.BLAKE2b;
import com.ibm.mapper.model.algorithms.blake.BLAKE2s;
import com.ibm.mapper.model.algorithms.cast.CAST128;
import com.ibm.mapper.model.algorithms.shake.CSHAKE;
import com.ibm.mapper.model.algorithms.shake.SHAKE;
import com.ibm.mapper.utils.DetectionLocation;
import java.util.Optional;
Expand Down Expand Up @@ -104,13 +107,20 @@ public class PycaMacMapper implements IMapper {
case "SHAKE128" -> Optional.of(new SHAKE(Mac.class, new SHAKE(128, detectionLocation)));
case "SHAKE256" -> Optional.of(new SHAKE(Mac.class, new SHAKE(256, detectionLocation)));
case "MD5" -> Optional.of(new MD5(Mac.class, detectionLocation));
case "MD2" -> Optional.of(new MD2(Mac.class, detectionLocation));
case "BLAKE2B" ->
Optional.of(new BLAKE2b(Mac.class, new BLAKE2b(false, detectionLocation)));
case "BLAKE2S" ->
Optional.of(new BLAKE2s(Mac.class, new BLAKE2s(false, detectionLocation)));
case "SM3" -> Optional.of(new SM3(Mac.class, new SM3(detectionLocation)));
case "POLY1305" ->
Optional.of(new Poly1305(Mac.class, new Poly1305(detectionLocation)));
case "RIPEMD160" ->
Optional.of(new RIPEMD(Mac.class, new RIPEMD(160, detectionLocation)));
case "CSHAKE128" ->
Optional.of(new CSHAKE(Mac.class, new CSHAKE(128, detectionLocation)));
case "CSHAKE256" ->
Optional.of(new CSHAKE(Mac.class, new CSHAKE(256, detectionLocation)));
default -> Optional.empty();
};
}
Expand Down
33 changes: 33 additions & 0 deletions mapper/src/main/java/com/ibm/mapper/mapper/ssl/json/JsonCipherSuites.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,17 @@ private JsonCipherSuites() {
null,
"AES 128 CCM 8",
"SHA256")),
Map.entry(
"TLS_AES_128_CCM_ASCONHASH256",
new JsonCipherSuite(
"TLS_AES_128_CCM_ASCONHASH256",
null,
null,
new String[] {"0x00", "0x71"},
"AES",
"128 CCM ASCONHASH256",
null,
null)),
Map.entry(
"TLS_AES_128_CCM_SHA256",
new JsonCipherSuite(
Expand All @@ -52,6 +63,17 @@ private JsonCipherSuites() {
null,
"AES 128 CCM",
"SHA256")),
Map.entry(
"TLS_AES_128_GCM_ASCONHASH256",
new JsonCipherSuite(
"TLS_AES_128_GCM_ASCONHASH256",
null,
null,
new String[] {"0x00", "0x70"},
"AES",
"128 GCM ASCONHASH256",
null,
null)),
Map.entry(
"TLS_AES_128_GCM_SHA256",
new JsonCipherSuite(
Expand All @@ -74,6 +96,17 @@ private JsonCipherSuites() {
null,
"AES 256 GCM",
"SHA384")),
Map.entry(
"TLS_ASCONAEAD128_SHA256",
new JsonCipherSuite(
"TLS_ASCONAEAD128_SHA256",
null,
null,
new String[] {"0x00", "0x6F"},
"ASCONAEAD128",
"SHA256",
null,
null)),
Map.entry(
"TLS_CHACHA20_POLY1305_SHA256",
new JsonCipherSuite(
Expand Down
5 changes: 5 additions & 0 deletions mapper/src/main/java/com/ibm/mapper/model/algorithms/RIPEMD.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
import com.ibm.mapper.model.Algorithm;
import com.ibm.mapper.model.DigestSize;
import com.ibm.mapper.model.INode;
import com.ibm.mapper.model.IPrimitive;
import com.ibm.mapper.model.MessageDigest;
import com.ibm.mapper.utils.DetectionLocation;
import java.util.Optional;
Expand Down Expand Up @@ -72,4 +73,8 @@ public RIPEMD(int digestSize, @Nonnull DetectionLocation detectionLocation) {
this(detectionLocation);
this.put(new DigestSize(digestSize, detectionLocation));
}

public RIPEMD(@Nonnull final Class<? extends IPrimitive> asKind, @Nonnull RIPEMD ripemd) {
super(ripemd, asKind);
}
}
35 changes: 22 additions & 13 deletions mapper/src/main/java/com/ibm/mapper/reorganizer/rules/SignatureReorganizer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@
import com.ibm.mapper.reorganizer.builder.ReorganizerRuleBuilder;
import java.util.LinkedList;
import java.util.List;
import java.util.Map;
import java.util.Optional;
import javax.annotation.Nonnull;

Expand Down Expand Up @@ -194,12 +193,17 @@ public static IReorganizerRule moveNodesFromUnderFunctionalityUnderNode(
.flatMap(p -> p.hasChildOfType(underNodeClazz))
.ifPresent(
n -> {
for (Map.Entry<Class<? extends INode>, INode>
childKeyValue :
node.getChildren().entrySet()) {
n.put(childKeyValue.getValue());
node.removeChildOfType(childKeyValue.getKey());
}
// Avoids java.util.ConcurrentModificationException
// thrown by original code
node.getChildren().values().forEach(n::put);
node.getChildren().clear();
// for (Map.Entry<Class<? extends INode>, INode>
// childKeyValue :
// node.getChildren().entrySet()) {
// n.put(childKeyValue.getValue());
//
// node.removeChildOfType(childKeyValue.getKey());
// }
});
return null;
});
Expand Down Expand Up @@ -252,12 +256,17 @@ public static IReorganizerRule moveNodesFromUnderFunctionalityUnderParent(
Optional.ofNullable(parent)
.ifPresent(
p -> {
for (Map.Entry<Class<? extends INode>, INode>
childKeyValue :
node.getChildren().entrySet()) {
p.put(childKeyValue.getValue());
node.removeChildOfType(childKeyValue.getKey());
}
// Avoids java.util.ConcurrentModificationException
// thrown by original code
node.getChildren().values().forEach(p::put);
node.getChildren().clear();
// for (Map.Entry<Class<? extends INode>, INode>
// childKeyValue :
// node.getChildren().entrySet()) {
// p.put(childKeyValue.getValue());
//
// node.removeChildOfType(childKeyValue.getKey());
// }
});
return null;
});
Expand Down
Loading
Loading