Skip to content

Commit 3ccec7e

Browse files
thebenignhackerthebenignhacker
committed
Update documentation for v1.2.0 certificate detection
README.md: - Added Certificates row to detection table - Updated pattern count to 90+ - Updated roadmap to show v1.2 as current release - Added certificate features to v1.2 release notes PATTERNS.md: - Added Certificates section with 19 patterns - Added to Table of Contents - Updated pattern count - Documented critical findings and remediation
1 parent 0d83c81 commit 3ccec7e

2 files changed

Lines changed: 61 additions & 18 deletions

File tree

‎PATTERNS.md‎

Lines changed: 44 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,20 @@
11
# CryptoScan Detection Patterns
22

3-
CryptoScan uses 100+ detection patterns to identify cryptographic algorithms, protocols, keys, and configurations in your codebase. Each pattern includes quantum risk classification and remediation guidance.
3+
CryptoScan uses 90+ detection patterns to identify cryptographic algorithms, protocols, keys, certificates, and configurations in your codebase. Each pattern includes quantum risk classification and remediation guidance.
44

55
## Table of Contents
66

77
- [How Detection Works](#how-detection-works)
88
- [Confidence Scoring](#confidence-scoring)
99
- [Pattern Categories](#pattern-categories)
10-
- [Post-Quantum Cryptography](#post-quantum-cryptography) *(NEW)*
11-
- [Hybrid Cryptography](#hybrid-cryptography) *(NEW)*
10+
- [Post-Quantum Cryptography](#post-quantum-cryptography)
11+
- [Hybrid Cryptography](#hybrid-cryptography)
1212
- [Asymmetric Encryption](#asymmetric-encryption)
1313
- [Symmetric Encryption](#symmetric-encryption)
1414
- [Hash Functions](#hash-functions)
15-
- [Message Authentication Codes (MACs)](#message-authentication-codes-macs) *(NEW)*
16-
- [Key Derivation Functions (KDFs)](#key-derivation-functions-kdfs) *(NEW)*
15+
- [Message Authentication Codes (MACs)](#message-authentication-codes-macs)
16+
- [Key Derivation Functions (KDFs)](#key-derivation-functions-kdfs)
17+
- [Certificates](#certificates) *(NEW in v1.2)*
1718
- [TLS/SSL Protocols](#tlsssl-protocols)
1819
- [Key Material & Secrets](#key-material--secrets)
1920
- [Cloud KMS Services](#cloud-kms-services)
@@ -243,6 +244,44 @@ KDFs derive cryptographic keys from passwords or other input material.
243244

244245
---
245246

247+
### Certificates
248+
249+
X.509 certificates, certificate chains, and PKI infrastructure. *(NEW in v1.2)*
250+
251+
| Pattern ID | Name | Quantum Risk | Severity | What It Detects |
252+
|------------|------|--------------|----------|-----------------|
253+
| CERT-001 | X.509 Certificate | UNKNOWN | Info | `-----BEGIN CERTIFICATE-----` |
254+
| CERT-CSR-001 | Certificate Signing Request | UNKNOWN | Info | `-----BEGIN CERTIFICATE REQUEST-----` |
255+
| CERT-PKCS12-001 | PKCS#12/PFX Container | UNKNOWN | Medium | `.p12`, `.pfx`, `PKCS12` references |
256+
| CERT-CHAIN-001 | Certificate Chain | UNKNOWN | Info | `cert_chain`, `ca_bundle`, `root_ca`, `trust_anchor` |
257+
| CERT-TRUSTED-001 | Trusted Certificate | UNKNOWN | Info | `-----BEGIN TRUSTED CERTIFICATE-----` |
258+
| CERT-EXPIRY-001 | Certificate Expiration | UNKNOWN | Info | `NotAfter`, `validUntil`, expiration checks |
259+
| CERT-SUBJECT-001 | Certificate Subject/Issuer | UNKNOWN | Info | `subjectDN`, `issuerDN`, `getSubject`, `getIssuer` |
260+
| CERT-SIGALG-001 | Certificate Signature Algorithm | VULNERABLE | Medium | `sha256WithRSA`, `ecdsaWithSHA256` |
261+
| CERT-SIGALG-WEAK-001 | Weak Certificate Signature | VULNERABLE | **Critical** | `sha1WithRSA`, `md5WithRSA` |
262+
| CERT-KEYUSAGE-001 | Certificate Key Usage | UNKNOWN | Info | `keyUsage`, `extendedKeyUsage` |
263+
| CERT-SAN-001 | Subject Alternative Name | UNKNOWN | Info | `subjectAltName`, `dnsNames` |
264+
| CERT-PARSE-001 | X.509 Certificate Parsing | UNKNOWN | Info | `x509.ParseCertificate`, `X509Certificate` |
265+
| CERT-VALIDATION-BYPASS-001 | Certificate Validation Bypass | UNKNOWN | **Critical** | `InsecureSkipVerify: true`, `verify=false`, `CERT_NONE` |
266+
| CERT-SELFSIGNED-001 | Self-Signed Certificate | UNKNOWN | Medium | `self_signed`, `generateSelfSignedCert` |
267+
| CERT-MTLS-001 | Mutual TLS (mTLS) | PARTIAL | Info | `mutual_tls`, `client_cert`, `RequireClientCert` |
268+
| CERT-REVOCATION-001 | Certificate Revocation | UNKNOWN | Info | `OCSP`, `CRL`, `checkRevocation` |
269+
| CERT-PINNING-001 | Certificate Pinning | UNKNOWN | Info | `cert_pin`, `TrustManagerFactory` |
270+
| CERT-ACME-001 | ACME/Let's Encrypt | VULNERABLE | Info | `letsencrypt`, `certbot`, `acme_challenge` |
271+
| KEY-JWK-001 | JSON Web Key (JWK) | VULNERABLE | Medium | `"kty": "RSA"`, `"kty": "EC"`, `.well-known/jwks` |
272+
273+
**Critical Findings**:
274+
- **Certificate Validation Bypass**: Disabling certificate validation enables man-in-the-middle attacks. This should be fixed immediately.
275+
- **Weak Certificate Signatures**: SHA-1 and MD5 signatures are deprecated and insecure. Replace certificates immediately.
276+
277+
**Remediation**:
278+
- Use certificates with RSA-3072+ or ECC-P256+ keys
279+
- Ensure SHA-256 or stronger signature algorithms
280+
- Never disable certificate validation in production
281+
- Plan for PQC certificate migration when standards finalize
282+
283+
---
284+
246285
### TLS/SSL Protocols
247286

248287
| Pattern ID | Name | Quantum Risk | Severity | What It Detects |

‎README.md‎

Lines changed: 17 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -169,13 +169,14 @@ CryptoScan identifies cryptographic usage across your entire technology stack:
169169
| **Hash Functions** | SHA-2, SHA-3, SHAKE128/256, BLAKE2, BLAKE3, MD5, SHA-1 |
170170
| **MACs** | HMAC-SHA256/384/512, HMAC-SHA3, KMAC128/256, CMAC, GMAC, Poly1305 |
171171
| **Key Derivation (KDFs)** | HKDF, PBKDF2, Argon2id, scrypt, bcrypt |
172-
| **TLS/SSL** | Protocol versions, cipher suites, weak configurations |
172+
| **Certificates** | X.509, CSR, PKCS#12/PFX, certificate chains, mTLS, validation bypass, expiration, JWK |
173+
| **TLS/SSL** | Protocol versions, cipher suites, weak configurations, certificate pinning |
173174
| **Key Material** | Private keys (RSA, EC, SSH, PGP, PKCS#8), JWT secrets, HMAC keys |
174175
| **Cloud KMS** | AWS KMS, Azure Key Vault, GCP Cloud KMS, HashiCorp Vault |
175176
| **Dependencies** | Crypto libraries across 20+ package managers |
176177
| **Configurations** | Hardcoded key sizes, algorithm selections, TLS settings |
177178

178-
**[100+ detection patterns](PATTERNS.md)** with context-aware confidence scoring to minimize false positives.
179+
**[90+ detection patterns](PATTERNS.md)** with context-aware confidence scoring to minimize false positives.
179180

180181
### Quantum Risk Classification
181182

@@ -478,22 +479,26 @@ cryptoscan/
478479

479480
## Roadmap
480481

481-
### v1.1 (Current Release)
482+
### v1.2 (Current Release)
482483
- [x] Local and remote repository scanning
483-
- [x] 100+ cryptographic patterns (expanded from 50+)
484+
- [x] 90+ cryptographic patterns
484485
- [x] Multiple output formats (text, JSON, CSV, SARIF, CBOM)
485486
- [x] Context-aware analysis with confidence scoring
486487
- [x] Dependency scanning for 20+ package managers
487488
- [x] Parallel scanning with worker pools
488489
- [x] Inline ignore comments
489-
- [x] **NEW: Post-Quantum Cryptography detection (ML-KEM, ML-DSA, SLH-DSA, FN-DSA, XMSS, LMS)**
490-
- [x] **NEW: Hybrid cryptography recognition (X25519+ML-KEM, composite signatures)**
491-
- [x] **NEW: Comprehensive MAC detection (HMAC, KMAC, CMAC, GMAC, Poly1305)**
492-
- [x] **NEW: KDF detection (HKDF, PBKDF2, Argon2id, scrypt, bcrypt)**
493-
- [x] **NEW: Migration Readiness Score with visual dashboard**
494-
- [x] **NEW: QRAMM framework integration (CVI Dimension mapping)**
495-
496-
### v1.2 (Next)
490+
- [x] Post-Quantum Cryptography detection (ML-KEM, ML-DSA, SLH-DSA, FN-DSA, XMSS, LMS)
491+
- [x] Hybrid cryptography recognition (X25519+ML-KEM, composite signatures)
492+
- [x] Comprehensive MAC detection (HMAC, KMAC, CMAC, GMAC, Poly1305)
493+
- [x] KDF detection (HKDF, PBKDF2, Argon2id, scrypt, bcrypt)
494+
- [x] Migration Readiness Score with visual dashboard
495+
- [x] QRAMM framework integration (CVI Dimension mapping)
496+
- [x] **NEW: Certificate detection (X.509, CSR, PKCS#12, chains, mTLS, JWK)**
497+
- [x] **NEW: Certificate validation bypass detection (CRITICAL severity)**
498+
- [x] **NEW: Weak certificate signature detection (SHA-1/MD5)**
499+
- [x] **NEW: Enhanced false positive reduction with smart context analysis**
500+
501+
### v1.3 (Next)
497502
- [ ] Smart remediation engine with language-specific recommendations
498503
- [ ] Enhanced CBOM output (CycloneDX 1.6 cryptoProperties)
499504
- [ ] Git history scanning (find crypto in past commits)
@@ -504,7 +509,6 @@ cryptoscan/
504509
- [ ] Azure resource scanning (Key Vault, App Configuration)
505510
- [ ] GCP resource scanning (Cloud KMS, Secret Manager)
506511
- [ ] Infrastructure-as-Code analysis (Terraform, CloudFormation, Pulumi)
507-
- [ ] Certificate chain analysis
508512

509513
## Contributing
510514

0 commit comments

Comments
 (0)