Skip to content

Commit 24e5c4c

Browse files
nicolaswillnicolaswill
committed
Add demos and tests for example deployment
1 parent 9176564 commit 24e5c4c

File tree

66 files changed

+1440
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

66 files changed

+1440
-0
lines changed

‎java/ql/src/experimental/quantum/Examples/Demo/AllClassifications.ql‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
/**
2+
* @name All cryptographic classifications
3+
* @description Reports every cryptographic element classified as quantum-vulnerable, insecure, or secure
4+
* using all predicates in the QuantumCryptoClassification library.
5+
* @id java/quantum/examples/demo/all-classifications
6+
* @kind problem
7+
* @problem.severity warning
8+
* @tags quantum
9+
* experimental
10+
*/
11+
12+
import QuantumCryptoClassification
13+
14+
/**
15+
* Gets a short label for logical grouping of each finding category.
16+
*/
17+
string categoryLabel(string cat) {
18+
cat = "Algorithm" and result = "Algorithm"
19+
or
20+
cat = "KeyAgreement" and result = "KeyAgreement"
21+
or
22+
cat = "Curve" and result = "Curve"
23+
or
24+
cat = "Padding" and result = "Padding"
25+
or
26+
cat = "Mode" and result = "Mode"
27+
or
28+
cat = "Hash" and result = "Hash"
29+
or
30+
cat = "KeySize" and result = "KeySize"
31+
}
32+
33+
from Crypto::NodeBase node, string category, string classification, string detail
34+
where
35+
// ---- Key-operation algorithms (quantum-vulnerable / insecure / secure) ----
36+
exists(Crypto::KeyOperationAlgorithmNode alg |
37+
node = alg and
38+
category = "Algorithm" and
39+
classification = classifyAlgorithmType(alg.getAlgorithmType()) and
40+
classification != "other" and
41+
detail = alg.getAlgorithmName()
42+
)
43+
or
44+
// ---- Key-agreement algorithms (quantum-vulnerable) ----
45+
exists(Crypto::KeyAgreementAlgorithmNode kaAlg |
46+
node = kaAlg and
47+
category = "KeyAgreement" and
48+
classification = classifyKeyAgreementType(kaAlg.getKeyAgreementType()) and
49+
classification != "other" and
50+
detail = kaAlg.getAlgorithmName()
51+
)
52+
or
53+
// ---- Elliptic curves (quantum-vulnerable) ----
54+
exists(Crypto::EllipticCurveNode curve |
55+
node = curve and
56+
category = "Curve" and
57+
isQuantumVulnerableCurveType(curve.getEllipticCurveType()) and
58+
classification = "quantum-vulnerable" and
59+
detail = curve.getAlgorithmName() + " (" + curve.getEllipticCurveType().toString() + ")"
60+
)
61+
or
62+
// ---- Padding (quantum-vulnerable) ----
63+
exists(Crypto::PaddingAlgorithmNode pad |
64+
node = pad and
65+
category = "Padding" and
66+
isQuantumVulnerablePaddingType(pad.getPaddingType()) and
67+
classification = "quantum-vulnerable" and
68+
detail = pad.getPaddingType().toString()
69+
)
70+
or
71+
// ---- Block modes (insecure) ----
72+
exists(Crypto::ModeOfOperationAlgorithmNode mode |
73+
node = mode and
74+
category = "Mode" and
75+
isInsecureModeType(mode.getModeType()) and
76+
classification = "insecure" and
77+
detail = mode.getModeType().toString()
78+
)
79+
or
80+
// ---- Hash algorithms (insecure / secure) ----
81+
exists(Crypto::HashAlgorithmNode hash |
82+
node = hash and
83+
category = "Hash" and
84+
(
85+
isInsecureHashType(hash.getHashType()) and
86+
classification = "insecure" and
87+
detail = hash.getHashType().toString()
88+
or
89+
isSecureHashType(hash.getHashType()) and
90+
classification = "secure" and
91+
detail =
92+
hash.getHashType().toString() +
93+
any(string s |
94+
if exists(hash.getDigestLength())
95+
then s = " (" + hash.getDigestLength().toString() + "-bit)"
96+
else s = ""
97+
)
98+
)
99+
)
100+
or
101+
// ---- Key sizes with quantum-vulnerable algorithms ----
102+
exists(Crypto::KeyCreationOperationNode keygen, Crypto::AlgorithmNode alg, int keySize |
103+
node = keygen and
104+
category = "KeySize" and
105+
classification = "quantum-vulnerable" and
106+
alg = keygen.getAKnownAlgorithm() and
107+
keygen.getAKeySizeSource().asElement().(Literal).getValue().toInt() = keySize and
108+
(
109+
exists(Crypto::KeyOperationAlgorithmNode keyAlg |
110+
keyAlg = alg and isQuantumVulnerableAlgorithmType(keyAlg.getAlgorithmType())
111+
)
112+
or
113+
exists(Crypto::KeyAgreementAlgorithmNode kaAlg |
114+
kaAlg = alg and isQuantumVulnerableKeyAgreementType(kaAlg.getKeyAgreementType())
115+
)
116+
) and
117+
detail = keySize.toString() + "-bit key for " + alg.getAlgorithmName()
118+
)
119+
select node, "[" + classification + "] " + categoryLabel(category) + ": " + detail

‎java/ql/src/experimental/quantum/Examples/Demo/InsecureBlockMode.ql‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
/**
2+
* @name Insecure block mode
3+
* @description Detects use of insecure block cipher modes of operation.
4+
* @id java/quantum/examples/demo/insecure-block-mode
5+
* @kind problem
6+
* @problem.severity error
7+
* @tags quantum
8+
* experimental
9+
*/
10+
11+
import QuantumCryptoClassification
12+
13+
from Crypto::KeyOperationAlgorithmNode alg, Crypto::ModeOfOperationAlgorithmNode mode
14+
where
15+
mode = alg.getModeOfOperation() and
16+
isInsecureModeType(mode.getModeType())
17+
select alg, "Insecure block mode $@ detected.", mode, mode.getModeType().toString()

‎java/ql/src/experimental/quantum/Examples/Demo/InsecureCipher.ql‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
/**
2+
* @name Insecure symmetric cipher
3+
* @description Detects use of classically insecure symmetric cipher algorithms.
4+
* @id java/quantum/examples/demo/insecure-cipher
5+
* @kind problem
6+
* @problem.severity error
7+
* @tags external/cwe/cwe-327
8+
* quantum
9+
* experimental
10+
*/
11+
12+
import QuantumCryptoClassification
13+
14+
from Crypto::KeyOperationAlgorithmNode alg, KeyOpAlg::TSymmetricCipherType cipherType
15+
where
16+
alg.getAlgorithmType() = KeyOpAlg::TSymmetricCipher(cipherType) and
17+
isInsecureCipherType(cipherType)
18+
select alg, "Insecure symmetric cipher: " + alg.getAlgorithmName() + "."

‎java/ql/src/experimental/quantum/Examples/Demo/InsecureHash.ql‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
/**
2+
* @name Insecure hash algorithm
3+
* @description Detects use of classically insecure hash algorithms.
4+
* @id java/quantum/examples/demo/insecure-hash
5+
* @kind problem
6+
* @problem.severity error
7+
* @tags external/cwe/cwe-327
8+
* quantum
9+
* experimental
10+
*/
11+
12+
import QuantumCryptoClassification
13+
14+
from Crypto::HashAlgorithmNode alg
15+
where isInsecureHashType(alg.getHashType())
16+
select alg, "Insecure hash algorithm: " + alg.getHashType().toString() + "."

‎java/ql/src/experimental/quantum/Examples/Demo/InventoryAlgorithms.ql‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
/**
2+
* @name Inventory of cryptographic algorithms
3+
* @description Lists all detected key operation algorithms with their security classification.
4+
* @id java/quantum/examples/demo/inventory-algorithms
5+
* @kind problem
6+
* @problem.severity recommendation
7+
* @tags quantum
8+
* experimental
9+
*/
10+
11+
import QuantumCryptoClassification
12+
13+
from Crypto::AlgorithmNode alg, string name, string classification
14+
where
15+
exists(Crypto::KeyOperationAlgorithmNode keyAlg |
16+
keyAlg = alg and
17+
name = keyAlg.getAlgorithmName() and
18+
classification = classifyAlgorithmType(keyAlg.getAlgorithmType())
19+
)
20+
or
21+
exists(Crypto::KeyAgreementAlgorithmNode kaAlg |
22+
kaAlg = alg and
23+
name = kaAlg.getAlgorithmName() and
24+
classification = classifyKeyAgreementType(kaAlg.getKeyAgreementType())
25+
)
26+
select alg, "Algorithm: " + name + " [" + classification + "]."

‎java/ql/src/experimental/quantum/Examples/Demo/InventoryCurves.ql‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/**
2+
* @name Inventory of elliptic curves
3+
* @description Lists all detected elliptic curve algorithms with their family and key size.
4+
* @id java/quantum/examples/demo/inventory-curves
5+
* @kind problem
6+
* @problem.severity recommendation
7+
* @tags quantum
8+
* experimental
9+
*/
10+
11+
import experimental.quantum.Language
12+
13+
from Crypto::EllipticCurveNode c, string detail
14+
where
15+
if exists(string ks | c.properties("KeySize", ks, _))
16+
then
17+
exists(string ks |
18+
c.properties("KeySize", ks, _) and
19+
detail =
20+
"Elliptic curve: " + c.getAlgorithmName() + " (" + c.getEllipticCurveType().toString() +
21+
" family, " + ks + "-bit)."
22+
)
23+
else
24+
detail =
25+
"Elliptic curve: " + c.getAlgorithmName() + " (" + c.getEllipticCurveType().toString() +
26+
" family)."
27+
select c, detail

‎java/ql/src/experimental/quantum/Examples/Demo/InventoryHashes.ql‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
/**
2+
* @name Inventory of hash algorithms
3+
* @description Lists all detected hash algorithms with their digest length.
4+
* @id java/quantum/examples/demo/inventory-hashes
5+
* @kind problem
6+
* @problem.severity recommendation
7+
* @tags quantum
8+
* experimental
9+
*/
10+
11+
import experimental.quantum.Language
12+
13+
from Crypto::HashAlgorithmNode h, string detail
14+
where
15+
if exists(h.getDigestLength())
16+
then
17+
detail =
18+
"Hash algorithm: " + h.getHashType().toString() + " (" + h.getDigestLength().toString() +
19+
"-bit digest)."
20+
else detail = "Hash algorithm: " + h.getHashType().toString() + "."
21+
select h, detail

‎java/ql/src/experimental/quantum/Examples/Demo/InventoryKeySizes.ql‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/**
2+
* @name Inventory of cryptographic key sizes
3+
* @description Lists all detected key creation operations with their algorithm and key size.
4+
* @id java/quantum/examples/demo/inventory-key-sizes
5+
* @kind problem
6+
* @problem.severity recommendation
7+
* @tags quantum
8+
* experimental
9+
*/
10+
11+
import experimental.quantum.Language
12+
13+
from Crypto::KeyCreationOperationNode keygen, Crypto::AlgorithmNode alg, int keySize
14+
where
15+
alg = keygen.getAKnownAlgorithm() and
16+
keygen.getAKeySizeSource().asElement().(Literal).getValue().toInt() = keySize
17+
select keygen,
18+
"Key creation with algorithm $@ using " + keySize.toString() + "-bit key.", alg,
19+
alg.getAlgorithmName()

‎java/ql/src/experimental/quantum/Examples/Demo/InventoryModes.ql‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
/**
2+
* @name Inventory of block cipher modes
3+
* @description Lists all detected modes of operation for block ciphers.
4+
* @id java/quantum/examples/demo/inventory-modes
5+
* @kind problem
6+
* @problem.severity recommendation
7+
* @tags quantum
8+
* experimental
9+
*/
10+
11+
import experimental.quantum.Language
12+
13+
from Crypto::ModeOfOperationAlgorithmNode m
14+
select m, "Mode of operation: " + m.getModeType().toString() + "."

‎java/ql/src/experimental/quantum/Examples/Demo/InventoryPadding.ql‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
/**
2+
* @name Inventory of padding schemes
3+
* @description Lists all detected padding scheme algorithms.
4+
* @id java/quantum/examples/demo/inventory-padding
5+
* @kind problem
6+
* @problem.severity recommendation
7+
* @tags quantum
8+
* experimental
9+
*/
10+
11+
import experimental.quantum.Language
12+
13+
from Crypto::PaddingAlgorithmNode pad
14+
select pad, "Padding scheme: " + pad.getPaddingType().toString() + "."

0 commit comments

Comments
 (0)