Merge pull request #14289 from microsoft/jb1/16-cryptography-models-libraries-and-queries-migration

16 cryptography models libraries and queries migration

python/ql/src/experimental/cryptography/example_alerts/UnknownAsymmetricKeyGen.ql

@@ -0,0 +1,21 @@
+/**
+ * @name Unknown key generation key size
+ * @description
+ * @id py/unknown-asymmetric-key-gen-size
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @tags external/cwe/cwe-326
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from AsymmetricKeyGen op, DataFlow::Node configSrc, string algName
+where
+  not op.hasKeySize(configSrc) and
+  configSrc = op.getKeyConfigSrc() and
+  algName = op.getAlgorithm().getName()
+select op,
+  "Non-statically verifiable key size used for key generation for algorithm " + algName.toString() +
+    " at config source $@", configSrc, configSrc.toString()

python/ql/src/experimental/cryptography/example_alerts/WeakAsymmetricKeyGen.ql

@@ -0,0 +1,23 @@
+/**
+ * @name Weak key generation key size (< 2048 bits)
+ * @description
+ * @id py/weak-asymmetric-key-gen-size
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @tags external/cwe/cwe-326
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from AsymmetricKeyGen op, DataFlow::Node configSrc, int keySize, string algName
+where
+  keySize = op.getKeySizeInBits(configSrc) and
+  keySize < 2048 and
+  algName = op.getAlgorithm().getName() and
+  // Can't be an elliptic curve
+  not isEllipticCurveAlgorithm(algName, _)
+select op,
+  "Use of weak asymmetric key size (int bits)" + keySize.toString() + " for algorithm " +
+    algName.toString() + " at config source $@", configSrc, configSrc.toString()

python/ql/src/experimental/cryptography/example_alerts/WeakAsymmetricPadding.ql

@@ -0,0 +1,17 @@
+/**
+ * @name Weak or unknown asymmetric padding
+ * @description
+ * @id py/weak-asymmetric-padding
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from AsymmetricPadding pad, string name
+where
+  name = pad.getPaddingName() and
+  not name = ["OAEP", "KEM", "PSS"]
+select pad, "Use of unapproved, weak, or unknown asymmetric padding algorithm or API: " + name

python/ql/src/experimental/cryptography/example_alerts/WeakBlockMode.ql

@@ -0,0 +1,48 @@
+/**
+ * @name Weak block mode
+ * @description Finds uses of symmetric encryption block modes that are weak, obsolete, or otherwise unaccepted.
+ * @id py/weak-block-mode
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @tags external/cwe/cwe-327
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from CryptographicArtifact op, string msg
+where
+  // False positive hack, some projects are directly including all of cryptography,
+  // filter any match that is in cryptography/hazmat
+  // Specifically happening for ECB being used in keywrap operations internally to the cryptography keywrap/unwrap API
+  not op.asExpr()
+      .getLocation()
+      .getFile()
+      .getAbsolutePath()
+      .toString()
+      .matches("%cryptography/hazmat/%") and
+  (
+    op instanceof BlockMode and
+    // ECB is only allowed for KeyWrapOperations, i.e., only alert on ECB is not a KeyWrapOperation
+    (op.(BlockMode).getBlockModeName() = "ECB" implies not op instanceof KeyWrapOperation) and
+    exists(string name | name = op.(BlockMode).getBlockModeName() |
+      // Only CBC, CTS, XTS modes are allowed.
+      //  https://liquid.microsoft.com/Web/Object/Read/MS.Security/Requirements/Microsoft.Security.Cryptography.10002
+      not name = ["CBC", "CTS", "XTS"] and
+      if name = unknownAlgorithm()
+      then msg = "Use of unrecognized block mode algorithm."
+      else
+        if name in ["GCM", "CCM"]
+        then
+          msg =
+            "Use of block mode algorithm " + name +
+              " requires special crypto board approval/review."
+        else msg = "Use of unapproved block mode algorithm or API " + name + "."
+    )
+    or
+    op instanceof SymmetricCipher and
+    not op.(SymmetricCipher).hasBlockMode() and
+    msg = "Cipher has unspecified block mode algorithm."
+  )
+select op, msg

python/ql/src/experimental/cryptography/example_alerts/WeakBlockModeIVorNonce.ql

@@ -0,0 +1,37 @@
+/**
+ * @name Weak block mode IV or nonce
+ * @description Finds initialization vectors or nonces used by block modes that are weak, obsolete, or otherwise unaccepted.
+ *              Looks for IVs or nonces that are not generated by a cryptographically secure random number generator
+ *
+ *            NOTE: for simplicity, if an IV or nonce is not known or not form os.urandom it is flagged.
+ *                  More specific considerations, such as correct use of nonces are currently not handled.
+ *                  In particular, GCM requires the use of a nonce. Using urandom is possible but may still be configured
+ *                  incorrectly. We currently assume that GCM is flagged as a block mode regardless through a separate
+ *                  query, and such uses will need to be reivewed by the crypto board.
+ *
+ *                  Additionally, some functions, which infer a mode and IV may be flagged by this query.
+ *                  For now, we will rely on users suppressing these cases rather than filtering them out.
+ *                  The exception is Fernet, which is explicitly ignored since it's implementation uses os.urandom.
+ * @id py/weak-block-mode-iv-or-nonce
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from BlockMode op, string msg, DataFlow::Node conf
+where
+  not op instanceof CryptographyModule::Encryption::SymmetricEncryption::Fernet::CryptographyFernet and
+  (
+    not op.hasIVorNonce() or
+    not API::moduleImport("os").getMember("urandom").getACall() = op.getIVorNonce()
+  ) and
+  (
+    if not op.hasIVorNonce()
+    then conf = op and msg = "Block mode is missing IV/Nonce initialization."
+    else conf = op.getIVorNonce()
+  ) and
+  msg = "Block mode is not using an accepted IV/Nonce initialization: $@"
+select op, msg, conf, conf.toString()

python/ql/src/experimental/cryptography/example_alerts/WeakEllipticCurve.ql

@@ -0,0 +1,32 @@
+/**
+ * @name Weak elliptic curve
+ * @description Finds uses of cryptography algorithms that are unapproved or otherwise weak.
+ * @id py/weak-elliptic-curve
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @tags external/cwe/cwe-327
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from EllipticCurveAlgorithm op, string msg, string name
+where
+  (
+    name = op.getCurveName() and
+    name = unknownAlgorithm() and
+    msg = "Use of unrecognized curve algorithm."
+    or
+    name != unknownAlgorithm() and
+    name = op.getCurveName() and
+    not name =
+      [
+        "SECP256R1", "PRIME256V1", //P-256
+        "SECP384R1", //P-384
+        "SECP521R1", //P-521
+        "ED25519", "X25519"
+      ] and
+    msg = "Use of weak curve algorithm " + name + "."
+  )
+select op, msg

python/ql/src/experimental/cryptography/example_alerts/WeakHashes.ql

@@ -0,0 +1,21 @@
+/**
+ * @name Weak hashes
+ * @description Finds uses of cryptography algorithms that are unapproved or otherwise weak.
+ * @id py/weak-hashes
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @tags external/cwe/cwe-327
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from HashAlgorithm op, string name, string msg
+where
+  name = op.getHashName() and
+  not name = ["SHA256", "SHA384", "SHA512"] and
+  if name = unknownAlgorithm()
+  then msg = "Use of unrecognized hash algorithm."
+  else msg = "Use of unapproved hash algorithm or API " + name + "."
+select op, msg

python/ql/src/experimental/cryptography/example_alerts/WeakKDFAlgorithm.ql

@@ -0,0 +1,22 @@
+/**
+ * @name Weak KDF algorithm.
+ * @description Approved KDF algorithms must one of the following
+ *  ["PBKDF2" , "PBKDF2HMAC", "KBKDF", "KBKDFHMAC", "CONCATKDF", "CONCATKDFHASH"]
+ * @assumption The value being used to derive a key (either a key or a password) is correct for the algorithm (i.e., a key is used for KBKDF and a password for PBKDF).
+ * @kind problem
+ * @id py/weak-kdf-algorithm
+ * @problem.severity error
+ * @precision high
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from KeyDerivationAlgorithm op
+where
+  not op.getKDFName() =
+    [
+      "PBKDF2", "PBKDF2HMAC", "KBKDF", "KBKDFHMAC", "KBKDFCMAC", "CONCATKDF", "CONCATKDFHASH",
+      "CONCATKDFHMAC"
+    ]
+select op, "Use of unapproved, weak, or unknown key derivation algorithm or API."

python/ql/src/experimental/cryptography/example_alerts/WeakKDFIteration.ql

@@ -0,0 +1,31 @@
+/**
+ * @name Use iteration count at least 100k to prevent brute force attacks
+ * @description When deriving cryptographic keys from user-provided inputs such as password,
+ * use sufficient iteration count (at least 100k).
+ *
+ * This query will alert if the iteration count is less than 10000 (i.e., a constant <100000 is observed)
+ * or if the source for the iteration count is not known statically.
+ * @kind problem
+ * @id py/kdf-low-iteration-count
+ * @problem.severity error
+ * @precision high
+ */
+
+import python
+import experimental.cryptography.Concepts
+private import experimental.cryptography.utils.Utils as Utils
+
+from KeyDerivationOperation op, string msg, DataFlow::Node iterConfSrc
+where
+  op.requiresIteration() and
+  iterConfSrc = op.getIterationSizeSrc() and
+  (
+    exists(iterConfSrc.asExpr().(IntegerLiteral).getValue()) and
+    iterConfSrc.asExpr().(IntegerLiteral).getValue() < 10000 and
+    msg = "Iteration count is too low. "
+    or
+    not exists(iterConfSrc.asExpr().(IntegerLiteral).getValue()) and
+    msg = "Iteration count is not a statically verifiable size. "
+  )
+select op, msg + "Iteration count must be a minimum of 10000. Iteration Config: $@",
+  iterConfSrc.asExpr(), iterConfSrc.asExpr().toString()

python/ql/src/experimental/cryptography/example_alerts/WeakKDFKeyLength.ql

@@ -0,0 +1,32 @@
+/**
+ * @name Small KDF derived key length.
+ * @description KDF derived keys should be a minimum of 128 bits (16 bytes).
+ * @assumption If the key length is not explicitly provided (e.g., it is None or otherwise not specified) assumes the length is derived from the hash length.
+ * @kind problem
+ * @id py/kdf-small-key-size
+ * @problem.severity error
+ * @precision high
+ */
+
+import python
+import experimental.cryptography.Concepts
+private import experimental.cryptography.utils.Utils as Utils
+
+from KeyDerivationOperation op, string msg, DataFlow::Node derivedKeySizeSrc
+where
+  // NOTE/ASSUMPTION: if the key size is not specified or explicitly None, it is common that the size is derived from the hash used.
+  //       The only acceptable hashes are currently "SHA256", "SHA384", "SHA512", which are all large enough.
+  //       We will currently rely on other acceptable hash queries therefore to determine if the size is
+  //       is sufficient where the key is not specified.
+  derivedKeySizeSrc = op.getDerivedKeySizeSrc() and
+  not derivedKeySizeSrc.asExpr() instanceof None and
+  (
+    exists(derivedKeySizeSrc.asExpr().(IntegerLiteral).getValue()) and
+    derivedKeySizeSrc.asExpr().(IntegerLiteral).getValue() < 16 and
+    msg = "Derived key size is too small. "
+    or
+    not exists(derivedKeySizeSrc.asExpr().(IntegerLiteral).getValue()) and
+    msg = "Derived key size is not a statically verifiable size. "
+  )
+select op, msg + "Derived key size must be a minimum of 16 (bytes). Derived Key Size Config: $@",
+  derivedKeySizeSrc.asExpr(), derivedKeySizeSrc.asExpr().toString()

python/ql/src/experimental/cryptography/example_alerts/WeakKDFMode.ql

@@ -0,0 +1,28 @@
+/**
+ * @name Weak KDF Modee
+ * @description KDF mode, if specified, must be CounterMode
+ * @kind problem
+ * @id py/kdf-weak-mode
+ * @problem.severity error
+ * @precision high
+ */
+
+import python
+import experimental.cryptography.Concepts
+private import experimental.cryptography.utils.Utils as Utils
+
+from KeyDerivationOperation op, DataFlow::Node modeConfSrc
+where
+  op.requiresMode() and
+  modeConfSrc = op.getModeSrc() and
+  not modeConfSrc =
+    API::moduleImport("cryptography")
+        .getMember("hazmat")
+        .getMember("primitives")
+        .getMember("kdf")
+        .getMember("kbkdf")
+        .getMember("Mode")
+        .getMember("CounterMode")
+        .asSource()
+select op, "Key derivation mode is not set to CounterMode. Mode Config: $@", modeConfSrc,
+  modeConfSrc.toString()

python/ql/src/experimental/cryptography/example_alerts/WeakKDFSaltGen.ql

@@ -0,0 +1,20 @@
+/**
+ * @name Weak KDF salt generation.
+ * @description KDF salts must be generated by an approved random number generator (os.urandom)
+ * @kind problem
+ * @id py/kdf-weak-salt-gen
+ * @problem.severity error
+ * @precision high
+ */
+
+import python
+import experimental.cryptography.Concepts
+private import experimental.cryptography.utils.Utils as Utils
+
+from KeyDerivationOperation op, DataFlow::Node saltSrc
+where
+  op.requiresSalt() and
+  not API::moduleImport("os").getMember("urandom").getACall() = saltSrc and
+  saltSrc = op.getSaltConfigSrc()
+select op, "Salt configuration is not from an accepted random source: $@. Must be os.urandom",
+  saltSrc, saltSrc.toString()

python/ql/src/experimental/cryptography/example_alerts/WeakKDFSaltSize.ql

@@ -0,0 +1,32 @@
+/**
+ * @name Small KDF salt length.
+ * @description KDF salts should be a minimum of 128 bits (16 bytes).
+ *
+ * This alerts if a constant traces to to a salt length sink less than 128-bits or
+ * if the value that traces to a salt length sink is not known statically.
+ * @kind problem
+ * @id py/kdf-small-salt-size
+ * @problem.severity error
+ * @precision high
+ */
+
+import python
+import experimental.cryptography.Concepts
+private import experimental.cryptography.utils.Utils as Utils
+
+from KeyDerivationOperation op, DataFlow::Node randConfSrc, API::CallNode call, string msg
+where
+  op.requiresSalt() and
+  API::moduleImport("os").getMember("urandom").getACall() = call and
+  call = op.getSaltConfigSrc() and
+  randConfSrc = Utils::getUltimateSrcFromApiNode(call.getParameter(0, "size")) and
+  (
+    not exists(randConfSrc.asExpr().(IntegerLiteral).getValue()) and
+    msg = "Salt config is not a statically verifiable size. "
+    or
+    randConfSrc.asExpr().(IntegerLiteral).getValue() < 16 and
+    msg = "Salt config is insufficiently large. "
+  )
+select op,
+  msg + "Salt size must be a minimum of 16 (bytes). os.urandom Config: $@, Size Config: $@", call,
+  call.toString(), randConfSrc, randConfSrc.toString()

python/ql/src/experimental/cryptography/example_alerts/WeakSymmetricEncryption.ql

@@ -0,0 +1,24 @@
+/**
+ * @name Weak symmetric encryption algorithm
+ * @description Finds uses of symmetric cryptography algorithms that are weak, obsolete, or otherwise unaccepted.
+ *
+ *              The key lengths allowed are 128, 192, and 256 bits. These are all the key lengths supported by AES, so any
+ *              application of AES is considered acceptable.
+ * @id py/weak-symmetric-encryption
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @tags external/cwe/cwe-327
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from SymmetricEncryptionAlgorithm op, string name, string msg
+where
+  name = op.getEncryptionName() and
+  not name = ["AES", "AES128", "AES192", "AES256"] and
+  if name = unknownAlgorithm()
+  then msg = "Use of unrecognized symmetric encryption algorithm."
+  else msg = "Use of unapproved symmetric encryption algorithm or API " + name + "."
+select op, msg

python/ql/src/experimental/cryptography/inventory/new_models/AllAsymmetricAlgorithms.ql

@@ -0,0 +1,15 @@
+/**
+ * @name All Asymmetric Algorithms
+ * @description Finds all potential usage of asymmeric keys (RSA & ECC) using the supported libraries.
+ * @kind problem
+ * @id py/quantum-readiness/cbom/all-asymmetric-algorithms
+ * @problem.severity error
+ * @preci cbom
+ *       cryptography
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from AsymmetricAlgorithm alg
+select alg, "Use of algorithm " + alg.getName()

python/ql/src/experimental/cryptography/inventory/new_models/AllCryptoAlgorithms.ql

@@ -0,0 +1,16 @@
+/**
+ * @name All Cryptographic Algorithms
+ * @description Finds all potential usage of cryptographic algorithms usage using the supported libraries.
+ * @kind problem
+ * @id py/quantum-readiness/cbom/all-cryptographic-algorithms
+ * @problem.severity error
+ * @precision high
+ * @tags cbom
+ *       cryptography
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from CryptographicAlgorithm alg
+select alg, "Use of algorithm " + alg.getName()

python/ql/src/experimental/cryptography/inventory/new_models/AsymmetricEncryptionAlgorithms.ql

@@ -0,0 +1,16 @@
+/**
+ * @name Asymmetric Encryption Algorithms
+ * @description Finds all potential usage of asymmeric keys for encryption or key exchange using the supported libraries.
+ * @kind problem
+ * @id py/quantum-readiness/cbom/all-asymmetric-encryption-algorithms
+ * @problem.severity error
+ * @precision high
+ * @tags cbom
+ *       cryptography
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from AsymmetricEncryptionAlgorithm alg
+select alg, "Use of algorithm " + alg.getEncryptionName()

python/ql/src/experimental/cryptography/inventory/new_models/AsymmetricKeyGenOperation.ql

@@ -0,0 +1,19 @@
+/**
+ * @name Known asymmetric key source generation
+ * @description Finds all known potential sources for asymmetric key generation while using the supported libraries.
+ * @kind problem
+ * @id py/quantum-readiness/cbom/asymmetric-key-generation
+ * @problem.severity error
+ * @precision high
+ * @tags cbom
+ *       cryptography
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from AsymmetricKeyGen op, DataFlow::Node confSrc
+where op.getKeyConfigSrc() = confSrc
+select op,
+  "Asymmetric key generation for algorithm " + op.getAlgorithm().getName() +
+    " with key config source $@", confSrc, confSrc.toString()

python/ql/src/experimental/cryptography/inventory/new_models/AsymmetricPaddingAlgorithms.ql

@@ -0,0 +1,15 @@
+/**
+ * @name Asymmetric Padding Schemes
+ * @description Finds all potential usage of padding schemes used with asymmeric algorithms.
+ * @kind problem
+ * @id py/quantum-readiness/cbom/asymmetric-padding-schemes
+ * @problem.severity error
+ * @tags cbom
+ *       cryptography
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from AsymmetricPadding alg
+select alg, "Use of algorithm " + alg.getPaddingName()

python/ql/src/experimental/cryptography/inventory/new_models/AuthenticatedEncryptionAlgorithms.ql

@@ -0,0 +1,16 @@
+/**
+ * @name Authenticated Encryption Algorithms
+ * @description Finds all potential usage of authenticated encryption schemes using the supported libraries.
+ * @kind problem
+ * @id py/quantum-readiness/cbom/authenticated-encryption-algorithms
+ * @problem.severity error
+ * @precision high
+ * @tags cbom
+ *       cryptography
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from AuthenticatedEncryptionAlgorithm alg
+select alg, "Use of algorithm " + alg.getAuthticatedEncryptionName()

python/ql/src/experimental/cryptography/inventory/new_models/BlockModeAlgorithms.ql

@@ -0,0 +1,16 @@
+/**
+ * @name Block cipher mode of operation
+ * @description Finds all potential block cipher modes of operations using the supported libraries.
+ * @kind problem
+ * @id py/quantum-readiness/cbom/block-cipher-mode
+ * @problem.severity error
+ * @precision high
+ * @tags cbom
+ *       cryptography
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from BlockMode alg
+select alg, "Use of algorithm " + alg.getBlockModeName()

python/ql/src/experimental/cryptography/inventory/new_models/BlockModeKnownIVsOrNonces.ql

@@ -0,0 +1,16 @@
+/**
+ * @name Initialization Vector (IV) or nonces
+ * @description Finds all potential sources for initialization vectors (IV) or nonce used in block ciphers while using the supported libraries.
+ * @kind problem
+ * @id py/quantum-readiness/cbom/iv-sources
+ * @problem.severity error
+ * @precision high
+ * @tags cbom
+ *       cryptography
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from BlockMode alg
+select alg.getIVorNonce().asExpr(), "Block mode IV/Nonce source"

python/ql/src/experimental/cryptography/inventory/new_models/BlockModeUnknownIVsOrNonces.ql

@@ -0,0 +1,17 @@
+/**
+ * @name Unknown Initialization Vector (IV) or nonces
+ * @description Finds all potentially unknown sources for initialization vectors (IV) or nonce used in block ciphers while using the supported libraries.
+ * @kind problem
+ * @id py/quantum-readiness/cbom/unkown-iv-sources
+ * @problem.severity error
+ * @precision high
+ * @tags cbom
+ *       cryptography
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from BlockMode alg
+where not alg.hasIVorNonce()
+select alg, "Block mode with unknown IV or Nonce configuration"

python/ql/src/experimental/cryptography/inventory/new_models/EllipticCurveAlgorithms.ql

@@ -0,0 +1,18 @@
+/**
+ * @name Elliptic Curve Algorithms
+ * @description Finds all potential usage of elliptic curve algorithms using the supported libraries.
+ * @kind problem
+ * @id py/quantum-readiness/cbom/elliptic-curve-algorithms
+ * @problem.severity error
+ * @precision high
+ * @tags cbom
+ *       cryptography
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from EllipticCurveAlgorithm alg
+select alg,
+  "Use of algorithm " + alg.getCurveName() + " with key size (in bits) " +
+    alg.getCurveBitSize().toString()

python/ql/src/experimental/cryptography/inventory/new_models/HashingAlgorithms.ql

@@ -0,0 +1,16 @@
+/**
+ * @name Hash Algorithms
+ * @description Finds all potential usage of cryptographic hash algorithms using the supported libraries.
+ * @kind problem
+ * @id py/quantum-readiness/cbom/hash-algorithms
+ * @problem.severity error
+ * @precision high
+ * @tags cbom
+ *       cryptography
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from HashAlgorithm alg
+select alg, "Use of algorithm " + alg.getName()

python/ql/src/experimental/cryptography/inventory/new_models/KeyDerivationAlgorithms.ql

@@ -0,0 +1,18 @@
+/**
+ * @name Key Derivation Algorithms
+ * @description Finds all potential usage of key derivation using the supported libraries.
+ * @kind problem
+ * @id py/quantum-readiness/cbom/key-derivation
+ * @problem.severity error
+ * @precision high
+ * @tags cbom
+ *       cryptography
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from KeyDerivationOperation op
+// TODO: pull out all configuration from the operation?
+select op,
+  "Use of key derivation algorithm " + op.getAlgorithm().(KeyDerivationAlgorithm).getKDFName()

python/ql/src/experimental/cryptography/inventory/new_models/KeyExchangeAlgorithms.ql

@@ -0,0 +1,16 @@
+/**
+ * @name Key Exchange Algorithms
+ * @description Finds all potential usage of key exchange using the supported libraries.
+ * @kind problem
+ * @id py/quantum-readiness/cbom/key-exchange
+ * @problem.severity error
+ * @precision high
+ * @tags cbom
+ *       cryptography
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from KeyExchangeAlgorithm alg
+select alg, "Use of algorithm " + alg.getName()

python/ql/src/experimental/cryptography/inventory/new_models/SigningAlgorithms.ql

@@ -0,0 +1,16 @@
+/**
+ * @name Signing Algorithms
+ * @description Finds all potential usage of signing algorithms using the supported libraries.
+ * @kind problem
+ * @id py/quantum-readiness/cbom/signing-algorithms
+ * @problem.severity error
+ * @precision high
+ * @tags cbom
+ *       cryptography
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from SigningAlgorithm alg
+select alg, "Use of algorithm " + alg.getName()

python/ql/src/experimental/cryptography/inventory/new_models/SymmetricEncryptionAlgorithms.ql

@@ -0,0 +1,16 @@
+/**
+ * @name Symmetric Encryption Algorithms
+ * @description Finds all potential usage of symmetric encryption algorithms using the supported libraries.
+ * @kind problem
+ * @id py/quantum-readiness/cbom/symmetric-encryption-algorithms
+ * @problem.severity error
+ * @precision high
+ * @tags cbom
+ *       cryptography
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from SymmetricEncryptionAlgorithm alg
+select alg, "Use of algorithm " + alg.getEncryptionName()

python/ql/src/experimental/cryptography/inventory/new_models/SymmetricPaddingAlgorithms.ql

@@ -0,0 +1,15 @@
+/**
+ * @name Symmetric Padding Schemes
+ * @description Finds all potential usage of padding schemes used with symmeric algorithms.
+ * @kind problem
+ * @id py/quantum-readiness/cbom/symmetric-padding-schemes
+ * @problem.severity error
+ * @tags cbom
+ *       cryptography
+ */
+
+import python
+import experimental.cryptography.Concepts
+
+from SymmetricPadding alg
+select alg, "Use of algorithm " + alg.getPaddingName()

python/ql/src/experimental/cryptography/inventory/old_models/AllCryptoAlgorithms.ql

@@ -0,0 +1,20 @@
+/**
+ * @name All Cryptographic Algorithms
+ * @description Finds all potential usage of cryptographic algorithms usage using the supported libraries.
+ * @kind problem
+ * @id py/quantum-readiness/cbom/classic-model/all-cryptographic-algorithms
+ * @problem.severity error
+ * @precision high
+ * @tags cbom
+ *       cryptography
+ */
+
+import python
+import semmle.python.Concepts
+
+from Cryptography::CryptographicOperation operation, string algName
+where
+  algName = operation.getAlgorithm().getName()
+  or
+  algName = operation.getBlockMode()
+select operation, "Use of algorithm " + algName

python/ql/src/experimental/cryptography/inventory/old_models/BlockModeAlgorithms.ql

@@ -0,0 +1,17 @@
+/**
+ * @name Block cipher mode of operation
+ * @description Finds all potential block cipher modes of operations using the supported libraries.
+ * @kind problem
+ * @id py/quantum-readiness/cbom/classic-model/block-cipher-mode
+ * @problem.severity error
+ * @precision high
+ * @tags cbom
+ *       cryptography
+ */
+
+import python
+import semmle.python.Concepts
+
+from Cryptography::CryptographicOperation operation, string algName
+where algName = operation.getBlockMode()
+select operation, "Use of algorithm " + algName

python/ql/src/experimental/cryptography/inventory/old_models/HashingAlgorithms.ql

@@ -0,0 +1,22 @@
+/**
+ * @name Hash Algorithms
+ * @description Finds all potential usage of cryptographic hash algorithms using the supported libraries.
+ * @kind problem
+ * @id py/quantum-readiness/cbom/classic-model/hash-algorithms
+ * @problem.severity error
+ * @precision high
+ * @tags cbom
+ *       cryptography
+ */
+
+import python
+import semmle.python.Concepts
+
+from Cryptography::CryptographicOperation operation, Cryptography::CryptographicAlgorithm algorithm
+where
+  algorithm = operation.getAlgorithm() and
+  (
+    algorithm instanceof Cryptography::HashingAlgorithm or
+    algorithm instanceof Cryptography::PasswordHashingAlgorithm
+  )
+select operation, "Use of algorithm " + operation.getAlgorithm().getName()