Skip to content

Add precise parameter detection for BC KEM and digest constructors#421

Open
Sanchay117 wants to merge 1 commit into
cbomkit:mainfrom
Sanchay117:precise-capture-of-parameter-sets-in-BouncyCastle
Open

Add precise parameter detection for BC KEM and digest constructors#421
Sanchay117 wants to merge 1 commit into
cbomkit:mainfrom
Sanchay117:precise-capture-of-parameter-sets-in-BouncyCastle

Conversation

@Sanchay117
Copy link
Copy Markdown

Fixes #149

Overview

This PR improves the detection precision of the BouncyCastle rules in the Sonar Cryptography Plugin. It replaces generic withAnyParameters() matches with precise constructor parameter capture rules. This enables the plugin to capture and distinguish specific parameter/algorithm sets (e.g., distinguishing between kyber512 vs kyber1024, or AsconHash vs AsconHashA) rather than only detecting the generic top-level algorithm family.

Key Changes

1. New KEM Parameter Detection Rules (8 New Classes)

Added 8 new cipher parameter classes under com.ibm.plugin.rules.detection.bc.cipherparameters to map and capture specific algorithm configurations using AlgorithmParameterFactory:

  • BcBIKEParameters: Captures BIKEParameters from BIKEKeyParameters, BIKEPrivateKeyParameters, and BIKEPublicKeyParameters.
  • BcCMCEParameters: Captures CMCEParameters from Classic McEliece key parameters.
  • BcFrodoParameters: Captures FrodoParameters from FrodoKEM key parameters.
  • BcHQCParameters: Captures HQCParameters from HQC key parameters.
  • BcKyberParameters: Captures KyberParameters from legacy Kyber key parameters.
  • BcNTRUParameters: Captures NTRUParameters from NTRU key parameters.
  • BcNTRULPRimeParameters: Captures NTRULPRimeParameters from NTRULPRime key parameters.
  • BcSNTRUPrimeParameters: Captures SNTRUPrimeParameters from Streamlined NTRU Prime key parameters.

These 8 new rules have been wired into the central registry in BcCipherParameters.java.

2. Precise KEM Extractor Signatures

  • Modified BcEncapsulatedSecretExtractor.java to replace the wildcard withAnyParameters() constructor match with explicit, type-safe constructor matches.
  • Constructors now explicitly map to the corresponding *PrivateKeyParameters classes (e.g., BIKEPrivateKeyParameters, HQCPrivateKeyParameters) and chain into BcCipherParameters.rules() for full parameter-set extraction.

3. Precise Ascon Digest Signatures

  • Modified BcDigests.java to move AsconDigest and AsconXof out of the wildcard regularConstructors() loop.
  • Added precise constructors matching AsconDigest(AsconDigest.AsconParameters) and AsconXof(AsconXof.AsconParameters).
  • Applied AlgorithmParameterFactory to correctly extract the exact configuration (e.g., AsconHash, AsconHashA, AsconXof, or AsconXofA) passing through.

4. Tests and Verification

  • Updated BcBIKEKEMExtractorTest.java to assert the newly resolved child node under the KEM finding: a ParameterSetIdentifier containing the detected parameter set (which maps from BIKEParameters.bike128 in the test file).
  • Formatted the workspace using Spotless (mvn spotless:apply).
  • Ran the entire test suite: 155/155 tests passing successfully.

@Sanchay117 Sanchay117 requested a review from a team as a code owner May 21, 2026 16:52
Signed-off-by: sanchaysingh <sanchay072@gmail.com>
@Sanchay117 Sanchay117 force-pushed the precise-capture-of-parameter-sets-in-BouncyCastle branch from 1e84413 to d83c49e Compare May 21, 2026 17:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Precise capture of parameter sets in BouncyCastle

1 participant