/**
 * Pass: weak-crypto (CWE-327 / CWE-329 / CWE-321 / CWE-326, category: security)
 *
 * Pattern pass — flags use of cryptographically weak symmetric ciphers
 * (DES, 3DES, RC2, RC4, Blowfish), ECB mode, weak RSA key sizes (< 2048),
 * static/zero IVs (CWE-329), hardcoded symmetric keys (CWE-321), and weak
 * AES modes. Like weak-hash, the vulnerability is the *constant algorithm
 * string*, *constant IV bytes*, *literal key material*, or *key-size
 * argument*, not data flow.
 *
 * Detection per language:
 *   Java:
 *     - `Cipher.getInstance("DES"|"DES/...")` / `"RC4"` / `"RC2"` / `"Blowfish"`
 *     - `Cipher.getInstance(".../ECB/...")` — ECB mode
 *     - `KeyGenerator.getInstance("DES"|"RC4"|"Blowfish")`
 *     - `new IvParameterSpec(new byte[N])` / `new IvParameterSpec(literalBytes)`
 *       — static/zero IV (CWE-329, issue #87)
 *     - `new SecretKeySpec("literal".getBytes(), ...)` — hardcoded symmetric
 *       key (CWE-321, issue #87)
 *     - `KeyPairGenerator.initialize(<2048)` — weak RSA key size (CWE-326,
 *       issue #87). Detected by literal `< 2048` argument on `initialize`
 *       calls whose receiver is a `KeyPairGenerator` (best-effort: matches
 *       any `*.initialize(int)` where the literal is below 2048, since
 *       2048+ is also the minimum for DSA / DH and 256+ is correct for EC).
 *   Python:
 *     - `Crypto.Cipher.DES.new(...)` / `Crypto.Cipher.ARC4.new(...)` /
 *       `Crypto.Cipher.Blowfish.new(...)` (pycryptodome / pycrypto)
 *     - `cryptography.hazmat.primitives.ciphers.algorithms.{TripleDES,Blowfish,ARC4,IDEA,SEED,CAST5}`
 *     - `AES.new(key, AES.MODE_ECB)` — ECB mode argument
 *     - `modes.ECB()` (cryptography.hazmat) — issue #87
 *     - `AES.new(b"literal", …)` / `algorithms.AES(b"literal")` — hardcoded
 *       symmetric key (CWE-321, issue #87). Detected for both inline byte
 *       literals and variables resolved via constant propagation.
 *     - `rsa.generate_private_key(key_size=<2048)` — weak RSA key size
 *       (CWE-326, issue #87)
 *   JavaScript / TypeScript:
 *     - `crypto.createCipher(...)` (deprecated; always weak)
 *     - `crypto.createCipheriv("des-..."|"rc4"|"bf-..."|"des-ede"|".*-ecb")`
 *   Go:
 *     - `des.NewCipher(...)` / `des.NewTripleDESCipher(...)` / `rc4.NewCipher(...)`
 *       (from `crypto/des` and `crypto/rc4`)
 *     - `cipher.NewECBEncrypter(...)` (custom ECB wrappers — best-effort)
 *     - `aes.NewCipher([]byte("literal"))` — hardcoded symmetric key
 *       (CWE-321, issue #87)
 *     - `rsa.GenerateKey(rand.Reader, <2048)` — weak RSA key size
 *       (CWE-326, issue #87)
 *
 * Aligned with: gosec G401/G405, Bandit B304/B305/B306, OWASP Benchmark `crypto` category.
 */
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
export type WeakCryptoIssue = 'weak-cipher' | 'ecb-mode' | 'deprecated-api' | 'static-iv' | 'hardcoded-key' | 'weak-rsa-key';
export interface WeakCryptoResult {
    findings: Array<{
        line: number;
        language: string;
        issue: WeakCryptoIssue;
        detail: string;
        api: string;
    }>;
}
export declare class WeakCryptoPass implements AnalysisPass<WeakCryptoResult> {
    readonly name = "weak-crypto";
    readonly category: "security";
    run(ctx: PassContext): WeakCryptoResult;
    private buildMessage;
    private buildFix;
    private detect;
}
//# sourceMappingURL=weak-crypto-pass.d.ts.map