Rule packs

Rule packs are YAML files that teach the source detector which calls and identifiers count as crypto. What you will do: put a file in the right folder, copy an existing rule, scan. Use the field reference below when you need a detail. Hands-on walkthrough: Adding a rule.

Where to put a file

Path	For
`rules/javascript/`	JS and TypeScript (TS loads JS packs)
`rules/c/`	C APIs: OpenSSL, libsodium, mbedTLS (C++ files also load these)
`rules/cpp/`	C++-only packs: Crypto++, Botan
`rules/go/`, `rules/python/`, `rules/java/`	Those languages
`rules/libraries/catalog.yaml`	Go modules in `go.mod` (deps detector)

Shipped C / C++ packs (v0.3.0)

Pack	Path	Matches
OpenSSL / libcrypto	`rules/c/openssl.yaml`	RSA, EC/ECDSA/ECDH, DSA/DH, AES, ChaCha20, digests, selected EVP APIs
libsodium	`rules/c/libsodium.yaml`	Sign/box/AEAD/hash helpers (`crypto_sign_`, `crypto_aead_`, …)
mbedTLS	`rules/c/mbedtls.yaml`	RSA, ECDSA/ECDH, AES/GCM, digests, polymorphic `mbedtls_pk_*`
Crypto++	`rules/cpp/cryptopp.yaml`	Distinctive type names (identifier match)
Botan	`rules/cpp/botan.yaml`	Distinctive type names and `create_private_key`

For C and C++, match.package is an ecosystem tag (openssl, libsodium, mbedtls, botan). Calls are usually unqualified; the tag does not need an import path. Release binaries ship embedded packs. If you scan from a source checkout, on-disk rules/ wins so edits apply without rebuilding. --rules adds extra directories after the defaults (it does not replace them). See CLI flags.

Annotated example

id: c-openssl
version: 1
language: c
description: OpenSSL and common C cryptographic API calls.

rules:
  - id: c.openssl.rsa_generate_key_ex
    primitive: RSA
    assetType: algorithm
    functions: [keygen]
    confidence: high
    match:
      kind: call
      package: openssl
      symbol: RSA_generate_key_ex
    references:
      - "https://www.openssl.org/docs/man3.0/man3/RSA_generate_key.html"

language picks which files this pack applies to.
id on each rule must stay stable (SARIF baselines).
primitive must be a canonical name, or UNKNOWN.
match is how cryptarium finds the site (call or identifier).

How loading works

Find on-disk rules/ by walking up from the working directory, or use the embedded packs.
Skip libraries/ when loading source packs (that file is for deps).
Append any --rules directories.
For each source file, run packs for that language (plus aliases: TS→javascript, cpp→c).
Prefer tree-sitter AST matches; regex fallback forces low confidence.

Library catalog

rules/libraries/catalog.yaml is separate from source packs:

libraries:
  - name: golang.org/x/crypto
    ecosystem: go
    primitives: [RSA, ECDSA, EdDSA, AES, ChaCha20, SHA-256]
    confidence: medium

Today the deps detector uses go.mod and entries with ecosystem: go. Presence means “this library is in the graph,” not “this algorithm is used.”

Pack fields

Field	Required	Meaning
`id`	yes	Pack name (`c-openssl`, `javascript-webcrypto`)
`version`	yes (schema)	Integer pack version
`language`	yes	Which language files this pack targets
`description`	no	Human notes only
`rules`	yes	List of rules (at least one)

Rule fields

Field	Required	Meaning
`id`	yes	Stable rule ID (part of finding identity)
`primitive`	yes	Canonical algorithm name or `UNKNOWN`
`assetType`	no	Defaults to `algorithm` for source
`functions`	no	Ops like `keygen`, `encrypt`, `sign` (helps scoring)
`confidence`	no	`high`, `medium`, or `low` (empty → medium)
`match`	yes	How to locate the site
`parameters`	no	Static values or argument extraction
`references`	no	API docs for reviewers (not copied onto findings today)

Use high only when the match alone establishes the algorithm and its important parameters.

match object

kind: call

Field	Meaning
`package`	Import / qualifier (`crypto`, `openssl`, `crypto/rsa`)
`symbol`	Exact function name

For OpenSSL, libsodium, mbedTLS, and Botan, package is an ecosystem tag. Unqualified C/C++ calls still match.kind: identifier

Field	Meaning
`pattern`	Go regexp on identifier text (TLS suite constants, etc.)

parameters

Form	Meaning
`keySize: { value: 128 }`	Always attach this value
`keySize: { from: argument, index: 1, type: int }`	Read a positional argument

Some packs write from: keyword. That form is not wired in the matcher yet. Prefer from: argument or omit parameters and keep confidence honest.

Get started

Concepts

Detectors & rules

Guides

Reference

Rule packs

Rule packs

Where to put a file

Shipped C / C++ packs (v0.3.0)

Annotated example

How loading works

Library catalog

Rule packs

Where to put a file

Shipped C / C++ packs (v0.3.0)

Annotated example

How loading works

Library catalog

Related