{
  "module": "codeql_quantum_external",
  "claim_type": "classification",
  "provenance": "third_party",
  "tool_version": "1.171.0",
  "elapsed_seconds": 4.24,
  "notes": [
    "semgrep available: True",
    "23 files vendored unmodified from github/codeql (MIT license, pinned commit d1fed84daf8f3abc59cf9453692b98632932d60f) -- see benchmark/corpus/vendor/codeql_quantum/NOTICE.md",
    "Ground truth is QShield's own file-level classification of each vendored file by which JCA algorithm-factory calls it contains, not borrowed from any CodeQL query result -- see benchmark/corpus/codeql_quantum.py CLASSIFICATION for the evidence behind every verdict."
  ],
  "case_count": 23,
  "reproduction_recipe": [
    "Fetch the unmodified file expected_context.filename from https://github.com/github/codeql, path expected_context.source_path, pinned commit d1fed84daf8f3abc59cf9453692b98632932d60f (MIT license -- see benchmark/corpus/vendor/codeql_quantum/NOTICE.md).",
    "Run QShield's source-code scanner against it unmodified.",
    "Check whether it reported any quantum_vulnerable finding anywhere in the file.",
    "Ground truth (expected.vulnerable) was derived by QShield's team reading the file's actual JCA algorithm-factory calls, not borrowed from any CodeQL query result -- see expected_note for the specific API calls cited as evidence, and benchmark/corpus/codeql_quantum.py CLASSIFICATION for the full list."
  ],
  "cases": [
    {
      "case_id": "codeql_quantum:AsymmetricEncryptionMacHybridCryptosystem.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": true,
        "present": null
      },
      "expected_context": {
        "filename": "AsymmetricEncryptionMacHybridCryptosystem.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "KeyPairGenerator.getInstance(\"RSA\"), KeyPairGenerator.getInstance(\"EC\"), KeyPairGenerator.getInstance(\"X25519\"), Cipher RSA/ECB/OAEP...",
      "actual_outcome": "TP",
      "actual_detail": {
        "filename": "AsymmetricEncryptionMacHybridCryptosystem.java"
      }
    },
    {
      "case_id": "codeql_quantum:EllipticCurve1.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": true,
        "present": null
      },
      "expected_context": {
        "filename": "EllipticCurve1.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "KeyPairGenerator.getInstance(\"EC\"/\"X25519\"/\"X448\"/\"Ed25519\") across NIST/SEC/Brainpool/Curve25519/Curve448/SM2/EdDSA curve families",
      "actual_outcome": "TP",
      "actual_detail": {
        "filename": "EllipticCurve1.java"
      }
    },
    {
      "case_id": "codeql_quantum:EllipticCurve2.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": true,
        "present": null
      },
      "expected_context": {
        "filename": "EllipticCurve2.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "KeyAgreement.getInstance(\"ECDH\"), KeyPairGenerator.getInstance(\"EC\"/\"Ed25519\"/\"X25519\"), Signature.getInstance(\"Ed25519\"/\"SHA256withECDSA\")",
      "actual_outcome": "TP",
      "actual_detail": {
        "filename": "EllipticCurve2.java"
      }
    },
    {
      "case_id": "codeql_quantum:Encryption1.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": true,
        "present": null
      },
      "expected_context": {
        "filename": "Encryption1.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "Cipher.getInstance(\"RSA/ECB/OAEPWithSHA-256AndMGF1Padding\")",
      "actual_outcome": "TP",
      "actual_detail": {
        "filename": "Encryption1.java"
      }
    },
    {
      "case_id": "codeql_quantum:Encryption2.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": true,
        "present": null
      },
      "expected_context": {
        "filename": "Encryption2.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "KeyAgreement.getInstance(\"ECDH\"), KeyPairGenerator.getInstance(\"EC\")",
      "actual_outcome": "TP",
      "actual_detail": {
        "filename": "Encryption2.java"
      }
    },
    {
      "case_id": "codeql_quantum:Hash.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": true,
        "present": null
      },
      "expected_context": {
        "filename": "Hash.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "Signature.getInstance(\"SHA256withRSA\") alongside its MD5/SHA-256 digest calls",
      "actual_outcome": "TP",
      "actual_detail": {
        "filename": "Hash.java"
      }
    },
    {
      "case_id": "codeql_quantum:KeyAgreementHybridCryptosystem.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": true,
        "present": null
      },
      "expected_context": {
        "filename": "KeyAgreementHybridCryptosystem.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "KeyPairGenerator.getInstance(\"EC\"/\"X25519\")",
      "actual_outcome": "TP",
      "actual_detail": {
        "filename": "KeyAgreementHybridCryptosystem.java"
      }
    },
    {
      "case_id": "codeql_quantum:KeyArtifact.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": true,
        "present": null
      },
      "expected_context": {
        "filename": "KeyArtifact.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "KeyFactory.getInstance(\"RSA\"), KeyPairGenerator.getInstance(\"RSA\"/\"EC\")",
      "actual_outcome": "TP",
      "actual_detail": {
        "filename": "KeyArtifact.java"
      }
    },
    {
      "case_id": "codeql_quantum:KeyEncapsulation.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": true,
        "present": null
      },
      "expected_context": {
        "filename": "KeyEncapsulation.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "KeyPairGenerator.getInstance(\"RSA\"/\"EC\"), KeyAgreement.getInstance(\"ECDH\"), Cipher RSA/ECB/OAEP... -- also demonstrates the PQC-safe Kyber KEM in the same file, but the RSA/EC calls alone make this file positive at file-level granularity",
      "actual_outcome": "TP",
      "actual_detail": {
        "filename": "KeyEncapsulation.java"
      }
    },
    {
      "case_id": "codeql_quantum:KeyExchange.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": true,
        "present": null
      },
      "expected_context": {
        "filename": "KeyExchange.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "KeyAgreement/KeyPairGenerator.getInstance(\"DH\"/\"EC\"/\"X25519\"/\"X448\")",
      "actual_outcome": "TP",
      "actual_detail": {
        "filename": "KeyExchange.java"
      }
    },
    {
      "case_id": "codeql_quantum:SignEncryptCombinations.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": true,
        "present": null
      },
      "expected_context": {
        "filename": "SignEncryptCombinations.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "KeyPairGenerator.getInstance(\"EC\"), Signature.getInstance(\"SHA256withECDSA\")",
      "actual_outcome": "TP",
      "actual_detail": {
        "filename": "SignEncryptCombinations.java"
      }
    },
    {
      "case_id": "codeql_quantum:SignatureOperation.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": true,
        "present": null
      },
      "expected_context": {
        "filename": "SignatureOperation.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "KeyPairGenerator.getInstance(\"EC\"/\"Ed25519\"/\"RSA\"), Signature.getInstance(\"Ed25519\"/\"SHA1withRSA\"/\"SHA256withECDSA\"/\"SHA256withRSAandMGF1\")",
      "actual_outcome": "TP",
      "actual_detail": {
        "filename": "SignatureOperation.java"
      }
    },
    {
      "case_id": "codeql_quantum:AesWrapAndPBEWith.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": false,
        "present": null
      },
      "expected_context": {
        "filename": "AesWrapAndPBEWith.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "AES/AESWrap, PBEWith.../PBKDF2WithHmacSHA256 -- symmetric/PBE only",
      "actual_outcome": "TN",
      "actual_detail": {
        "filename": "AesWrapAndPBEWith.java"
      }
    },
    {
      "case_id": "codeql_quantum:ChainedEncryptionTest.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": false,
        "present": null
      },
      "expected_context": {
        "filename": "ChainedEncryptionTest.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "AES/GCM, ChaCha20-Poly1305 -- symmetric only",
      "actual_outcome": "TN",
      "actual_detail": {
        "filename": "ChainedEncryptionTest.java"
      }
    },
    {
      "case_id": "codeql_quantum:Digest.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": false,
        "present": null
      },
      "expected_context": {
        "filename": "Digest.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "MD5/SHA-1/SHA-256 digests, AES, PBKDF2 -- no asymmetric call",
      "actual_outcome": "TN",
      "actual_detail": {
        "filename": "Digest.java"
      }
    },
    {
      "case_id": "codeql_quantum:IVArtifact.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": false,
        "present": null
      },
      "expected_context": {
        "filename": "IVArtifact.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "AES/CBC, AES/GCM, SHA-256 -- symmetric/hash only",
      "actual_outcome": "TN",
      "actual_detail": {
        "filename": "IVArtifact.java"
      }
    },
    {
      "case_id": "codeql_quantum:KeyDerivation1.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": false,
        "present": null
      },
      "expected_context": {
        "filename": "KeyDerivation1.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "PBKDF2 (SHA1/256/512), SCRYPT, AES/ECB -- KDF/symmetric only",
      "actual_outcome": "TN",
      "actual_detail": {
        "filename": "KeyDerivation1.java"
      }
    },
    {
      "case_id": "codeql_quantum:MACOperation.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": false,
        "present": null
      },
      "expected_context": {
        "filename": "MACOperation.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "HmacSHA1/256, HmacSHA3-256, KMAC128, GMac, Poly1305, AES/GCM -- MAC/symmetric only",
      "actual_outcome": "TN",
      "actual_detail": {
        "filename": "MACOperation.java"
      }
    },
    {
      "case_id": "codeql_quantum:Nonce.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": false,
        "present": null
      },
      "expected_context": {
        "filename": "Nonce.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "AES/GCM, HmacSHA256 -- symmetric only",
      "actual_outcome": "TN",
      "actual_detail": {
        "filename": "Nonce.java"
      }
    },
    {
      "case_id": "codeql_quantum:PrngTest.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": false,
        "present": null
      },
      "expected_context": {
        "filename": "PrngTest.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "KeyGenerator.getInstance(\"AES\") only",
      "actual_outcome": "TN",
      "actual_detail": {
        "filename": "PrngTest.java"
      }
    },
    {
      "case_id": "codeql_quantum:SymmetricAlgorithm.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": false,
        "present": null
      },
      "expected_context": {
        "filename": "SymmetricAlgorithm.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "AES/ChaCha20/DES/DESede/RC4 ciphers, HmacSHA256/KMAC128 -- all symmetric (DES/RC4 are weak against classical brute force, not Shor-vulnerable)",
      "actual_outcome": "TN",
      "actual_detail": {
        "filename": "SymmetricAlgorithm.java"
      }
    },
    {
      "case_id": "codeql_quantum:SymmetricModesTest.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": false,
        "present": null
      },
      "expected_context": {
        "filename": "SymmetricModesTest.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "AES/KWP, AES/OFB8 -- symmetric only",
      "actual_outcome": "TN",
      "actual_detail": {
        "filename": "SymmetricModesTest.java"
      }
    },
    {
      "case_id": "codeql_quantum:UniversalFlowTest.java",
      "claim_type": "classification",
      "expected": {
        "vulnerable": false,
        "present": null
      },
      "expected_context": {
        "filename": "UniversalFlowTest.java",
        "source": "github/codeql (MIT)",
        "source_path": "java/ql/test/experimental/library-tests/quantum/jca/"
      },
      "expected_note": "KeyGenerator.getInstance(<AES or disk-loaded string, defaults to \"AES\">), Cipher AES/GCM -- no asymmetric call on any resolvable path",
      "actual_outcome": "TN",
      "actual_detail": {
        "filename": "UniversalFlowTest.java"
      }
    }
  ]
}