# Kindi default API definitions
# Whole-word matched patterns for crypto library API calls
# Format: All patterns get implicit \b word boundaries

[keyword_list_version]
    1

# ══════════════════════════════════════════════════════════════════════
# OpenSSL API
# ══════════════════════════════════════════════════════════════════════

[{"evidence_type": "api/openssl/cipher", "language": "c", "encryption_library": "OpenSSL", "encryption_api_usage": "call"}]
    "EVP_EncryptInit_ex"
    "EVP_EncryptUpdate"
    "EVP_EncryptFinal_ex"
    "EVP_DecryptInit_ex"
    "EVP_DecryptUpdate"
    "EVP_DecryptFinal_ex"
    "EVP_CipherInit_ex"
    "EVP_CIPHER_CTX_new"
    "EVP_CIPHER_CTX_free"
    "EVP_aes_256_gcm"
    "EVP_aes_256_cbc"
    "EVP_aes_128_gcm"
    "EVP_aes_128_cbc"
    "EVP_chacha20_poly1305"
    "EVP_des_ede3_cbc"

[{"evidence_type": "api/openssl/digest", "language": "c", "encryption_library": "OpenSSL", "encryption_api_usage": "call"}]
    "EVP_DigestInit_ex"
    "EVP_DigestUpdate"
    "EVP_DigestFinal_ex"
    "EVP_MD_CTX_new"
    "EVP_MD_CTX_free"
    "EVP_sha256"
    "EVP_sha384"
    "EVP_sha512"
    "EVP_sha1"
    "EVP_md5"

[{"evidence_type": "api/openssl/pkey", "language": "c", "encryption_library": "OpenSSL", "encryption_api_usage": "call"}]
    "EVP_PKEY_new"
    "EVP_PKEY_CTX_new"
    "EVP_PKEY_keygen_init"
    "EVP_PKEY_keygen"
    "EVP_PKEY_sign_init"
    "EVP_PKEY_sign"
    "EVP_PKEY_verify_init"
    "EVP_PKEY_verify"
    "EVP_PKEY_encrypt_init"
    "EVP_PKEY_encrypt"
    "EVP_PKEY_decrypt_init"
    "EVP_PKEY_decrypt"

[{"evidence_type": "api/openssl/rsa", "language": "c", "encryption_library": "OpenSSL", "encryption_api_usage": "call"}]
    "RSA_generate_key_ex"
    "RSA_public_encrypt"
    "RSA_private_decrypt"
    "RSA_sign"
    "RSA_verify"
    "RSA_new"
    "RSA_free"

[{"evidence_type": "api/openssl/ec", "language": "c", "encryption_library": "OpenSSL", "encryption_api_usage": "call"}]
    "EC_KEY_new_by_curve_name"
    "EC_KEY_generate_key"
    "ECDSA_do_sign"
    "ECDSA_do_verify"
    "ECDH_compute_key"
    "EC_POINT_mul"
    "EC_GROUP_new_by_curve_name"

[{"evidence_type": "api/openssl/hmac", "language": "c", "encryption_library": "OpenSSL", "encryption_api_usage": "call"}]
    "HMAC_CTX_new"
    "HMAC_CTX_free"
    "HMAC_Init_ex"
    "HMAC_Update"
    "HMAC_Final"

[{"evidence_type": "api/openssl/rand", "language": "c", "encryption_library": "OpenSSL", "encryption_api_usage": "call"}]
    "RAND_bytes"
    "RAND_pseudo_bytes"
    "RAND_seed"

[{"evidence_type": "api/openssl/ssl", "language": "c", "encryption_library": "OpenSSL", "encryption_api_usage": "call"}]
    "SSL_CTX_new"
    "SSL_CTX_free"
    "SSL_new"
    "SSL_free"
    "SSL_connect"
    "SSL_accept"
    "SSL_read"
    "SSL_write"
    "SSL_shutdown"
    "SSL_set_fd"
    "SSL_CTX_use_certificate_file"
    "SSL_CTX_use_PrivateKey_file"
    "SSL_CTX_set_cipher_list"
    "SSL_CTX_set_verify"

[{"evidence_type": "api/openssl/x509", "language": "c", "encryption_library": "OpenSSL", "encryption_api_usage": "call"}]
    "X509_new"
    "X509_free"
    "X509_verify"
    "X509_get_subject_name"
    "X509_get_issuer_name"
    "X509_STORE_add_cert"
    "X509_STORE_CTX_new"
    "PEM_read_X509"
    "PEM_write_X509"
    "PEM_read_PrivateKey"
    "PEM_write_PrivateKey"

[{"evidence_type": "api/openssl/aes", "language": "c", "encryption_library": "OpenSSL", "encryption_api_usage": "call"}]
    "AES_set_encrypt_key"
    "AES_set_decrypt_key"
    "AES_encrypt"
    "AES_decrypt"
    "AES_cbc_encrypt"

[{"evidence_type": "api/openssl/sha", "language": "c", "encryption_library": "OpenSSL", "encryption_api_usage": "call"}]
    "SHA256_Init"
    "SHA256_Update"
    "SHA256_Final"
    "SHA512_Init"
    "SHA512_Update"
    "SHA512_Final"
    "SHA1_Init"
    "SHA1_Update"
    "SHA1_Final"

[{"evidence_type": "api/openssl/hash", "language": "c", "encryption_library": "OpenSSL", "encryption_api_usage": "call"}]
    "MD5_Init"
    "MD5_Update"
    "MD5_Final"

[{"evidence_type": "api/openssl/des", "language": "c", "encryption_library": "OpenSSL", "encryption_api_usage": "call"}]
    "DES_set_key"
    "DES_ecb_encrypt"
    "DES_cbc_encrypt"
    "DES_ede3_cbc_encrypt"

[{"evidence_type": "api/openssl/dh", "language": "c", "encryption_library": "OpenSSL", "encryption_api_usage": "call"}]
    "DH_generate_parameters_ex"
    "DH_generate_key"
    "DH_compute_key"
    "DH_new"
    "DH_free"

# ══════════════════════════════════════════════════════════════════════
# Go crypto API
# ══════════════════════════════════════════════════════════════════════

[{"evidence_type": "api/go/crypto", "language": "go", "encryption_library": "Go stdlib", "encryption_api_usage": "call"}]
    "crypto/aes"
    "crypto/cipher"
    "crypto/des"
    "crypto/dsa"
    "crypto/ecdh"
    "crypto/ecdsa"
    "crypto/ed25519"
    "crypto/hmac"
    "crypto/md5"
    "crypto/rand"
    "crypto/rc4"
    "crypto/rsa"
    "crypto/sha1"
    "crypto/sha256"
    "crypto/sha512"
    "crypto/tls"
    "crypto/x509"
    "golang.org/x/crypto/bcrypt"
    "golang.org/x/crypto/scrypt"
    "golang.org/x/crypto/argon2"
    "golang.org/x/crypto/chacha20poly1305"
    "golang.org/x/crypto/nacl"

# ══════════════════════════════════════════════════════════════════════
# Rust crypto API
# ══════════════════════════════════════════════════════════════════════

[{"evidence_type": "api/rust/crypto", "language": "rust", "encryption_library": "Rust ecosystem", "encryption_api_usage": "call"}]
    "ring::aead"
    "ring::agreement"
    "ring::digest"
    "ring::hkdf"
    "ring::hmac"
    "ring::pbkdf2"
    "ring::rand"
    "ring::rsa"
    "ring::signature"
    "rustls::ClientConfig"
    "rustls::ServerConfig"
    "aes_gcm::Aes256Gcm"
    "chacha20poly1305"
    "ed25519_dalek"
    "x25519_dalek"
    "rsa::RsaPrivateKey"
    "rsa::RsaPublicKey"

# ══════════════════════════════════════════════════════════════════════
# Python crypto API
# ══════════════════════════════════════════════════════════════════════

[{"evidence_type": "api/python/crypto", "language": "python", "encryption_library": "Python ecosystem", "encryption_api_usage": "call"}]
    "from cryptography"
    "from Crypto"
    "from Cryptodome"
    "Crypto.Cipher.AES"
    "Crypto.PublicKey.RSA"
    "Crypto.Hash.SHA256"
    "Crypto.Signature"
    "cryptography.fernet"
    "cryptography.hazmat"
    "cryptography.x509"
    "hashlib.sha256"
    "hashlib.sha512"
    "hashlib.md5"
    "hashlib.pbkdf2_hmac"
    "hmac.new"
    "bcrypt.hashpw"
    "nacl.secret"
    "nacl.signing"

# ══════════════════════════════════════════════════════════════════════
# Java JCA/JCE API
# ══════════════════════════════════════════════════════════════════════

[{"evidence_type": "api/java/crypto", "language": "java", "encryption_library": "Java JCA", "encryption_api_usage": "call"}]
    "javax.crypto.Cipher"
    "javax.crypto.KeyGenerator"
    "javax.crypto.SecretKeyFactory"
    "javax.crypto.Mac"
    "javax.crypto.spec.SecretKeySpec"
    "javax.crypto.spec.IvParameterSpec"
    "java.security.KeyPairGenerator"
    "java.security.Signature"
    "java.security.MessageDigest"
    "java.security.KeyStore"
    "java.security.cert.X509Certificate"
    "java.security.SecureRandom"
    "Cipher.getInstance"
    "MessageDigest.getInstance"
    "KeyPairGenerator.getInstance"
    "KeyGenerator.getInstance"
    "Mac.getInstance"

# ══════════════════════════════════════════════════════════════════════
# JavaScript/Node.js crypto API
# ══════════════════════════════════════════════════════════════════════

[{"evidence_type": "api/javascript/crypto", "language": "javascript", "encryption_library": "Node.js crypto", "encryption_api_usage": "call"}]
    "crypto.createCipheriv"
    "crypto.createDecipheriv"
    "crypto.createHash"
    "crypto.createHmac"
    "crypto.createSign"
    "crypto.createVerify"
    "crypto.publicEncrypt"
    "crypto.privateDecrypt"
    "crypto.generateKeyPairSync"
    "crypto.generateKeyPair"
    "crypto.scryptSync"
    "crypto.pbkdf2Sync"
    "crypto.randomBytes"
    "SubtleCrypto"
    "window.crypto"
    "crypto.subtle"

# ══════════════════════════════════════════════════════════════════════
# libgcrypt API
# ══════════════════════════════════════════════════════════════════════

[{"evidence_type": "api/libgcrypt", "language": "c", "encryption_library": "libgcrypt", "encryption_api_usage": "call"}]
    "gcry_cipher_open"
    "gcry_cipher_setkey"
    "gcry_cipher_encrypt"
    "gcry_cipher_decrypt"
    "gcry_md_open"
    "gcry_md_write"
    "gcry_md_read"
    "gcry_pk_encrypt"
    "gcry_pk_decrypt"
    "gcry_pk_sign"
    "gcry_pk_verify"
    "gcry_randomize"
    "gcry_create_nonce"

# ══════════════════════════════════════════════════════════════════════
# libsodium API
# ══════════════════════════════════════════════════════════════════════

[{"evidence_type": "api/libsodium", "language": "c", "encryption_library": "libsodium", "encryption_api_usage": "call"}]
    "crypto_secretbox_easy"
    "crypto_secretbox_open_easy"
    "crypto_box_easy"
    "crypto_box_open_easy"
    "crypto_sign_ed25519"
    "crypto_sign_verify_detached"
    "crypto_aead_xchacha20poly1305_ietf_encrypt"
    "crypto_aead_xchacha20poly1305_ietf_decrypt"
    "crypto_pwhash"
    "crypto_generichash"
    "crypto_shorthash"
    "crypto_kdf_derive_from_key"
