# Kindi default keyword list
# Cryptographic evidence patterns for firmware and software supply chains
# Covers: symmetric, asymmetric, hash, MAC, KDF, protocols, libraries, key material

[keyword_list_version]
    1

# ══════════════════════════════════════════════════════════════════════
# Symmetric Block Ciphers
# ══════════════════════════════════════════════════════════════════════

[{"evidence_type": "algorithm/symmetric/block-cipher/AES", "language": "all"}]
    "AES_encrypt"
    "AES_decrypt"
    "\bAES_set_encrypt_key\b"
    "\bAES_set_decrypt_key\b"
    "AES_cbc_encrypt"
    "\bAES_KEY\b"
    "\bAES_BLOCK_SIZE\b"
    "AES-256-GCM"
    "AES-256-CBC"
    "AES-128-GCM"
    "AES-128-CBC"
    "aes-256-gcm"
    "aes-256-cbc"
    "aes-128-gcm"
    "aes-128-cbc"
    "aes-256-ctr"
    "\bAES-256\b"
    "\bAES-128\b"
    "\bAES-192\b"
    "createCipheriv"
    "createDecipheriv"

[{"evidence_type": "algorithm/symmetric/block-cipher/DES", "language": "all"}]
    "DES_ecb_encrypt"
    "DES_set_key"
    "DES_cblock"
    "\bDES_KEY\b"
    "DES_ede3"
    "\b3DES\b"
    "\bTripleDES\b"
    "DESede"

[{"evidence_type": "algorithm/symmetric/block-cipher/Blowfish", "language": "all"}]
    "BF_encrypt"
    "BF_set_key"
    "BF_cbc_encrypt"
    "\bBLOWFISH\b"

[{"evidence_type": "algorithm/symmetric/block-cipher/Twofish", "language": "all"}]
    "Twofish_encrypt"
    "TWOFISH_KEY"
    "\bTWOFISH\b"

[{"evidence_type": "algorithm/symmetric/block-cipher/Camellia", "language": "all"}]
    "Camellia_set_key"
    "Camellia_encrypt"
    "\bCAMELLIA\b"

[{"evidence_type": "algorithm/symmetric/block-cipher/CAST5", "language": "all"}]
    "\bCAST5\b"
    "CAST_encrypt"
    "CAST_set_key"

[{"evidence_type": "algorithm/symmetric/block-cipher/Serpent", "language": "all"}]
    "\bSERPENT\b"
    "serpent_encrypt"

[{"evidence_type": "algorithm/symmetric/block-cipher/KASUMI", "language": "all"}]
    "\bKASUMI\b"
    "kasumi_encrypt"

[{"evidence_type": "algorithm/symmetric/block-cipher/IDEA", "language": "all"}]
    "\bIDEA_encrypt\b"
    "\bIDEA_set_encrypt_key\b"

[{"evidence_type": "algorithm/symmetric/block-cipher/SEED", "language": "all"}]
    "\bSEED_encrypt\b"
    "\bSEED_set_key\b"
    "\bSEED_KEY\b"

[{"evidence_type": "algorithm/symmetric/block-cipher/ARIA", "language": "all"}]
    "\bARIA_encrypt\b"
    "\bARIA_set_encrypt_key\b"

# ══════════════════════════════════════════════════════════════════════
# Symmetric Stream Ciphers
# ══════════════════════════════════════════════════════════════════════

[{"evidence_type": "algorithm/symmetric/stream-cipher/ChaCha20", "language": "all"}]
    "ChaCha20_ctr32"
    "chacha20_poly1305"
    "\bCHACHA20\b"
    "\bChaCha20\b"
    "CHACHA20_POLY1305"

[{"evidence_type": "algorithm/symmetric/stream-cipher/RC4", "language": "all"}]
    "\bRC4_set_key\b"
    "RC4_encrypt"
    "\bRC4\b"

[{"evidence_type": "algorithm/symmetric/stream-cipher/Salsa20", "language": "all"}]
    "\bSalsa20\b"
    "\bSALSA20\b"
    "salsa20_encrypt"

# ══════════════════════════════════════════════════════════════════════
# Asymmetric Cryptography
# ══════════════════════════════════════════════════════════════════════

[{"evidence_type": "algorithm/asymmetric/RSA", "language": "all"}]
    "RSA_generate_key"
    "RSAPublicKey"
    "RSAPrivateKey"
    "RSA_sign"
    "RSA_verify"
    "\bRSA_new\b"
    "RSA-OAEP"
    "RSASSA-PKCS1"
    "RSA_public_encrypt"
    "RSA_private_decrypt"

[{"evidence_type": "algorithm/asymmetric/DSA", "language": "all"}]
    "DSA_generate_key"
    "DSA_sign"
    "DSA_verify"
    "\bDSA_new\b"
    "\bDSA_SIG\b"

[{"evidence_type": "algorithm/asymmetric/ECC", "language": "all"}]
    "EC_KEY_new"
    "EC_POINT_mul"
    "ECDSA_sign"
    "ECDSA_verify"
    "ECDH_compute_key"
    "\bECDSA\b"
    "\bECDH\b"
    "secp256k1"
    "secp384r1"
    "secp256r1"
    "prime256v1"
    "\bEd25519\b"
    "\bEd448\b"
    "\bX25519\b"
    "\bX448\b"
    "Curve25519"

[{"evidence_type": "algorithm/asymmetric/DiffieHellman", "language": "all"}]
    "DH_generate_key"
    "DH_compute_key"
    "DHParameterSpec"
    "Diffie-Hellman"

[{"evidence_type": "algorithm/asymmetric/ElGamal", "language": "all"}]
    "\bElGamal\b"
    "elgamal_encrypt"

# ══════════════════════════════════════════════════════════════════════
# Hash Functions
# ══════════════════════════════════════════════════════════════════════

[{"evidence_type": "algorithm/hash/SHA1", "language": "all"}]
    "\bSHA1_Init\b"
    "\bSHA1_Update\b"
    "\bSHA1_Final\b"
    "SHA_DIGEST_LENGTH"
    "\bSHA-1\b"

[{"evidence_type": "algorithm/hash/SHA2", "language": "all"}]
    "SHA256_Init"
    "SHA256_Update"
    "SHA256_Final"
    "SHA256_DIGEST_LENGTH"
    "SHA512_Init"
    "SHA512_Update"
    "SHA512_Final"
    "\bSHA-256\b"
    "\bSHA-384\b"
    "\bSHA-512\b"

[{"evidence_type": "algorithm/hash/SHA3", "language": "all"}]
    "SHA3_256"
    "SHA3_512"
    "\bKECCAK\b"
    "sha3_init"
    "\bSHA-3\b"

[{"evidence_type": "algorithm/hash/MD5", "language": "all"}]
    "\bMD5_Init\b"
    "\bMD5_Update\b"
    "\bMD5_Final\b"
    "MD5_DIGEST_LENGTH"

[{"evidence_type": "algorithm/hash/MD4", "language": "all"}]
    "\bMD4_Init\b"
    "\bMD4_Update\b"
    "\bMD4_Final\b"

[{"evidence_type": "algorithm/hash/BLAKE", "language": "all"}]
    "\bBLAKE2\b"
    "\bBLAKE3\b"
    "blake2b_init"
    "blake2s_init"

[{"evidence_type": "algorithm/hash/RIPEMD", "language": "all"}]
    "\bRIPEMD\b"
    "RIPEMD160"
    "RIPEMD_160"

[{"evidence_type": "algorithm/hash/Whirlpool", "language": "all"}]
    "\bWhirlpool\b"
    "WHIRLPOOL_Init"

# ══════════════════════════════════════════════════════════════════════
# MAC (Message Authentication Code)
# ══════════════════════════════════════════════════════════════════════

[{"evidence_type": "algorithm/mac/HMAC", "language": "all"}]
    "\bHMAC_Init\b"
    "HMAC_Update"
    "HMAC_Final"
    "HMAC_CTX_new"

[{"evidence_type": "algorithm/mac/CMAC", "language": "all"}]
    "\bCMAC_Init\b"
    "CMAC_Update"
    "CMAC_Final"

[{"evidence_type": "algorithm/mac/Poly1305", "language": "all"}]
    "\bPoly1305\b"
    "poly1305_init"

# ══════════════════════════════════════════════════════════════════════
# Key Derivation Functions
# ══════════════════════════════════════════════════════════════════════

[{"evidence_type": "algorithm/kdf/PBKDF2", "language": "all"}]
    "\bPBKDF2\b"
    "PKCS5_PBKDF2_HMAC"

[{"evidence_type": "algorithm/kdf/scrypt", "language": "all"}]
    "\bscrypt\b"
    "EVP_PBE_scrypt"

[{"evidence_type": "algorithm/kdf/bcrypt", "language": "all"}]
    "\bbcrypt\b"
    "bcrypt_hashpw"

[{"evidence_type": "algorithm/kdf/Argon2", "language": "all"}]
    "\bArgon2\b"
    "\bargon2id\b"
    "\bargon2i\b"

[{"evidence_type": "algorithm/kdf/HKDF", "language": "all"}]
    "\bHKDF\b"
    "HKDF_SHA256"
    "HKDF_expand"
    "HKDF_extract"

# ══════════════════════════════════════════════════════════════════════
# Protocols
# ══════════════════════════════════════════════════════════════════════

[{"evidence_type": "protocol/TLS", "language": "all"}]
    "SSL_CTX_new"
    "TLS_method"
    "SSL_connect"
    "SSL_read"
    "SSL_write"
    "SSL_library_init"
    "SSL_set_fd"
    "TLSv1_2_method"
    "TLSv1_3"

[{"evidence_type": "protocol/SSH", "language": "all"}]
    "ssh-rsa"
    "ssh-ed25519"
    "ssh-dss"
    "libssh2"

[{"evidence_type": "protocol/kerberos", "language": "all"}]
    "krb5_init_context"
    "krb5_get_credentials"
    "\bKERBEROS\b"

[{"evidence_type": "protocol/PKCS", "language": "all"}]
    "\bPKCS#12\b"
    "\bPKCS12\b"
    "\bPKCS#7\b"
    "\bPKCS7\b"
    "\bPKCS#11\b"
    "\bPKCS#8\b"
    "\bPKCS8\b"
    "\bPKCS#1\b"

[{"evidence_type": "protocol/PKI", "language": "all"}]
    "\bX509\b"
    "X509_STORE"
    "X509_verify"
    "X509_get_subject"

# ══════════════════════════════════════════════════════════════════════
# Crypto Libraries
# ══════════════════════════════════════════════════════════════════════

[{"evidence_type": "library/OpenSSL", "language": "all", "encryption_library": "OpenSSL"}]
    "\bopenssl\b"
    "libssl"
    "libcrypto"
    "EVP_EncryptInit"
    "EVP_DecryptInit"
    "EVP_DigestInit"
    "EVP_PKEY"
    "EVP_MD_CTX"
    "EVP_CIPHER_CTX"

[{"evidence_type": "library/BoringSSL", "language": "all", "encryption_library": "BoringSSL"}]
    "\bBoringSSL\b"
    "boringssl"

[{"evidence_type": "library/libgcrypt", "language": "all", "encryption_library": "libgcrypt"}]
    "\blibgcrypt\b"
    "gcry_cipher"
    "gcry_md"
    "gcry_pk"

[{"evidence_type": "library/CryptoPP", "language": "all", "encryption_library": "Crypto++"}]
    "CryptoPP"
    "Crypto++"
    "CryptoLib"

[{"evidence_type": "library/WinCrypt", "language": "all", "encryption_library": "WinCrypt"}]
    "CryptAcquireContext"
    "CryptEncrypt"
    "CryptDecrypt"
    "CryptGenKey"
    "BCryptOpenAlgorithm"
    "NCryptOpenKey"

[{"evidence_type": "library/libsodium", "language": "all", "encryption_library": "libsodium"}]
    "\blibsodium\b"
    "sodium_init"
    "crypto_secretbox"
    "crypto_box_open"
    "crypto_sign"
    "crypto_aead"
    "randombytes_buf"

[{"evidence_type": "library/mbedTLS", "language": "all", "encryption_library": "mbedTLS"}]
    "\bmbedtls\b"
    "mbedtls_aes"
    "mbedtls_rsa"
    "mbedtls_sha256"
    "mbedtls_ssl"

[{"evidence_type": "library/wolfSSL", "language": "all", "encryption_library": "wolfSSL"}]
    "\bwolfSSL\b"
    "wolfCrypt"
    "wc_AesEncrypt"
    "wc_RsaPublicEncrypt"
