让 AI 先画出密码学地图：面向 2029 的后量子迁移方法

仓库与制品清单
    ↓
规则扫描 / AST / 依赖解析
    ↓
带证据的密码学发现记录
    ↓
AI 分类、去重与依赖推断
    ↓
人工安全评审
    ↓
迁移任务、测试和验收证据

#!/usr/bin/env python3
import argparse
import json
import re
from pathlib import Path

RULES = {
    "legacy_hash": re.compile(r"\b(md5|sha1|hashlib\.md5|hashlib\.sha1)\b", re.I),
    "public_key_crypto": re.compile(r"\b(RSA|ECDSA|ECDH|Ed25519|X25519)\b", re.I),
    "tls_config": re.compile(r"\b(TLSv1(?:\.0|\.1|\.2|\.3)?|cipher_suites?|ssl_protocols?)\b", re.I),
    "certificate_or_key": re.compile(r"\b(X\.509|BEGIN CERTIFICATE|BEGIN (?:RSA |EC )?PRIVATE KEY)\b", re.I),
    "crypto_library": re.compile(r"\b(cryptography|pycryptodome|openssl|libsodium|bouncycastle)\b", re.I),
}

EXTENSIONS = {
    ".py", ".go", ".java", ".js", ".ts", ".rs", ".c", ".cc", ".cpp", ".h",
    ".yaml", ".yml", ".json", ".toml", ".ini", ".conf", ".xml", ".gradle"
}
SKIP_DIRS = {".git", "node_modules", "vendor", "dist", "build", ".venv", "venv"}


def scan(root: Path):
    findings = []
    for path in root.rglob("*"):
        if not path.is_file() or path.suffix.lower() not in EXTENSIONS:
            continue
        if any(part in SKIP_DIRS for part in path.parts):
            continue

        try:
            lines = path.read_text(encoding="utf-8", errors="ignore").splitlines()
        except OSError:
            continue

        for line_number, line in enumerate(lines, start=1):
            for rule_name, pattern in RULES.items():
                matches = sorted({match.group(0) for match in pattern.finditer(line)})
                if matches:
                    findings.append({
                        "rule": rule_name,
                        "file": str(path.relative_to(root)),
                        "line": line_number,
                        "matches": matches,
                        "evidence": line.strip()[:240],
                        "review_status": "unreviewed"
                    })
    return findings


def main():
    parser = argparse.ArgumentParser(description="Create a basic cryptography inventory")
    parser.add_argument("root", nargs="?", default=".", help="Repository root")
    parser.add_argument("-o", "--output", default="crypto-inventory.json")
    args = parser.parse_args()

    root = Path(args.root).resolve()
    findings = scan(root)
    Path(args.output).write_text(
        json.dumps(findings, indent=2, ensure_ascii=False),
        encoding="utf-8"
    )
    print(f"Wrote {len(findings)} findings to {args.output}")


if __name__ == "__main__":
    main()

python3 crypto_inventory.py /path/to/repository -o crypto-inventory.json
python3 -m json.tool crypto-inventory.json | less

你是一名密码学迁移分析助手。
根据输入的扫描记录，判断该发现最可能属于：
1. 数字签名
2. 密钥交换
3. 静态数据加密
4. 传输加密
5. 非安全用途的哈希或校验
6. 无法判断

只返回 JSON。必须包含 category、confidence、reason、required_evidence、suggested_owner。
不得根据算法名称直接断言业务用途；证据不足时选择“无法判断”。
不要提出自创密码算法，也不要声称某个替代方案已经通过组织安全审批。

asset_id: payments-api/tls-client
owner: payments-platform
purpose: service-authentication
current_mechanism: certificate-based TLS
source_evidence:
  repository: payments-api
  file: config/tls.yaml
  line: 18
depends_on:
  - internal-ca
  - edge-gateway
migration:
  status: assessment-required
  target_date: 2027-06-30
  compatibility_test: not-started
  rollback_plan: required
review:
  human_verified: false
  confidence: medium