From 2daa32e769b0419e65c79e9ab0bf0c54b071914d Mon Sep 17 00:00:00 2001
From: Pizhuk David <David.Pizhuk@scch.at>
Date: Wed, 8 Oct 2025 09:30:34 +0200
Subject: [PATCH] feature: added new metrics:

- added descriptions and configurations for BlockCipher and BlockCipherMode metrics
---
 .../BlockCipher/BlockCipher.yaml              | 12 ++++++++++
 .../TransportEncryption/BlockCipher/data.json |  4 ++++
 .../BlockCipher/metric.rego                   | 22 +++++++++++++++++++
 .../BlockCipherMode/BlockCipherMode.yaml      | 12 ++++++++++
 .../BlockCipherMode/data.json                 |  4 ++++
 .../BlockCipherMode/metric.rego               | 21 ++++++++++++++++++
 6 files changed, 75 insertions(+)
 create mode 100644 metrics/TransportEncryption/BlockCipher/BlockCipher.yaml
 create mode 100644 metrics/TransportEncryption/BlockCipher/data.json
 create mode 100644 metrics/TransportEncryption/BlockCipher/metric.rego
 create mode 100644 metrics/TransportEncryption/BlockCipherMode/BlockCipherMode.yaml
 create mode 100644 metrics/TransportEncryption/BlockCipherMode/data.json
 create mode 100644 metrics/TransportEncryption/BlockCipherMode/metric.rego

diff --git a/metrics/TransportEncryption/BlockCipher/BlockCipher.yaml b/metrics/TransportEncryption/BlockCipher/BlockCipher.yaml
new file mode 100644
index 00000000..539515e9
--- /dev/null
+++ b/metrics/TransportEncryption/BlockCipher/BlockCipher.yaml
@@ -0,0 +1,12 @@
+# ====== Metadata ======
+id: BlockCipher
+description: This rule assesses whether a [Resource] has all its [TransportEncryption] [p1:cipherSuites] configured so that each cipher suite’s sessionCipher is correctly set to the AES block cipher family.
+category: Cryptography
+version: "1.0"
+comments: Aligned with BSI TR-02102-2, which recommends AES-based suites."
+
+# ====== Configuration ======
+configuration:
+  p1:
+    operator: "regex.match"
+    targetValue: "^AES([_-]|$)"
diff --git a/metrics/TransportEncryption/BlockCipher/data.json b/metrics/TransportEncryption/BlockCipher/data.json
new file mode 100644
index 00000000..dbf36b48
--- /dev/null
+++ b/metrics/TransportEncryption/BlockCipher/data.json
@@ -0,0 +1,4 @@
+{
+    "operator": "regex.match",
+    "target_value": "^AES([_-]|$)"
+}
diff --git a/metrics/TransportEncryption/BlockCipher/metric.rego b/metrics/TransportEncryption/BlockCipher/metric.rego
new file mode 100644
index 00000000..b090291e
--- /dev/null
+++ b/metrics/TransportEncryption/BlockCipher/metric.rego
@@ -0,0 +1,22 @@
+package cch.metrics.block_cipher
+
+import rego.v1
+import input as document
+
+default applicable := false
+
+default compliant := false
+
+applicable if {
+  document.TransportEncryption
+  document.TransportEncryption.cipherSuites
+  count(document.TransportEncryption.cipherSuites) > 0
+}
+
+compliant if {
+  applicable
+  every cs in document.TransportEncryption.cipherSuites {
+      cs.sessionCipher
+      regex.match(data.target_value, cs.sessionCipher)
+  }
+}
diff --git a/metrics/TransportEncryption/BlockCipherMode/BlockCipherMode.yaml b/metrics/TransportEncryption/BlockCipherMode/BlockCipherMode.yaml
new file mode 100644
index 00000000..297f66cf
--- /dev/null
+++ b/metrics/TransportEncryption/BlockCipherMode/BlockCipherMode.yaml
@@ -0,0 +1,12 @@
+# ====== Metadata ======
+id: BlockCipherMode
+description: This rule assesses whether a [Resource] has all its [TransportEncryption] [p1:cipherSuites] configured so that each cipher suite’s sessionCipher mode is correctly configured.
+category: Cryptography
+version: "1.0"
+comments: Aligned with BSI TR-02102-2, which recommends using either CCM mode, or GCM mode, or CBC mode.
+
+# ====== Configuration ======
+configuration:
+  p1:
+    operator: "regex.match"
+    targetValue: "(?:^|[_-])(GCM|CCM|CBC)$"
diff --git a/metrics/TransportEncryption/BlockCipherMode/data.json b/metrics/TransportEncryption/BlockCipherMode/data.json
new file mode 100644
index 00000000..9c495678
--- /dev/null
+++ b/metrics/TransportEncryption/BlockCipherMode/data.json
@@ -0,0 +1,4 @@
+{
+    "operator": "regex.match",
+    "target_value": "(?:^|[_-])(GCM|CCM|CBC)$"
+}
diff --git a/metrics/TransportEncryption/BlockCipherMode/metric.rego b/metrics/TransportEncryption/BlockCipherMode/metric.rego
new file mode 100644
index 00000000..f6deec9c
--- /dev/null
+++ b/metrics/TransportEncryption/BlockCipherMode/metric.rego
@@ -0,0 +1,21 @@
+package cch.metrics.block_cipher_mode
+
+import rego.v1
+import input as document
+
+default applicable := false
+default compliant := false
+
+applicable if {
+  document.TransportEncryption
+  document.TransportEncryption.cipherSuites
+  count(document.TransportEncryption.cipherSuites) > 0
+}
+
+compliant if {
+  applicable
+  every cs in document.TransportEncryption.cipherSuites {
+    cs.sessionCipher
+    regex.match(data.target_value, cs.sessionCipher)
+  }
+}