Possible Issue with the Python Parser

[FotiosBistas]

I have noticed the following issue, after running some tests. I have the following code:

def cryptography_aes_examples():
    from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes

    key64 = b"01234567"
    key128 = b"0123456789abcdef"
    key192 = b"0123456789abcdef01234567"
    key256 = b"0123456789abcdef0123456789abcdef"

    iv = b"1234567890abcdef"
    nonce = b"123456789012"
    data = b"hello world!!!!!"

    # AES-CBC (invalid 64-bit key — should fail at runtime, but useful for static detection testing)
    algo_small = algorithms.AES(key64)
    c_small = Cipher(algo_small, modes.CBC(iv))
    encryptor_small = c_small.encryptor()
    ct_small = encryptor_small.update(data) + encryptor_small.finalize()

    # AES-CBC (128-bit)
    algo_128 = algorithms.AES(key128)
    c_128 = Cipher(algo_128, modes.CBC(iv))
    encryptor_128 = c_128.encryptor()
    ct_128 = encryptor_128.update(data) + encryptor_128.finalize()

    # AES-CBC (192-bit)
    algo_192 = algorithms.AES(key192)
    c_192 = Cipher(algo_192, modes.CBC(iv))
    encryptor_192 = c_192.encryptor()
    ct_192 = encryptor_192.update(data) + encryptor_192.finalize()

    # AES-CBC (256-bit)
    algo_256 = algorithms.AES(key256)
    c_256 = Cipher(algo_256, modes.CBC(iv))
    encryptor_256 = c_256.encryptor()
    ct_256 = encryptor_256.update(data) + encryptor_256.finalize()

After scanning the CBOM seems to produce the following output:

      "type": "cryptographic-asset",
      "bom-ref": "132e7ce1-279f-497f-8118-c75e3f594949",
      "name": "AES-CBC",
      "evidence": {
        "occurrences": [
          {
            "location": "configs/symmetric-atomic-primitives/tests/aes.py",
            "line": 65,
            "offset": 14,
            "additionalContext": "Cipher"
          },
          {
            "location": "configs/symmetric-atomic-primitives/tests/aes.py",
            "line": 71,
            "offset": 12,
            "additionalContext": "Cipher"
          },
          {
            "location": "configs/symmetric-atomic-primitives/tests/aes.py",
            "line": 77,
            "offset": 12,
            "additionalContext": "Cipher"
          },
          {
            "location": "configs/symmetric-atomic-primitives/tests/aes.py",
            "line": 83,
            "offset": 12,
            "additionalContext": "Cipher"
          },
          {
            "location": "configs/symmetric-atomic-primitives/tests/aes.py",
            "line": 90,
            "offset": 8,
            "additionalContext": "Cipher"
          },
          {
            "location": "configs/symmetric-atomic-primitives/tests/aes.py",
            "line": 107,
            "offset": 9,
            "additionalContext": "Cipher"
          },
          {
            "location": "configs/symmetric-atomic-primitives/tests/aes_key_length.py",
            "line": 107,
            "offset": 8,
            "additionalContext": "Cipher"
          },
          {
            "location": "configs/symmetric-atomic-primitives/tests/aes_key_length.py",
            "line": 133,
            "offset": 8,
            "additionalContext": "Cipher"
          },
          {
            "location": "configs/symmetric-atomic-primitives/tests/aes_key_length.py",
            "line": 164,
            "offset": 8,
            "additionalContext": "Cipher"
          }
        ]
      },
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "block-cipher",
          "parameterSetIdentifier": "128",
          "mode": "cbc",
          "cryptoFunctions": [
            "encrypt"
          ]
        },
        "oid": "2.16.840.1.101.3.4.1"
      }
    },

From what I understand, I should use the parameter set identifier to determine what key size I'm using. Here it seems to only detect the 128 key size. Is this supposed to happen?

[FotiosBistas]

Another instance where this seems to happen:

from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.hmac import HMAC
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives.kdf.concatkdf import ConcatKDFHash, ConcatKDFHMAC
from cryptography.hazmat.primitives.kdf.x963kdf import X963KDF


def pyca_hash_direct_examples():
    # Legacy / disallowed according to ECCG
    sha224_obj = hashes.Hash(hashes.SHA224())
    sha224_obj.update(b"data")
    digest_sha224 = sha224_obj.finalize()

    sha512_224_obj = hashes.Hash(hashes.SHA512_224())
    sha512_224_obj.update(b"data")
    digest_sha512_224 = sha512_224_obj.finalize()

    # Allowed according to ECCG
    sha256_obj = hashes.Hash(hashes.SHA256())
    sha256_obj.update(b"data")
    digest_sha256 = sha256_obj.finalize()

    sha384_obj = hashes.Hash(hashes.SHA384())
    sha384_obj.update(b"data")
    digest_sha384 = sha384_obj.finalize()

    sha512_obj = hashes.Hash(hashes.SHA512())
    sha512_obj.update(b"data")
    digest_sha512 = sha512_obj.finalize()

    sha512_256_obj = hashes.Hash(hashes.SHA512_256())
    sha512_256_obj.update(b"data")
    digest_sha512_256 = sha512_256_obj.finalize()

    sha3_256_obj = hashes.Hash(hashes.SHA3_256())
    sha3_256_obj.update(b"data")
    digest_sha3_256 = sha3_256_obj.finalize()

    sha3_384_obj = hashes.Hash(hashes.SHA3_384())
    sha3_384_obj.update(b"data")
    digest_sha3_384 = sha3_384_obj.finalize()

    sha3_512_obj = hashes.Hash(hashes.SHA3_512())
    sha3_512_obj.update(b"data")
    digest_sha3_512 = sha3_512_obj.finalize()

    # External / non-ECCG hash (should likely be flagged by policy)
    blake2b_obj = hashes.Hash(hashes.BLAKE2b(64))
    blake2b_obj.update(b"data")
    digest_blake2b = blake2b_obj.finalize()

    return (
        digest_sha224,
        digest_sha512_224,
        digest_sha256,
        digest_sha384,
        digest_sha512,
        digest_sha512_256,
        digest_sha3_256,
        digest_sha3_384,
        digest_sha3_512,
        digest_blake2b,
    )


def pyca_hmac_examples():
    key = b"k" * 32

    # Legacy / disallowed
    hmac_sha224 = HMAC(key, hashes.SHA224())
    hmac_sha224.update(b"message")
    tag_sha224 = hmac_sha224.finalize()

    hmac_sha512_224 = HMAC(key, hashes.SHA512_224())
    hmac_sha512_224.update(b"message")
    tag_sha512_224 = hmac_sha512_224.finalize()

    # Allowed
    hmac_sha256 = HMAC(key, hashes.SHA256())
    hmac_sha256.update(b"message")
    tag_sha256 = hmac_sha256.finalize()

    hmac_sha384 = HMAC(key, hashes.SHA384())
    hmac_sha384.update(b"message")
    tag_sha384 = hmac_sha384.finalize()

    hmac_sha512 = HMAC(key, hashes.SHA512())
    hmac_sha512.update(b"message")
    tag_sha512 = hmac_sha512.finalize()

    hmac_sha512_256 = HMAC(key, hashes.SHA512_256())
    hmac_sha512_256.update(b"message")
    tag_sha512_256 = hmac_sha512_256.finalize()

    # External / non-ECCG hash
    hmac_blake2b = HMAC(key, hashes.BLAKE2b(64))
    hmac_blake2b.update(b"message")
    tag_blake2b = hmac_blake2b.finalize()

    return (
        tag_sha224,
        tag_sha512_224,
        tag_sha256,
        tag_sha384,
        tag_sha512,
        tag_sha512_256,
        tag_blake2b,
    )

The above usages are not detected at all. Here's the first detection of BLAKE2b:

Which is inside the HMAC function: