Fix FIPS tests.

6 files changed, 246 insertions, 192 deletions

diff --git a/sec_certs/cert_rules.py b/sec_certs/cert_rules.py
index 79819167..3272f95f 100644
--- a/sec_certs/cert_rules.py
+++ b/sec_certs/cert_rules.py
@@ -179,98 +179,6 @@ SARS_IMPLIED_FROM_EAL: Dict[str, Set[Tuple[str, int]]] = {
 
 security_level_csv_scan = r"EAL[1-7]\+?"
 
-rules_fips_remove_algorithm_ids = [
-    # --- HMAC(-SHA)(-1) - (bits) (method) ((hardware/firmware cert) #id) ---
-    # + added (and #id) everywhere
-    r"HMAC(?:[- –]*SHA)?(?:[- –]*1)?[– -]*((?:;|\/|160|224|256|384|512)?(?:;|\/| |[Dd]ecrypt|[Ee]ncrypt|KAT)*?[, ]*?\(?(?: |hardware|firmware)*?[\s(\[]*?(?:#|cert\.?|Cert\.?|Certificate|sample)?[\s#]*?)?[\s#]*?(\d{1,4})(?:[\s#]*and[\s#]*\d+)?",
-    # --- same as above, without hw or fw ---
-    r"HMAC(?:-SHA)?(?:-1)?[ -]*((?:;|\/|160|224|256|384|512)?(?:;|\/| |[Dd]ecrypt|[Ee]ncrypt|KAT)*?[, ]*?(?:#|cert\.?|sample|Cert\.?|Certificate)?[\s#]*?)?[\s#]*?(\d{1,4})",
-    # --- SHS/A - (bits) (method) ((cert #) numbers) ---
-    r"SH[SA][-– 123]*(?:;|\/|160|224|256|384|512)?(?:[\s(\[]*?(?:KAT|[Bb]yte [Oo]riented)*?[\s,]*?[\s(\[]*?(?:#|cert\.?|sample|Cert\.?|Certificate)?[\s#]*?)?[\s#]*?(\d{1,4})(?:\)?\[#?\d+\])?(?:[\s#]*?and[\s#]*?\d+)?",
-    # --- RSA (bits) (method) ((cert #)) ---
-    r"RSA(?:[-– ]*(?:;|\/|512|768|1024|1280|1536|2048|3072|4096|8192)\s\(\[]*?(?:(?:;|\/|KAT|Verify|PSS|\s)*?)?[\s,]*?[\s(\[]*?(?:#|cert\.?|sample|Cert\.?|Certificate)?[\s#]*?)?[\s#]*?(\d{1,4})",
-    # --- RSA (SSA) (PKCS) (version) (#) ---
-    r"(?:RSA)?[-– ]?(?:SSA)?[- ]?PKCS\s?#?\d(?:-[Vv]1_5| [Vv]1[-_]5)?[\s#]*?(\d{1,4})?",
-    # --- AES (bits) (method) ((cert #)) ---
-    r"AES[-– ]*((?: |;|\/|bit|key|128|192|256|CBC)*(?: |\/|;|[Dd]ecrypt|[Ee]ncrypt|KAT|CMAC|CTR|GCM|IV|CBC)*?[,\s(\[]*?(?:#|cert\.?|sample|Cert\.?|Certificate)?[\s#]*?)?[\s#]*?(\d{1,4})(?:\)?[\s#]*?\[#?\d+\])?(?:[\s#]*?and[\s#]*?(\d+))?",
-    # --- Diffie Helman (CVL) ((cert #)) ---
-    r"Diffie[-– ]*Hellman[,\s(\[]*?(?:CVL|\s)*?(?:#|cert\.?|sample|Cert\.?|Certificate)?[\s#]*?[\s#]*?(\d{1,4})",
-    # --- DRBG (bits) (method) (cert #) ---
-    r"DRBG[ –-]*((?:;|\/|160|224|256|384|512)?(?:;|\/| |[Dd]ecrypt|[Ee]ncrypt|KAT)*?[,\s(\[]*?(?:#|cert\.?|sample|Cert\.?|Certificate)?[\s#]*?)?[\s#]*?(\d{1,4})",
-    # --- DES (bits) (method) (cert #)
-    r"DES[ –-]*((?:;|\/|160|224|256|384|512)?(?:;|\/| |[Dd]ecrypt|[Ee]ncrypt|KAT|CBC|(?:\d(?: and \d)? keying options?))*?[,\s(\[]*?(?:#|cert\.?|sample|Cert\.?|Certificate)*?[\s#]*?)?[\s#]*?(\d{1,4})(?:[\s#]*?and[\s#]*?(\d+))?",
-    # --- DSA (bits) (method) (cert #)
-    r"DSA[ –-]*((?:;|\/|160|224|256|384|512)?(?: |[Dd]ecrypt|[Ee]ncrypt|KAT)*?[,\s(\[]*?(?:#|cert\.?|sample|Cert\.?|Certificate)?[\s#]*?)?[\s#]*?(\d{1,4})",
-    # --- platforms (#)+ - this is used in modification history ---
-    r"[Pp]latforms? #\d+(?:#\d+|,| |-|and)*[^\n]*",
-    # --- CVL (#) ---
-    r"CVL[\s#]*?(\d{1,4})",
-    # --- PAA (#) ---
-    r"PAA[: #]*?\d{1,4}",
-    # --- (#) Type ---
-    r"(?:#|cert\.?|sample|Cert\.?|Certificate)[\s#]*?(\d+)?\s*?(?:AES|SHS|SHA|RSA|HMAC|Diffie-Hellman|DRBG|DES|CVL)",
-    # --- PKCS (#) ---
-    r"PKCS[\s]?#?\d+",
-    r"PKSC[\s]?#?\d+",  # typo, #625
-    # --- # C and # A (just in case) ---
-    r"#\s+?[Cc]\d+",
-    r"#\s+?[Aa]\d+",
-]
-
-rules_fips_to_remove = [
-    # --- random words found ---
-    r"[Ss]lot #\d",  # a card slot, #2069
-    r"[Ss]eals? ?\(?#\d - #\d",  # #1232
-    r"\[#\d*\]",  # some certs use this as references
-    r"CSP ?#\d",  # #2795
-    r"[Pp]ower [Ss]upply #\d",  # #604
-    r"TEL #\d and #\d",  # #3337
-    r"#\d+ - #\d+",  # labels, seals... #1232
-    r"#\d+‐#?\d+",  # labels, seals... #3530
-    r"#\d+ to #?\d+",  # labels, seals... #3058
-    r"see #\d+",  # labels, seals... #3058
-    r"#\d+, ?#\d+",
-    r"#?\d+ and #?\d+",
-    r"label \(#\d+\)",
-    r"[Ll]abel #\d+",
-    r"\(#\d\)",
-    r"IETF[25\s]*RFC[26\s]*#\d+",  # #3425
-    r"Document # 540-105000-A1",
-    r"Certificate #2287-1 from EMCE Engineering",  # ???
-    r"[sS]cenarios?\s?#\d+",  # 3789
-    r"#\d+\s?\(\S\)",  # 2159
-]
-
-rules_fips_cert = [
-    #     r"(?:#\s?|Cert\.?[^. ]*?\s?)(?P<id>\d{4})",
-    #     r"(?:#\s?|Cert\.?[^. ]*?\s?)(?P<id>\d{3})",
-    #     r"(?:#\s?|Cert\.?[^. ]*?\s?)(?P<id>\d{2})",
-    #     r"(?:#\s?|Cert\.?[^. ]*?\s?)(?P<id>\d{1})
-    r"(?:#[^\S\r\n]?|Cert\.?(?!.\s)[^\S\r\n]?|Certificate[^\S\r\n]?)(?P<id>\d{1,4})(?!\d)",
-]
-
-#  rule still too "general"
-rules_fips_security_level = [r"[lL]evel (\d)"]
-
-rules_fips_htmls = [
-    r"module-name\">\s*(?P<fips_module_name>[^<]*)",
-    r"module-standard\">\s*(?P<fips_standard>[^<]*)",
-    r"Status[\s\S]*?\">\s*(?P<fips_status>[^<]*)",
-    r"Sunset Date[\s\S]*?\">\s*(?P<fips_date_sunset>[^<]*)",
-    r"Validation Dates[\s\S]*?\">\s*(?P<fips_date_validation>[^<]*)",
-    r"Overall Level[\s\S]*?\">\s*(?P<fips_level>[^<]*)",
-    r"Caveat[\s\S]*?\">\s*(?P<fips_caveat>[^<]*)",
-    r"Security Level Exceptions[\s\S]*?\">\s*(?P<fips_exceptions><ul.*</ul>)",
-    r"Module Type[\s\S]*?\">\s*(?P<fips_type>[^<]*)",
-    r"Embodiment[\s\S]*?\">\s*(?P<fips_embodiment>[^<]*)",
-    r"Tested Configuration[\s\S]*?\">\s*(?P<fips_tested_conf><ul.*</ul>)",
-    r"FIPS Algorithms[\s\S]*?\">\s*(?P<fips_algorithms><tbody>[\s\S]*</tbody>)",
-    r"Allowed Algorithms[\s\S]*?\">\s*(?P<fips_allowed_algorithms>[^<]*)",
-    r"Software Versions[\s\S]*?\">\s*(?P<fips_software>[^<]*)",
-    r"Product URL[\s\S]*?\">\s*<a href=\"(?P<fips_url>.*)\"",
-    r"Vendor<\/h4>[\s\S]*?href=\".*?\">(?P<fips_vendor>.*?)<\/a>",
-]
-
 
 def _load():
     script_dir = Path(__file__).parent
diff --git a/sec_certs/rules.yaml b/sec_certs/rules.yaml
index 3785856a..55763568 100644
--- a/sec_certs/rules.yaml
+++ b/sec_certs/rules.yaml
@@ -1,4 +1,8 @@
 ---
+
+#####
+# Common Criteria certificate IDs, grouped by scheme (Alpha-2 ISO country code).
+#####
 cc_cert_id:
   DE:
     - "BSI-DSZ-CC-[0-9]+?-[0-9]+"
@@ -71,6 +75,9 @@ cc_cert_id:
     - "(?:EFS|EFT|DXC-EFC)-T[0-9]+(?: |-)ETR [0-9]+.[0-9]+"
     - "Certificate Number: [0-9]{1,4}/[0-9]{1,4}"
 
+#####
+# Common Criteria protection profile IDs, grouped by certification body (e.g. BSI)
+#####
 cc_protection_profile_id:
   BSI:
     - "BSI-(?:CC[-_]|)PP[-_]*.+?"
@@ -85,6 +92,9 @@ cc_protection_profile_id:
     - "WBIS_V[0-9]\\.[0-9]"
     - "EHCT_V.+?"
 
+#####
+# Common Criteria security level (EAL or ITSEC).
+#####
 cc_security_level:
   EAL:
     - "EAL[ ]*[0-9+]+?"
@@ -92,6 +102,9 @@ cc_security_level:
   ITSEC:
     - "ITSEC[ ]*E[1-9]*.+?"
 
+#####
+# Common Criteria security assurance requirement (SAR) code, grouped by class (e.g. ACE, ACM, ...).
+#####
 cc_sar:
   ACE:
     - "ACE(?:_[A-Z]{3,4}){1,2}(?:\\.[0-9]){0,2}"
@@ -118,6 +131,9 @@ cc_sar:
   ASE:
     - "ASE(?:_[A-Z]{3,4}){1,2}(?:\\.[0-9]){0,2}"
 
+#####
+# Common Criteria security functional requirement (SFR) code, grouped by class (e.g. FAU, FCO, ...).
+#####
 cc_sfr:
   FAU:
     - "FAU(?:_[A-Z]{3,4}){1,2}(?:\\.[0-9]){0,2}"
@@ -142,6 +158,9 @@ cc_sfr:
   FTP:
     - "FTP(?:_[A-Z]{3,4}){1,2}(?:\\.[0-9]){0,2}"
 
+#####
+# Common Criteria claim code, grouped by class (e.g. D, T, ...).
+#####
 cc_claims:
   D:
     - "D\\.[\\._\\-A-Z]+?"
@@ -164,6 +183,9 @@ cc_claims:
   OSP:
     - "OSP\\.[\\._\\-A-Z]+?"
 
+#####
+# A generic vendor of a product, mostly has smartcard/secure hardware vendors or other large vendors of certified products.
+#####
 vendor:
   NXP:
     - "NXP( Semiconductors)?( N\\.V\\.)?"
@@ -204,6 +226,9 @@ vendor:
   Microsoft:
     - "Microsoft( Corporation)?"
 
+#####
+# Common Criteria evaluation facility, mostly from https://www.commoncriteriaportal.org/labs/, grouped roughly by facility.
+#####
 eval_facility:
   Serma:
     - "Serma Technologies|SERMA|Serma Safety & Security"
@@ -327,7 +352,9 @@ eval_facility:
   BAE:
     - "BAE Applied Intelligence"
 
-
+#####
+# Symmetric crypto primitive (e.g. a block or stream cipher), grouped by competition/standardization effort.
+#####
 symmetric_crypto:
   AES_competition:
     AES:
@@ -432,6 +459,8 @@ symmetric_crypto:
       - "GOST 28147-89"
       - "Magma"
       - "Kuznyechik"
+    SEED:
+      - "SEED"
     Skipjack:
       - "Skipjack"
     Skinny:
@@ -443,6 +472,9 @@ symmetric_crypto:
       - "KMAC"
       - "CMAC|CBC-MAC"
 
+#####
+# Asymmetric crypto primitive, grouped by type (RSA, ECC, FF).
+#####
 asymmetric_crypto:
   RSA:
     - "RSA[- ]?(?P<bitsize>512|768|1024|1280|1536|2048|3072|4096|8192)"
@@ -465,6 +497,9 @@ asymmetric_crypto:
     DSA:
       - "DSA"
 
+#####
+# Post-quantum crypto primitive, grouped by primitive, from NIST-PQC.
+#####
 pq_crypto:
   ClassicMcEliece:
     - "Classic[ -]McEliece"
@@ -501,6 +536,9 @@ pq_crypto:
   SPHINCS:
     - "SPHINCS\\+"
 
+#####
+# Hash-function, grouped by hash-function class (SHA, MD) or competition (PHC).
+#####
 hash_function:
   SHA:
     SHA1:
@@ -559,6 +597,9 @@ hash_function:
   PBKDF:
     - "PBKDF[12]?"
 
+#####
+# General cryptographic scheme.
+#####
 crypto_scheme:
   MAC:
     - "MAC"
@@ -575,6 +616,9 @@ crypto_scheme:
   AEAD:
     - "AEAD"
 
+#####
+# General cryptographic protocol.
+#####
 crypto_protocol:
   SSH:
     - "SSH"
@@ -590,6 +634,9 @@ crypto_protocol:
   IPsec:
     - "IPsec"
 
+#####
+# Random number generator.
+#####
 randomness:
   DUAL_EC:
     - "DUAL_EC_DRBG"
@@ -602,6 +649,9 @@ randomness:
     - "RN[GD]"
     - "RBG"
 
+#####
+# Block cipher mode.
+#####
 cipher_mode:
   ECB:
     - "ECB"
@@ -628,6 +678,10 @@ cipher_mode:
   XTS:
     - "XTS"
 
+#####
+# An elliptic curve, grouped by standardization body (e.g. NIST, Brainpool).
+# Note that multiple curve names may correspond to the same curve.
+#####
 ecc_curve:
   NIST:
     - "(?:Curve |curve |)P-(192|224|256|384|521)"
@@ -659,6 +713,9 @@ ecc_curve:
   BN:
     - "bn[0-9]{3}"
 
+#####
+# A cryptographic engine.
+#####
 crypto_engine:
   TORNADO:
     - "TORNADO"
@@ -667,10 +724,16 @@ crypto_engine:
   NexCrypt:
     - "NexCrypt"
 
+#####
+# TLS cipher suite name.
+#####
 tls_cipher_suite:
   TLS:
     - "TLS(_[A-Z0-9]+){1,3}_WITH(_[A-Z0-9]+){2,4}"
 
+#####
+# A cryptographic library, grouped by rough library category.
+#####
 crypto_library:
   Neslib:
     - "(?:NesLib|NESLIB) [v]*[0-9\\.]+"
@@ -724,6 +787,9 @@ crypto_library:
   libsecp256k1:
     - "libsecp256k1"
 
+#####
+# A vulnerability idenfitier or name (e.g. CVE-... but also Minerva, ROCA).
+#####
 vulnerability:
   CVE:
     - "CVE-[0-9]+?-[0-9]+?"
@@ -736,6 +802,9 @@ vulnerability:
   TPM-Fail:
     - "TPM[\\.-]Fail"
 
+#####
+# A side-channel analysis related term, grouped into SCA, FI and other.
+#####
 side_channel_analysis:
   SCA:
     - "Leak-Inherent"
@@ -765,6 +834,9 @@ side_channel_analysis:
     - "JIL(-(AAPS|COMP|AM|AAPHD|AMHD))?"
     - "JHAS"
 
+#####
+# A term used in the certification process.
+#####
 certification_process:
   OutOfScope:
     - "[oO]ut of [sS]cope"
@@ -775,11 +847,17 @@ certification_process:
   SecurityFunction:
     - "[sS]ecurity [fF]unction SF\\.[a-zA-Z0-9_]"
 
+#####
+# A technical report id, grouped by standardization body (e.g. BSI).
+#####
 technical_report_id:
   BSI:
     - "BSI[ ]*TR-[0-9]+?(?:-[0-9]+?|)"
     - "BSI [0-9]+?" # German BSI document containing list of issued certificates in some period
 
+#####
+# A device model, grouped by manufacturer and subgroups into particular model families.
+#####
 device_model:
   G87:
     - "G87-.+?"
@@ -792,6 +870,9 @@ device_model:
     SLE:
       - "SLE[0-9]{2}[A-Z]{3}[0-9]{1-4}[A-Z]{1-3}"
 
+#####
+# A Trusted Execution Environment, grouped by manufacturer (e.g. Intel, ARM, ...).
+#####
 tee_name:
   Intel:
     - "(Intel )?SGX"
@@ -818,12 +899,18 @@ tee_name:
     - "WatchTrust"
     - "TEE"
 
+#####
+# An OS name, grouped by OS.
+#####
 os_name:
   STARCOS:
     - "STARCOS(?: [0-9\\.]+?|)"
   JCOP:
     - "JCOP[ ]*[0-9]"
 
+#####
+# CPLC data name..
+#####
 cplc_data:
   ICFab:
     - "IC[ \\.]*Fabricator"
@@ -832,6 +919,9 @@ cplc_data:
   ICVersion:
     - "IC[ \\.]*Version"
 
+#####
+# An elementary data group.
+#####
 ic_data_group:
   EF:
     - "EF\\.DG[1-9][0-6]?"
@@ -840,11 +930,14 @@ ic_data_group:
     - "EF\\.SOD"
     - "EF\\.ChipSecurity"
 
+#####
+# Standard ID, grouped by standardization body (e.g. FIPS, NIST, ISO).
+#####
 standard_id:
   FIPS:
     - "FIPS ?(?:PUB )?[0-9]+(-[0-9]+)?"
   NIST:
-    - "NIST SP [0-9]+-[0-9]+?[a-zA-Z]?"
+    - "(NIST )?SP [0-9]+-[0-9]+?[a-zA-Z]?"
   PKCS:
     - "PKCS[ #]*[1-9]+"
   BSI:
@@ -866,7 +959,9 @@ standard_id:
     - "CC[I]*MB-20[0-9]+?-[0-9]+?-[0-9]+?"  # Common Criteria methodology
     - "CCIMB-9[0-9]-[0-9]+?"  # Common Criteria methodology old
 
-
+#####
+# JavaCard version identifier.
+#####
 javacard_version:
   JavaCard:
     - "(?:Java Card|JavaCard) [2-3]\\.[0-9](?:\\.[0-9]|)"
@@ -876,6 +971,9 @@ javacard_version:
     - "(?:Global Platform|GlobalPlatform) [2-3]\\.[0-9]\\.[0-9]"
     - "(?:Global Platform|GlobalPlatform) \\(version [2-3]\\.[0-9]\\.[0-9]\\)"
 
+#####
+# JavaCard API constant, grouped into "ALG", "misc" and "curves".
+#####
 javacard_api_const:
   ALG:
     RNG:
@@ -931,6 +1029,9 @@ javacard_api_const:
     - "X25519"
     - "X448"
 
+#####
+# JavaCard common package identifiers.
+#####
 javacard_packages:
   java:
     - "java\\.[a-z\\.]+"
@@ -947,15 +1048,65 @@ javacard_packages:
   de:
     - "de\\.bsi\\.[a-z\\.]+"
 
+#####
+# FIPS 140 certificate id.
+#####
 fips_cert_id:
   Cert:
     - "(?:#[^\\S\\r\\n]?|Cert\\.?(?!.\\s)[^\\S\\r\\n]?|Certificate[^\\S\\r\\n]?)(?P<id>\\d{1,4})(?!\\d)"
 
+#####
+# FIPS 140 security level.
+#####
 fips_security_level:
   Level:
     - "[lL]evel (\\d)"
 
+#####
+# FIPS 140 "certlike" string, that needs to get removed from certificate id matches.
+#####
+fips_certlike:
+  Certlike:
+      # --- HMAC(-SHA)(-1) - (bits) (method) ((hardware/firmware cert) #id) ---
+      # + added (and #id) everywhere
+    - "HMAC(?:[- –]*SHA)?(?:[- –]*1)?[– -]*((?:;|\\/|160|224|256|384|512)?(?:;|\\/| |[Dd]ecrypt|[Ee]ncrypt|KAT)*?[, ]*?\\(?(?: |hardware|firmware)*?[\\s(\\[]*?(?:#|cert\\.?|Cert\\.?|Certificate|sample)?[\\s#]*?)?[\\s#]*?(\\d{1,4})(?:[\\s#]*and[\\s#]*\\d+)?"
+      # --- same as above, without hw or fw ---
+    - "HMAC(?:-SHA)?(?:-1)?[ -]*((?:;|\\/|160|224|256|384|512)?(?:;|\\/| |[Dd]ecrypt|[Ee]ncrypt|KAT)*?[, ]*?(?:#|cert\\.?|sample|Cert\\.?|Certificate)?[\\s#]*?)?[\\s#]*?(\\d{1,4})"
+      # --- SHS/A - (bits) (method) ((cert #) numbers) ---
+    - "SH[SA][-– 123]*(?:;|\\/|160|224|256|384|512)?(?:[\\s(\\[]*?(?:KAT|[Bb]yte [Oo]riented)*?[\\s,]*?[\\s(\\[]*?(?:#|cert\\.?|sample|Cert\\.?|Certificate)?[\\s#]*?)?[\\s#]*?(\\d{1,4})(?:\\)?\\[#?\\d+\\])?(?:[\\s#]*?and[\\s#]*?\\d+)?"
+      # --- RSA (bits) (method) ((cert #)) ---
+    - "RSA(?:[-– ]*(?:;|\\/|512|768|1024|1280|1536|2048|3072|4096|8192)\\s\\(\\[]*?(?:(?:;|\\/|KAT|Verify|PSS|\\s)*?)?[\\s,]*?[\\s(\\[]*?(?:#|cert\\.?|sample|Cert\\.?|Certificate)?[\\s#]*?)?[\\s#]*?(\\d{1,4})"
+      # --- RSA (SSA) (PKCS) (version) (#) ---
+    - "(?:RSA)?[-– ]?(?:SSA)?[- ]?PKCS\\s?#?\\d(?:-[Vv]1_5| [Vv]1[-_]5)?[\\s#]*?(\\d{1,4})?"
+      # --- AES (bits) (method) ((cert #)) ---
+    - "AES[-– ]*((?: |;|\\/|bit|key|128|192|256|CBC)*(?: |\\/|;|[Dd]ecrypt|[Ee]ncrypt|KAT|CMAC|CTR|GCM|IV|CBC)*?[,\\s(\\[]*?(?:#|cert\\.?|sample|Cert\\.?|Certificate)?[\\s#]*?)?[\\s#]*?(\\d{1,4})(?:\\)?[\\s#]*?\\[#?\\d+\\])?(?:[\\s#]*?and[\\s#]*?(\\d+))?"
+      # --- Diffie Helman (CVL) ((cert #)) ---
+    - "Diffie[-– ]*Hellman[,\\s(\\[]*?(?:CVL|\\s)*?(?:#|cert\\.?|sample|Cert\\.?|Certificate)?[\\s#]*?[\\s#]*?(\\d{1,4})"
+      # --- DRBG (bits) (method) (cert #) ---
+    - "DRBG[ –-]*((?:;|\\/|160|224|256|384|512)?(?:;|\\/| |[Dd]ecrypt|[Ee]ncrypt|KAT)*?[,\\s(\\[]*?(?:#|cert\\.?|sample|Cert\\.?|Certificate)?[\\s#]*?)?[\\s#]*?(\\d{1,4})"
+      # --- DES (bits) (method) (cert #)
+    - "DES[ –-]*((?:;|\\/|160|224|256|384|512)?(?:;|\\/| |[Dd]ecrypt|[Ee]ncrypt|KAT|CBC|(?:\\d(?: and \\d)? keying options?))*?[,\\s(\\[]*?(?:#|cert\\.?|sample|Cert\\.?|Certificate)*?[\\s#]*?)?[\\s#]*?(\\d{1,4})(?:[\\s#]*?and[\\s#]*?(\\d+))?"
+      # --- DSA (bits) (method) (cert #)
+    - "DSA[ –-]*((?:;|\\/|160|224|256|384|512)?(?: |[Dd]ecrypt|[Ee]ncrypt|KAT)*?[,\\s(\\[]*?(?:#|cert\\.?|sample|Cert\\.?|Certificate)?[\\s#]*?)?[\\s#]*?(\\d{1,4})"
+      # --- platforms (#)+ - this is used in modification history ---
+    - "[Pp]latforms? #\\d+(?:#\\d+|,| |-|and)*[^\\n]*"
+      # --- CVL (#) ---
+    - "CVL[\\s#]*?(\\d{1,4})"
+      # --- PAA (#) ---
+    - "PAA[: #]*?\\d{1,4}"
+      # --- (#) Type ---
+    - "(?:#|cert\\.?|sample|Cert\\.?|Certificate)[\\s#]*?(\\d+)?\\s*?(?:AES|SHS|SHA|RSA|HMAC|Diffie-Hellman|DRBG|DES|CVL)"
+      # --- PKCS (#) ---
+    - "PKCS[\\s]?#?\\d+"
+    - "PKSC[\\s]?#?\\d+"  # typo, #625
+      # --- # C and # A (just in case) ---
+    - "#\\s+?[Cc]\\d+"
+    - "#\\s+?[Aa]\\d+"
 
+
+#####
+# Common Criteria rules.
+#####
 cc_rules:
   - "cc_cert_id"
   - "cc_protection_profile_id"
@@ -989,10 +1140,16 @@ cc_rules:
   - "javacard_version"
   - "javacard_api_const"
   - "javacard_packages"
+  - "certification_process"
+
 
+#####
+# FIPS rules.
+#####
 fips_rules:
   - "fips_cert_id"
   - "fips_security_level"
+  - "fips_certlike"
   - "vendor"
   - "eval_facility"
   - "symmetric_crypto"
@@ -1017,4 +1174,5 @@ fips_rules:
   - "standard_id"
   - "javacard_version"
   - "javacard_api_const"
-  - "javacard_packages"
\ No newline at end of file
+  - "javacard_packages"
+  - "certification_process"
\ No newline at end of file
diff --git a/sec_certs/sample/fips.py b/sec_certs/sample/fips.py
index 5b2c7367..3a921c03 100644
--- a/sec_certs/sample/fips.py
+++ b/sec_certs/sample/fips.py
@@ -726,16 +726,15 @@ class FIPSCertificate(Certificate["FIPSCertificate", "FIPSCertificate.FIPSHeuris
         return result
 
     def _process_to_pop(self, reg_to_match: Pattern, cert: str, to_pop: Set[str]) -> None:
-        for alg in self.heuristics.keywords["rules_fips_algorithms"]:
-            for found in self.heuristics.keywords["rules_fips_algorithms"][alg]:
-                match_in_found = reg_to_match.search(found)
-                match_in_cert = reg_to_match.search(cert)
-                if (
-                    match_in_found is not None
-                    and match_in_cert is not None
-                    and match_in_found.group("id") == match_in_cert.group("id")
-                ):
-                    to_pop.add(cert)
+        for found in self.heuristics.keywords["fips_certlike"]["Certlike"]:
+            match_in_found = reg_to_match.search(found)
+            match_in_cert = reg_to_match.search(cert)
+            if (
+                match_in_found is not None
+                and match_in_cert is not None
+                and match_in_found.group("id") == match_in_cert.group("id")
+            ):
+                to_pop.add(cert)
 
         for alg_cert in self.heuristics.algorithms:
             for cert_no in alg_cert["Certificate"]:
@@ -752,28 +751,29 @@ class FIPSCertificate(Certificate["FIPSCertificate", "FIPSCertificate.FIPSHeuris
 
         self.heuristics.keywords = copy.deepcopy(self.pdf_scan.keywords)
 
-        # XXX: What is this mess?
-        #
         # # TODO figure out why can't I delete this
         # if self.web_scan.mentioned_certs:
         #     for item, value in self.web_scan.mentioned_certs.items():
         #         self.heuristics.keywords["fips_cert_id"].update({"caveat_item": {item: value}})
         #
-        # alg_set = self._create_alg_set()
-        #
-        # for rule in self.heuristics.keywords["fips_cert_id"]:
-        #     to_pop = set()
-        #     rr = re.compile(rule)
-        #     for cert in self.heuristics.keywords["fips_cert_id"][rule]:
-        #         if cert in alg_set:
-        #             to_pop.add(cert)
-        #             continue
-        #         self._process_to_pop(rr, cert, to_pop)
-        #
-        #     for r in to_pop:
-        #         self.heuristics.keywords["fips_cert_id"][rule].pop(r, None)
-        #
-        #     self.heuristics.keywords["rules_cert_id"][rule].pop(self.cert_id, None)
+        alg_set = self._create_alg_set()
+        print(f"-----------Cert #{self.cert_id}")
+        print(f"Alg set: {alg_set}")
+        print(f"Before: {self.pdf_scan.keywords['fips_cert_id']['Cert']}")
+        for cert_rule in fips_rules["fips_cert_id"]["Cert"]:
+            to_pop = set()
+            for cert in self.heuristics.keywords["fips_cert_id"]["Cert"]:
+                if cert in alg_set:
+                    to_pop.add(cert)
+                    continue
+                self._process_to_pop(cert_rule, cert, to_pop)
+
+            for r in to_pop:
+                print(f"Removing {r} from {self.cert_id}")
+                self.heuristics.keywords["fips_cert_id"]["Cert"].pop(r, None)
+
+        self.heuristics.keywords["fips_cert_id"]["Cert"].pop("#" + str(self.cert_id), None)
+        print(f"After: {self.heuristics.keywords['fips_cert_id']['Cert']}")
 
     @staticmethod
     def get_compare(vendor: str) -> str:
diff --git a/sec_certs/utils/extract.py b/sec_certs/utils/extract.py
index 199b16c2..91d24489 100644
--- a/sec_certs/utils/extract.py
+++ b/sec_certs/utils/extract.py
@@ -734,4 +734,4 @@ def flatten_matches(dct: Dict) -> Dict:
             result.update(flatten_matches(value))
         else:
             result[key] = value
-    return dict(result)
\ No newline at end of file
+    return dict(result)
diff --git a/tests/test_fips_oop.py b/tests/test_fips_oop.py
index aff012b4..d8932d91 100644
--- a/tests/test_fips_oop.py
+++ b/tests/test_fips_oop.py
@@ -120,91 +120,97 @@ class TestFipsOOP(TestCase):
             dataset = _set_up_dataset_for_full(tmp_dir, certs, self.cpe_dset_path, self.cve_dset_path)
 
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3095")].heuristics.st_references.directly_referencing), {"3096"}
+                {"3093", "3094", "3096"},
+                set(dataset.certs[fips_dgst("3095")].heuristics.st_references.directly_referencing),
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3095")].heuristics.web_references.directly_referencing),
                 {"3093", "3096", "3094"},
+                set(dataset.certs[fips_dgst("3095")].heuristics.web_references.directly_referencing),
             )
+
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3651")].heuristics.st_references.directly_referencing), {"3615"}
+                {"3615"}, set(dataset.certs[fips_dgst("3651")].heuristics.st_references.directly_referencing)
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3093")].heuristics.st_references.directly_referencing), {"3091"}
+                {"3090", "3091"}, set(dataset.certs[fips_dgst("3093")].heuristics.st_references.directly_referencing)
             )
+
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3093")].heuristics.web_references.directly_referencing), {"3090", "3091"}
+                {"3090", "3091"}, set(dataset.certs[fips_dgst("3093")].heuristics.web_references.directly_referencing)
             )
             self.assertEqual(
                 set(dataset.certs[fips_dgst("3090")].heuristics.st_references.directly_referencing), {"3089"}
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3197")].heuristics.web_references.directly_referencing),
                 {"3195", "3096", "3196", "3644", "3651"},
+                set(dataset.certs[fips_dgst("3197")].heuristics.web_references.directly_referencing),
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3196")].heuristics.st_references.directly_referencing), {"3091"}
+                {"3091", "3194"}, set(dataset.certs[fips_dgst("3196")].heuristics.st_references.directly_referencing)
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3196")].heuristics.web_references.directly_referencing),
                 {"3194", "3091", "3480", "3615"},
+                set(dataset.certs[fips_dgst("3196")].heuristics.web_references.directly_referencing),
             )
             self.assertIsNone(dataset.certs[fips_dgst("3089")].heuristics.st_references.directly_referencing)
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3195")].heuristics.st_references.directly_referencing), {"3091"}
+                {"3091", "3194"}, set(dataset.certs[fips_dgst("3195")].heuristics.st_references.directly_referencing)
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3195")].heuristics.web_references.directly_referencing),
                 {"3194", "3091", "3480"},
+                set(dataset.certs[fips_dgst("3195")].heuristics.web_references.directly_referencing),
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3480")].heuristics.st_references.directly_referencing), {"3089"}
+                {"3089"}, set(dataset.certs[fips_dgst("3480")].heuristics.st_references.directly_referencing)
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3615")].heuristics.st_references.directly_referencing), {"3089"}
+                {"3089"}, set(dataset.certs[fips_dgst("3615")].heuristics.st_references.directly_referencing)
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3194")].heuristics.st_references.directly_referencing), {"3089"}
+                {"3089"}, set(dataset.certs[fips_dgst("3194")].heuristics.st_references.directly_referencing)
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3091")].heuristics.st_references.directly_referencing), {"3089"}
+                {"3089"}, set(dataset.certs[fips_dgst("3091")].heuristics.st_references.directly_referencing)
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3690")].heuristics.st_references.directly_referencing), {"3651"}
+                {"3644", "3196", "3651"},
+                set(dataset.certs[fips_dgst("3690")].heuristics.st_references.directly_referencing),
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3690")].heuristics.web_references.directly_referencing),
                 {"3644", "3196", "3651"},
+                set(dataset.certs[fips_dgst("3690")].heuristics.web_references.directly_referencing),
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3644")].heuristics.st_references.directly_referencing), {"3615"}
+                {"3615"}, set(dataset.certs[fips_dgst("3644")].heuristics.st_references.directly_referencing)
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3527")].heuristics.st_references.directly_referencing), {"3091"}
+                {"3090", "3091"}, set(dataset.certs[fips_dgst("3527")].heuristics.st_references.directly_referencing)
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3527")].heuristics.web_references.directly_referencing), {"3090", "3091"}
+                {"3090", "3091"}, set(dataset.certs[fips_dgst("3527")].heuristics.web_references.directly_referencing)
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3094")].heuristics.st_references.directly_referencing), {"3091"}
+                {"3090", "3091"}, set(dataset.certs[fips_dgst("3094")].heuristics.st_references.directly_referencing)
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3544")].heuristics.st_references.directly_referencing), {"3096"}
+                {"3093", "3096", "3527"},
+                set(dataset.certs[fips_dgst("3544")].heuristics.st_references.directly_referencing),
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3544")].heuristics.web_references.directly_referencing),
                 {"3093", "3096", "3527"},
+                set(dataset.certs[fips_dgst("3544")].heuristics.web_references.directly_referencing),
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3096")].heuristics.st_references.directly_referencing), {"3091"}
+                {"3194", "3091", "3090"},
+                set(dataset.certs[fips_dgst("3096")].heuristics.st_references.directly_referencing),
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3096")].heuristics.web_references.directly_referencing),
                 {"3090", "3194", "3091", "3480"},
+                set(dataset.certs[fips_dgst("3096")].heuristics.web_references.directly_referencing),
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3092")].heuristics.web_references.directly_referencing),
                 {"3093", "3195", "3096", "3644", "3651"},
+                set(dataset.certs[fips_dgst("3092")].heuristics.web_references.directly_referencing),
             )
 
     def test_connections_redhat(self):
@@ -218,9 +224,7 @@ class TestFipsOOP(TestCase):
                 set(dataset.certs[fips_dgst("2633")].heuristics.st_references.directly_referencing), {"2441"}
             )
             self.assertIsNone(dataset.certs[fips_dgst("2441")].heuristics.st_references.directly_referencing)
-            self.assertEqual(
-                set(dataset.certs[fips_dgst("2997")].heuristics.st_references.directly_referencing), {"2711"}
-            )
+            self.assertIsNone(dataset.certs[fips_dgst("2997")].heuristics.st_references.directly_referencing)
             self.assertEqual(
                 set(dataset.certs[fips_dgst("2446")].heuristics.st_references.directly_referencing), {"2441"}
             )
@@ -232,36 +236,30 @@ class TestFipsOOP(TestCase):
             )
             self.assertIsNone(dataset.certs[fips_dgst("2441")].heuristics.st_references.directly_referencing)
             self.assertIsNone(dataset.certs[fips_dgst("2711")].heuristics.st_references.directly_referencing)
+            self.assertIsNone(dataset.certs[fips_dgst("2908")].heuristics.st_references.directly_referencing)
+            self.assertIsNone(dataset.certs[fips_dgst("3613")].heuristics.st_references.directly_referencing)
             self.assertEqual(
-                set(dataset.certs[fips_dgst("2908")].heuristics.st_references.directly_referencing), {"2711"}
-            )
-            self.assertEqual(
-                set(dataset.certs[fips_dgst("3613")].heuristics.st_references.directly_referencing), {"2997"}
-            )
-            self.assertEqual(
-                set(dataset.certs[fips_dgst("2721")].heuristics.st_references.directly_referencing), {"2441"}
+                set(dataset.certs[fips_dgst("2721")].heuristics.st_references.directly_referencing), {"2441", "2711"}
             )
             self.assertEqual(
                 set(dataset.certs[fips_dgst("2721")].heuristics.web_references.directly_referencing), {"2441", "2711"}
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("2798")].heuristics.st_references.directly_referencing), {"2721"}
+                set(dataset.certs[fips_dgst("2798")].heuristics.st_references.directly_referencing), {"2711", "2721"}
             )
             self.assertEqual(
                 set(dataset.certs[fips_dgst("2798")].heuristics.web_references.directly_referencing), {"2711", "2721"}
             )
             self.assertIsNone(dataset.certs[fips_dgst("2711")].heuristics.st_references.directly_referencing)
+            self.assertIsNone(dataset.certs[fips_dgst("2997")].heuristics.st_references.directly_referencing)
             self.assertEqual(
-                set(dataset.certs[fips_dgst("2997")].heuristics.st_references.directly_referencing), {"2711"}
-            )
-            self.assertEqual(
-                set(dataset.certs[fips_dgst("2742")].heuristics.st_references.directly_referencing), {"2721"}
+                set(dataset.certs[fips_dgst("2742")].heuristics.st_references.directly_referencing), {"2711", "2721"}
             )
             self.assertEqual(
                 set(dataset.certs[fips_dgst("2742")].heuristics.web_references.directly_referencing), {"2721", "2711"}
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("2721")].heuristics.st_references.directly_referencing), {"2441"}
+                set(dataset.certs[fips_dgst("2721")].heuristics.st_references.directly_referencing), {"2441", "2711"}
             )
             self.assertEqual(
                 set(dataset.certs[fips_dgst("2721")].heuristics.web_references.directly_referencing), {"2441", "2711"}
@@ -272,7 +270,7 @@ class TestFipsOOP(TestCase):
         with TemporaryDirectory() as tmp_dir:
             dataset = _set_up_dataset_for_full(tmp_dir, certs, self.cpe_dset_path, self.cve_dset_path)
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3850")].heuristics.st_references.directly_referencing), {"1883"}
+                set(dataset.certs[fips_dgst("3850")].heuristics.st_references.directly_referencing), {"1883", "3518"}
             )
             self.assertEqual(
                 set(dataset.certs[fips_dgst("3850")].heuristics.web_references.directly_referencing), {"1883"}
@@ -304,49 +302,36 @@ class TestFipsOOP(TestCase):
             self.assertEqual(
                 set(dataset.certs[fips_dgst("3493")].heuristics.st_references.directly_referencing), {"2398"}
             )
-            self.assertEqual(
-                set(dataset.certs[fips_dgst("3495")].heuristics.st_references.directly_referencing), {"2398"}
-            )
-            self.assertEqual(
-                set(dataset.certs[fips_dgst("3711")].heuristics.st_references.directly_referencing), {"3220"}
-            )
-            self.assertEqual(
-                set(dataset.certs[fips_dgst("3176")].heuristics.st_references.directly_referencing), {"2398"}
-            )
-            self.assertEqual(
-                set(dataset.certs[fips_dgst("3488")].heuristics.st_references.directly_referencing), {"2398"}
-            )
-            self.assertEqual(
-                set(dataset.certs[fips_dgst("3126")].heuristics.st_references.directly_referencing), {"2398"}
-            )
-            self.assertEqual(
-                set(dataset.certs[fips_dgst("3126")].heuristics.st_references.directly_referencing), {"2398"}
-            )
+            self.assertIsNone(dataset.certs[fips_dgst("3495")].heuristics.st_references.directly_referencing)
+            self.assertIsNone(dataset.certs[fips_dgst("3711")].heuristics.st_references.directly_referencing)
+            self.assertIsNone(dataset.certs[fips_dgst("3176")].heuristics.st_references.directly_referencing)
+            self.assertIsNone(dataset.certs[fips_dgst("3488")].heuristics.st_references.directly_referencing)
+            self.assertIsNone(dataset.certs[fips_dgst("3126")].heuristics.st_references.directly_referencing)
             self.assertEqual(
                 set(dataset.certs[fips_dgst("3126")].heuristics.web_references.directly_referencing), {"2398"}
             )
+            self.assertIsNone(dataset.certs[fips_dgst("3269")].heuristics.st_references.directly_referencing)
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3269")].heuristics.st_references.directly_referencing), {"3220"}
+                set(dataset.certs[fips_dgst("3524")].heuristics.web_references.directly_referencing), {"3220"}
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3524")].heuristics.st_references.directly_referencing), {"3220"}
+                set(dataset.certs[fips_dgst("3220")].heuristics.st_references.directly_referencing), {"2398"}
             )
-            self.assertIsNone(dataset.certs[fips_dgst("3220")].heuristics.st_references.directly_referencing)
             self.assertIsNone(dataset.certs[fips_dgst("3220")].heuristics.web_references.directly_referencing)
             self.assertIsNone(dataset.certs[fips_dgst("2398")].heuristics.st_references.directly_referencing)
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3543")].heuristics.st_references.directly_referencing), {"2398"}
+                set(dataset.certs[fips_dgst("3543")].heuristics.web_references.directly_referencing), {"2398"}
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("2676")].heuristics.st_references.directly_referencing), {"2398"}
+                set(dataset.certs[fips_dgst("2676")].heuristics.web_references.directly_referencing), {"2398"}
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3313")].heuristics.st_references.directly_referencing), {"3220"}
+                set(dataset.certs[fips_dgst("3313")].heuristics.web_references.directly_referencing), {"3220"}
             )
             self.assertIsNone(dataset.certs[fips_dgst("3363")].heuristics.st_references.directly_referencing)
             self.assertEqual(
                 set(dataset.certs[fips_dgst("3608")].heuristics.st_references.directly_referencing), {"2398"}
             )
             self.assertEqual(
-                set(dataset.certs[fips_dgst("3158")].heuristics.st_references.directly_referencing), {"2398"}
+                set(dataset.certs[fips_dgst("3158")].heuristics.web_references.directly_referencing), {"2398"}
             )
diff --git a/tests/test_rules.py b/tests/test_rules.py
index ee718172..2ce991a0 100644
--- a/tests/test_rules.py
+++ b/tests/test_rules.py
@@ -1,9 +1,12 @@
 from unittest import TestCase
 
-from sec_certs.cert_rules import cc_rules, fips_rules
+from sec_certs.cert_rules import cc_rules, fips_rules, rules
 
 
 class TestRules(TestCase):
     def test_rules(self):
         assert "cc_cert_id" in cc_rules
         assert "fips_cert_id" in fips_rules
+        for rule_group in rules:
+            if rule_group not in ("cc_rules", "fips_rules"):
+                assert rule_group in cc_rules.keys() or rule_group in fips_rules.keys()