Build cryptographic cipher inventory
Recipe ID
io.moderne.cryptography.agilesec.BuildCipherInventoryArtifactio.moderne.recipe:rewrite-cryptographyBuilds a cipher inventory for Keyfactor AgileSec by detecting insecure cryptographic algorithm usages across Java (JCA/JCE and BouncyCastle), C# (.NET) and C/C++ (OpenSSL) sources. Every detection is recorded in the shared cipher inventory data table with the algorithm, its function, the library and language, the precise source location, and repository provenance. Phase 1 covers DES, 3DES, RC2, RC4, Blowfish, MD2, MD4, MD5, SHA1 and HMAC-SHA1.
Composite recipeProprietary
Usage
This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.
mod run . --recipe io.moderne.cryptography.agilesec.BuildCipherInventoryIf the recipe isn’t available locally, install it with:
mod config recipes jar install io.moderne.recipe:rewrite-cryptography:RELEASEDefinition
This recipe runs the following recipes in order.
- Find insecure Java cryptography
io.moderne.cryptography.agilesec.FindInsecureJavaCryptography - Find insecure C# cryptography
io.moderne.cryptography.agilesec.FindInsecureCSharpCryptography - Find insecure C/C++ cryptography
io.moderne.cryptography.agilesec.FindInsecureNativeCryptography
Data tables
Structured output this recipe can produce.
- Cipher inventoryCryptographic algorithm usages detected in source code, including the algorithm, its function, the library and language, the precise source location, and repository provenance.
io.moderne.cryptography.agilesec.table.CipherInventoryTable - Cryptography inventoryEvery cryptographic finding this module detects, joined into one sparse table so that a consumer does not have to match the per-detector tables on source location. A row carries the columns of whichever detectors reported at its location and leaves the others empty; the `Finding type` column names those detectors. The per-detector tables (`Cipher inventory`, `PQC readiness`, `TLS configuration inventory`, `TLS named groups inventory`) are still emitted unchanged, and carry the same findings unjoined.
io.moderne.cryptography.table.CryptographyInventoryTable - Source files that had resultsSource files that were modified by the recipe run.
org.openrewrite.table.SourcesFileResults - Source files that had search resultsSearch results that were found during the recipe run.
org.openrewrite.table.SearchResults - Source files that errored on a recipeThe details of all errors produced by a recipe run.
org.openrewrite.table.SourcesFileErrors - Recipe performanceStatistics used in analyzing the performance of recipes.
org.openrewrite.table.RecipeRunStats