← All recipes
Moderne licensed

Offer a hybrid ML-KEM key exchange group first in properties files

Recipe IDio.moderne.cryptography.pqc.AddHybridTlsNamedGroupToPropertiesArtifactio.moderne.recipe:rewrite-cryptography

Prepends an ML-KEM hybrid key-exchange group to a jdk.tls.namedGroups value in a .properties file, under either the bare key or Gradle's systemProp. prefix. The group goes first because first means most preferred. An entry that already names any ML-KEM group is left alone silently and produces no row: the JSSE API throws on a duplicate group, so re-running this recipe has to be a no-op. A repository with no such entry is deliberately not given one — on JDK 27 the absence of a pin is the good state.

Single recipeProprietary

Usage

This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.

mod run . --recipe io.moderne.cryptography.pqc.AddHybridTlsNamedGroupToProperties

If the recipe isn’t available locally, install it with:

mod config recipes jar install io.moderne.recipe:rewrite-cryptography:RELEASE

Options

NameTypeDescription
hybridGroupStringThe hybrid named group to offer first. Kept as a single option on purpose: draft-ietf-tls-ecdhe-mlkem is still an IETF draft, so a rename at RFC promotion is a one-line default change rather than a sweep through the recipes. Default X25519MLKEM768, which is what JEP 527 puts first in the JDK 27 provider default.
e.g. SecP256r1MLKEM768
modeStringrewrite (the default) prepends the hybrid group. report leaves every entry untouched and only marks it and records a row — for estates whose group pins are deliberate, typically because a middlebox chokes on the larger ML-KEM key share or because ClientHello size is constrained.
e.g. report

Data tables

Structured output this recipe can produce.

  • Hybrid TLS key exchange enforcementNamed-group configuration rewritten to offer an ML-KEM hybrid group first, and sites flagged as needing manual review because the value is not statically resolvable or the transformation would need a BouncyCastle upgrade to compile. `-D` flags outside the scanned repository are invisible, so an unchanged repository is not evidence of a hybrid-ready runtime.io.moderne.cryptography.pqc.table.HybridKexEnforcementTable
  • Source files that had resultsSource files that were modified by the recipe run.org.openrewrite.table.SourcesFileResults
  • Source files that had search resultsSearch results that were found during the recipe run.org.openrewrite.table.SearchResults
  • Source files that errored on a recipeThe details of all errors produced by a recipe run.org.openrewrite.table.SourcesFileErrors
  • Recipe performanceStatistics used in analyzing the performance of recipes.org.openrewrite.table.RecipeRunStats