Enable hybrid TLS key exchange

Proprietary

Prepends an ML-KEM hybrid key-exchange group to explicitly configured named-group lists in Java and .properties sources, and reports the sites that cannot be rewritten safely. Code that configures no named groups is deliberately left alone: on JDK 27 and BouncyCastle 1.81 the provider default already offers a hybrid group, so inserting a literal list there would freeze today's defaults forever.

io.moderne.cryptography.pqc.EnableHybridTlsKeyExchange
mod run . --recipe=io.moderne.cryptography.pqc.EnableHybridTlsKeyExchange

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.

Recipe list

It runs these recipes, in this order.

  1. Offer a hybrid ML-KEM key exchange group first
  2. Offer a hybrid ML-KEM key exchange group first in properties files
  3. Find TLS key exchange sites that cannot be made hybrid automatically