Find TLS key exchange sites that cannot be made hybrid automatically
io.moderne.cryptography.pqc.FindMissingHybridTlsNamedGroupsArtifactio.moderne.recipe:rewrite-cryptographyReports the named-group sites a transformation recipe deliberately leaves alone, so that an empty diff is not mistaken for an empty problem. Three kinds: a setNamedGroups call whose argument is a runtime value, which no source rewrite can reach; a getSupportedGroups override on a BouncyCastle AbstractTlsClient subclass naming no ML-KEM group, where generated code referencing NamedGroup.X25519MLKEM768 would only compile against bctls 1.81 or later and so must ride with a dependency upgrade; and optionally SSL parameters applied without any named-groups configuration, whose remediation is a JDK 27 or BouncyCastle 1.81 upgrade rather than an edit.
Usage
This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.
mod run . --recipe io.moderne.cryptography.pqc.FindMissingHybridTlsNamedGroupsIf the recipe isn’t available locally, install it with:
mod config recipes jar install io.moderne.recipe:rewrite-cryptography:RELEASEOptions
| Name | Type | Description |
|---|---|---|
includeAppliedWithoutNamedGroups | Boolean | Also report every place SSL parameters are applied to a socket or engine without any named-groups call. Off by default because it fires on a large share of ordinary TLS code where the finding only means "fine once this runs on JDK 27" — the remediation is a runtime upgrade, not an edit. Turn it on to size that upgrade. |
Data tables
Structured output this recipe can produce.
- Hybrid TLS key exchange enforcementNamed-group configuration rewritten to offer an ML-KEM hybrid group first, and sites flagged as needing manual review because the value is not statically resolvable or the transformation would need a BouncyCastle upgrade to compile. `-D` flags outside the scanned repository are invisible, so an unchanged repository is not evidence of a hybrid-ready runtime.
io.moderne.cryptography.pqc.table.HybridKexEnforcementTable - Source files that had resultsSource files that were modified by the recipe run.
org.openrewrite.table.SourcesFileResults - Source files that had search resultsSearch results that were found during the recipe run.
org.openrewrite.table.SearchResults - Source files that errored on a recipeThe details of all errors produced by a recipe run.
org.openrewrite.table.SourcesFileErrors - Recipe performanceStatistics used in analyzing the performance of recipes.
org.openrewrite.table.RecipeRunStats