Find TLS key exchange (named groups) configuration
io.moderne.cryptography.pqc.FindTlsNamedGroupsConfigurationArtifactio.moderne.recipe:rewrite-cryptographyInventories every place a codebase decides which TLS key-exchange groups it offers, and classifies each by whether an ML-KEM hybrid group — the thing JEP 527 and BouncyCastle 1.81 add — is among them. Covers SSLParameters.setNamedGroups and BCSSLParameters.setNamedGroups, the jdk.tls.namedGroups system property set in code or embedded as a -D flag in checked-in YAML and .properties files, getSupportedGroups overrides on BouncyCastle AbstractTlsClient subclasses, BCJSSE provider registration, and jdk.tls.disabledAlgorithms values that disable a hybrid group. When the repository configures named groups nowhere, each TLS-using file gets one A row: that code is post-quantum ready as soon as it runs on JDK 27 or BouncyCastle 1.81, with no source change. -D flags in shell scripts, Dockerfiles and orchestration manifests outside the repository are invisible, so an absent row is not proof that no group pin exists.
Usage
This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.
mod run . --recipe io.moderne.cryptography.pqc.FindTlsNamedGroupsConfigurationIf the recipe isn’t available locally, install it with:
mod config recipes jar install io.moderne.recipe:rewrite-cryptography:RELEASEOptions
| Name | Type | Description |
|---|---|---|
reportDefaultReliance | Boolean | Emit one A row per TLS-using source file when the repository configures named groups nowhere at all, anchored at the first TLS entry-point call in the file. This is the row that says "this code becomes post-quantum ready by upgrading the runtime, with no source change", which for most repositories is the whole answer. Set to false for a call-site-only inventory. Default true. |
detectConfigKeyHeuristics | Boolean | Also flag ad-hoc .properties and YAML keys whose name looks like a named-groups setting, e.g. tls.named-groups. Off by default: neither the JDK nor Spring Boot has a first-class named-groups configuration key, so any such key is an application's own invention and matching on the name alone produces false positives. The -Djdk.tls.namedGroups= flag embedded in a JVM-options value is matched either way. |
Data tables
Structured output this recipe can produce.
- TLS named groups inventoryTLS key-exchange group configuration detected in Java sources, configuration files and checked-in JVM-options values, classified by whether an ML-KEM hybrid group is offered. `-D` flags in shell scripts, Dockerfiles and orchestration manifests outside the scanned repository are invisible, so an absent row is not evidence that no group pin exists.
io.moderne.cryptography.pqc.table.TlsNamedGroupsInventoryTable - Cryptography inventoryEvery cryptographic finding this module detects, joined into one sparse table so that a consumer does not have to match the per-detector tables on source location. A row carries the columns of whichever detectors reported at its location and leaves the others empty; the `Finding type` column names those detectors. The per-detector tables (`Cipher inventory`, `PQC readiness`, `TLS configuration inventory`, `TLS named groups inventory`) are still emitted unchanged, and carry the same findings unjoined.
io.moderne.cryptography.table.CryptographyInventoryTable - Source files that had resultsSource files that were modified by the recipe run.
org.openrewrite.table.SourcesFileResults - Source files that had search resultsSearch results that were found during the recipe run.
org.openrewrite.table.SearchResults - Source files that errored on a recipeThe details of all errors produced by a recipe run.
org.openrewrite.table.SourcesFileErrors - Recipe performanceStatistics used in analyzing the performance of recipes.
org.openrewrite.table.RecipeRunStats