Upgrade to post-quantum ready TLS
io.moderne.cryptography.pqc.UpgradeToPqcReadyTlsArtifactio.moderne.recipe:rewrite-cryptographyThe single transformation entry point for post-quantum TLS readiness. Moves a repository off the end-of-life jdk15on BouncyCastle artifacts onto a hybrid-capable bctls, raises the protocol floor to TLS 1.3, and offers an ML-KEM hybrid key-exchange group first wherever groups are pinned. Run BuildPqcReadinessInventory first: this recipe cannot reach configuration held outside the repository, and the sites it deliberately skips are visible only in its data tables. It also cannot upgrade the runtime, which is the other half of the job — JEP 527 hybrid key exchange exists on JDK 27 and later only.
Usage
This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.
mod run . --recipe io.moderne.cryptography.pqc.UpgradeToPqcReadyTlsIf the recipe isn’t available locally, install it with:
mod config recipes jar install io.moderne.recipe:rewrite-cryptography:RELEASEDefinition
This recipe runs the following recipes in order.
- Change Maven dependency
org.bouncycastle:bcprov-jdk15onorg.openrewrite.maven.ChangeDependencyGroupIdAndArtifactId - Change Maven dependency
org.bouncycastle:bctls-jdk15onorg.openrewrite.maven.ChangeDependencyGroupIdAndArtifactId - Change Maven dependency
org.bouncycastle:bcpkix-jdk15onorg.openrewrite.maven.ChangeDependencyGroupIdAndArtifactId - Change Gradle dependency
org.bouncycastle:bcprov-jdk15onorg.openrewrite.gradle.ChangeDependency - Change Gradle dependency
org.bouncycastle:bctls-jdk15onorg.openrewrite.gradle.ChangeDependency - Change Gradle dependency
org.bouncycastle:bcpkix-jdk15onorg.openrewrite.gradle.ChangeDependency - Upgrade Maven dependency version
org.bouncycastle:bc*-jdk18on:1.81org.openrewrite.maven.UpgradeDependencyVersion - Upgrade Gradle dependency versions
org.bouncycastle:bc*-jdk18onorg.openrewrite.gradle.UpgradeDependencyVersion - Enforce a TLS 1.3 floor
io.moderne.cryptography.pqc.EnforceTls13 - Enable hybrid TLS key exchange
io.moderne.cryptography.pqc.EnableHybridTlsKeyExchange
Data tables
Structured output this recipe can produce.
- Maven metadata failuresAttempts to resolve maven metadata that failed.
org.openrewrite.maven.table.MavenMetadataFailures - TLS protocol enforcementProtocol configuration surfaces rewritten to a TLS 1.3 floor, and surfaces flagged as needing manual review because rewriting them would change behaviour in a way a source scan cannot justify. Rows describe declared configuration only: a JVM's `java.security` file, container `-D` flags and environment variables are invisible here, so an enforced source does not prove an enforced runtime.
io.moderne.cryptography.pqc.table.ProtocolEnforcementTable - Hybrid TLS key exchange enforcementNamed-group configuration rewritten to offer an ML-KEM hybrid group first, and sites flagged as needing manual review because the value is not statically resolvable or the transformation would need a BouncyCastle upgrade to compile. `-D` flags outside the scanned repository are invisible, so an unchanged repository is not evidence of a hybrid-ready runtime.
io.moderne.cryptography.pqc.table.HybridKexEnforcementTable - Source files that had resultsSource files that were modified by the recipe run.
org.openrewrite.table.SourcesFileResults - Source files that had search resultsSearch results that were found during the recipe run.
org.openrewrite.table.SearchResults - Source files that errored on a recipeThe details of all errors produced by a recipe run.
org.openrewrite.table.SourcesFileErrors - Recipe performanceStatistics used in analyzing the performance of recipes.
org.openrewrite.table.RecipeRunStats