From Java 17 to 21: A Showcase of JDK Security Enhancements
summary
From Java 17 to 21 the JDK hardens defaults and adds post‑quantum tooling: JDK21 adds HSS/LMS signature verification and a KEM API for post‑quantum key encapsulation, TLS/DTLS weak ciphers (3DES, RC4 variants) and DTLS 1.0 are removed from defaults, and SHA‑1‑signed jars are treated as unsigned since JDK18 (backported to older releases). Also: SecurityManager is deprecated for removal, KeyStore and Subject APIs are simplified, keytool and jarsigner warn on weak choices, and JFR records initial security properties and provider requests.
AI-written summary · about
chapters (10)
- 0:00JDK security enhancements intro
- 7:37Modern cryptography in JDK 20-21
- 12:52Disabling weak algorithms
- 20:02Security manager deprecation
- 26:58Post-quantum cryptography
- 32:26OS integrations and keystores
- 35:14Keytool and jarsigner updates
- 37:18Flight Recorder security events
- 39:24Java crypto roadmap
- 42:17Q&A on security algorithms
related talks
40mJava Security Evolution - Out with the Old, In with the New
39mEvolving the Security of the Java Platform
51mJava and Post-Quantum Cryptography
37mKeeping Your Java Applications Secure - Cryptographic Improvements and Best Practices
44mMaking the JDK More Secure
52mSecurity Control Enhancements
40mMaximizing Security with JDK: Understanding Built-in Capabilities
48mSecure Java Applications against Quantum Threats