--- title: Security in Java [AtA] Inside Java Podcast 71 | daily.dev description: An Inside Java Podcast episode features Sean Mullan, lead of the OpenJDK security group and tech lead of Oracle's security libraries team, discussing how JDK... canonical: https://daily.dev/posts/security-in-java-ata-inside-java-podcast-71-80t0lewpg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Security in Java [AtA] Inside Java Podcast 71 | daily.dev og:description: An Inside Java Podcast episode features Sean Mullan, lead of the OpenJDK security group and tech lead of Oracle's security libraries team, discussing how JDK... og:url: https://daily.dev/posts/security-in-java-ata-inside-java-podcast-71-80t0lewpg og:image: https://api.daily.dev/og/posts/80T0LEwpg.png og:image:alt: Security in Java [AtA] Inside Java Podcast 71 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security in Java [AtA] Inside Java Podcast 71 **[Java \(Official Oracle\)](https://daily.dev/sources/java-oracle)** · 33 min read · 0 upvotes · 0 comments ## Summary An Inside Java Podcast episode features Sean Mullan, lead of the OpenJDK security group and tech lead of Oracle's security libraries team, discussing how JDK vulnerabilities get reported (via vuln-report@openjdk.org), the ongoing nature of cryptographic maintenance, and the JDK crypto roadmap that tracks deprecating algorithms like SHA-1 and Triple DES. The conversation covers post-quantum cryptography in depth: HSS/LMS (JDK 21), ML-KEM and ML-DSA (JDK 24, backported to 17/21), and post-quantum hybrid TLS key exchange landing as the highest-priority group in JDK 27 early access. Also discussed: the new PEM API (two previews, renamed DEREncodable to BinaryEncodable), and an upcoming Argon2 password hashing draft to replace PBKDF2. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What post-quantum cryptography algorithms has the JDK implemented so far? The JDK has implemented three post-quantum algorithms: HSS/LMS, a one-time-use digital signature system released in JDK 21; ML-KEM, a quantum-resistant key exchange algorithm; and ML-DSA, a quantum-resistant digital signature algorithm, both standardized by NIST in FIPS 203 and 204 and added in JDK 24, with backports to JDK 17 and 21 planned for later that year. _Track how JDK's post-quantum rollout evolves release by release on daily.dev before planning a TLS upgrade._ ### How does JDK 27 handle post-quantum hybrid key exchange in TLS? JDK 27 early access implements post-quantum hybrid key exchange as the highest-priority group offered during a TLS handshake, combining ML-KEM with a traditional elliptic-curve algorithm so the connection stays secure even if one of the two algorithms is later broken. If a peer server doesn't support the hybrid group, the connection falls back to whatever both sides support. _Developers weighing TLS defaults for Java services can follow JDK 27's rollout details on daily.dev._ ### How do I report a security vulnerability I found in the JDK? Send an email with as much detail as possible, including a test case, crash logs, and the Java version affected, to vuln-report@openjdk.org, using the PGP key published on the OpenJDK vulnerability group page for encryption. The report reaches the OpenJDK vulnerability group, which routes it to the relevant component team (such as the security group) for analysis and a fix before any public disclosure. _Anyone maintaining Java services can keep up with OpenJDK security process changes via daily.dev._ ## Similar posts on daily.dev - [Episode 71 “Security in Java” \[AtA\]](https://daily.dev/posts/episode-71-security-in-java-ata--jnchyyiyb) · Inside Java · 1 upvotes · 0 comments --- Tags: [#java](https://daily.dev/tags/java), [#quantum-computing](https://daily.dev/tags/quantum-computing), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/security-in-java-ata-inside-java-podcast-71-80t0lewpg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Security in Java [AtA] Inside Java Podcast 71","url":"https://daily.dev/posts/security-in-java-ata-inside-java-podcast-71-80t0lewpg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/security-in-java-ata-inside-java-podcast-71-80t0lewpg"},"datePublished":"2026-09-24T11:29:08.461Z","dateModified":"2026-09-24T11:29:30.669Z","description":"An Inside Java Podcast episode features Sean Mullan, lead of the OpenJDK security group and tech lead of Oracle's security libraries team, discussing how JDK...","image":"https://i.ytimg.com/vi/Hlth1BHTpLw/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/Hlth1BHTpLw/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Java (Official Oracle)","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Java (Official Oracle)","logo":"https://media.daily.dev/image/upload/s--SM9hIYUY--/f_auto,q_auto/v1773648791/logos/java-oracle?_a=BAMAMiiu0","url":"https://daily.dev/sources/java-oracle"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/security-in-java-ata-inside-java-podcast-71-80t0lewpg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"java,quantum-computing,cryptography","timeRequired":"PT33M","video":{"@type":"VideoObject","name":"Security in Java [AtA] Inside Java Podcast 71","description":"An Inside Java Podcast episode features Sean Mullan, lead of the OpenJDK security group and tech lead of Oracle's security libraries team, discussing how JDK...","thumbnailUrl":"https://i.ytimg.com/vi/Hlth1BHTpLw/sddefault.jpg","uploadDate":"2026-09-24T11:29:08.461Z","duration":"PT33M","url":"https://api.daily.dev/r/80T0LEwpg","embedUrl":"https://www.youtube.com/embed/Hlth1BHTpLw"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Java (Official Oracle)","item":"https://daily.dev/sources/java-oracle"},{"@type":"ListItem","position":3,"name":"Security in Java [AtA] Inside Java Podcast 71"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/security-in-java-ata-inside-java-podcast-71-80t0lewpg#faq","mainEntity":[{"@type":"Question","name":"What post-quantum cryptography algorithms has the JDK implemented so far?","acceptedAnswer":{"@type":"Answer","text":"The JDK has implemented three post-quantum algorithms: HSS/LMS, a one-time-use digital signature system released in JDK 21; ML-KEM, a quantum-resistant key exchange algorithm; and ML-DSA, a quantum-resistant digital signature algorithm, both standardized by NIST in FIPS 203 and 204 and added in JDK 24, with backports to JDK 17 and 21 planned for later that year. Track how JDK's post-quantum rollout evolves release by release on daily.dev before planning a TLS upgrade."}},{"@type":"Question","name":"How does JDK 27 handle post-quantum hybrid key exchange in TLS?","acceptedAnswer":{"@type":"Answer","text":"JDK 27 early access implements post-quantum hybrid key exchange as the highest-priority group offered during a TLS handshake, combining ML-KEM with a traditional elliptic-curve algorithm so the connection stays secure even if one of the two algorithms is later broken. If a peer server doesn't support the hybrid group, the connection falls back to whatever both sides support. Developers weighing TLS defaults for Java services can follow JDK 27's rollout details on daily.dev."}},{"@type":"Question","name":"How do I report a security vulnerability I found in the JDK?","acceptedAnswer":{"@type":"Answer","text":"Send an email with as much detail as possible, including a test case, crash logs, and the Java version affected, to vuln-report@openjdk.org, using the PGP key published on the OpenJDK vulnerability group page for encryption. The report reaches the OpenJDK vulnerability group, which routes it to the relevant component team (such as the security group) for analysis and a fix before any public disclosure. Anyone maintaining Java services can keep up with OpenJDK security process changes via daily.dev."}}]} ```