Why Oracle is Bringing Post-Quantum Security to Java

Oracle has released Java 27 with nine JDK Enhancement Proposals (JEPs) focused on security, performance, developer productivity, and AI workloads. The release also advances Java’s post-quantum cryptography (PQC) capabilities with hybrid key exchange for TLS 1.3, while Oracle has previewed upcoming features in JDK 28, including Project Valhalla.

Java 27 introduces JEP 527, which adds post-quantum hybrid key exchange for TLS 1.3. Oracle says the feature is built to help protect sensitive data and business-critical communications against “harvest now, decrypt later (HNDL)” threats while allowing organisations to adopt new cryptographic requirements with limited application disruption. 

In HNDL threats, attackers steal encrypted data, store it in secure archives, and bet on future quantum computers to break the encryption.

The company says the capability is particularly relevant to enterprise AI systems that rely on secure communication between data services, models, agents, APIs, and cloud platforms.

In an exclusive interview with AIM, Donald Smith, Vice President, Java Product Management at Oracle, says the feature is the result of several years of work across Java releases, security standards, and third-party libraries. 

“It’s not a matter of just flipping a switch in the Java platform, and suddenly you’re post-quantum ready,” Smith quips.

The new capability lets Java applications securely exchange information with other hardware, operating systems, and applications ready for post-quantum cryptography. 

Java 27 Targets Quantum Transition

Java 27 delivers post-quantum hybrid key exchange for TLS 1.3, building on cryptographic algorithms and infrastructure introduced across earlier releases.

Smith says the implementation was built incrementally, with Java first adding the underlying algorithms, followed by key exchange, encapsulation mechanisms, and key derivation functions before reaching hybrid key exchange in TLS 1.3.

Oracle also plans to backport the capability to older Java versions. JDK 25 is expected to receive post-quantum hybrid key exchange for TLS 1.3 with the October 2026 Critical Patch Update, while JDK 21 and JDK 17 are expected to receive comparable functionality in the first half of 2027. JDK 11 and JDK 8 are targeted for the second half of 2027.

For enterprises, however, the upgrade is only one part of a broader transition. “Enterprises are undertaking post-quantum crypto readiness as a long-term project,” Smith says.

He notes some organisations have already been working on the transition for several years, with Java viewed as an early dependency because of its role in enterprise infrastructure.

Java Pushes Further Into AI

Beyond security, Oracle is continuing to position Java for AI workloads, with the company focusing on both integrating existing Java applications with AI services and running AI workloads natively in Java.

Smith highlights continued work on the Vector API, which helps developers process large volumes of data more efficiently. Oracle is also working on Project Babylon to extend the JVM for GPUs and other AI hardware.

The longer-term goal is to allow developers to write AI inference engines and models in Java while allowing the JVM to determine whether workloads should run on CPUs or GPUs based on their execution profile.

The approach intends to address the growing diversity of AI hardware. Smith says “write once, run everywhere” remains a central Java principle, with the JVM expected to help applications achieve suitable performance across different hardware environments.

Oracle is also continuing work on garbage collection and JVM scalability to support data-intensive AI workloads.

Improving Memory Density

One of the notable AI-related changes in JDK 27 is that compact object headers are now enabled by default.

Bernard Traversat, Vice President of Engineering for the Java Platform, says the change improves memory density, which can help large language models and inference engines operate at scale.

Java 27 also includes continued work on the Vector API and Project Valhalla to overhaul Java’s type and object model. Traversat says Valhalla focuses on value classes and reducing the distinction between primitive and object types, with the goal of improving memory density and primitive-like performance.

Oracle has already released JDK 28 early access, which includes a major milestone for Project Valhalla. The project focuses on improving the relationship between Java objects and primitives, including through value classes and objects that could benefit data-heavy workloads in areas such as analytics, financial services, scientific computing, and AI.

Oracle is also advancing Project Leyden, which focuses on startup time, time to peak performance, and memory footprint, including through ahead-of-time compilation.

The Java ecosystem is receiving aligned updates with the release. Helidon 27, Oracle’s open-source Java framework for microservices, now aligns its version numbering and release cadence with OpenJDK. 

Java’s Six-Month Release Cycle

Oracle remains committed to its six-month Java release cadence, which has been in place since 2017.

The company continues to develop Java in OpenJDK, with Oracle-led innovation happening throughout each release’s lifecycle. Each release also includes thousands of features, fixes, and enhancements beyond the JDK Enhancement Proposals that typically receive the most attention.

For Java 27, these include improvements to cryptographic algorithms, system administration, and diagnostics, along with continued performance work around the C2 JIT compiler and garbage collection.

Oracle is also maintaining older Java versions while developing new capabilities in the latest releases. The company refers to this as balancing the ‘tip’ of the platform, where innovation happens, with the ‘tail’ of older versions running in production.

Other Projects Remain in Development

Oracle is continuing work on several longer-term Java projects.

It is advancing Project Leyden, while also working on Project Detroit, which provides a native interface between Java applications and Python or JavaScript. Oracle already has production-level implementations internally and is working towards making them available as open source.

The project is also relevant to AI developers who frequently need to connect Java applications with Python and JavaScript libraries.

Oracle is also moving towards monthly Critical Security Patch Updates (CSPUs) for Java, alongside its existing quarterly CPUs. Smith says the change reflects the faster pace of vulnerability discovery and remediation, particularly as AI changes the security landscape.

The monthly CSPUs will target critical security fixes between the established quarterly updates. Customers will need to apply either the quarterly CPU or applicable CSPUs to remain on the security baseline.

Java Ecosystem Expands

Oracle is also expanding its Java Verified portfolio beyond the JDK to include commercially supported but open-source frameworks, libraries, and tools.

Helidon 27 will align with the JDK 27 release cadence. The microservices framework has added capabilities for AI applications, including LangChain4j integration and improvements around the Model Context Protocol (MCP), which can help developers integrate agents with Java applications.

Oracle is also continuing development of JavaFX and highlights growing interest in the framework over the past year. JavaFX 27 brings updates for interactive Java applications, including AI-powered analytics dashboards, operational consoles and data visualisation tools.

The company says JavaFX is also being evaluated for US government applications, where applications need to meet FIPS 140-3 requirements.

The Java ecosystem has also crossed 6 million downloads for its latest version-related distribution effort. The company is continuing to invest in Java community and education programmes, including technical resources for developers, administrators, and operations teams.