"Security in Java" [AtA]

Given how prevalent Java is on web servers throughout the internet, security in Java is of critical importance. There's the security of the JDK itself, of course, which is overseen by the OpenJDK Security Group, which you should report JDK vulnerabilities to. But there are also the algorithms and features Java offers applications that are built on top of it and the cryptographic road map is an essential part of that development process. In recent years, post-quantum encryption has made big splashes but Java now also supports PEM texts and is considering the adoption of Argon2.

In this "Ask the Architects" episode of the Inside Java Podcast, recorded during JavaOne 2026, Nicolai Parlog talks to Sean Mullan, Lead of the OpenJDK Security Group and Tech Lead of the Oracle Security Libraries Team.

"Ask the Architects" is our podcast show, where we talk to experts in OpenJDK about their work on the Java language, API, and runtime.

Show notes:

OpenJDK Security Group: https://openjdk.org/groups/security/
Oracle JDK Cryptographic Roadmap: https://www.java.com/en/jre-jdk-cryptoroadmap.html
Post-Quantum Hybrid Key Exchange for TLS 1.3: https://inside.java/2026/02/17/tls-post-quantum-hybrid-key-exchange/
JEP 542 - PEM Encodings of Cryptographic Objects: https://openjdk.org/jeps/542
JEP Draft for Argon2: https://openjdk.org/jeps/8377081

Denne episoden er hentet fra en åpen RSS-feed og er ikke publisert av Podme. Den kan derfor inneholde annonser.

Episoder(71)

"AOT Caching - Netflix' Practice vs OpenJDK's Theory" [I/O]

Java projects that want to reduce their launch times need to look into Java's new ahead-of-time capabilities. A training run is used to populate a cache that, in production, allows the JVM to short-ci...

17 Sep 1h 11min

"Declassifying the Java 27 Release!" [IJN]

Java 27 is heading for release on September 15th. As with every release of the JDK there are a host of changes that will impact developers, from new features, to changes in behavior of existing featur...

10 Sep 15min

"Operator Overloading with Type Classes" [AtA]

OpenJDK's Project Valhalla is improving Java's support for custom numerical types. That goes beyond value types and also encompasses explorations into operator support. While Java is extremely unlikel...

27 Aug 41min

"Keeping Up with the Java Release Train" [I/O]

20 Aug 34min

"JSON API, Valhalla Progress, LTS ❤️ PQC" [IJN]

JEP 540 proposes to incubate a simple JSON API and is currently proposed to target JDK 28. The pull request for Project Valhalla's JEPs 401 and 539 were merged and value types are available as a previ...

15 Aug 10min

"Embracing Virtual Threads with Helidon" [I/O]

Helidon 4.4 was released in April 2026 and stands out from other web frameworks by embracing new Java features as early as possible, particularly virtual threads and ahead-of-time computation. It is a...

6 Aug 14min

"JIT Compiler From the Ground Up" [AtA]

While Java programs are deployed as bytecode, performance-relevant code will be compiled, at run time, to machine code whose performance rivals that of any other platform. In the HotSpot JVM, this is ...

30 Jul 45min