Serguey Asael Shinder: JDK 27 brings post-quantum hybrid key exchange to TLS 1.3
JDK 27 was released on 15 September, and the security notes name two changes worth knowing about even if you never touch a KeyStore by hand.
JEP 527 adds post-quantum hybrid key exchange to TLS 1.3. It builds on the ML-KEM algorithm that arrived in JDK 24 and combines a traditional key exchange with a post-quantum one, so the handshake stays secure as long as either of the two holds. Oracle's write-up names the threat it addresses directly: harvest now, decrypt later — traffic captured today and decrypted years from now when the machine to do it exists.
JEP 538, the PEM API, reaches a third preview. PEMEncoder and PEMDecoder encode and decode certificates, CRLs and private keys to and from PEM, which until now has meant hand-rolled base64 and header parsing in most codebases. Both can be configured for encryption, so a private key can be encrypted and encoded in one step. One rename to watch: the DEREncodable interface is now BinaryEncodable, and X509Certificate and X509CRL have been retrofitted to implement it.
Full notes: https://inside.java/2026/09/16/jdk27-security-enhancements/
What this means in practice
The hybrid key exchange is the one that matters, and it is not urgent for the reason people assume. No quantum computer is breaking your TLS this year. The point of a hybrid scheme is the recording happening now: anything an adversary captures today sits on a disk until decryption becomes cheap, so the value of switching is proportional to how long your traffic stays sensitive. For a session cookie, minutes. For a document you transmit once and must keep confidential for a decade, the calculus is completely different — and that is the traffic to move first.
Two practical notes before anybody plans a migration:
- Both ends have to agree. A hybrid group is negotiated; a JDK 27 client talking to a server that does not offer it falls back silently to a classical exchange. Whatever you change, verify at the handshake level rather than by reading version numbers.
- Preview means preview. The PEM API is behind
--enable-previewand has already renamed a public interface between previews. Fine for a tool you rebuild whenever you like; not fine for a library other teams compile against.
And the boring one: JDK 27 is a feature release, not an LTS. If your production images track a release line by habit rather than by decision, this is the week to check which line they are actually on.