Transport Layer Security (TLS) v1.3 support in Java
summary
Java ships a TLS 1.3 implementation in JDK 11 that lands as about 54,000 lines (70k with tests), implemented under JEP 332 and enabled by default so the HTTP client uses TLS 1.3 default-enabled. It removes RSA key transport, SHA‑1, RC4, CBC modes, and DSA; it reduces handshake latency from two RTTs to one (with 0‑RTT experimental), introduces new cipher-suite names and key‑share behavior, and still lacks some optional pieces (ChaCha20/Poly1305 and X25519/JSS linkage) while offering compatibility switches and new debug output.
AI-written summary · about
chapters (15)
- 0:00Transport Layer Security (TLS) v1.3
- 2:12Network Stack
- 2:42TLS Cryptographic Fundamentals
- 4:18How TLS Operates
- 5:02SSL 3.0/TLS 1.0-1.2 Handshaking Messages
- 6:20SSL/TLS Historical Highlights
- 11:36How does TLS 1.3 differ from TLS 1.2?
- 12:12Enhanced Security
- 13:40TLS 1.0-1.2 vs. 1.3 Handshaking Messages
- 16:59Developed Under Java Enhancement Proposal (JEP) Process
- 19:33TLS 1.3 Features: Where Are We?
- 20:48Configuration Properties Existing & New System Properties to Override Enabled Protocol Detsuits
- 25:37Countermeasures
- 29:28Interoperability and Compatibility Testing
- 30:00TLS 1.3 Regression and interoperability Testing
related talks
39mEvolving the Security of the Java Platform
37mKeeping Your Java Applications Secure - Cryptographic Improvements and Best Practices
52mSecurity Control Enhancements
44mMaking the JDK More Secure
28mA Deep Dive Into Advanced TLS
45mFrom Java 17 to 21: A Showcase of JDK Security Enhancements
52mWhat's New in TLS 1.3
46mBeam Me Up, Java! A Journey through Java LTS Versions 11 to 21