Keeping Your Java Applications Secure - Cryptographic Improvements and Best Practices
summary
Java adds concrete crypto features (SHA-3, RSA-PSS, TLS 1.3, ChaCha20-Poly1305, X25519/X448, EdDSA) across JDK 9–15 and backports key items to 8u251/8u261; the roadmap restricts several elliptic curves in October, disables SHA-1-signed jars next April, and plans to stop enabling TLS 1.0/1.1. Tools warn or log weak usage: keytool and jarsigner emit warnings, Java Flight Recorder records TLS events, and applications can override via java.security.properties. Secure coding: avoid Java deserialization, use serialization filters or allowlists, run static analysis and OWASP ZAP and dependency-check.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 0:20Safe Harbor Statement
- 0:36About the speakers
- 1:10Agenda
- 2:27Java Security
- 4:11Motivation
- 5:17Categories
- 5:46Strong Algorithms
- 8:07Strong Defaults
- 8:33Examples
- 9:32Restrictions
- 10:30TLS Server
- 11:35Warnings Events
- 11:51Key Tool
- 12:38Charge Timer
- 13:08Java Flight Recorder
- 13:39Flight Recorder
- 13:58Java Crypto Roadmap
- 14:47Secure Programming Best Practices
- 15:06Eliminate Avoid Vulnerabilities
- 17:15Secure Coding Starts With Training
- 22:05Secure Coding Guidelines
- 23:59Injection and Inclusion
- 25:54Serialization and Deserialization
- 29:45Questions
related talks
52mSecurity Control Enhancements
39mEvolving the Security of the Java Platform
44mMaking the JDK More Secure
45mFrom Java 17 to 21: A Showcase of JDK Security Enhancements
51mJava and Post-Quantum Cryptography
50mMaking the Future Secure with Java
48mSecure Java Applications against Quantum Threats
37mTransport Layer Security (TLS) v1.3 support in Java