Evolving the Security of the Java Platform
summary
Java updates strong defaults and tools: TLS 1.0/1.1 are disabled by default (disabled April 2021), DTLS is disabled in JDK 20, and TLS 1.3 is the primary TLS version. Default keystore and cacerts move to PKCS12 (passwordless by default). Default key sizes increase (AES 128→256, ECDH/ECDSA 256→384), ChaCha20-Poly1305, XDH (x25519/x448), DRBG added, keytool/jarsigner now warn on legacy algorithms, JFR/monitoring events track provider usage, and planned APIs include Argon2id and KEM/KDF support.
AI-written summary · about
chapters (6)
- 0:00Start
- 4:07Java Security Components
- 5:46Java Security Provider Implementations
- 9:38The OpenJDK Security Group
- 14:33Guiding Principles
- 20:05JDK Security Configuration
related talks
45mFrom Java 17 to 21: A Showcase of JDK Security Enhancements
37mKeeping Your Java Applications Secure - Cryptographic Improvements and Best Practices
52mSecurity Control Enhancements
44mMaking the JDK More Secure
37mTransport Layer Security (TLS) v1.3 support in Java
40mJava Security Evolution - Out with the Old, In with the New
51mJava and Post-Quantum Cryptography
40mMaximizing Security with JDK: Understanding Built-in Capabilities