Making the JDK More Secure
summary
JDK 9 adds concrete security changes: SHA-3 message digests and a DRBG SecureRandom implementation, TLS improvements including OCSP stapling and DTLS 1.2, plus default PKCS12 keystores and the crypto policy set to unlimited so AES‑192/256 work out of the box. Defaults block SHA‑1-signed public CA chains (backported to some 8u builds), java.security properties list five disable/legacy settings, and AES‑GCM GHASH sees huge HS intrinsics speedups (tens to hundreds×).
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:37Program Agenda
- 1:56Making the JDK More Secure
- 3:14Java Security Components
- 7:04Making the DK Secure by Default
- 9:46Cryptographic Roadmap
- 14:37Disable SHA-1 Certificates
- 18:15Enable Unlimited Cryptographic Policy By Default
- 19:57Configuring the Restrictions
- 22:04Default Restrictions
- 22:51Restrictions Example
- 24:29JDK 9 Security Features
- 26:40Create PKCS12 Keystores by Default
- 28:52Leverage CPU Instructions for GHASH and RSA
- 29:36DRBG-Based Secure Random Implementations
- 31:55OCSP Stapling for TLS
- 35:01TLS Application Layer Protocol Negotiation Extension
- 36:20Datagram Transport Layer Security (DTLS)
- 38:24Other Module System Security Features
- 41:29Conclusion
related talks
52mSecurity Control Enhancements
37mKeeping Your Java Applications Secure - Cryptographic Improvements and Best Practices
45mFrom Java 17 to 21: A Showcase of JDK Security Enhancements
39mEvolving the Security of the Java Platform
40mMaximizing Security with JDK: Understanding Built-in Capabilities
40mJava Security Evolution - Out with the Old, In with the New
51mJava and Post-Quantum Cryptography
01h 01m55 New Features in JDK 9