Episode 71 “Security in Java” [AtA]

Given how prevalent Java is on web servers throughout the internet, security in Java is of critical importance. There's the security of the JDK itself, of course, which is overseen by the OpenJDK Security Group, which you should report JDK vulnerabilities to. But there are also the algorithms and features Java offers applications that are built on top of it and the cryptographic road map is an essential part of that development process. In recent years, post-quantum encryption has made big splashes but Java now also supports PEM texts and is considering the adoption of Argon2.

In this "Ask the Architects" episode of the Inside Java Podcast, recorded during JavaOne 2026, Nicolai Parlog talks to Sean Mullan, Lead of the OpenJDK Security Group and Tech Lead of the Oracle Security Libraries Team.

Show Notes

• OpenJDK Security Group

• Oracle JDK Cryptographic Roadmap

• Post-Quantum Hybrid Key Exchange for TLS 1.3

• JEP 542 - PEM Encodings of Cryptographic Objects

• JEP draft for Argon2

Additional Resources

• dev.java: the destination for Java developers

• OpenJDK: the place to collaborate on the Java Platform and related projects

• Oracle Java: the #1 programming language and development platform

In our show "Ask the Architects", we talk to experts in OpenJDK about their work on the Java language, API, and runtime. For Inside Java Podcast episodes, check out the podcast page or our YouTube playlist. For more Java news, subscribe to our RSS feed and follow @Java on X.

Contact us.