Key Points
- Java 27 introduces hybrid post-quantum key exchange for TLS 1.3 connections
- Nine JDK Enhancement Proposals included in the release for developers
- JDK 28 early access previews Project Valhalla for data-heavy workloads
Oracle has released Java 27, introducing hybrid post-quantum cryptography for TLS 1.3 connections alongside nine JDK Enhancement Proposals (JEPs) aimed at improving developer productivity and application performance for AI-enabled enterprise workloads.
The release, announced on Tuesday (15 September), adds quantum-resistant key exchange capabilities to the Transport Layer Security protocol, a cryptographic standard that secures internet communications.
The feature addresses what security researchers call ‘harvest now, decrypt later’ threats, where adversaries collect encrypted data today with the intention of decrypting it once quantum computers become sufficiently powerful.
Georges Saab, senior vice president, Oracle Java Platform and chair of the OpenJDK governing board, said the company was executing on a roadmap to bring comparable post-quantum capabilities to long-term support releases. This approach, Saab said, would help customers protect business-critical applications with less disruption.
Security features
The post-quantum security features in Java 27 include JEP 527, which implements hybrid key exchange combining classical and quantum-resistant algorithms for TLS 1.3. JEP 538, now in its third preview, improves handling of PEM encodings, a text format widely used for storing cryptographic certificates and keys.
JEP 536 adds data redaction capabilities to Java Flight Recorder (JFR), a diagnostic tool that monitors running applications, reducing the risk of exposing sensitive information during troubleshooting.
Arnal Dayaratna, research vice president for software development at IDC, said Java’s security and enterprise scale made it a critical foundation for AI agents requiring trusted access to business systems and sensitive data. The new post-quantum cryptography capabilities, Dayaratna added, strengthen Java’s position for organisations preparing for security threats in what he termed the ‘agentic era’.
By the numbers
Key figures from this story- 9 JEPs
- JDK Enhancement Proposals in Java 27
- 12th incubator
- Vector API iteration for AI workloads
- JDK 28
- Next version with Project Valhalla preview
For AI and data processing workloads, Java 27 includes JEP 537, the twelfth incubator release of the Vector API. This application programming interface accelerates analytics and AI inference by enabling developers to write code that takes advantage of processor-level vector operations without requiring specialised native code.
JEP 533, the seventh preview of structured concurrency, simplifies the development of applications that coordinate multiple parallel tasks such as model calls and data retrieval.
Performance updates
Two JEPs target runtime efficiency. JEP 534 enables compact object headers by default in the Java Virtual Machine (JVM), the software layer that executes Java applications, reducing memory overhead for existing applications running on the new version. JEP 523 makes G1, a garbage collector that automatically manages memory allocation, the default across all deployment environments.
Oracle is also previewing future innovations through JDK 28 early access. Project Valhalla, expected to enter its first major release phase in JDK 28, aims to bridge the gap between Java objects and primitive data types. The project targets data-heavy applications in analytics, financial services, scientific computing and AI by making data representation more memory-efficient.
Project Leyden, also under development, focuses on improving startup time and reducing memory footprint through ahead-of-time compilation, a technique that converts code to machine instructions before the application runs rather than during execution.
The release includes aligned updates across Oracle’s Java ecosystem. Helidon 27, an open-source framework for building microservices, now aligns its version numbering with OpenJDK and adds support for virtual threads, lightweight threads introduced in recent Java versions that improve scalability for concurrent applications. JavaFX 27 updates the client application framework with a new rendering pipeline for macOS and accessibility enhancements.
Oracle Jipher 20, which wraps a FIPS 140-3 validated cryptographic module for applications requiring federal security compliance, has been added to the Java Verified Portfolio. The module adds support for ML-KEM and ML-DSA, the post-quantum algorithms standardised by the US National Institute of Standards and Technology in 2024.
Oracle Cloud Infrastructure is the first cloud provider to support JDK 27, the company said.
Your Questions, Answered
What is post-quantum cryptography in Java 27?
Java 27 introduces hybrid key exchange for TLS 1.3 that combines classical encryption algorithms with quantum-resistant ones. This protects data against future quantum computers that could break current encryption methods.
How many JDK Enhancement Proposals are included in Java 27?
Java 27 includes nine featured JEPs covering security, AI capabilities, performance improvements and runtime efficiency, plus additional non-JEP updates for cryptographic performance and diagnostics.
What is Project Valhalla in JDK 28?
Project Valhalla aims to improve Java's handling of data-heavy applications by bridging the gap between objects and primitive types. It targets workloads in analytics, financial services and AI by making data representation more memory-efficient.
What cloud platforms support Java 27?
Oracle Cloud Infrastructure is currently the first cloud provider to support JDK 27, according to Oracle's announcement.
