Oracle Integrates Hybrid Post-Quantum Key Exchange for TLS 1.3 in JDK 27, Extending PQC Support to Key LTS JDK Releases by 2027

August 17, 2026

Oracle Blogs USA

Overview

Oracle announced that JDK 27, slated for General Availability in September 2026, will introduce JEP 527, adding hybrid post-quantum key exchange for TLS 1.3 with minimal application changes. This release provides foundational PQC capabilities for the Java ecosystem. Furthermore, Oracle plans to backport these critical features to earlier Long-Term Support (LTS) JDK releases, with JDK 25, 21, 17, 11, and 8 expected to achieve comparable PQC functionality by 2027, ensuring broad compatibility and security readiness across enterprise Java applications.

In Depth

Key Findings

Oracle has announced significant progress in enabling post-quantum cryptography (PQC) within its Long-Term Support (LTS) releases of the Java Development Kit (JDK). Specifically, JDK 27, set for General Availability in September 2026, will introduce JEP 527 to incorporate a hybrid post-quantum key exchange mechanism for TLS 1.3. This measure aims to simplify PQC enablement with minimal application changes, marking a crucial step towards securing the broader Java ecosystem.

Technical Details

JEP 527 adopts a hybrid key exchange approach, combining classical Elliptic Curve Cryptography (ECC) with the quantum-resistant Key Encapsulation Mechanism (KEM) Kyber algorithm. This hybrid design is intended to maintain current security standards while adding resilience against future quantum computer attacks, acknowledging that Kyber’s PQC has not yet been fully battle-tested. Should unexpected vulnerabilities be discovered in PQC algorithms, the classical ECC component will continue to provide a security baseline. This allows enterprises and developers to gradually transition to PQC while ensuring long-term security.

Beyond JDK 27, Oracle plans to backport these PQC capabilities to existing major LTS JDK releases, including JDK 25, JDK 21, JDK 17, JDK 11, and even JDK 8. These backports are anticipated to be completed by 2027, ensuring that a vast array of legacy systems and currently deployed applications can benefit from PQC with relatively little effort.

Background and Context

The evolution of quantum computers is predicted to enable the breaking of widely used public-key cryptographic systems (such as RSA and ECC) within seconds, a threat known as “quantum threat.” To counter this, the U.S. National Institute of Standards and Technology (NIST) has been standardizing post-quantum cryptographic algorithms, with Kyber being one of the selected candidates. Oracle’s implementation of PQC in JDK is critically important for global cybersecurity infrastructure, given Java’s widespread use in enterprise applications, cloud services, and mobile devices.

Strategic Significance and Outlook

Oracle’s initiative is essential for preparing the Java ecosystem for the quantum era. By providing PQC capabilities across major JDK releases, developers can more easily build secure applications, and existing systems will be protected from future threats. This will strengthen the security foundations in many industries handling sensitive data, such as finance, healthcare, and government agencies, and serve as a powerful driving force to accelerate the transition to a quantum-resistant society.

Source: https://blogs.oracle.com/java/post-quantum-cryptography-in-long-term-support-jdk-releases

Get our weekly technology intelligence — free

Receive an infographic that lets you judge at a glance whether each field’s analysis report is worth reading.

Subscribe Free — Weekly Tech Intelligence

By subscribing, you’ll receive Troy-Technical’s weekly technology intelligence newsletter.