"Security in Java" [AtA]

Given how prevalent Java is on web servers throughout the internet, security in Java is of critical importance. There's the security of the JDK itself, of course, which is overseen by the OpenJDK Security Group, which you should report JDK vulnerabilities to. But there are also the algorithms and features Java offers applications that are built on top of it and the cryptographic road map is an essential part of that development process. In recent years, post-quantum encryption has made big splashes but Java now also supports PEM texts and is considering the adoption of Argon2.

In this "Ask the Architects" episode of the Inside Java Podcast, recorded during JavaOne 2026, Nicolai Parlog talks to Sean Mullan, Lead of the OpenJDK Security Group and Tech Lead of the Oracle Security Libraries Team.

"Ask the Architects" is our podcast show, where we talk to experts in OpenJDK about their work on the Java language, API, and runtime.

Show notes:

• OpenJDK Security Group: https://openjdk.org/groups/security/
• Oracle JDK Cryptographic Roadmap: https://www.java.com/en/jre-jdk-cryptoroadmap.html
• Post-Quantum Hybrid Key Exchange for TLS 1.3: https://inside.java/2026/02/17/tls-post-quantum-hybrid-key-exchange/
• JEP 542 - PEM Encodings of Cryptographic Objects: https://openjdk.org/jeps/542
• JEP Draft for Argon2: https://openjdk.org/jeps/8377081