Oracle Java 27 livre un échange hybride de clés post-quantique pour TLS 1.3

Oracle announced the general availability of Java 27 on September 15, 2026. Among the nine JDK Enhancement Proposals in the release, JEP 527 adds post-quantum hybrid key exchange to TLS 1.3, pairing a classical key agreement with ML-KEM so that a session stays protected even if one of the two is broken. Oracle also released Jipher 20, its FIPS 140 cryptographic provider, with ML-KEM and ML-DSA support, and says it is executing on a roadmap to bring comparable capabilities to long term support releases.

Java runs a large share of the enterprise and carrier back office, including billing, provisioning and network management systems that sit behind the firewalls Fabric sees on the wire. A runtime that negotiates hybrid post-quantum TLS by default moves a whole class of application traffic out of harvest now, decrypt later exposure without a rewrite.

Our take

You can't fix what you can't see, and a platform upgrade is one of the quieter ways exposure changes. When Java 27 lands in your estate, the TLS sessions it opens will look different on the wire, and the ones it cannot upgrade will stand out. That is exactly the kind of observed evidence a cryptographic bill of materials should capture. Long lived equipment, long lived secrets: the application layer moving first does not help a router that still terminates classical VPN tunnels. Start your Discovery Program and know which is which.