Upgrading to JDK 27 switches TLS 1.3 handshakes to hybrid post-quantum key exchange

Oracle's wording is specific about who does nothing. Applications that use the javax.net.ssl APIs "will benefit from these improved algorithms by default, without change to existing code" ^[4]. The diff under review is a version number in a base image.

The announcement describes hybrid key exchange as combining a quantum-resistant algorithm with a traditional algorithm, and gives defence against future quantum computing attacks as the reason ^[3]. Both halves run in the same key exchange.

For the no-code-change claim to transfer to a given service, that service has to be taking the default. An application that sets its own named groups or its own SSL parameters keeps the behaviour it configured and picks up nothing from the upgrade ^[11].

The second default flip in this release affects deployments where the JVM used to choose for you. G1 becomes the default collector in all environments, and HotSpot will always select G1 unless the command line names another collector ^[5]. For the cases where the JVM previously selected Serial, Oracle says throughput, latency, memory footprint and startup time "should not degrade significantly" ^[6]. It is a prediction about a population of workloads, and it holds on yours only if your heap and startup path resemble the ones that were measured. Command-line selection still works, so pinning Serial remains available ^[5].

JDK Flight Recorder's new redaction covers command-line arguments and the initial values of environment variables and system properties ^[8]. A credential supplied as a system property is therefore absent from those initial values in a recording ^[13]. Separately, a new encoding API converts cryptographic keys, certificates and certificate revocation lists to and from PEM text and back into objects ^[9].

Four of the nine feature descriptions reach for AI: primitive types in patterns, lazy constants, structured concurrency and the vector API ^[10]. For the vector API the connection is concrete, since the point of it is compiling vector computations to vector instructions on supported CPU architectures ^[12]. Pattern matching on primitives easing AI integration is a sentence about the marketing calendar. The announcement does not identify which of the nine JEPs are the four preview features and which is the incubator feature ^[14].