Java 27: Post-Quantum TLS and Faster Runtimes | Bernard Traversat, Oracle | TFiR

Swapnil Bhartiya: As we all know that Java still powers much of the enterprise backend, but two shifts are testing that position. AI agents need a runtime that is fast, secure and observable at the same time. Quantum computing is threatening today’s encryption. Oracle announced Java 22. Oracle announced Java 27 that ships with answers to both including post quantum key exchange for TLS 1.3 and runtime updates built for AI era workloads. And to walk us through what’s new and where Java goes next, today we have with us Bernard Trevorset, Vice President of Java Platform Software Engineering at Oracle. Bernard, it’s great to have you on the show.

Bernard Traversat: Hey, great meeting you again.

Swapnil Bhartiya: It’s my pleasure. Let’s start with the release itself. What are the most notable features and capabilities that Java 27 is bringing to the users?

Bernard Traversat: If I’m looking at 2027, what I would say is that we have kind of and typically we do that across all the six month release. So first 27 is one of our six months release. You know that we change our catal where we are releasing Java every six months and then every two years we do elect one of these six months release to be a long term supported release. So on 27th there are kind of, I would say three main area of investment. The first one which is all around the continued investments that we are making on the Java platform, around making the platform and the JVM more efficient. And so in 27 we have been working for some time on a feature that we call Compact Header. So as you know, Java has these perceptions to be very angry in terms of memory usage. That’s because in the representation of Java Object we need to add a header which is basically allocated with every object. And with the Compact headers we are kind of reducing significantly from 96 bit to 64 bit those headers which mean that without any modification of your applications, you’re going to be able to reduce the overall heap usage by and of course it’s going to depend on your applications by potentially up to 20 25%. And so in 27 now this feature is a default, which means that you don’t have to pass an optional VM argument to be able to enable the VM into this mode. It’s something that now every developer would be able to use. We feel that this feature has been tested, debugged and is production ready for our enterprise customers to be able to deploy these features in full productions. Another significant step forward with 27 is all around post Quantum computing. As you know, beyond AI, clearly the Enterprise is talking about AI. The second main area of interest and concern by most of our enterprise customers is around security and the post quantum computing and how basically you can protect your data today knowing that maybe there is not yet post quantum computers that can decrypt current algorithm. But it’s very important for the entire industry to kind of start to move into this place and deploy those more secure protocol. So we’ve been working in post quantum for now almost five years and what we have done it is kind of starting to build the best foundations, meaning that ensuring that we have the right encoding, the right digital signatures, the right way to do the private key encoding and that’s something that we deliver over the past couple of years. But now with 27 we kind of adding the last block if I want to present it in this way, which is JEP 527, which is a post quantum hybrid key exchange for TLS 1.3. So as you know the vast majority of the enterprise world, when you are establishing secure communications, you’re going to use a TLS protocol and most likely you want to use a TLS 1.3 because that’s the most secure protocol. So with JDK27 now you will be enabled to establish TLS 1.3 connections using post quantum encryptions. And so that’s kind of at that point basically and it’s separate because there is still some amount of key exchange that will involve some elliptic curve encryptions, but the rest will use the MLChem MLDSA protocol for encrypting the data that is going on over the wires. So that’s such an important step forward because we are now providing in the end of our enterprise developers the abilities to start to move their existing workload under inner pqc. Now the nice things about this feature is that you don’t have to completely rewrite your entire applications. And that’s kind of the value that Java has provided over the years, which is a stability of API. So in fact the way for an enterprise applications to switch from elliptic curve full encryptions on TLS to PQC is just a single properties that you are moving in new orders of which protocol you want to use. When you establish TLS connections, then by putting post quantum protocol, you know the encryption at the top, then that’s basically the first encryption that will be used to establish communication between your server and or server between your clients for teams.

Swapnil Bhartiya: Of course everybody is running Java in production. What changes in a developer’s day to day work they will experience with 27.

Bernard Traversat: So it’s going to get faster. This is something that, as I mentioned, that we continue to improve because if you look at the 27 at the high level, there is nine larger features, we call them the JDK enhancement process which is coming from the development that we are doing in OpenJDK. But beyond it there is more than 3,000 smaller investment bug fixes, performance improvement that are part of 27. And so what you are getting it is improved productivities improve with some of the work that we are continuing to do on the language side, better performance with the continued work that we are doing on improving the git compilers in OC2 as we are discussing with compactators, improving the density of your application. So you can basically and when all this work is done without any cut change to your applications, by just running on a new version of the JVM and the Java platform, you’re going to get all this efficiency. Another set of capabilities that I should mention also that we are introducing in 27 is around our Java Fly Recorder. You were mentioning serviceability, something that of course is very essential and important for our enterprise customers. So we are starting to look at how we can ensure that all the traces so JFR gives you basically these abilities to record a number of very important events that are occurring on the JVM for you to either better understand how you can better tune the JVM or in some case when you have a crash to try to kind of reconstruct the few events that occur before the JVM crashed. And so there is a lot of data that is being collected by GFR. And so those traces what we are introducing in 27 because of security concern, we want to remove any sensitive informations related to the data that may be used in terms of parameters that contain maybe username parameters that might contain IP addresses. You don’t need this information to understand what was happening on the jvf. So this GAPP is kind of starting to remove all the unnecessary potentially sensitive data from the GFR recording because we know that those recordings tend to move into different system may move into a developer desktop for the user, for the developer to kind of understand what is going on. And finally also I should also mention the work that we are continuing to do around AI, making sure that we are kind of moving the Java platform and the JVM as a premier execution runtime for SIMD GPUs. And so with the, the JEP 537 and the Vector API, we’re kind of providing to our developers High level abstractions, they don’t have to go and write down at the very lowest level to take advantage of those new GPUs or SIMD capabilities.

Swapnil Bhartiya: Let’s talk about the big elephant in the room these days which is AI agents. As we all know that AI agents are already in not moving. They are inside enterprise business systems, they’re autonomous, they are taking actions on users behalf. What in Java 27 makes it a strong or stronger foundation for that kind of agentic workflow.

Bernard Traversat: So you know one area that is going to be extremely important with agents is, and I’m sure you have heard about it, it is the orchestrations. That means you’re going to have a lot of agents doing and trying to orchestrate, interact to provide information which at the end would be combined to hopefully get you the answer that you want. In this model there are a number of foundation mechanism that we have built in the platform over the years. The first one is ensuring that we have the abilities to start very quickly. And so we have made investment with project laden and there is improvement that are coming in 27 to improving the startup because you want basically agents to be startup on the fly. You don’t want to run them all the time. It’s just as a response to something that’s happening. You want to be able to start an agent fairly quickly. The second thing that we are doing is continuing to ensure that you can run those agents with a priming model around concurrency that is simpler to explain. And that’s all the investment that we have made around virtual threads where we kind of shifting from this very complex reactive and asynchronous model where the developers has to do a lot of work to ensure that, you know, the asynchronous part of the priming require you to go and check is my task was completed or not with virtual thread. Now we have moved the concurrency model back to the original visions for the Java platform which was all around blocking model. Well now you can create as many virtual thread as you want. Virtual threads are very cheap. And then underneath the JVM can basically understand that this virtual thread is not going to make progress until a piece of data is arriving. So I’m going to switch a physical thread to run on a different virtual thread. And all this scheduling is being done underneath by the JVM. And then on 27 we are continuing to make progress on what we call structure concurrency, which is think about the places or world where you have thousand, ten thousand of those agents interacting with each other. You really want to Have a programming model that can structure the concurrency, the interactions and the orchestration of all those AI agents. And that’s what the structure concurrency improvement that we’re making on 27 will enable people to write all those agents, provide the abilities of our ecosystem to build third party framework for developing agents on very sound foundations. And I should say that we have been working very closely with the Eliden team, which is one of the App server that wasn’t the first App server on the market that fully embraced virtual threads as the foundations of how to serve applications running on Eliden. And so that’s a fantastic platform for developing AI agents. And of course there are a lot of very nice projects that are being developed within the Java ecosystem like for example langchain4j that basically move a lot of those current or I will say previous model that, that were using Python or different languages and moving basically the abilities from the Java language exposing API that let you connect, configure different LLM models. And again here this is something that we have seen over the years. One of the mantra that Java gave to the Ontario ecosystem was the curations of building the right set of API. Which means those API design is very important because if you do a good job, that means that moving forward when the developer writes to those APIs and there is different technology, different implementations that occur, the developer don’t have to reprogram the API underneath. The implementation of those APIs will enable to take advantage of new capabilities, new LLM models. And so that’s one of the very nice things about LLC, the LangChain 4J project, which is just by different configuration you can switch models and of course every model has different set of API that they are providing. But LangChain provide basically a generic umbrella API to be able to interact with all those different models.

Swapnil Bhartiya: You already talked about Java 27’s preparedness for post Quantum. How much awareness is there within? Because I talk to a lot of folks, some folks are like yes, this is important, we are doing some folks, yeah, this is a lot of discussion, but we are not focusing on it now. The problem is if you have any data which is like 10 years old or it will be relevant 10 years from now, it’s already compromised because they have already harvested it. So talk a bit about the preparedness and how much awareness are you seeing in the market for post quantum key exchange?

Bernard Traversat: It’s a massive awareness. I think that and I’m sure you have seen security for cloud infrastructures where there is a lot of more centralization that we have seen in the past and Oracle is really at the forefront both in terms of what we are doing within our OCI cloud infrastructures that has been designed with security as a first principle. And of course that’s something that aligns very well with what we are doing with the Java platform here. But the concern, as you say it, is that today people can start to record, harvest all this data and then at some point in the near future, still some question mark in the past few years, the sense was okay, well we are still five years, 10 years from reaching that point. I think now there is border concern that we are getting closer and closer, closer. So that’s why virtually all enterprise now are putting in place plan to deploy as quickly as possible PQC encryptions. And that’s basically what we are doing here with the Java platform which is first introducing the base mechanism as I was describing with the hybrid key TLS now so you can establish those connections through PQC. And we’re doing that on 27. But as we have done in the past, we want to ensure that all our customers, independently of which versions of the Java platform they are using, clearly we want them to be on the latest possible versions, which is the latest long term supported release is JDK25. What we are doing it is basically doing the backport of the PQC capabilities that will be available on 27. We’re going to make it available on 25 in the upcoming October CPU which is coming up very shortly. And then also we are committed to backport to 2117 and even up to 8, because we know that it’s so important that for some of our key enterprise customers that are still running some very important workload on 8, that we provide them basically security. And that’s something that we have done over the years, basically making sure that we are taking care of the entire Java ecosystem, even if they are running on older release of Java, providing them the kind of security. And that’s part of what Oracle, as part of our enterprise subscriptions, universal subscriptions, we’re kind of providing the support to our key customers, providing them the best capable and secure Java.

Swapnil Bhartiya: And that also makes me wonder in a way when you explain that about releases. Many teams have standardized on LTS releases like Java 25. What’s the case for picking up Java 27 before the next LTS arrive? Who would you recommend should try it or who you recommend to ignore it?

Bernard Traversat: Very good. Very, very, very good question. So what we have seen since we kind of started to introduce the six months release and then the LTS as you say it is starting to see enterprise. As there is more automations in the cloud with CI CD system, people will start to say that okay, I only want to run in production on an LTS release, which makes a lot of sense now saying that any of our six month release goes through the same level of testing that LTS releases. It’s just the main difference it is they are not supported for a shorter period of time. But what we are seeing it is a lot of the customer now through Automations they will basically start to create a new build of their software running on the new versions of the jdk. Even if they don’t deploy it in production, it’s kind of giving them time to understand some of the changes in some case some of the benefits. So by the time we are releasing the next lts they are ready to deploy it in a quick, you know, quickly because they have done all this internal testing from the multiple 6 months releases until the next LTS releases and in fact, you know, that’s enabled them. And that’s something that I will, and I will say in the case of pqc, it’s so important that we have those enterprise start to understand, you know, the different behaviors that the enterprise application and workload will have when they’re running under PQC encryptions. Because there is no secret in some way what the PQC encryption is doing. It is using much larger keys and guess what? Much larger keys mean that there is more processing that need to occur, which means that your application is going to have to spend a bit more time processing all those encryptions that may in some case unbalance your application and it may take you some time to retune your applications to fully take and find out basically the optimum configurations for the workload that you are running. And by providing now the six months release we can give enterprise can go and start to play, can start to understand what will require for them to deploy in productions. You know, PQC, which means by the time we have the next LTS, which is JDK 29, they will be ready to deploy it in production.

Swapnil Bhartiya: Now if we just look beyond this release, since you mentioned community, what are Oracle and the global Java community people may not realize but you know, it’s you know, massive community because Java is being used where you may not even imagine, right? Small devices, cars, you know, of course enterprise is big there as well. Can you talk about what things are you folks working on right now that developers should be watching or excited about

Bernard Traversat: the big one is you may have heard us talk about project VARA over the past 10 years and we are so excited that in GDK 28 we will have the first preview of value Classes. And the Value Classes is a massive advance for the Java platform because we’re going to address these fundamental dualities that we had since the initial implementation of Java, which is this, these two worlds of primitive type and object type. And basically developers over the past 30 years, they had to make these decisions. Do I want performance so I have to use a primitive type or do I want to take advantage of the object oriented identities? All the good things around what the class can provide you. Now with Project Vahana, what we are doing is we are kind of unifying this programming model where now developers will be able, they will not have to choice between primitive type and an object. They will be able to say, hey, I want this class, I want to use a class because identity is something that is important to me, but I want the most performance that I was getting from primitive type. And that will enable us to have much efficient representations, increase density which means better cache, improve or reducing the cache misses. When you are running on advanced computers it’s also the place that will enable developers to define new type, which is something that is going to be very important for AI as we start to see people starting to re implement inference model in Java. So with Project Vahana you will have the abilities to go and define a new data representation. For example, as you know, you may have seen that the initial LLM model were using 64 bit. They realized that I don’t need all this precision so they moved to 32 bit, they moved to 16, they moved to 8. With Project Vana, developer would be able to define whatever representation they want, maybe four bit, two bit, whatever, and write that once. And as hardware come up then the JVM will be able to take advantage of advance in macro architecture that will support new set of instructions or representations to be able to optimize as best as we can the executions. So it’s a major step forward that we’ll be delivering in 28. Kind of continue to move the Java platform into a place where performance is getting closer and closer to native runtime, but of course getting all the benefit that the Java platform is providing. So that’s one area, the second key area and is project Babylon and hat, which is the code reflections. And that’s something that we believe is going to put Java at the center of the next generation of AI system because what we are seeing on the hardware level is the emergence of what people call hybrid system. Well, basically you see that with Nvidia, with the VERA ribbon system, where you are kind of fusing CPUs on the same memory board, MDM doing the same. And so the grand challenge now with those architectures, it is that you need to figure out if you’re a compiler, what is the right place to execute your code. Should you execute it on the GPUs or should you execute it on the CPU? And one of the big advantage that Java has is with the jvm because the JVM is doing kind of, you know, this profiling. So we do this profiling and then what we have is we have a dynamic compiler that can understand what your application is doing. And with Project Vahana we’re now providing, we’ll provide the capabilities to basically transform the code executions to fit the executions to run on the GPUs for maximum efficiency or on the CPU for maximum or less power consumptions. And so at the end the VM will be able to manage, ensure optimum performance. But more importantly the best use of all the hardware available today. If you look at lot of the workload either they tend to use a lot of GPUs which means the CPU is idle most of the time. And that’s kind of an efficiency problem because you still power the CPUs it’s capabilities that you are not taking fully advantage. And so with Project babydon and HAT working with the GPU vendors, we are really looking to put in place the next generations of executions with both optimum performance and and more importantly optimum efficiencies on those hybrid CPU GPU systems.

Swapnil Bhartiya: This also leads me to one more question which is so much is happening around so it’s really hard to keep an eye on things. I mean of course you folks are. But looking at the broader software industry, broader trends that are going on, which trends are shaping what gets built into Java. Because Java no offenses to anybody, so don’t get upset about it. But when I look at Java, when I look at, even if you look at Mainframe, those are very, very old technology, but they are critical to the modern infrastructure. You cannot think about any transactions without Mainframe. You can call that, oh no, those are Linux. Look at the Linux kernel and you folks are invested heavily in the Linux 30, 40 years old technology. Same thing with the Java as well. But talk a bit about. Because you folks stay where the customers. This is not becoming a technology which has become Mentioned like Flash and has been discontinued. No, it is. So talk about what trends that you folks are also monitoring which are shaping what gets built into Java next.

Bernard Traversat: So I will point you and we will send you a pointer. There is a great keynote that Ron Pressler just did at devox Belgium here. So what we are seeing and what we are believing it is clearly AI is going to fundamentally change the way we are developing software. And even us internally, we are leveraging as best as we can in the right place AI. But what AI is really doing, it’s going to reduce the cost to generate code. No doubt about it. That means you keep hearing it, there’s going to be a lot of code is going to be generated by AI. But the sense that we have it is that the Java platform has always been two things, the Java language and then the Java runtime. And we believe that the edge of AI is going to be the edge of the runtime because the runtime will provide two fundamental things that AI need, which is compilers that can guarantee and ensure the security of the executions. That means when you send some code, the compiler with you know, like the type system will be able to detect that hey, okay, you’re trying to pass the wrong type. And that’s something that is going to be so important because we can advance, you will see more advanced compiler that will try to verify that the code that is being generated by all those LLM system or frontier models is correct or doesn’t do things that was not specified as part of the specifications. And the second part of the runtime, which is also essential, which is the efficiency, you want a runtime that would be able to efficiently, at the low cost, low cost of powers at the scale those data centers are running, used all the possible hardware with the best optimized execution efficiencies. And so that’s why runtime and the JVM we believe is one of the most sophisticated and also well positioned to be able to be so relevant in the hedge of AI.

Swapnil Bhartiya: Bernard, thank you so much for walking us through Java 27 and we are the platform goes from here. Thank you for your time today and I look forward to chatting with you folks again.

Bernard Traversat: One thing I should I forgot to mention it is that we’re gonna have Java 1 next year. So if you have the chance, we love to see you, love to see you at Java 1.

Swapnil Bhartiya: Of course we will be at Java 1 again. And Bernard, thank you so much for your time and I look forward to another great discussion with you. And for those who are watching. You can dig into [email protected] Java and once again, thanks for watching.