Topic Thread
3 published observations tracking this thread.
Java 27's most consequential security change is JEP 527: hybrid post-quantum key exchange for TLS 1.3. Because the release also changes runtime defaults and includes preview features, teams should evaluate it as both a cryptography milestone and a normal runtime upgrade.
Cloudflare's 1.1.1.1 resolver can now validate ML-DSA-44 DNSSEC signatures. The important signal is not that DNS is suddenly quantum-safe, but that operators can now measure what 2,420-byte signatures do to the DNS transport and trust chain.
The interesting part of Cloudflare's post-quantum rollout is not a new cipher. It is the decision to learn an origin's capabilities once and use that information to avoid slow TLS retries at scale.
