RELEASE NOTES: JDK 17.0.21

ML-DSA Performance Improved

The performance of the ML-DSA key generation, sign, and verify operations has been improved significantly, 1.5 - 2.5 times depending on operation type and input, on the aarch64 and AVX-512 platforms.

ML-KEM Performance Improved

The performance of the ML-KEM key generation, encapsulation, and decapsulation operations has been improved significantly, 1.9 - 2.7 times depending on operation type and platform, on the aarch64 and AVX-512 platforms.

Added Support for the Latest ML-KEM and ML-DSA Private Key Encodings

The JDK now encodes ML-KEM and ML-DSA private keys in PKCS #8 format using the DER-encoded ASN.1 CHOICE formats defined in Section 6, "Private Key Format" of RFC 9935 and Section 6, "Private Key Format" of RFC 9881. Two new security properties, jdk.mlkem.pkcs8.encoding and jdk.mldsa.pkcs8.encoding, control the encoding used when generating new keys with a KeyPairGenerator or when translating keys with a KeyFactory. Valid values are seed, expandedKey, and both (case-insensitive). If a system property of the same name is also specified, it supersedes the security property value. All three formats are supported when decoding previously encoded private keys with a KeyFactory.

When these algorithms were introduced in JDK 24, the encoding format was equivalent to the expandedKey value. This release changes the default value to seed. As a result, ML-KEM and ML-DSA private keys generated by this JDK release will not be accepted by older releases by default, although keys generated by older releases are still readable by this release. To enable older JDK releases to accept ML-KEM and ML-DSA private keys generated by this JDK release, set the jdk.mlkem.pkcs8.encoding or jdk.mldsa.pkcs8.encoding property (whichever property is relevant to your use case) to expandedKey, and use KeyFactory.translateKey to convert the key to the older format.

Added Support for the Latest ML-KEM and ML-DSA Private Key Encodings

The JDK now encodes ML-KEM and ML-DSA private keys in PKCS #8 format using the DER-encoded ASN.1 CHOICE formats defined in Section 6, "Private Key Format" of RFC 9935 and Section 6, "Private Key Format" of RFC 9881. Two new security properties, jdk.mlkem.pkcs8.encoding and jdk.mldsa.pkcs8.encoding, control the encoding used when generating new keys with a KeyPairGenerator or when translating keys with a KeyFactory. Valid values are seed, expandedKey, and both (case-insensitive). If a system property of the same name is also specified, it supersedes the security property value. All three formats are supported when decoding previously encoded private keys with a KeyFactory.

The default encoding for newly generated ML-KEM and ML-DSA private keys is seed. Applications that require a particular private-key encoding can configure the relevant security property or equivalent system property.

SHAKE128-256 and SHAKE256-512 as MessageDigest Algorithms

Two new MessageDigest algorithms, SHAKE128-256 and SHAKE256-512, have been added to the SUN provider. These are fixed-length versions of the SHAKE128 and SHAKE256 Extendable-Output Functions (XOFs) defined in NIST FIPS 202. For more information, see The SUN Provider.

SHA3 Performance Improved

The performance of the MessageDigest implementations that belong to the SHA3 family (SHA3-224, SHA3-256, SHA3-384, and SHA3-512) has been improved by 6-27%, depending on digested message length and on the platform used. An additional 30-40% can be experienced on AVX-512 capable platforms due to new intrinsic implementations on that platform.

LuxTrust Global Root CA removed

The following root certificate has been removed from the cacerts keystore: ``` + alias name "luxtrustglobalrootca [jdk]" Distinguished Name: CN=LuxTrust Global Root, O=LuxTrust s.a., C=LU

```