RELEASE NOTES: JDK 25.0.4

Thread Dumps Generated by HotSpotDiagnosticMXBean.dumpThreads and jcmd Thread.dump_to_file Updated to Include Owner of the Park Blocker

The thread dump generated by the [com.sun.management.HotSpotDiagnosticMXBean.dumpThreads] API, and the diagnostic command jcmd <pid> Thread.dump_to_file, now includes information about park blocker owner for threads that are parked on [java.util.concurrent.locks.AbstractOwnableSynchronizer] objects.

Add Support for the Latest ML-KEM and ML-DSA Private Key Encodings

The JDK now encodes ML-KEM and ML-DSA private keys in PKCS #8 format using the DER-encoded ASN.1 CHOICE formats defined in Section 6 of RFC 9935 and Section 6 of RFC 9881. Two new security properties (jdk.mlkem.pkcs8.encoding and jdk.mldsa.pkcs8.encoding) control the encoding used when generating new keys with a KeyPairGenerator or when translating keys with a KeyFactory. Valid values are "seed", "expandedKey", and "both" (case-insensitive). If a system property of the same name is also specified, it supersedes the security property value. All three formats are supported when decoding previously encoded private keys with a KeyFactory.

When these algorithms were introduced in JDK 24, the encoding format was equivalent to the "expandedKey" choice. This release changes the default to "seed". As a result, ML-KEM and ML-DSA private keys generated by this JDK release will not be accepted by older releases by default, although keys generated by older releases are still readable by this release. To make a new private key acceptable by older releases, set the relevant property to "expandedKey" and use KeyFactory.translateKey to convert it to the older format.

Add Support for the Latest ML-KEM and ML-DSA Private Key Encodings

The JDK now encodes ML-KEM and ML-DSA private keys in PKCS #8 format using the DER-encoded ASN.1 CHOICE formats defined in Section 6 of RFC 9935 and Section 6 of RFC 9881. Two new security properties (jdk.mlkem.pkcs8.encoding and jdk.mldsa.pkcs8.encoding) control the encoding used when generating new keys with a KeyPairGenerator or when translating keys with a KeyFactory. Valid values are "seed", "expandedKey", and "both" (case-insensitive). If a system property of the same name is also specified, it supersedes the security property value. All three formats are supported when decoding previously encoded private keys with a KeyFactory.

When these algorithms were introduced in JDK 24, the encoding format was equivalent to the "expandedKey" choice. This release changes the default to "seed". As a result, ML-KEM and ML-DSA private keys generated by this JDK release will not be accepted by older releases by default, although keys generated by older releases are still readable by this release. To make a new private key acceptable by older releases, set the relevant property to "expandedKey" and use KeyFactory.translateKey to convert it to the older format.

This change is planned to be backported to Oracle's JDK update releases that support ML-KEM and ML-DSA, so the interoperability impact is expected to be temporary.

Added WISeKey Global GB and GC Root CA Certificates

The following root certificates have been added to the cacerts truststore: ``` + WISeKey + wisekeyglobalrootgbca DN: CN=OISTE WISeKey Global Root GB CA, OU=OISTE Foundation Endorsed, O=WISeKey, C=CH

• WISeKey
• wisekeyglobalrootgcca DN: CN=OISTE WISeKey Global Root GC CA, OU=OISTE Foundation Endorsed, O=WISeKey, C=CH ```