Executive Summary
- Jipher 20 expands support for more versions of Java, including Java 17, 21, 25, and 27.
- Jipher 20 is now commercially supported for Java SE Subscription product customers through the Oracle Java Verified Portfolio.
- Jipher 20 introduces post-quantum cryptography algorithm support to the framework.
We are pleased to announce Oracle Jipher 20, the next major release of Oracle Jipher, a Java Cryptographic Service Provider for customers deploying Java applications in FIPS-regulated environments.
Jipher makes FIPS-validated cryptographic services available to Java applications through the standard Java Cryptography Architecture (JCA). Jipher 20 builds on that foundation with support for newer Java releases and establishes the next generation of Jipher for customers.
What’s new in Jipher 20
Jipher 20 introduces new cryptographic capabilities, adds support for newer JDK versions, and changes how Jipher accesses native OpenSSL libraries from Java. This release introduces several post-quantum cryptography (PQC) features for use in FIPS 140-3 and OpenSSL contexts. Please see the blog “Post-Quantum Cryptography in Long-Term Support JDK Releases” for more information on Oracle’s broader strategy for introducing PQC support to the Java platform.
Highlights include:
Post-quantum cryptography: Jipher 20 adds support for post-quantum algorithms standardized by NIST: ML-KEM for key encapsulation and ML-DSA for digital signatures. These capabilities help Java applications transition to post-quantum cryptography while continuing to use standard Java security APIs.
Key Derivation Function support: Starting with JDK 25, Jipher 20 supports the Java KDF service and HMAC-based Key Derivation Function (HKDF), including HKDF with SHA-256, SHA-384, and SHA-512. This allows applications to use Jipher’s HKDF implementation through the standard javax.crypto.KDF API introduced in JDK 25.
FFM-based OpenSSL integration: Jipher relies on native OpenSSL libraries to provide its underlying cryptographic implementation. Jipher 20 introduces a redesigned native-access architecture and, from JDK 25 onward, it uses the Java Foreign Function and Memory (FFM) API to interface with those native libraries.
Separate jipher-native package: In Jipher 10, native OpenSSL dependencies were packaged in the Jipher JAR. With Jipher 20, the native dependencies are bundled separately in a jipher-native-<platform> package. This clearly distinguishes Java components from native components and gives deployment environments explicit control over installing the appropriate native libraries for each platform.
Stricter FIPS-oriented defaults: Jipher 20 no longer enables certain legacy, non-FIPS PKCS#12 related algorithms by default, including HmacPBE* algorithms and PBEWithSHA1AndDESede. For applications that still depend on these algorithms, Jipher 20 provides an explicit compatibility option to enable them. However, since these algorithms are not FIPS-approved, enabling this option falls outside the FIPS 140-3 compliant configuration.
Together, these changes make Jipher 20 a new generation of the Java Cryptographic Service Provider rather than an incremental update to Jipher 10. Customers moving from Jipher 10 should review the Jipher 20 migration guide for deployment, configuration, and compatibility changes.
Jipher included in the Java Verified Portfolio
Jipher 20 is now included in Oracle Java Verified Portfolio (JVP).
The Java Verified Portfolio brings together Oracle-provided Java tools, frameworks, libraries, and services with clear support timelines and JDK compatibility information. Adding Jipher to JVP gives Java customers a more consistent way to identify supported Oracle components for their Java deployments.
Jipher 20 supersedes Jipher 10
With this release, Jipher 20 supersedes the Jipher 10 release.
Jipher 10 has enabled Java customers to deploy applications with FIPS-validated cryptography. Jipher 20 carries that support forward to newer JDK versions.
Customers using Jipher 10 should begin planning their transition to Jipher 20. Migration guidance and compatibility information are available in the Jipher documentation
Supported Java releases
Jipher 20 supports Oracle JDK 17, 21, 25, and 27 and later.
Jipher 20 support timeline
Oracle intends to provide commercial support for Jipher 20 on Java versions that are under Oracle Premier Support through at least September 2028. More details on JDK versions and commercial support can be found on the JVP Support Roadmap.
Supported platforms
Jipher 20 supports Oracle Linux 10, 9, and 8 on x64 and aarch64, macOS 26 on aarch64, and Windows Server 2025 on x64.
Moving to Jipher 20
Jipher 20 is the next major release for customers using Java in FIPS-regulated environments. It supersedes Jipher 10, supports JDK 25 and later JDK versions, and is commercially supported as part of the Java Verified Portfolio.
Existing Jipher customers should review the Jipher 20 migration guidance and begin planning their move from Jipher 10.