We recently announced post-quantum cryptography support in wolfJSSE and wolfJCE, our Java JSSE and JCE providers backed by wolfSSL and wolfCrypt. Java applications can now use the CNSA 2.0 algorithms directly from the standard JSSE and JCE APIs!
What CNSA 2.0 Requires
CNSA 2.0 is the NSA’s Commercial National Security Algorithm Suite 2.0, the quantum-resistant algorithm suite required for National Security Systems. It specifies:
- ML-KEM-1024 (FIPS 203) for key establishment
- ML-DSA-87 (FIPS 204) for digital signatures
- AES-256 for symmetric encryption
- SHA-384 or SHA-512 for hashing
- LMS and XMSS (NIST SP 800-208) for firmware and software signing
New National Security System acquisitions must support CNSA 2.0 algorithms starting January 1, 2027, with exclusive use required by 2033. Vendors selling into that space, and the commercial industries that follow NSA guidance, need their Java stacks ready ahead of those dates. The full requirements and timeline are in the NSA’s CNSA 2.0 announcement and CNSA 2.0 FAQ. More background can be found in our more general post: https://www.wolfssl.com/nsa-announces-cnsa-suite-2-0/
CNSA 2.0 TLS 1.3 in Java with wolfJSSE
wolfJSSE plugs into the standard JSSE API (SSLSocket, SSLEngine, SSLContext, etc), so existing Java TLS code can move to CNSA 2.0 algorithms through configuration rather than a rewrite. With native wolfSSL built with –enable-mlkem and –enable-mldsa, wolfJSSE can be configured to negotiate TLS 1.3 with:
- SecP384r1MLKEM1024 hybrid key exchange, or standalone ML-KEM-1024 (add –enable-tls-mlkem-standalone)
- ML-DSA-87 X.509 certificate authentication
- TLS_AES_256_GCM_SHA384
Named groups are configured the same ways SunJSSE supports: SSLParameters.setNamedGroups() on JDK 20+, the jdk.tls.namedGroups System property, or the wolfjsse.enabledSupportedCurves Security property on older JDKs. Cipher suites are pinned the standard way, with setEnabledCipherSuites(). Our JUnit suite includes a composite CNSA 2.0 test (WolfSSLCNSA2Test) that stands up exactly this configuration, client and server, and is a good reference for wiring up your own application.
CNSA 2.0 Signatures and Key Establishment with wolfJCE
For Java crypto outside of TLS, wolfJCE registers ML-DSA-87 through the standard Signature, KeyPairGenerator, and KeyFactory JCA classes, and ML-KEM-1024 through KeyPairGenerator and KeyFactory on Java 8 and later, plus the javax.crypto.KEM API on JDK 21+. ML-DSA keys can be stored in standard keystores on JDK 24+ (JEP 497) or in our WKS KeyStore on any JDK. wolfJCE also provides LMS and XMSS signature verification for checking firmware and software signatures, matching the NIST SP 800-208 guidance that private keys for the stateful schemes belong in hardware. AES-256-GCM, SHA-384, and SHA-512 have been supported for some time already, which rounds out the suite.
Getting Started
The post-quantum support is in the master branch of wolfssljni and wolfcrypt-jni on GitHub now and will be included in the next stable releases. Both repositories ship example clients, servers, and ML-DSA certificates and keystores under their examples directories. wolfJSSE and wolfJCE can also be used with wolfCrypt FIPS 140-3.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now