Post-quantum cryptography (PQC) support has been added to wolfSSL’s Java providers! wolfJSSE, our JSSE provider built on the wolfSSL embedded SSL/TLS library, and wolfJCE, our JCE provider built on the wolfCrypt encryption engine, now include the NIST-standardized post-quantum algorithms along with the stateful hash-based signature schemes:
- ML-KEM (FIPS 203) key encapsulation with parameter sets ML-KEM-512, ML-KEM-768, and ML-KEM-1024
- ML-DSA (FIPS 204) signatures with parameter sets ML-DSA-44, ML-DSA-65, and ML-DSA-87
- SLH-DSA (FIPS 205) signatures with all 12 SHA-2 and SHAKE parameter sets
- LMS/HSS signature verification (RFC 8554) with all four hash families: SHA-256/256, SHA-256/192, SHAKE256/256, and SHAKE256/192
- XMSS/XMSS^MT signature verification (RFC 8391)
In wolfJCE the new algorithms are available through the standard KeyPairGenerator, KeyFactory, and Signature services, plus the KEM API on JDK 21 and later for ML-KEM. LMS and XMSS are verify-only, following the NIST SP 800-208 guidance that signing keys for stateful schemes stay in hardware.
On the TLS side, wolfJSSE can now negotiate ML-KEM key exchange in TLS 1.3. This includes the hybrid groups X25519MLKEM768, SECP256R1MLKEM768, and SECP384R1MLKEM1024, as well as the standalone groups ML-KEM-512, ML-KEM-768, and ML-KEM-1024 when native wolfSSL is compiled with –enable-tls-mlkem-standalone. wolfJSSE can also authenticate peers using ML-DSA certificates. Groups can be configured with SSLParameters.setNamedGroups() or the jdk.tls.namedGroups property.
To use the new algorithms, compile native wolfSSL with the matching options (–enable-mlkem, –enable-mldsa, –enable-slhdsa, –enable-lms, –enable-xmss). SLH-DSA requires wolfSSL 5.9.2 or later. Both projects can be cloned from GitHub here:
wolfSSL JNI/JSSE: https://github.com/wolfSSL/wolfssljni
wolfCrypt JNI/JCE: https://github.com/wolfSSL/wolfcrypt-jni.
Give the new algorithms a try and let us know how you are using post-quantum cryptography in your Java applications. Keep an eye out for future blogs on Java PQ examples and usage.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now