Hi Mickael, thanks for opening the KIP and starting such discussion. > Named groups are how the JVM describes TLS key exchange schemes. APIs to use named groups have been added in Java 20. Are you referring to KEM API? Because JEP-452 <https://openjdk.org/jeps/452> was done as part of Java 21 not 20.
> This JEP was initially delivered in Java 26 Even in this case JEP-527 <https://openjdk.org/jeps/527> was delivered as part of Java 27 not 26. > It's being backported by several implementations to earlier Java versions. You can add a reference to the roadmap <https://www.java.com/en/jre-jdk-cryptoroadmap.html> or you can find more details on this link about the Oracle plan https://blogs.oracle.com/java/post-quantum-cryptography-in-long-term-support-jdk-releases so that readers can have an idea about the older Java versions which are going to get it (first one will be Java 25 at the end of October 2026). > The TLS version (set via ssl.protocol) gates what named groups are valid and automatically drops entries not compatible (like for ciphers). What does exactly mean "drop" here? If I set TLS 1.2 for example but then in the named groups I add "X25519MLKEM768", does Kafka refuse the configuration? Or it leaves to the JVM during the TLS handshake? (If you have x25519 in the list it should fall back. It works for TLS 1.3 but need to be confirmed for 1.2). Thanks, Paolo On Tue, 6 Oct 2026 at 12:14, Mickael Maison <[email protected]> wrote: > Hi, > > I'd like to start a discussion about KIP-1376 which proposes adding > support for TLS named groups: > https://cwiki.apache.org/confluence/x/dJXwGg > > Thanks, > Mickael > -- Paolo Patierno *Senior Principal Software Engineer @ IBM**CNCF Ambassador* Twitter : @ppatierno <http://twitter.com/ppatierno> Linkedin : paolopatierno <http://it.linkedin.com/in/paolopatierno> GitHub : ppatierno <https://github.com/ppatierno>
