Support in IBM WebSphere Application Server to Mitigate “Harvest Now, Decrypt Later” (HNDL) Threats Merged

Support in IBM WebSphere Application Server to Mitigate “Harvest Now, Decrypt Later” (HNDL) Threats

Description:
As cryptographic research advances, traditional asymmetric key exchange algorithms (such as RSA and ECC) face a significant long-term risk from future quantum computing capabilities. Adversaries may harvest encrypted data today and decrypt it later once quantum computing becomes practical—an attack strategy known as Harvest Now, Decrypt Later (HNDL).
 
To safeguard sensitive enterprise workloads running on IBM WebSphere Application Server (WAS), it is essential that the platform adopts quantum-safe cryptography mechanisms to prevent future decryption of intercepted communications.

IBMJCEPlus has recently introduced support for Post-Quantum Cryptography (PQC) algorithms — specifically:

• Module-Lattice-Based Digital Signature Algorithm (ML-DSA)
• Module-Lattice-Based Key Encapsulation Mechanism (ML-KEM)

However, at this time, there is no clear guidance or configuration support in WebSphere Application Server (WAS) traditional (8.5.5, 9.0.5) or Liberty runtime environments for enabling or integrating PQC algorithms for SSL/TLS communication or mutual authentication.

This enhancement request proposes the following:

Request:

• Provide official support in WebSphere Application Server (traditional and Liberty) for PQC-based TLS key exchange mechanisms (e.g., hybrid classical + ML-KEM key exchange). 
• Document clear configuration steps to enable PQC algorithms within the WebSphere security framework using the IBMJCEPlus provider.
• Ensure backward compatibility with existing browsers and TLS clients that do not yet support PQC.
• Include hybrid key exchange support (classical + PQC) to ensure communications are protected from HNDL without breaking compatibility with current clients.
• Provide official IBM guidance for customers seeking to achieve quantum-safe readiness in their existing WAS environments (8.5.5 and 9.0.5) and forward compatibility with future versions.