4

I am a Java developer and my Architect urges me to use Bouncycastle and he told me it is better than the JCE. I know Bouncycastle contains more rich libraries than JCE. But the question is is it safe to use non-Java(Oracle) standard cryptography in the production environment ?

Improve this question

2 Answers 2

Reset to default
3

Given the wide use of Bouncy Castle and a security record which is no worse than other TLS implementations it is probably not a security problem to use it instead of the standard Java libraries in production. This means I would not argue that it is 100% safe but it is probably not less safe than the standard Java libraries.

Improve this answer
1
  • 1
    That would be the JSSE instead of the JCE. I consider myself friends with the Bouncy Castle crew (or at least a far off acquaintance :P ), but to be fair, I'd use the JCE over the Bouncy Castle for the standard functionality most of the time (if just for the AES-NI support etc.). I don't think BC has as many tests run over it as the JCE either.
    – Maarten Bodewes
    Jan 16, 2017 at 22:03
3

I Agree with @Steffen. There is one more thing that you need consider here. Bouncycastle allows you to use non permitted( In some countries) bit lengths in Crypto algorithms. Hence is it very important to analyse what your (or clients) jurisdiction regulations before you implement this in the Production environment.

As an example United States do not allow to export anything uses Bouncycastle.

Improve this answer
2
  • This is only the case for the "lightweight" API mind you (i.e. using Bouncy's classes directly). The limited crypto is itself limited to Cipher instances and is actually enforced in that class, not in the CipherSpi derived implementations.
    – Maarten Bodewes
    Jan 16, 2017 at 21:49
  • U.S has not banned export of strong cryptography in years, except to specific terrorist regimes. Admittedly it may not be perfectly simple with Wassennar being expanded, but this alone should not be a limiting factor.
    – AviD ♦
    Mar 27, 2017 at 10:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .