I'm implementing the signing algorithms for JWS. For all the HMAC and RSA algorithms, the provider named "SunJCE" has them. But I am seeing almost all the popular JWT packages in Java has dependencies to Bouncy Castle.
Any particular reasons for choosing Bouncy Castle over SunJCE when you can get all the needed implementations from SunJCE?
What could be the best practice here?
I assume that, security-wise, they are the equal. The difference would be with performance?