I'm implementing the signing algorithms for JWS. For all the HMAC and RSA algorithms, the provider named "SunJCE" has them. But I am seeing almost all the popular JWT packages in Java has dependencies to Bouncy Castle.

Any particular reasons for choosing Bouncy Castle over SunJCE when you can get all the needed implementations from SunJCE?

What could be the best practice here?

I assume that, security-wise, they are the equal. The difference would be with performance?

  • For HMAC and RSA you can use Bouncy Castle, for AES use SunJCE as it's hardware accelerated. – Aria May 6 '17 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.