In my Java application (which use StandardPBEStringEncryptor by jasypt), when I use the PBEWITHSHA256AND128BITAES-CBC-BC algorithm instead of something weaker such as PBEWithMD5AndDES, I get an exception saying I need to install Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files.

But, as far as I know, AES 128 bit on it's own is always allowed since the export law limit for AES is 128 bit keys (for example if I use it in javax.crypto.Cipher). SHA256 is also allowed on it's own...

Why is password based encryption of kind "SHA256 AND 128 BIT AES-CBC" not allowed? Does that use a longer key than 128 bit? (AES128 should use a 128 bits key by definition, so if the SHA256 makes it use a longer key it... makes no sense.)


If you are using a password longer than 16 bytes (without the JCE Unlimited Strength Jurisdiction Policy files installed), this can cause an InvalidKeyException. For PBE ciphers, the key is derived from the password during cipher.init() but after the key length check is done. That means the raw password is provided to the cipher in place of the key, and the password length exceeds the max key length at the time of the check. I discovered this with further documentation here.

  • I was using a 16 characters String password, but Jasypt normalize it internally so it's hard to tell what was the final actual size in bytes. – yair Dec 6 '15 at 20:56
  • 1
    @yair Not sure if you are still interested, but I have found that some algorithms actually limit the password length to 7 characters (the algorithm you referenced above is one that does that). See update in my question here – Andy Feb 4 '16 at 2:26

Without the JCE Unlimited Strength Policy files in place, Java is able to use "strong but limited cryptography". That isn't limited to 128-bit or less necessarily. Just that "the jurisdiction policy files distributed with the Java SE 7 software have built-in restrictions on available cryptographic strength."

From the README.txt:

Due to import control restrictions of some countries, the version of the JCE policy files that are bundled in the Java Runtime Environment, or JRE(TM), 7 environment allow "strong" but limited cryptography to be used. This download bundle (the one including this README file) provides "unlimited strength" policy files which contain no restrictions on cryptographic strengths.

The README.txt for Java 6 and Java 8 are similar.

  • Yes, but what makes the strength of PBEWITHSHA256AND128BITAES-CBC-BC (when StandardPBEStringEncryptor by jasypt is used) stronger than the allowed, assuming encryption using AES128 is allowed without the unlimited strength files when i use javax.crypto.Cipher – yair Nov 19 '14 at 14:30
  • The JCA documentation explicitly notes that 128 bit encryption is the maximum key length for AES without the unlimited strength policies installed. – Andy Dec 7 '15 at 2:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.