Re: [GNU Crypto] How to replace Sun JCE+BouncyCastle with GNU JCE+BouncyCastle?

[Kevin Smith]

Casey Marshall wrote:
> Out of curiosity, what algorithms are we missing, in particular?

SHA1WithRSA for signing.

> That might not work; you have to prepend those Jar files to the
> bootclasspath, not your normal classpath.

Hm. I've never dealt with bootclasspath before. I'm in eclipse at the 
moment, and eventually would also have to know the magic that would 
allow this to work on raw Linux, Mac, and Windows environments. Let's 
postpone going down that path while we explore the other possible 
cause(s) and solutions.

> But also; why do you want to do this? Sun's JCE should be compatible
> with the one we provide, and our algorithms should work under it,
> provided that the jar file is signed first.

Our app is intended to be installed and used by computer novices around 
the world. Requiring them to download and install the unlimited strength 
crypto policy file is unacceptable. Distributing the file ourself would 
apparently violate Sun's copyrights, so that's also unacceptable. We are 
faced with rewriting our code using the BouncyCastle lightweight API to 
bypass JCE, or to find a JCE that doesn't enforce those restrictions, 
like gnu-crypto.

I think we are indifferent about using BouncyCastle's JCE provider or 
the gnu-crypto JCE provider, as long as it is compatible with our 
existing data (including SHA1WithRSA signatures).

> our javax-crypto.jar contains some BC code, including
> some classes in the 'org.bouncycastle' namespace. It is likely that
> one class is being loaded from our javax-crypto.jar, and another from
> the BC jar. I rewrote the JCE from scratch, which is in our CVS
> sources, and is also now a part of the GNU Classpath project.

Ok. That makes sense, I think. How stable is your new JCE? Do you think 
it will be production quality and released soon? Or, will the gnu-crypto 
provider support SHA1WithRSA soon (or does it already and it just isn't 
documented)?

I suppose the third option would be for me to try to rename packages or 
strip out parts of the existing gnu-crypto, bouncy-castle-based JCE to 
try to get it to work with the BouncyCastle provider.

> Hope this helps!

Very helpful!

Thanks much,

Kevin