alternative JCE providers?

[Cantor, Scott]

On 9/16/15, 7:28 AM, "users on behalf of Peter Schober" <users-bounces at shibboleth.net on behalf of peter.schober at univie.ac.at> wrote:



>Seems the IDP cannot be run on Free/Libre/Opensource Software alone --
>provided stronger crypto is desired/needed for interop -- because of
>its use of the Java Crypto API and the export limitations of the
>standard implementation thereof?

If you want AES-256, yes. I don't know what else requires it. I also didn't know how OpenJDK handled that. I assumed they must be including the stronger files, or supplying them via the OS' packaging system.

>Yet others claim using the BouncyCastle Crypo API directly would make
>the need for the JCE policy files go away. (Which sounds like a huge
>amount of effort for probably very little gain.)

That's not possible anyway, we depend on libraries that don't use that API.

-- Scott