Bouncy Castle is a collection of
APIs used in
cryptography
Cryptography, or cryptology (from grc, , translit=kryptós "hidden, secret"; and ''graphein'', "to write", or ''-logia'', "study", respectively), is the practice and study of techniques for secure communication in the presence of adver ...
. It includes APIs for both the
Java
Java (; id, Jawa, ; jv, ꦗꦮ; su, ) is one of the Greater Sunda Islands in Indonesia. It is bordered by the Indian Ocean to the south and the Java Sea to the north. With a population of 151.6 million people, Java is the world's List ...
and the
C# programming languages. The APIs are supported by a registered
Australian
Australian(s) may refer to:
Australia
* Australia, a country
* Australians, citizens of the Commonwealth of Australia
** European Australians
** Anglo-Celtic Australians, Australians descended principally from British colonists
** Aboriginal Au ...
charitable organization
A charitable organization or charity is an organization whose primary objectives are philanthropy and social well-being (e.g. educational, Religion, religious or other activities serving the public interest or common good).
The legal definitio ...
: Legion of the Bouncy Castle Inc.
Bouncy Castle is Australian in origin and therefore American restrictions on the
export of cryptography from the United States
The export of cryptography from the United States to other countries has experienced various levels of restrictions over time. World War II illustrated that code-breaking and cryptography can play an integral part in national security and the ab ...
do not apply to it.
History
Bouncy Castle started when two colleagues were tired of having to re-invent a set of cryptography libraries each time they changed jobs working in server-side
Java SE
Java Platform, Standard Edition (Java SE) is a computing platform for development and deployment of portable code for desktop and server environments. Java SE was formerly known as Java 2 Platform, Standard Edition (J2SE).
The platform uses Ja ...
. One of the developers was active in
Java ME
Java Platform, Micro Edition or Java ME is a computing platform for development and deployment of portable code for embedded and mobile devices (micro-controllers, sensors, gateways, mobile phones, personal digital assistants, TV set-top ...
(J2ME at that time) development as a hobby and a design consideration was to include the greatest range of Java VMs for the library, including those on J2ME. This design consideration led to the architecture that exists in Bouncy Castle.
The project, founded in May 2000, was originally written in Java only, but added a C# API in 2004. The original Java API consisted of approximately 27,000 lines of code, including test code and provided support for J2ME, a
JCE/
JCA provider, and basic
X.509
In cryptography, X.509 is an International Telecommunication Union (ITU) standard defining the format of public key certificates. X.509 certificates are used in many Internet protocols, including TLS/SSL, which is the basis for HTTPS, the secu ...
certificate generation. In comparison, the 1.53 release consists of 390,640 lines of code, including test code. It supports the same functionality as the original release with a larger number of algorithms, plus
PKCS#10, PKCS#12, CMS,
S/MIME S/MIME (Secure/Multipurpose Internet Mail Extensions) is a standard for public key encryption and signing of MIME data. S/MIME is on an IETF standards track and defined in a number of documents, most importantly . It was originally developed by R ...
,
OpenPGP
Pretty Good Privacy (PGP) is an encryption program that provides cryptographic privacy and authentication for data communication. PGP is used for signing, encrypting, and decrypting texts, e-mails, files, directories, and whole disk partitio ...
,
DTLS
Datagram Transport Layer Security (DTLS) is a communications protocol providing security to datagram-based applications by allowing them to communicate in a way designed to prevent eavesdropping, tampering, or message forgery. The DTLS protocol i ...
,
TLS,
OCSP
The Online Certificate Status Protocol (OCSP) is an Internet protocol used for obtaining the revocation status of an X.509 digital certificate. It is described in RFC 6960 and is on the Internet standards track. It was created as an alternative t ...
,
TSP,
CMP, CRMF,
DVCS,
DANE
Dane or Danes may refer to:
People Pertaining to Denmark
* Dane, somebody from Denmark
* Danes, an ethnic group native to Denmark
* Danes (Germanic tribe)
Other people
* Dane (name), a surname and a given name (and a list of people with the nam ...
,
EST and Attribute Certificates. The C# API is around 145,000 lines of code and supports most of what the Java API does.
Some key properties of the project are:
* Strong emphasis on standards compliance and adaptability.
* Public support facilities include an issue tracker, dev mailing list and a wiki all available at the website.
* Commercial support provided under resources for the relevant API listed on the Bouncy Castle website
On 18 October 2013, a not-for-profit association, the Legion of the Bouncy Castle Inc. was established in the state of Victoria, Australia, by the core developers and others to take ownership of the project and support the ongoing development of the APIs. The association was recognised as an Australian charity with a purpose of advancement in education and a purpose that is beneficial to the community by the
Australian Charities and Not-For-Profits Commission
The Australian Charities and Not-for-profits Commission (ACNC) is the regulatory authority for charities and not-for-profit organisations within Australia. The Commission was established in December 2012 as part of the ''Australian Charities ...
on 7 November 2013. The association was authorised to fundraise to support its purposes on 29 November 2013 by
Consumer Affairs Victoria Consumer Affairs Victoria (CAV) is a government agency that protects and promotes the interests of consumers and is based in the Australian state of Victoria. It is responsible for reviewing and advising the Victorian Government on consumer legislat ...
.
Architecture
The Bouncy Castle architecture consists of two main components that support the base cryptographic capabilities. These are known as the 'light-weight' API, and the
Java Cryptography Extension
The Java Cryptography Extension (JCE) is an officially released Standard Extension to the Java Platform and part of Java Cryptography Architecture (JCA). JCE provides a framework and implementation for encryption, key generation and key agreemen ...
(JCE) provider. Further components built upon the JCE provider support additional functionality, such as
PGP
PGP or Pgp may refer to:
Science and technology
* P-glycoprotein, a type of protein
* Pelvic girdle pain, a pregnancy discomfort
* Personal Genome Project, to sequence genomes and medical records
* Pretty Good Privacy, a computer program for the ...
support,
S/MIME S/MIME (Secure/Multipurpose Internet Mail Extensions) is a standard for public key encryption and signing of MIME data. S/MIME is on an IETF standards track and defined in a number of documents, most importantly . It was originally developed by R ...
, etc.
The low-level, or 'light-weight', API is a set of APIs that implement all the underlying cryptographic algorithms. The APIs were designed to be simple enough to use if needed, but provided the basic building blocks for the JCE provider. The intent is to use the low-level API in memory constrained devices (JavaME) or when easy access to the JCE libraries is not possible (such as distribution in an
applet
In computing, an applet is any small application that performs one specific task that runs within the scope of a dedicated widget engine or a larger program, often as a plug-in. The term is frequently used to refer to a Java applet, a program w ...
). As the light-weight API is just Java code, the Java virtual machine (JVM) does not impose any restrictions on the operation of the code, and at early times of the Bouncy Castle history it was the only way to develop strong cryptography that was not crippled by the Jurisdiction Policy files that prevented JCE providers from performing "strong" encryption.
The JCE-compatible provider is built upon the low-level APIs. As such, the source code for the JCE provider is an example of how to implement many of the "common" crypto problems using the low-level API. Many projects have been built using the JCE provider, including an Open Source Certificate Authority
EJBCA
EJBCA (formerly: ''Enterprise JavaBeans Certificate Authority'') is a free software public key infrastructure (PKI) certificate authority software package maintained and sponsored by the Swedish for-profit company PrimeKey Solutions AB, which h ...
.
Certified releases
The C# and Java releases have
FIPS 140-2
The Federal Information Processing Standard Publication 140-2, (FIPS PUB 140-2), is a U.S. government computer security standard used to approve cryptographic modules. The title is ''Security Requirements for Cryptographic Modules''. Initial publ ...
Level 1 certified streams as well. These differ from the regular releases in that, while the modules are designed in a similar fashion to the regular releases, the low-level APIs are quite different – largely to support the enforcement of controls that FIPS requires when an algorithm is used. In the case of the JCE level of the Java API, the provider is still largely a drop-in replacement for the regular release. The first FIPS-certified releases were made available in November 2016, with the Java version being assigned certification numbe
2768and the C# version being assigned certification numbe
Spongy Castle
The
Android operating system, as of early 2014, includes a customized version of Bouncy Castle. Due to class name conflicts, this prevents Android applications from including and using the official release of Bouncy Castle as-is. A third-party project called ''Spongy Castle'' distributes a renamed version of the library to work around this issue.
Stripy Castle
Originally, it was assumed a FIPS 140-2 version of ''Spongy Castle'' could also be done. It turned out due to Android's DEX file processing that for FIPS purposes the provider needs to be installed on the device separate from the application. The FIPS 140-2 release for Android is now called ''Stripy Castle'' and is packaged under ''org.stripycastle''. This was needed in order to avoid clashes with Android's version of Bouncy Castle as well as clashes for applications that might be using Spongy Castle and not requiring FIPS 140-2 certified services.
See also
*
Comparison of cryptography libraries
The tables below compare cryptography libraries that deal with cryptography algorithms and have API function calls to each of the supported features.
Cryptography libraries
FIPS 140
This table denotes, if a cryptography library provides t ...
References
External links
*
{{Portal bar, Free and open-source software
Cryptographic software
Java (programming language) libraries
Software using the MIT license
Transport Layer Security implementation