Bouncy Castle Crypto Package - Release Notes
1.0 Introduction
The Bouncy Castle Crypto package is a Java implementation of
cryptographic algorithms. The package is organised so that it
contains a light-weight API suitable for use in any environment
(including the newly released J2ME) with the additional infrastructure
to conform the algorithms to the JCE framework.
2.0 Release History
2.1.1 Version
Release 1.11
2.1.2 Defects Fixed
- X9.23 padding of MACs now works correctly with block size aligned data.
- Loading a corrupted "UBER" key store would occassionally cause the
appearance of hanging. This has been fixed.
- Loading a PKCS12 store where not all certificates had PKCS9 attributes
assigned to them would cause a NullPointerException. This has been fixed.
- The PKCS12 store wasn't correctly recovering certificate chains of
length less than 2 on calling the getCertificateChain method. This has been
fixed.
- Lone certificates were not been stored in the PKCS12 store. This has been fixed.
- CFB and OFB modes weren't padding iv's more than 1 byte less than the
block size of the cipher if the mode was reused with a shorter IV. This has
been fixed.
- IV handling and block size return values for CFB and OFB modes wasn't being handled in the same way as the Sun reference implementation. This has been fixed.
- CertficateInfoRequests were not handling null attributes correctly. This
has been fixed.
- Tags for the X.509 GeneralName structure were wrongly encoded. This has been
fixed.
- getExtensionValue for X.509 certificates was returning the value of the
DER-Encoded octet string not the DER-Encoded octet string as required. This has
been fixed.
- reset on the version 3 X.509 certificate generator was not flushing the
extensions. This has been fixed.
- The NetscapeCert type buits were reversed! This has been fixed.
2.1.3 Additional Functionality and Features
- The lightweight API and the JCE provider now support ElGamal.
- X509Principal, and X509Name now supports the "DC" attribute and the
creation of directory names from vectors.
- RSA-PSS signature padding has been added to the lightweight API.
- EC Public/Private keys are now encoded in accordance with SEC 1. The library
will still read older keys as well.
- Added PKCS12-DEF a pkcs12 based key store which works around a bug in
the Sun keytool - it always uses the default provider for creating certificates.
- A cut down version of the Rijndael has been added that provides the functionality required to conform the the AES. It is designed to fully support FIPS-197. A fips AES wrapper (AESWrap in the JCE, AESWrapEngine in the lightweight library has also been added).
- Elliptic curve routines now handle uncompressed points as well as the
compressed ones.
2.1.4 Other changes
- As the range of public key types supported has expanded the getPublicKey
method on the SubjectPublicKeyInfo class is not always going to work. The
more generic method getPublicKeyData has been added and getPublicKey now
throws an IOException if there is a problem.
2.2.1 Version
Release 1.10
2.2.2 Defects Fixed
- The PKCS12 Key Store now interoperates with the JDK key tool. Note: this does mean the the key name passed to the setKeyEntry calls has become
significant.
- The "int" constructor for DERInteger only supported ints up to 128. This
has been fixed.
- The ASN.1 input streams now handle zero-tagged zero length objects correctly.
2.2.3 Additional Functionality and Features
- The JCE Provider and the lightweight API now support Serpent, CAST5, and CAST6.
- The JCE provider and the lightweight API now has an implementation of ECIES.
Note: this is based on a draft, don't use it for anything that needs to
be kept long term as it may be adjusted.
- Further work has been done on performance - mainly in the symmetric ciphers.
- Support for the generation of PKCS10 certification requests has been added.
2.3.1 Version
Release 1.09
2.3.2 Defects Fixed
- failure to pass in an RC5 parameters object now results in an exception
at the upper level of the JCE, rather than falling over in the lightweight
library.
- ISO10126Padding now incorporates the correct amount of random data.
- The PKCS12 key store wasn't picking up certificate chains properly
when being used to write PKCS12 files. This has been fixed.
- The Twofish engine would call System.exit if the ket was too large.
This has been fixed.
- In some cases the ASN.1 library wouldn't handle implicit tagging properly.
This has been fixed.
2.3.3 Additional Functionality and Features
- Support for RC5-64 has been added to the JCE.
- ISO9796-2 signatures have been added to the JCE and lightweight API.
- A more general paddings packge for use with MACs and block ciphers had been aded to the lightweight API. MACs now allow you to specify padding.
- X9.23 Padding has been added to the JCE and lightwieght API. The old
PaddedBlockCipher class is now deprecated see org.bouncycastle.crypto.paddings for details.
- SHA-256, SHA-384, and SHA-512 are now added. Note: while the public review
period has finished, these algorithms have not yet been standardised, in the
event that final standardisation changes the algorithms these implementations
will be changed.
- It's now possible to set bag attributes on items to go into a PKCS12 store,
using the org.bouncycastle.jce.interfaces.PKCS12BagAttributeCarrier interface.
- More classses have been added to the ASN.1 package for dealing with
certificate extensions and CRLs including a CRL generator. Note: the
CRL generators should be regarded as under development and subject to change.
- There's now an examples package for the JCE (in addition to the examples
in org.bouncycastle.jce.provider.test) - org.bouncycastle.jce.examples. It
currently consists of a class showing how to generate a PKCS12 file.
- The X.509 CertificateFactory now includes CRL support. DER or PEM CRLs may be processed.
- The BigInteger library has been written with a view to making it less
resource hungry and faster - whether it's fast enough remains to be seen!
2.4.1 Version
Release 1.08
2.4.2 Defects Fixed
- It wasn't possible to specify an ordering for distinguished names in
X509 certificates. This is now supported.
- In some circumstances stream Ciphers in the JCE would cause null pointer
exceptions on doFinal. This has been fixed.
- Unpadded ciphers would sometimes buffer the last block of input, even
if it could be processed. This has been fixed.
- The netscape certificate request class wouldn't compile under JDK 1.1. This
has been fixed.
2.4.3 Additional Functionality and Features
- ISO 9796-1 padding is now supported with RSA in the lightweight
API and the JCE.
- support classes have been added for reading and writing PKCS 12 files,
including a keystore for the JCA.
- The message digests MD4, Tiger, and RIPEMD128 have been added to the
JCE and the lightweight API. Note: MD4 and RIPEMD128 have been added for
compatability purposes only - we recommend you don't use them for anything new!
- The JDK 1.1 certificate classes didn't conform to the JDK 1.2 API as
the collections class was not present. Thanks to a donated collections API
this is fixed.
2.5.1 Version
Release 1.07
2.5.2 Defects Fixed
- It turned out that the setOddParity method in the DESParameter class
was indeed doing something odd but not what was intended. This is now
fixed. Note:This will affect some PBE encryptions that were carried
out with DES, equivalent PBE ciphers to the old PBE DES cipher can be
accessed by prepending the work "Broken" in front of the original PBE cipher
call. If you want an example of how to deal with this as a migration issue
have a look in org.bouncycastle.jce.provider.JDKKeyStore lines 201-291.
2.6.1 Version
Release 1.06
2.6.2 Defects Fixed
- Diffie-Hellman keys are now properly serialisable as well as
encodable.
- Three of the semi-weak keys in the DESParameters, and the DESKeySpec look
up table, were incorrect. This has been fixed.
- DESEDE key generators now accept 112 and 168 as the key sizes, as well
as 128 and 192 (for those people who don't like to count the parity bits).
- Providing no strength parameter is passed to the DESede key generator in
the JCE provider, the provider now generates DESede keys in the k1-k2-k1
format (which is compatible with the Sun reference implementation), otherwise
you get what you ask for (3-DES or 2-DES in the minimum number of bytes).
- Base Diffie-Hellman key agreement now works correctly for more than two
parties.
- Cipher.getAlgorithmParameters was returing null in cases where a cipher
object had generated it's own IV. This has been fixed.
- An error in the key store occasionally caused checks of entry types to
result in a null pointer exception. This has been fixed.
- RSA key generator in JCE now recognises RSAKeyGenerationParameterSpec.
- Resetting and resusing HMacs in the lightweight and heavyweight libraries
caused a NullPointer exception. This has been fixed.
2.6.3 Additional Functionality
- ISO10126Padding is now recognised explicitly for block ciphers
as well.
- The Blowfish implementation is now somewhat faster.
2.7.1 Version
Release 1.05
2.7.2 Defects Fixed
- The DESEDE key generator can now be used to generate 2-Key-DESEDE
keys as well as 3-Key-DESEDE keys.
- One of the weak keys in the DESParameters, and the DESKeySpec look
up table, was incorrect. This has been fixed.
- The PKCS12 generator was only generating the first 128-160 bits of the
key correctly (depending on the digest used). This has been fixed.
- The ASN.1 library was skipping explicitly tagged objects of zero length.
This has been fixed.
2.7.3 Additional Functionality
- There is now an org.bouncycastle.jce.netscape package which has
a class in for dealing with Netscape Certificate Request objects.
2.7.4 Additional Notes
Concerning the PKCS12 fix: in a few cases this may cause some backward
compatability issues - if this happens to you, drop us a line at
feedback-crypto@bouncycastle.org
and we will help you get it sorted out.
2.8.1 Version
Release 1.04
2.8.2 Defects Fixed
- Signatures generated by other providers that include optional null
parameters in the AlgorithmIdentifier are now handled correctly by the
provider.
- The JCE 1.2.1 states that the names of algorithms associated with the JCE
are case insensitive. The class that matches algorithms to names now tries
to match the name given with it's equivalent in upper case, before trying
to match it as given. If you write a provider and include versions of your
algorithm names in uppercase only, this JCE implementation will always
match a getInstance regardless of the case of the algorithm passed into
the getInstance method.
- If the JCE API and the Provider were in a different class path, the
class loader being used sometimes failed to find classes for JCE Ciphers, etc.
This has been fixed.
- An error in the ASN.1 library was causing problems serialising Diffie-Hellman keys. This has been fixed.
- The agreement package was left out of the j2me bat file. This has been fixed.
- The BigInteger class for 1.0 and the j2me wasn't able to generate random
integers (prime or otherwise). This has been fixed.
- The BigInteger class would sometimes go into a death spiral if the any
32nd bit of an exponent was set when modPow was called. This has been fixed.
- Cipher.getInstance would treat "//" in a transformation as a single "/".
This has been fixed.
- PBEWithSHAAndIDEA-CBC was throwing an exception on initialisation. This has
been fixed.
- The X509Name class in the asn1.x509 package wasn't initialising its local
hash table when the hash table constructor was called. This has been fixed.
2.8.3 Additional Functionality
- Added Elliptic Curve DSA (X9.62) - ECDSA - to provider and lightweight
library.
- Added Elliptic Curve basic Diffie-Hellman to provider and lightweight
library.
- Added DSA support to the provider and the lightweight library.
- Added super class interfaces for basic Diffie-Hellman agreement classes
to lightweight library.
- The certificate generators now support ECDSA and DSA certs as well.
2.9.1 Version
Release 1.03
2.9.2 Defects Fixed
- CFB and OFB modes when specified without padding would insist on input
being block aligned. While this seems like the right thing to do, no-one else
does it! When specified without padding CFB and OFB now behave in a compatible
fashion (a doFinal on a partial block will yield just the data that could
be processed).
In short, it provides another way of generating cipher text the same
length as the plain text.
2.10.1 Version
Release 1.02
2.10.2 Defects Fixed
- The RSA key pair generator occasionally produced keys 1 bit under the
requested size. This is now fixed.
2.11.1 Version
Release 1.01
2.11.2 Defects Fixed
- Buffered ciphers in lightweight library were not resetting correctly
on a doFinal. This has been fixed.
2.12.1 Version
Release 1.0
2.12.2 Defects Fixed
- JDK1.2 version now works with keytool for certificate generation.
- Certificate toString method no longer throws a null pointer exception
if a group [3] extension has not been added.
- Under some circumstances the NullCipher would throw a NullPointerException,
this has been fixed.
- Under some circumstances CipherInputStream would throw a NullPointerException, this has been fixed.
- OpenSSL/SSLeay private key encodings would cause an exception to be thrown
by the RSA key factory. This is now fixed.
- The Cipher class always used the default provider even when one was specified, this has been fixed.
2.12.3 Additional functionality
- Argument validation is much improved.
- An X509KeyUsage class has been added to the JCE class to make it easier
to specify the KeyUsage extension on X.509 certificates.
- The library now allows creation of version 1 certificates as well.
2.13.1 Version
Release 1.0 Beta 4
2.13.2 Defects Fixed
Occasionally the RSA engine would return a block less than the standard
block-size when encrypting. This has been fixed so the same block size
is always returned. Also a similar problem sometimes affected the OAEP encoder's
interaction with the RSA engine, this has also been fixed.
2.13.3 Additional functionality
- added X509Certificate factory, and certificate generation classes
- added Diffie-Hellman key agreement to provider and light weight API
- added MD2 message digest to lightweight library.
- added MD2 message digest to JCE provider.
- Added MD2withRSA signature processing.
- added Rijndael block cipher to provider and lightweight API.
2.14.1 Version
Release 1.0 Beta 3
2.14.2 Defects Fixed
- RSA padding now works properly in JCE provider (before always unpadded).
- RSA cipher now passes random number generator through correctly.
- fixed bug in CipherKeyGenerator where key was being truncated to a multiple
of 8 rather than rounded up.
- fixed bug in JDK 1.0 SecureRandom which was causing a NullPointerException
on some JVMs.
2.14.3 Additional Functionality
- added DES encryptor example (crypto.examples).
- BigInteger support is now added for the J2ME and JDK 1.0 for everything
except key generation (still doing isProbablePrime).
- added CBCBlockCipherMac and CFBBlockCipherMac class (see below).
- JCE provider Mac class now supports IV's and CFB mode.
- added MacTest to lightweight nad provider classes.
- added first stage of X509 certificate parsing to asn1 package.
- KeyWrapping now guarantees to use the BC provider when doing unwrapping.
2.14.4 Other
- BlockCipherMac is now deprecated and will disappear in b4, use CBCBlockCipherMac instead.
2.15.1 Version
Release 1.0 Beta 2
2.15.2 Defects Fixed
- DEROuputStream (was writing out incorrect lengths).
- Lightweight API now compiles with J2ME.
- Deleted unnecessary method form StreamCipher (single byte output to array).
- JCECipher now handles AlgorithmParameter objects without always throwing
an exception.
- added equals to JCERSAPublicKey (keystore uses it).
- replaced clone in lightweight API with copy constructors (J2ME does not
support clone).
- RC4Engine now throws DataLengthException when i/o buffers too small.
- Ciphers now throws exception if decrypting in a mode where an IV is
expected and none is provided
- Cipher now throws NoSuchAlgorithmException rather than NullPointerException
if a base algorithm is not avaliable.
- Signature now extends Signature, rather than SignatureSpi (JDK 1.1 compatibility)
- default key size now set in RSAKeyPairGenerator (2048)
- RSA encrypted private key info objects now serialise correctly in DER format.
- stream and block ciphers now throw IllegalArgumentException if the
wrong parameter object is passed.
- KeyStore now compiles with JDK 1.3 (private variable issue)
- test classes always specify "BC" provider to avoid clashes with Sun RSA
signature classes.
- Macs now initialise correctly from BlockCipher
2.15.3 Additional Functionality
- Added RIPEMD160withRSA signature processing.
- Added basic key wrapping.
- javax.crypto.Cipher argument checking.
- basic wrap/unwrap implementation for Cipher classes.
- improved alias support with Signature implementations.
- implementation of clone() in JCE provider digests.
- added tests to support new features.
- added 1.1 compatibility classes.
- added 1.0 compatibility classes.
- added j2me compatibility classes.
- J2ME test code
- J2ME/KVM/Palm example (CryptoTest.prc)
- J2ME compilation support
- Windows compilation support
2.16 Notes
The J2ME is only supported under Windows.
The provided zips/midp_classes.zip is the result of the build-midp.bat script. The palm classes are no longer provided as the midp ones should now work for both.
If you are trying to use the lightweight provider in a JDK 1.0 applet, you
need to change the package names for java.math.BigInteger, java.lang.IllegalStateException, and java.security.SecureRandom
The RSA test under JDK 1.0 and J2ME takes a while to run...