search

otr4j / otr4j-issues

1 stars 0 forks source link

managing bouncycastle vs spongycastle dependency #1

Closed eighthave closed 4 years ago

eighthave commented 9 years ago

Android has a very aggravating BouncyCastle setup: it does not include all of BouncyCastle, only some of it. Therefore, some standard features of BouncyCastle are not available in Android's BouncyCastle, but the namespace is already claimed by Android's crippled version.

The best known solution to this issue is SpongyCastle, which packages up the parts of BouncyCastle that were left out of Android into a new namespace: org.spongycastle. The problem here is managing the need for spongycastle on Android versus using plain bouncycastle on Java.

aelmahmoudy commented 9 years ago

I don't understand the problem of "managing the need for spongycastle on Android versus using plain bouncycastle on Java"

aelmahmoudy commented 9 years ago

In commit ab6850e1d96b0464e94686635c1e660310e46825: bouncycastle was replaced with spongycastle. Then in commit 12544df6153a1c93e294c4cad9c6d66807538af9: switched back to bouncycastle

eighthave commented 9 years ago

@aelmahmoudy otr4j is also used on Java SE, not only on Android. It would be difficult to also use spongycastle on a full Java desktop app. I think that it should be possible now in Android to use plain bouncycastle, and drop spongycastle all together. I don't know exact when this happened, but it does seem like it is possible if the app sets minSdkTarget to 14 or higher (i..e 4.0 and above).

aelmahmoudy commented 9 years ago

So, where is the source for bouncycastle ? I understand from the issue title, that it is a part of Android ? Yet when I compile Xabber against this otr4j source, it fails because it cannot find bouncycastle packages.

eighthave commented 9 years ago

bouncycastle is a java lib like spongycastle. The easiest way to include it is getting the release jar from bouncycastle.org

cobratbq commented 5 years ago

I'm not sure if this issue is still current. Maybe we should include instructions on how to include otr4j as dependency in such a way that - where needed - the appropriate BC/SC library can be substituted. Closing for now and we'll cross that bridge when we get there.