Open rtyley opened 7 years ago
π
Going to test our setup by bundling with regular Bouncy on Android. BTW thanks for you hard work @rtyley!
These two actively developed projects depend on spongycastle (and my android wallet in turn depends on them):
https://github.com/bitcoinj/bitcoinj https://github.com/ACINQ/bitcoin-lib (this one already needs v1.55 so spongycastle branch lags behind master for now)
I am working on a major UK banking app that has more than a couple of million active users and we would be definitely interested in having an upgrade to the latest version of BouncyCastle through Spongy. In the longer term, we will be looking at alternate options but near term an upgrade would be very helpful.
am working on a major UK banking app that has more than a couple of million active users
Thanks for your response @rahulmcs - given that you're working on a commercial project, would the bank you're working for be interested in sponsoring me for a day of work so I can get this release of Spongy Castle out?
I'm willing to send 0.1 BTC to at least partially compensate for your time. Please provide an address if that's fine with you. anton.kumaigorodskiy@outlook.com
Many thanks for your kind offer @btcontract. My bitcoin address is 1HTBHTjsZddo8PJU5eT6EcNk4mzLU6m5Zf - all funding is much appreciated, it would probably take about 0.3 BTC for a full day.
Done. Hope others interested will join and we'll get a release sooner than later :)
π if you take a look on how providers and manufacturers are handling android updates you have to buy a new phone at least every two years to use an android that still has an accepable security level. If you don't have to depend on the normal update cycle but instead depend on your own crypto lib you can assure that at least the communication between server and client is secure. I'm too working on porting bouncycastle to the current version with aar libs. The buiild is working (including the mail part) only problem are the tests π .
+1 thank you so much for the Spongy effort. I've managed to get BC 1.56 working after realizing it was necessary to call Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
to remove the built-in BC before calling Security.addProvider(new BouncyCastleProvider());
.
Release v1.56.0.0 is now available on Maven Central - more details here at : https://github.com/rtyley/spongycastle/releases/tag/sc-v1.56.0.0
Like @tsombrero said, the "BC" issue is an annoyance, but not a show-stopper for using regular BouncyCastle, at least in my case. I thought I would have to use SpongyCastle for my new project, but I've managed to use regular BC by removing Android's bundled provider like he said.
Hi everyone, I made a tool called mybc
for building your own customized BC library, so you don't need to wait for the next SpongyCastle release. I'm using it in my Android app. Currently it's building BC version 1.62 for JDK 1.5 successfully. Links: mybc on GitHub and mybc on NPM. If it helps please star the repo!
We are shipping some SDKs for our clients to consume them inside their apps. When building with spongycastle
, the SDK size almost inflates by ~3 MBs. For spongycastle, the proguard rules for thinning out the unused parts used are very generic:
-keep class org.spongycastle.** {*;}
-keepclassmembers class org.spongycastle.**
If I remove these rules, proguard thins out everything, causing a runtime exception where the SC
provider could not be found. Can someone guide with more specific proguard rules so that my SDK size does not inflate a lot?
PS: Removing the SC
as a provider and using the method KeyFactory.getInstance(KEY_GENERATOR_ALGO)
runs fine with several devices. Not sure, if this is a safe way to proceed based on the comments above.
I'm not fully qualified to answer this one, but I think I can guess what the problem would be - the provider architecture uses reflection to build the services, progaurd is not going to be able to deal with that sensibly. If you had a look at the source of the provider and the lookups you could work out a list of required classes which would help you minimise the size of the jar.
Currently: Bouncy Castle 1.65.
1.54 vs 1.65? I guess Spongy is no longer maintained.
There is a Bouncy Castle 1.66 since 4th July 2020 : https://www.bouncycastle.org/releasenotes.html
Today:
Previously:
Time to update (last CVEs):
Recall that SpongyCastle was a fork of BouncyCastle, and ALL old SpongyCastle have VULNERABILITIES.
Recall that SpongyCastle was a fork of BouncyCastle, and ALL old SpongyCastle have VULNERABILITIES.
what do you mean by "ALL old SpongyCastle"?
The Bouncy Castle fork "Spongy Castle" is dead and has a lot of CVEs.
Please use the original code: Bouncy Castle to solve all CVEs:
Spongy Castle was created back in 2011 because the Android platform bundled an old, restricted subset of Bouncy Castle. Simply adding an updated version of Bouncy Castle to your app resulted in class-clashes and exceptions - so you needed a repackaged & renamed version, like Spongy Castle.
Why might Spongy Castle be obsolete?
As mentioned in the book Android Security Internals by @nelenkov, the
org.bouncycastle
packages in Android were renamed tocom.android.org.bouncycastle
starting with Android 3.0 (see also https://github.com/open-keychain/open-keychain/issues/1676 and Android Platform commit 0ac85ead96f - note that the version of BC bundled with Android 4.0 was still a restricted subset). So using Spongy Castle may no longer be necessary, if you can just include an up-to-date version of Bouncy Castle directly.There are also alternative crypto libraries to consider, like Facebook's Conceal, Google's Conscrypt, libsodium-jni, etc.
Why might Spongy Castle not be obsolete?
So Spongy Castle may still be necessary, if you really do need the functionality of Bouncy Castle on older devices. However it takes non-negligible effort to maintain Spongy Castle, so I'm using this issue to solicit feedback from people on whether they do, or do not, need further releases of Spongy Castle, and also to answer the users who ask "Why hasn't the latest release of Spongy Castle come out yet?"
Why do releases of Spongy Castle lag so far behind Bouncy Castle?
The Bouncy Castle project has a suite of nearly a thousand tests, and with every new release of Spongy Castle I want to make sure that those tests all pass - I have to make sure I haven't broken anything. In particular, I want to make sure that those tests pass in public CI (eg Travis CI) so that people can reproduce my work.
Unfortunately, this is surprisingly difficult:
javax.crypto.JceSecurity.verifyProviderJar()
checks that will only pass with one of these two problematic options:Sunset on a Spongy Castle?
Given the inevitable obsolescence of Spongy Castle, at some point there will be literally no reason to keep on devoting the significant chunk of time it takes to cut a release! That time may not have arrived yet - but for my own sanity, I'd like to know when it does, so I can use my time to do other stuff.
So, please vote on this issue:
...and if you could add a comment, explaining why you need it, and linking to your project, that would be great and hold much more weight with me.