# Bouncy Castle Crypto Package - Release Notes

## 1.0 Introduction

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. The package is organised so that it contains a light-weight API suitable for use in any environment (including the newly released J2ME) with the additional infrastructure to conform the algorithms to the JCE framework.

## 2.0 Release History

### 2.1.1 Version

Release 1.20

### 2.1.2 Defects Fixed

- BigInteger toString() in J2ME/JDK1.0 now produces same output as the Sun one.
- RSA would throw a NullPointer exception with doFinal without arguments. This has been fixed.
- OCSP CertificateID would calculate wrong issuer hash if issuer cert was not self signed. This has been fixed.
- Most of response generation in OCSP was broken. This has been fixed.
- The CertPath builder would sometimes go into an infinite loop on some chains if the trust anchor was missing. This has been fixed.
- AES OIDS were incorrect, this has been fixed.
- In some cases BC generated private keys would not work with the JSSE. This has been fixed.

### 2.1.3 Additional Features and Functionality

- Support for reading/writing OpenPGP public/private keys and OpenPGP signatures has been added.
- Support for generating OpenPGP PBE messages and public key encrypted messages has been added.
- Support for decrypting OpenPGP messages has been added.
- Addition of a Null block cipher to the light weight API.

### 2.2.1 Version

Release 1.19

### 2.2.2 Defects Fixed

- The PKCS12 store would throw an exception reading PFX files that had attributes with no values. This has been fixed.
- RSA Private Keys would not serialise if they had PKCS12 bag attributes attached to them, this has been fixed.
- GeneralName was encoding OtherName as explicitly tagged, rather than implicitly tagged. This has been fixed.
- ASN1 parser would sometimes mistake an implicit null for an implicit empty sequence. This has been fixed.

### 2.2.3 Additional Features and Functionality

- S/MIME and CMS now support the draft standard for AES encryption.
- S/MIME and CMS now support setable key sizes for the standard algorithms.
- S/MIME and CMS now handle ARC4/RC4 encrypted messages.
- The CertPath validator now passes the NIST test suite.
- A basic OCSP implementation has been added which includes request generation and the processing of responses. Response generation is also provided, but should be treated as alpha quality code.
- CMS now attempts to use JCA naming conventions in addition to the OID name in order to find algorithms.

### 2.3.1 Version

Release 1.18

### 2.3.2 Defects Fixed

- DESKeySpec.isParityAdjusted in the clean room JCE could go into an infinite loop. This has been fixed.
- The SMIME API would end up throwing a class cast exception if a MimeBodyPart was passed in containing a MimeMultipart. This is now fixed.
- ASN1InputStream could go into an infinite loop reading a truncated input stream. This has been fixed.
- Seeding with longs in the SecureRandom for the J2ME and JDK 1.0, only used 4 bytes of the seed value. This has been fixed.

### 2.3.3 Additional Features and Functionality

- The X.509 OID for RSA is now recognised by the provider as is the OID for RSA/OAEP.
- Default iv's for DES are now handled correctly in CMS.
- The ASN.1 classes have been updated to use the generic ASN1* classes where possible.
- A constructor has been added to SMIMESigned to simplify the processing of "application/pkcs7-mime; smime-type=signed-data;" signatures.
- Diffie-Hellman key generation is now faster in environments using the Sun BigInteger library.

### 2.4.1 Version

Release 1.17

### 2.4.2 Defects Fixed

- Reuse of an CMSSignedObject could occassionally result in a class cast exception. This has been fixed.
- The X.509 DistributionPointName occasionally encoded incorrectly. This has been fixed.
- BasicConstraints construction would break if an ASN.1 sequence was used with only the required parameter. This has been fixed.
- The DERObject constructor in OriginatorIdentifierOrKey was leaving the id field as null. This has been fixed.

### 2.4.2 Additional Functionality and Features

- RC2 now supports the full range of parameter versions and effective key sizes.
- CompressedData handling has been added to CMS/SMIME.
- The 1.4 version now allows X500Principles to be generated directly from CRLs.
- SMIME objects now support binary encoding. The number of signature types recognised has been increased.
- CMS can create signed objects with encapsulated data. Note: while this was been done we realised we could simplify things, we did and for the most part people won't notice, other than the occassional reference to CMSSignable will need to be replaced with CMSProcessable.
- X509Name and X509Principal now support forward and reverse X509Name to string conversion, with changeable lookup tables for converting OIDs into strings. Both classes also now allow the direction of encoding to be set when a string is converted as well as changeable lookup tables for string to OID conversion.

### 2.5.1 Version

Release 1.16

### 2.5.2 Defects Fixed

- CRLS were only working for UTC time constructed Time objects, this has been fixed.
- KeyUsage and ReasonFlags sometimes encoded longer than necessary. This has been fixed.
- BER encoded sets are now recognised and dealt with.
- Encoding issues in CMS which were causing problems with backwards compatibility with older CMS/SMIME clients have been fixed.
- KeyFactory now allows for creation of RSAKey*Spec classes.
- The X509CertSelector in the clean room CertPath API is now less likely to throw a NullPointerException at the wrong time.
- Macs now clone correctly in the clean room JCE.

### 2.5.2 Additional Functionality and Features

- PGPCFB support has been added to the provider and the lightweight API.
- There are now three versions of the AESEngine, all faster than before, with the largest footprint one being the fastest. The JCE AES now refers to the fastest.
- The 1.4 version of the library now allows for X500Principals to be generated directly from certificates.
- X509Name has been extended to parse numeric oids, "oid." oids, and to recognise the LDAP UID.
- Immutable sequences and sets have been introduced to the ASN.1 package.
- The SMIME/CMS ASN.1 base classes have been rewritten to reduce the size of the package for use with the lightweight API.
- The SMIME/CMS api's have been rewritten to allow them to take advantage of the Cert Path API, remove code suited to inclusion in the provider, and to support multiple recipients/signers.

### 2.6.1 Version

Release 1.15

### 2.6.2 Defects Fixed

- The base string for the oids in asn1.x509.KeyPurposeId was incorrect. This has been fixed.
- MimeBodyParts in the SMIME Generator did not have their Content-Type properly set up after decryption. This has been fixed.
- If a X.509 certificate did not have all the keyUsage extension bits set, the provider wasn't padding the return value of the key usage extension to 8 booleans in length. This has been fixed.
- In some cases the simple BC keystore allowed overwriting of an alias with one of the same name. This has been fixed.
- The key schedule for RC5-64 was not always being calculated correctly. This has been fixed.
- On reset buffered blockcipher was only partially erasing the previous buffer. This has been fixed.
- All lightweight mac classes now do a reset on doFinal.
- ASN.1 object identifiers wouldn't encode the first byte correctly if the OID started with 2 and the second number was greater than 47. This has been fixed.
- If a key had PKCS9 attributes associated with it on storage they took precedence over the local alias used to add the key to the PKCS12 key store. The local name now takes precedence.
- ReasonFlags now correctly encodes.

### 2.6.2 Additional Functionality and Features

- The PKCS12 key store now handles key bags in encryptedData bags.
- The X509NameTokenizer now handles for '\' and '"' characters.
- SMIME v2 compliance has been added. Use setVersion(2) in the generator classes.
- The ASN.1 library now supports ENUMERATED, UniversalString and the X.509 library support for CRLs now includes CRLReason, and some elements of CertificatePolicies.
- Both the provider and the lightweight library now support a basic SIC mode for block ciphers.

### 2.7.1 Version

Release 1.14

### 2.7.2 Defects Fixed

- there was a bug in the BigInteger right shifting for > 31 bit shifts. This has been fixed.
- x509 name had it's equality test based on the order of the directory elements, this has been fixed.
- the mode used with the RSA cipher in KeyTransRecipientInfoParser in the smime implementation was not compatible with the Sun JCE. This has been fixed.
- PKCS7 SignedData now supports single length signing chains.
- When a root certificate had a different issuer id from the subject id, or had it's own AuthorityKeyExtension the PKCS12 key store would drop the root certificate from the certificate chain. This has been fixed.
- The PKCS10 CertificationRequestInfo class always expected at least one attribute. This has been fixed.
- UTF8 strings are now correctly recognised.
- The Tiger implementation was producing results in reverse byte order for each of the 3 words making up the digest. This has been fixed.
- asn1.x509.ExtendedKeyUsage used to through a null pointer exception on construction. This has been fixed.

### 2.7.3 Additional Functionality and Features

- The BigInteger library now uses Montgomery numbers for modPow and is substantially faster.
- SMIMECapabilities, and SMIMEEncryptionKeyPreference attributes added to S/MIME.
- Increased range of key sizes available in S/MIME.
- getInstance(ASN1TaggedObject, boolean) methods have been added to most ASN1 types. These deal with implicit/explicit tagging ambiguities with constructed types.
- Added EncryptedPrivateKeyInfo object to the clean room JCE.
- A PEMReader has been added for handling some of the openSSL PEM files.
- The X.509 certificate factory supports a wider range of encodings and object identifiers.

### 2.8.1 Version

Release 1.13

### 2.8.2 Defects Fixed

- The TBSCertificate object in the ASN.1 library now properly implements the Time object, rather returning UTC time.
- The DESedeKeyGenerator now supports 112 and 168 bit key generation.
- Certificates with the keyId set to null in the AuthorityKeyIdentifier extensions would sometimes cause the PKCS12 store to throw a NullPointer exception. This has been fixed.
- toByteArray in the big integer class was not always producing correct results for negative numbers. This has been Fixed.

### 2.8.3 Additional Functionality and Features

- The key to keySpec handling of the secret key factories has been improved.
- There is now a SMIME implementation and a more complete CMS implementation (see CONTRIBUTORS file for additonal details).
- A CertPath implementation that runs under jdk1.1 and jdk1.4 has also being contributed. A work around to allow it to be used with jdk1.2 and jdk1.3 has also been added. Note: the implementation is not quite complete because policymapping, name and subtree contraints are not yet implemented.
- The API now supports the generation of PKCS7 signed objects. Note: this is still beta code - one known issue is that it doesn't support single length certificate chains for signing keys.

### 2.9.1 Version

Release 1.12

### 2.9.2 Defects Fixed

- The ASN.1 library was unable to read an empty set object. This has been fixed.
- Returning sets of critical and non-critical extensions on X.509 certificates could result in a null pointer exception if the certificate had no extensions. This has been fixed.
- The BC JKS implementation does not follow the conventional one - it has been renamed BKS, an attempt to create a JKS keystore using the BC provider will now result in an exception.
- The PKCS 10 generator verify(provider) method was ignoring the provider when generating the public key. This has been fixed.
- The PKCS12 store would throw an OutOfMemoryException if passed a non-PKCS12 file. This has been fixed.
- In the case where there was no AuthorityKeyIdentifier the PKCS12 store would fail to find certificates further up the signing chain. The store now uses the IssuerDN if no AuthorityKeyIdentifier is specified and the IssuerDN is different from the SubjectDN,
- PKCS10/CertificationRequestInfo objects with only a single attribute wer not being handled properly. This has been fixed.
- getExtensionValue for X.509 CRLs was returning the value of the DER-Encoded octet string not the DER-Encoded octet string as required. This has been fixed.
- the IV algorithm parameters class would improperly throw an exception on initialisation. This has been fixed.

### 2.9.3 Additional Functionality and Features

- The AESWrap ciphers will now take IV's.
- The DES-EDEWrap algorithm described in http://www.ietf.org/internet-drafts/draft-ietf-smime-key-wrap-01.txt is now supported.
- Support for the ExtendedKeyUsageExtension and the KeyPurposeId has been added.
- The OID based alias for DSA has been added to the JCE provider.
- BC key stores now implement the BCKeyStore interface so you can provide your own source of randomness to a key store.
- The ASN.1 library now supports GeneralizedTime.
- HMACSHA256, HMACSHA384, and HMACSHA512 are now added.
- PSS has been added to the JCE, PSS and ISO9796 signers in the lightweight api have been rewritten so they can be used incrementally.
- Base support for CMS (RFC 2630) is now provided (see CONTRIBUTORS file for details).

### 2.10.1 Version

Release 1.11

### 2.10.2 Defects Fixed

- X9.23 padding of MACs now works correctly with block size aligned data.
- Loading a corrupted "UBER" key store would occassionally cause the appearance of hanging. This has been fixed.
- Loading a PKCS12 store where not all certificates had PKCS9 attributes assigned to them would cause a NullPointerException. This has been fixed.
- The PKCS12 store wasn't correctly recovering certificate chains of length less than 2 on calling the getCertificateChain method. This has been fixed.
- Lone certificates were not been stored in the PKCS12 store. This has been fixed.
- CFB and OFB modes weren't padding iv's more than 1 byte less than the block size of the cipher if the mode was reused with a shorter IV. This has been fixed.
- IV handling and block size return values for CFB and OFB modes wasn't being handled in the same way as the Sun reference implementation. This has been fixed.
- CertificateInfoRequests were not handling null attributes correctly. This has been fixed.
- Tags for the X.509 GeneralName structure were wrongly encoded. This has been fixed.
- getExtensionValue for X.509 certificates was returning the value of the DER-Encoded octet string not the DER-Encoded octet string as required. This has been fixed.
- reset on the version 3 X.509 certificate generator was not flushing the extensions. This has been fixed.
- The NetscapeCert type bits were reversed! This has been fixed.

### 2.10.3 Additional Functionality and Features

- The lightweight API and the JCE provider now support ElGamal.
- X509Principal, and X509Name now supports the "DC" attribute and the creation of directory names from vectors.
- RSA-PSS signature padding has been added to the lightweight API.
- EC Public/Private keys are now encoded in accordance with SEC 1. The library will still read older keys as well.
- Added PKCS12-DEF a pkcs12 based key store which works around a bug in the Sun keytool - it always uses the default provider for creating certificates.
- A cut down version of the Rijndael has been added that provides the functionality required to conform the the AES. It is designed to fully support FIPS-197. A fips AES wrapper (AESWrap in the JCE, AESWrapEngine in the lightweight library has also been added).
- Elliptic curve routines now handle uncompressed points as well as the compressed ones.

### 2.10.4 Other changes

- As the range of public key types supported has expanded the getPublicKey method on the SubjectPublicKeyInfo class is not always going to work. The more generic method getPublicKeyData has been added and getPublicKey now throws an IOException if there is a problem.

### 2.11.1 Version

Release 1.10

### 2.11.2 Defects Fixed

- The PKCS12 Key Store now interoperates with the JDK key tool. Note: this does mean the the key name passed to the setKeyEntry calls has become significant.
- The "int" constructor for DERInteger only supported ints up to 128. This has been fixed.
- The ASN.1 input streams now handle zero-tagged zero length objects correctly.

### 2.11.3 Additional Functionality and Features

- The JCE Provider and the lightweight API now support Serpent, CAST5, and CAST6.
- The JCE provider and the lightweight API now has an implementation of ECIES. Note: this is based on a draft, don't use it for anything that needs to be kept long term as it may be adjusted.
- Further work has been done on performance - mainly in the symmetric ciphers.
- Support for the generation of PKCS10 certification requests has been added.

### 2.12.1 Version

Release 1.09

### 2.12.2 Defects Fixed

- failure to pass in an RC5 parameters object now results in an exception at the upper level of the JCE, rather than falling over in the lightweight library.
- ISO10126Padding now incorporates the correct amount of random data.
- The PKCS12 key store wasn't picking up certificate chains properly when being used to write PKCS12 files. This has been fixed.
- The Twofish engine would call System.exit if the key was too large. This has been fixed.
- In some cases the ASN.1 library wouldn't handle implicit tagging properly. This has been fixed.

### 2.12.3 Additional Functionality and Features

- Support for RC5-64 has been added to the JCE.
- ISO9796-2 signatures have been added to the JCE and lightweight API.
- A more general paddings packge for use with MACs and block ciphers had been aded to the lightweight API. MACs now allow you to specify padding.
- X9.23 Padding has been added to the JCE and lightwieght API. The old PaddedBlockCipher class is now deprecated see org.bouncycastle.crypto.paddings for details.
- SHA-256, SHA-384, and SHA-512 are now added. Note: while the public review period has finished, these algorithms have not yet been standardised, in the event that final standardisation changes the algorithms these implementations will be changed.
- It's now possible to set bag attributes on items to go into a PKCS12 store, using the org.bouncycastle.jce.interfaces.PKCS12BagAttributeCarrier interface.
- More classses have been added to the ASN.1 package for dealing with certificate extensions and CRLs including a CRL generator. Note: the CRL generators should be regarded as under development and subject to change.
- There's now an examples package for the JCE (in addition to the examples in org.bouncycastle.jce.provider.test) - org.bouncycastle.jce.examples. It currently consists of a class showing how to generate a PKCS12 file.
- The X.509 CertificateFactory now includes CRL support. DER or PEM CRLs may be processed.
- The BigInteger library has been written with a view to making it less resource hungry and faster - whether it's fast enough remains to be seen!

### 2.13.1 Version

Release 1.08

### 2.13.2 Defects Fixed

- It wasn't possible to specify an ordering for distinguished names in X509 certificates. This is now supported.
- In some circumstances stream Ciphers in the JCE would cause null pointer exceptions on doFinal. This has been fixed.
- Unpadded ciphers would sometimes buffer the last block of input, even if it could be processed. This has been fixed.
- The netscape certificate request class wouldn't compile under JDK 1.1. This has been fixed.

### 2.13.3 Additional Functionality and Features

- ISO 9796-1 padding is now supported with RSA in the lightweight API and the JCE.
- support classes have been added for reading and writing PKCS 12 files, including a keystore for the JCA.
- The message digests MD4, Tiger, and RIPEMD128 have been added to the JCE and the lightweight API. Note: MD4 and RIPEMD128 have been added for compatability purposes only - we recommend you don't use them for anything new!
- The JDK 1.1 certificate classes didn't conform to the JDK 1.2 API as the collections class was not present. Thanks to a donated collections API this is fixed.

### 2.14.1 Version

Release 1.07

### 2.14.2 Defects Fixed

- It turned out that the setOddParity method in the DESParameter class was indeed doing something odd but not what was intended. This is now fixed. Note:This will affect some PBE encryptions that were carried out with DES, equivalent PBE ciphers to the old PBE DES cipher can be accessed by prepending the work "Broken" in front of the original PBE cipher call. If you want an example of how to deal with this as a migration issue have a look in org.bouncycastle.jce.provider.JDKKeyStore lines 201-291.

### 2.15.1 Version

Release 1.06

### 2.15.2 Defects Fixed

- Diffie-Hellman keys are now properly serialisable as well as encodable.
- Three of the semi-weak keys in the DESParameters, and the DESKeySpec look up table, were incorrect. This has been fixed.
- DESEDE key generators now accept 112 and 168 as the key sizes, as well as 128 and 192 (for those people who don't like to count the parity bits).
- Providing no strength parameter is passed to the DESede key generator in the JCE provider, the provider now generates DESede keys in the k1-k2-k1 format (which is compatible with the Sun reference implementation), otherwise you get what you ask for (3-DES or 2-DES in the minimum number of bytes).
- Base Diffie-Hellman key agreement now works correctly for more than two parties.
- Cipher.getAlgorithmParameters was returing null in cases where a cipher object had generated it's own IV. This has been fixed.
- An error in the key store occasionally caused checks of entry types to result in a null pointer exception. This has been fixed.
- RSA key generator in JCE now recognises RSAKeyGenerationParameterSpec.
- Resetting and resusing HMacs in the lightweight and heavyweight libraries caused a NullPointer exception. This has been fixed.

### 2.15.3 Additional Functionality

- ISO10126Padding is now recognised explicitly for block ciphers as well.
- The Blowfish implementation is now somewhat faster.

### 2.16.1 Version

Release 1.05

### 2.16.2 Defects Fixed

- The DESEDE key generator can now be used to generate 2-Key-DESEDE keys as well as 3-Key-DESEDE keys.
- One of the weak keys in the DESParameters, and the DESKeySpec look up table, was incorrect. This has been fixed.
- The PKCS12 generator was only generating the first 128-160 bits of the key correctly (depending on the digest used). This has been fixed.
- The ASN.1 library was skipping explicitly tagged objects of zero length. This has been fixed.

### 2.16.3 Additional Functionality

- There is now an org.bouncycastle.jce.netscape package which has a class in for dealing with Netscape Certificate Request objects.

### 2.16.4 Additional Notes

Concerning the PKCS12 fix: in a few cases this may cause some backward compatability issues - if this happens to you, drop us a line at feedback-crypto@bouncycastle.org and we will help you get it sorted out.

### 2.17.1 Version

Release 1.04

### 2.17.2 Defects Fixed

- Signatures generated by other providers that include optional null parameters in the AlgorithmIdentifier are now handled correctly by the provider.
- The JCE 1.2.1 states that the names of algorithms associated with the JCE are case insensitive. The class that matches algorithms to names now tries to match the name given with it's equivalent in upper case, before trying to match it as given. If you write a provider and include versions of your algorithm names in uppercase only, this JCE implementation will always match a getInstance regardless of the case of the algorithm passed into the getInstance method.
- If the JCE API and the Provider were in a different class path, the class loader being used sometimes failed to find classes for JCE Ciphers, etc. This has been fixed.
- An error in the ASN.1 library was causing problems serialising Diffie-Hellman keys. This has been fixed.
- The agreement package was left out of the j2me bat file. This has been fixed.
- The BigInteger class for 1.0 and the j2me wasn't able to generate random integers (prime or otherwise). This has been fixed.
- The BigInteger class would sometimes go into a death spiral if the any 32nd bit of an exponent was set when modPow was called. This has been fixed.
- Cipher.getInstance would treat "//" in a transformation as a single "/". This has been fixed.
- PBEWithSHAAndIDEA-CBC was throwing an exception on initialisation. This has been fixed.
- The X509Name class in the asn1.x509 package wasn't initialising its local hash table when the hash table constructor was called. This has been fixed.

### 2.17.3 Additional Functionality

- Added Elliptic Curve DSA (X9.62) - ECDSA - to provider and lightweight library.
- Added Elliptic Curve basic Diffie-Hellman to provider and lightweight library.
- Added DSA support to the provider and the lightweight library.
- Added super class interfaces for basic Diffie-Hellman agreement classes to lightweight library.
- The certificate generators now support ECDSA and DSA certs as well.

### 2.18.1 Version

Release 1.03

### 2.18.2 Defects Fixed

- CFB and OFB modes when specified without padding would insist on input being block aligned. While this seems like the right thing to do, no-one else does it! When specified without padding CFB and OFB now behave in a compatible fashion (a doFinal on a partial block will yield just the data that could be processed). In short, it provides another way of generating cipher text the same length as the plain text.

### 2.19.1 Version

Release 1.02

### 2.19.2 Defects Fixed

- The RSA key pair generator occasionally produced keys 1 bit under the requested size. This is now fixed.

### 2.20.1 Version

Release 1.01

### 2.20.2 Defects Fixed

- Buffered ciphers in lightweight library were not resetting correctly on a doFinal. This has been fixed.

### 2.21.1 Version

Release 1.0

### 2.21.2 Defects Fixed

- JDK1.2 version now works with keytool for certificate generation.
- Certificate toString method no longer throws a null pointer exception if a group [3] extension has not been added.
- Under some circumstances the NullCipher would throw a NullPointerException, this has been fixed.
- Under some circumstances CipherInputStream would throw a NullPointerException, this has been fixed.
- OpenSSL/SSLeay private key encodings would cause an exception to be thrown by the RSA key factory. This is now fixed.
- The Cipher class always used the default provider even when one was specified, this has been fixed.

### 2.21.3 Additional functionality

- Argument validation is much improved.
- An X509KeyUsage class has been added to the JCE class to make it easier to specify the KeyUsage extension on X.509 certificates.
- The library now allows creation of version 1 certificates as well.

### 2.22 Notes

The J2ME is only supported under Windows.

The provided zips/midp_classes.zip is the result of the build-midp.bat script. The palm classes are no longer provided as the midp ones should now work for both.

If you are trying to use the lightweight provider in a JDK 1.0 applet, you need to change the package names for java.math.BigInteger, java.lang.IllegalStateException, and java.security.SecureRandom

The RSA test under JDK 1.0 and J2ME takes a while to run...