# Bouncy Castle Crypto Package - Release Notes

## 1.0 Introduction

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. The package is organised so that it contains a light-weight API suitable for use in any environment (including the newly released J2ME) with the additional infrastructure to conform the algorithms to the JCE framework.

## 2.0 Release History

### 2.1.1 Version

Release 1.28

### 2.1.2 Defects Fixed

- Signatures on binary encoded S/MIME messages could fail to validate when correct. This has been fixed.
- getExtensionValue() on CRL Entries were returning the encoding of the inner object, rather than the octet string. This has been fixed.
- CertPath implementation now returns an immutable list for a certificate path.
- Generic sorting now takes place in the CertificateFactory.generateCertPath() rather than CertPathValidator.
- DERGeneralizedTime can now handle time strings with milli-seconds.
- Stateful CertPathCheckers were not being initialised in all cases, by the CertPathValidator. This has been fixed.
- PGPUtil file processing methods were failing to close files after processing. This has been fixed.
- A disordered set in a CMS signature could cause a CMS signature to fail to validate when it should. This has been fixed.
- PKCS12 files where both the local key id and friendly name were set on a certificate would not parse correctly. This has been fixed.
- Filetype for S/MIME compressed messages was incorrect. This has been fixed.

### 2.1.3 Additional Features and Functionality

- S/MIME now does canonicalization on non-binary input for signatures.
- Micalgs for the new SHA schemes are now supported.
- Provided and lightweight API now support ISO 7816-4 padding.
- The S/MIME API now directly supports the creation of certificate management messages.
- The provider and the light weight API now support the cipher GOST-28147, the signature algorithms GOST-3410 (GOST-3410 94) and EC GOST-3410 (GOST-3410 2001), the message digest GOST-3411 and the GOST OFB mode (use GOFB).
- CMSSignedDataGenerator will used default implementation of message digest if signature provider doesn't support it.
- Support has been added for the creation of ECDSA certificate requests.
- The provider and the light weigt API now support the WHIRLPOOL message digest.

### 2.1.4 Notes

- Patches for S/MIME binary signatures and canonicalization were actually applied in 1.27, but a couple of days after the release - if the class CMSProcessableBodyPartOutbound is present in the package org.bouncycastle.mail.smime you have the patched 1.27. We would recommend upgrading to 1.28 in any case as some S/MIME 3.1 recommendations have also been introduced for header creation.
- GOST private keys are probably not encoding correctly and can be expected to change.

### 2.2.1 Version

Release 1.27

### 2.2.2 Defects Fixed

- Typos in the provider which pointed Signature algorithms SHA256WihRSA, SHA256WihRSAEncryption, SHA384WithRSA, SHA384WithRSAEncryption, SHA512WithRSA, and SHA512WithRSAEncryption at the PSS versions of the algorithms have been fixed. The correct names for the PSS algorithms are SHA256withRSAandMGF1, SHA384withRSAandMGF1, and SHA512withRSAandMGF1.
- X509CertificateFactory failed under some circumstances to reset properly if the input stream being passed to generateCertificate(s)() changed, This has been fixed.
- OpenPGP BitStrength for DSA keys was being calculated from the key's generator rather than prime. This has been fixed.
- Possible infinite loop in ASN.1 SET sorting has been removed.
- SHA512withRSAandMGF1 with a zero length salt would cause an exception if used with a 1024 bit RSA key. This has been fixed.
- Adding an Exporter to a PGPSubpacketVector added a Revocable instead. This has been fixed.
- AttributeCertificateIssuer.getPrincipal() could throw an ArrayStoreException. This has been fixed.
- CertPathValidator now guarantees to call any CertPathCheckers passed in for each certificate.
- TSP TimeStampToken was failing to validate time stamp tokens with the issuerSerial field set in the ESSCertID structure. This has been fixed.
- Path validation in environments with frequently updated CRLs could occasionally reject a valid path. This has been fixed.

### 2.2.3 Additional Features and Functionality

- Full support has been added for the OAEPParameterSpec class to the JDK 1.5 povider.
- Full support has been added for the PSSParameterSpec class to the JDK 1.4 and JDK 1.5 providers.
- Support for PKCS1 signatures for SHA-256, SHA-384, and SHA-512 has been added to CMS.
- PGPKeyRingCollection classes now support partial matching of user ID strings.
- This release disables the quick check on the IV for a PGP public key encrypted message in order to help prevent applications being vunerable to oracle attacks.
- The CertPath support classes now support PKCS #7 encoding.
- Point compression can now be turned off when encoding elliptic curve keys.

### 2.2.4 Changes that may affect compatibility

- org.bouncycastle.jce.interfaces.ElGamalKey.getParans() has been changed to getParameters() to avoid clashes with a JCE interface with the same method signature.
- org.bouncycastle.jce.interfaces.ECKey.getParams() has been changed in JDK 1.5 to getParameters() to avoid clashes with a JCE interface with the same method signature. The getParams() method in pre-1.5 has been deprecated.
- SHA256WithRSAEncryption, SHA384WithRSAEncryption, SHA512WithRSAEncryption now refer to their PKCS #1 V1.5 implementations. If you were using these previously you should use SHA256WithRSAAndMGF1, SHA384WithRSAAndMGF1, or SHA512WithRSAAndMGF1.

### 2.3.1 Version

Release 1.26

### 2.3.2 Defects Fixed

- The X.509 class UserNotice assumed some of the optional fields were not optional. This has been fixed.
- BCPGInputStream would break on input packets of 8274 bytes in length. This has been fixed.
- Public key fingerprints for PGP version 3 keys are now correctly calculated.
- ISO9796-2 PSS would sometimes throw an exception on a correct signature. This has been fixed.
- ASN1Sets now properly sort their contents when created from scratch.
- A bug introduced in the CertPath validation in the last release which meant some certificate paths would validate if they were invalid has been fixed.

### 2.3.3 Additional Features and Functionality

- Support for JDK 1.5 naming conventions for OAEP encryption and PSS signing has been added.
- Support for Time Stamp Protocol (RFC 3161) has been added.
- Support for Mozilla's PublicKeyAndChallenge key certification message has been added.
- OpenPGP now supports key rings containing GNU_DUMMY_S2K.
- Support for the new versions (JDK 1.4 and later) of PBEKeySpec has been added to the providers.
- PBEWithMD5AndRC2, PBEWithSHA1AndRC2 now generate keys rather than exceptions.
- The BigInteger implementation has been further optimised to take more advantage of the Montgomery number capabilities.

### 2.3.4 JDK 1.5 Changes

- The JDK 1.5 version of the provider now supports the new Elliptic Curve classes found in the java.security packages. Note: while we have tried to preserve some backwards compatiblity people using Elliptic curve are likely to find some minor code changes are required when moving code from JDK 1.4 to JDK 1.5 as the java.security APIs have changed.

### 2.4.1 Version

Release 1.25

### 2.4.2 Defects Fixed

- In some situations OpenPGP would overread when a stream had been broken up into partial blocks. This has been fixed.
- Explicitly setting a key size for RC4 in the CMS library would cause an exception. This has been fixed.
- getSignatures() on PGPPublicKey would throw a ClassCastException in some cases. This has been fixed.
- Encapsulated signed data was been generated with the wrong mime headers, this has been fixed.
- The isSignature method on PGPSecretKey now correctly identifies signing keys.
- An interoperability issue with DH key exchange between the Sun JCE provider and the BC provider, concerning sign bit expansion, has been fixed.
- The X509CertificateFactory would fail to reset correctly after reading an ASN.1 certificate chain. This has been fixed.
- CertPathValidator now handles unsorted lists of certs.
- The PGPSignatureGenerator would sometimes throw an exception when adding hashed subpackets. This has been fixed.
- Ordered equality in X509Name was not terminating as early as possible. This has been fixed.
- getBitStrength for PGPPublicKeys was returning the wrong value for ElGamal keys. This has been fixed.
- getKeyExpirationTime/getSignatureExpirationTime was returning a Date rather than a delta. This isn't meaningful as a Date and has been changed to a long.
- the crlIssuer field in DistributionPoint name was encoding/decoding incorrectly. This has been fixed.
- X509Name now recognises international characters in the input string and stores them as BMP strings.
- Parsing a message with a zero length body with SMIMESigned would cause an exception. This has been fixed.
- Some versions of PGP use zeros in the data stream rather than a replication of the last two bytes of the iv as specified in the RFC to determine if the correct decryption key has been found. The decryption classes will now cope with both.

### 2.4.3 Additional Features and Functionality

- Support for extracting signatures based on PGP user attributes has been added to PGPPublicKey.
- BCPGArmoredInputStream should cope with plain text files better.
- The OpenPGP library can now create indefinite length streams and handle packets greater than (2^32 - 1) in length.
- Direct support for adding SignerUserID and PrimaryUserID has been added to the PGPSignatureSubpacketGenerator.
- Support for ISO-9796-2/PSS has been added to the lightweight API.
- API support for extracting recovered messages from signatures that support message recovery has been added to the lightweight API.
- String value conversion in a DN being processed by X509Name is now fully configurable.
- It is now possible to create new versions of CMSSignedData objects without having to convert the original object down to its base ASN.1 equivalents.
- Support for adding PGP revocations and other key signatures has been added.
- Support for SHA-224 and SHA224withRSA has been added.
- Trailing bit complement (TBC) padding has been added.
- OID components of up to 2^63 bits are now supported.

### 2.5.1 Version

Release 1.24

### 2.5.2 Defects Fixed

- OpenPGP Secret key rings now parse key rings with user attribute packets in them correctly.
- OpenPGP Secret key rings now parse key rings with GPG comment packets in them.
- X509Name and X509Principal now correctly handle BitStrings.
- OpenPGP now correctly recognises RSA signature only keys.
- When re-encoding PGP public keys taken off secret keys getEncoded would sometimes throw a NullPointerException. This has been fixed.
- A basic PKCS12 file with a single key and certificate, but no attributes, would cause a null pointer exception. This has been fixed.
- Signature verification now handles signatures where the parameters block is missing rather than NULL.
- Lightweight CBCBlockCipherMac was failing to add padding if padding was being explicitly provided and data length was a multiple of the block size. This has been fixed.
- ZIP compression in PGP was failing to compress data in many cases. This has been fixed.
- Signatures were occassionally produced with incorrect padding in their associated bit strings, this has been fixed.
- An encoding error introduced in 1.23 which affected generation of the KeyUsage extension has been fixed.

### 2.5.3 Additional Features and Functionality

- PKCS12 keystore now handles single key/certificate files without any attributes present.
- Support for creation of PGPKeyRings incorporating sub keys has been added.
- ZeroPadding for encrypting ASCII data has been added.

### 2.6.1 Version

Release 1.23

### 2.6.2 Defects Fixed

- Reading a PGP Secret key file would sometimes cause a class cast exception. This has been fixed.
- PGP will now read SecretKeys which are encrypted with the null algorithm.
- PGP ObjectFactory will recognise Marker packets.
- BasicConstraints class now handles default empty sequences correctly.
- S2K Secret Key generation now supported in OpenPGP for keys greater than 160 bits, a bug causing it to occasionally generate the wrong key has been fixed.
- OpenPGP implementation can now read PGP 8 keys.
- Decoding issues with Secret Sub Keys should now be fixed.
- PGP would occasionally unpack ElGamal encrypted data incorrectly, this has been fixed.
- OCSP TBSRequest now uses abreviated encoding if the default version is used.
- X509Name class will now print names with nested pairs in component sets correctly.
- RC4 now resets correctly on doFinal.

### 2.6.3 Additional Features and Functionality

- PGP V3 keys and V3 signature generation is now supported.
- Collection classes have been added for representing files of PGP public and secret keys.
- PEMReader now supports "RSA PUBLIC KEY".
- RipeMD256 and RipeMD320 have been added.
- Heuristic decoder stream has been added to OpenPGP which "guesses" how the input is constructed.
- ArmoredInputStream now recognises clear text signed files.
- ArmoredOutputStream now provides support for generating clear text signed files.
- Support has been added to CMS for RipeMD128, RipeMD160, and RipeMD256.
- Support for generating certification directly and editing PGP public key certifications has been added.
- Support has been added for modification detection codes to the PGP library.
- Examples have been rewritten to take advantage of the above.
- SMIMESigned can now covert data straight into a mime message.
- DERGeneralizedTime getTime() method now handles a broader range of input strings.

### 2.7.1 Version

Release 1.22

### 2.7.2 Defects Fixed

- Generating DSA signatures with PGP would cause a class cast exception, this has been fixed.
- PGP Data in the 192 to 8383 byte length would sometimes be written with the wrong length header. This has been fixed.
- The certificate factory would only parse the first certificate in a PKCS7 object. This has been fixed.
- getRevocationReason() in RevokedStatus in OCSP would throw an exception for a non-null reason, rather than a null one. This has been fixed.
- PSS signature verification would fail approximately 0.5 % of the time on correct signatures. This has been fixed.
- Encoding of CRL Distribution Points now always works.

### 2.7.3 Additional Features and Functionality

- Additional methods for getting public key information have been added to the PGP package.
- Some support for user attributes and the image attribute tag has been added.
- Support for the AuthorityInformationAccess extension has been added.
- Support for ElGamal encryption/decryption has been added to the PGP package.

### 2.8.1 Version

Release 1.21

### 2.8.2 Defects Fixed

- The CertPath validator would fail for some valid CRLs. This has been fixed.
- AES OIDS for S/MIME were still incorrect, this has been fixed.
- The CertPathBuilder would sometimes throw a NullPointerException looking for an issuer. This has been fixed.
- The J2ME BigInteger class would sometimes go into an infinite loop generating prime numbers. This has been fixed.
- DERBMPString.equals() would throw a class cast exception. This has been fixed.

### 2.8.3 Additional Features and Functionality

- PEMReader now handles public keys.
- OpenPGP/BCPG should now handle partial input streams. Additional methods for reading subpackets off signatures.
- The ASN.1 library now supports policy qualifiers and policy info objects.

### 2.9.1 Version

Release 1.20

### 2.9.2 Defects Fixed

- BigInteger toString() in J2ME/JDK1.0 now produces same output as the Sun one.
- RSA would throw a NullPointer exception with doFinal without arguments. This has been fixed.
- OCSP CertificateID would calculate wrong issuer hash if issuer cert was not self signed. This has been fixed.
- Most of response generation in OCSP was broken. This has been fixed.
- The CertPath builder would sometimes go into an infinite loop on some chains if the trust anchor was missing. This has been fixed.
- AES OIDS were incorrect, this has been fixed.
- In some cases BC generated private keys would not work with the JSSE. This has been fixed.

### 2.9.3 Additional Features and Functionality

- Support for reading/writing OpenPGP public/private keys and OpenPGP signatures has been added.
- Support for generating OpenPGP PBE messages and public key encrypted messages has been added.
- Support for decrypting OpenPGP messages has been added.
- Addition of a Null block cipher to the light weight API.

### 2.10.1 Version

Release 1.19

### 2.10.2 Defects Fixed

- The PKCS12 store would throw an exception reading PFX files that had attributes with no values. This has been fixed.
- RSA Private Keys would not serialise if they had PKCS12 bag attributes attached to them, this has been fixed.
- GeneralName was encoding OtherName as explicitly tagged, rather than implicitly tagged. This has been fixed.
- ASN1 parser would sometimes mistake an implicit null for an implicit empty sequence. This has been fixed.

### 2.10.3 Additional Features and Functionality

- S/MIME and CMS now support the draft standard for AES encryption.
- S/MIME and CMS now support setable key sizes for the standard algorithms.
- S/MIME and CMS now handle ARC4/RC4 encrypted messages.
- The CertPath validator now passes the NIST test suite.
- A basic OCSP implementation has been added which includes request generation and the processing of responses. Response generation is also provided, but should be treated as alpha quality code.
- CMS now attempts to use JCA naming conventions in addition to the OID name in order to find algorithms.

### 2.11.1 Version

Release 1.18

### 2.11.2 Defects Fixed

- DESKeySpec.isParityAdjusted in the clean room JCE could go into an infinite loop. This has been fixed.
- The SMIME API would end up throwing a class cast exception if a MimeBodyPart was passed in containing a MimeMultipart. This is now fixed.
- ASN1InputStream could go into an infinite loop reading a truncated input stream. This has been fixed.
- Seeding with longs in the SecureRandom for the J2ME and JDK 1.0, only used 4 bytes of the seed value. This has been fixed.

### 2.11.3 Additional Features and Functionality

- The X.509 OID for RSA is now recognised by the provider as is the OID for RSA/OAEP.
- Default iv's for DES are now handled correctly in CMS.
- The ASN.1 classes have been updated to use the generic ASN1* classes where possible.
- A constructor has been added to SMIMESigned to simplify the processing of "application/pkcs7-mime; smime-type=signed-data;" signatures.
- Diffie-Hellman key generation is now faster in environments using the Sun BigInteger library.

### 2.12.1 Version

Release 1.17

### 2.12.2 Defects Fixed

- Reuse of an CMSSignedObject could occassionally result in a class cast exception. This has been fixed.
- The X.509 DistributionPointName occasionally encoded incorrectly. This has been fixed.
- BasicConstraints construction would break if an ASN.1 sequence was used with only the required parameter. This has been fixed.
- The DERObject constructor in OriginatorIdentifierOrKey was leaving the id field as null. This has been fixed.

### 2.12.2 Additional Functionality and Features

- RC2 now supports the full range of parameter versions and effective key sizes.
- CompressedData handling has been added to CMS/SMIME.
- The 1.4 version now allows X500Principles to be generated directly from CRLs.
- SMIME objects now support binary encoding. The number of signature types recognised has been increased.
- CMS can create signed objects with encapsulated data. Note: while this was been done we realised we could simplify things, we did and for the most part people won't notice, other than the occassional reference to CMSSignable will need to be replaced with CMSProcessable.
- X509Name and X509Principal now support forward and reverse X509Name to string conversion, with changeable lookup tables for converting OIDs into strings. Both classes also now allow the direction of encoding to be set when a string is converted as well as changeable lookup tables for string to OID conversion.

### 2.13.1 Version

Release 1.16

### 2.13.2 Defects Fixed

- CRLS were only working for UTC time constructed Time objects, this has been fixed.
- KeyUsage and ReasonFlags sometimes encoded longer than necessary. This has been fixed.
- BER encoded sets are now recognised and dealt with.
- Encoding issues in CMS which were causing problems with backwards compatibility with older CMS/SMIME clients have been fixed.
- KeyFactory now allows for creation of RSAKey*Spec classes.
- The X509CertSelector in the clean room CertPath API is now less likely to throw a NullPointerException at the wrong time.
- Macs now clone correctly in the clean room JCE.

### 2.13.2 Additional Functionality and Features

- PGPCFB support has been added to the provider and the lightweight API.
- There are now three versions of the AESEngine, all faster than before, with the largest footprint one being the fastest. The JCE AES now refers to the fastest.
- The 1.4 version of the library now allows for X500Principals to be generated directly from certificates.
- X509Name has been extended to parse numeric oids, "oid." oids, and to recognise the LDAP UID.
- Immutable sequences and sets have been introduced to the ASN.1 package.
- The SMIME/CMS ASN.1 base classes have been rewritten to reduce the size of the package for use with the lightweight API.
- The SMIME/CMS api's have been rewritten to allow them to take advantage of the Cert Path API, remove code suited to inclusion in the provider, and to support multiple recipients/signers.

### 2.14.1 Version

Release 1.15

### 2.14.2 Defects Fixed

- The base string for the oids in asn1.x509.KeyPurposeId was incorrect. This has been fixed.
- MimeBodyParts in the SMIME Generator did not have their Content-Type properly set up after decryption. This has been fixed.
- If a X.509 certificate did not have all the keyUsage extension bits set, the provider wasn't padding the return value of the key usage extension to 8 booleans in length. This has been fixed.
- In some cases the simple BC keystore allowed overwriting of an alias with one of the same name. This has been fixed.
- The key schedule for RC5-64 was not always being calculated correctly. This has been fixed.
- On reset buffered blockcipher was only partially erasing the previous buffer. This has been fixed.
- All lightweight mac classes now do a reset on doFinal.
- ASN.1 object identifiers wouldn't encode the first byte correctly if the OID started with 2 and the second number was greater than 47. This has been fixed.
- If a key had PKCS9 attributes associated with it on storage they took precedence over the local alias used to add the key to the PKCS12 key store. The local name now takes precedence.
- ReasonFlags now correctly encodes.

### 2.14.2 Additional Functionality and Features

- The PKCS12 key store now handles key bags in encryptedData bags.
- The X509NameTokenizer now handles for '\' and '"' characters.
- SMIME v2 compliance has been added. Use setVersion(2) in the generator classes.
- The ASN.1 library now supports ENUMERATED, UniversalString and the X.509 library support for CRLs now includes CRLReason, and some elements of CertificatePolicies.
- Both the provider and the lightweight library now support a basic SIC mode for block ciphers.

### 2.15.1 Version

Release 1.14

### 2.15.2 Defects Fixed

- there was a bug in the BigInteger right shifting for > 31 bit shifts. This has been fixed.
- x509 name had it's equality test based on the order of the directory elements, this has been fixed.
- the mode used with the RSA cipher in KeyTransRecipientInfoParser in the smime implementation was not compatible with the Sun JCE. This has been fixed.
- PKCS7 SignedData now supports single length signing chains.
- When a root certificate had a different issuer id from the subject id, or had it's own AuthorityKeyExtension the PKCS12 key store would drop the root certificate from the certificate chain. This has been fixed.
- The PKCS10 CertificationRequestInfo class always expected at least one attribute. This has been fixed.
- UTF8 strings are now correctly recognised.
- The Tiger implementation was producing results in reverse byte order for each of the 3 words making up the digest. This has been fixed.
- asn1.x509.ExtendedKeyUsage used to through a null pointer exception on construction. This has been fixed.

### 2.15.3 Additional Functionality and Features

- The BigInteger library now uses Montgomery numbers for modPow and is substantially faster.
- SMIMECapabilities, and SMIMEEncryptionKeyPreference attributes added to S/MIME.
- Increased range of key sizes available in S/MIME.
- getInstance(ASN1TaggedObject, boolean) methods have been added to most ASN1 types. These deal with implicit/explicit tagging ambiguities with constructed types.
- Added EncryptedPrivateKeyInfo object to the clean room JCE.
- A PEMReader has been added for handling some of the openSSL PEM files.
- The X.509 certificate factory supports a wider range of encodings and object identifiers.

### 2.16.1 Version

Release 1.13

### 2.16.2 Defects Fixed

- The TBSCertificate object in the ASN.1 library now properly implements the Time object, rather returning UTC time.
- The DESedeKeyGenerator now supports 112 and 168 bit key generation.
- Certificates with the keyId set to null in the AuthorityKeyIdentifier extensions would sometimes cause the PKCS12 store to throw a NullPointer exception. This has been fixed.
- toByteArray in the big integer class was not always producing correct results for negative numbers. This has been Fixed.

### 2.16.3 Additional Functionality and Features

- The key to keySpec handling of the secret key factories has been improved.
- There is now a SMIME implementation and a more complete CMS implementation (see CONTRIBUTORS file for additonal details).
- A CertPath implementation that runs under jdk1.1 and jdk1.4 has also being contributed. A work around to allow it to be used with jdk1.2 and jdk1.3 has also been added. Note: the implementation is not quite complete because policymapping, name and subtree contraints are not yet implemented.
- The API now supports the generation of PKCS7 signed objects. Note: this is still beta code - one known issue is that it doesn't support single length certificate chains for signing keys.

### 2.17.1 Version

Release 1.12

### 2.17.2 Defects Fixed

- The ASN.1 library was unable to read an empty set object. This has been fixed.
- Returning sets of critical and non-critical extensions on X.509 certificates could result in a null pointer exception if the certificate had no extensions. This has been fixed.
- The BC JKS implementation does not follow the conventional one - it has been renamed BKS, an attempt to create a JKS keystore using the BC provider will now result in an exception.
- The PKCS 10 generator verify(provider) method was ignoring the provider when generating the public key. This has been fixed.
- The PKCS12 store would throw an OutOfMemoryException if passed a non-PKCS12 file. This has been fixed.
- In the case where there was no AuthorityKeyIdentifier the PKCS12 store would fail to find certificates further up the signing chain. The store now uses the IssuerDN if no AuthorityKeyIdentifier is specified and the IssuerDN is different from the SubjectDN,
- PKCS10/CertificationRequestInfo objects with only a single attribute wer not being handled properly. This has been fixed.
- getExtensionValue for X.509 CRLs was returning the value of the DER-Encoded octet string not the DER-Encoded octet string as required. This has been fixed.
- the IV algorithm parameters class would improperly throw an exception on initialisation. This has been fixed.

### 2.17.3 Additional Functionality and Features

- The AESWrap ciphers will now take IV's.
- The DES-EDEWrap algorithm described in http://www.ietf.org/internet-drafts/draft-ietf-smime-key-wrap-01.txt is now supported.
- Support for the ExtendedKeyUsageExtension and the KeyPurposeId has been added.
- The OID based alias for DSA has been added to the JCE provider.
- BC key stores now implement the BCKeyStore interface so you can provide your own source of randomness to a key store.
- The ASN.1 library now supports GeneralizedTime.
- HMACSHA256, HMACSHA384, and HMACSHA512 are now added.
- PSS has been added to the JCE, PSS and ISO9796 signers in the lightweight api have been rewritten so they can be used incrementally. SHA256withRSA, SHA384withRSA, and SHA512withRSA have been added.
- Base support for CMS (RFC 2630) is now provided (see CONTRIBUTORS file for details).

### 2.18.1 Version

Release 1.11

### 2.18.2 Defects Fixed

- X9.23 padding of MACs now works correctly with block size aligned data.
- Loading a corrupted "UBER" key store would occassionally cause the appearance of hanging. This has been fixed.
- Loading a PKCS12 store where not all certificates had PKCS9 attributes assigned to them would cause a NullPointerException. This has been fixed.
- The PKCS12 store wasn't correctly recovering certificate chains of length less than 2 on calling the getCertificateChain method. This has been fixed.
- Lone certificates were not been stored in the PKCS12 store. This has been fixed.
- CFB and OFB modes weren't padding iv's more than 1 byte less than the block size of the cipher if the mode was reused with a shorter IV. This has been fixed.
- IV handling and block size return values for CFB and OFB modes wasn't being handled in the same way as the Sun reference implementation. This has been fixed.
- CertificateInfoRequests were not handling null attributes correctly. This has been fixed.
- Tags for the X.509 GeneralName structure were wrongly encoded. This has been fixed.
- getExtensionValue for X.509 certificates was returning the value of the DER-Encoded octet string not the DER-Encoded octet string as required. This has been fixed.
- reset on the version 3 X.509 certificate generator was not flushing the extensions. This has been fixed.
- The NetscapeCert type bits were reversed! This has been fixed.

### 2.18.3 Additional Functionality and Features

- The lightweight API and the JCE provider now support ElGamal.
- X509Principal, and X509Name now supports the "DC" attribute and the creation of directory names from vectors.
- RSA-PSS signature padding has been added to the lightweight API.
- EC Public/Private keys are now encoded in accordance with SEC 1. The library will still read older keys as well.
- Added PKCS12-DEF a pkcs12 based key store which works around a bug in the Sun keytool - it always uses the default provider for creating certificates.
- A cut down version of the Rijndael has been added that provides the functionality required to conform the the AES. It is designed to fully support FIPS-197. A fips AES wrapper (AESWrap in the JCE, AESWrapEngine in the lightweight library has also been added).
- Elliptic curve routines now handle uncompressed points as well as the compressed ones.

### 2.18.4 Other changes

- As the range of public key types supported has expanded the getPublicKey method on the SubjectPublicKeyInfo class is not always going to work. The more generic method getPublicKeyData has been added and getPublicKey now throws an IOException if there is a problem.

### 2.19.1 Version

Release 1.10

### 2.19.2 Defects Fixed

- The PKCS12 Key Store now interoperates with the JDK key tool. Note: this does mean the the key name passed to the setKeyEntry calls has become significant.
- The "int" constructor for DERInteger only supported ints up to 128. This has been fixed.
- The ASN.1 input streams now handle zero-tagged zero length objects correctly.

### 2.19.3 Additional Functionality and Features

- The JCE Provider and the lightweight API now support Serpent, CAST5, and CAST6.
- The JCE provider and the lightweight API now has an implementation of ECIES. Note: this is based on a draft, don't use it for anything that needs to be kept long term as it may be adjusted.
- Further work has been done on performance - mainly in the symmetric ciphers.
- Support for the generation of PKCS10 certification requests has been added.

### 2.20.1 Version

Release 1.09

### 2.20.2 Defects Fixed

- failure to pass in an RC5 parameters object now results in an exception at the upper level of the JCE, rather than falling over in the lightweight library.
- ISO10126Padding now incorporates the correct amount of random data.
- The PKCS12 key store wasn't picking up certificate chains properly when being used to write PKCS12 files. This has been fixed.
- The Twofish engine would call System.exit if the key was too large. This has been fixed.
- In some cases the ASN.1 library wouldn't handle implicit tagging properly. This has been fixed.

### 2.20.3 Additional Functionality and Features

- Support for RC5-64 has been added to the JCE.
- ISO9796-2 signatures have been added to the JCE and lightweight API.
- A more general paddings packge for use with MACs and block ciphers had been aded to the lightweight API. MACs now allow you to specify padding.
- X9.23 Padding has been added to the JCE and lightwieght API. The old PaddedBlockCipher class is now deprecated see org.bouncycastle.crypto.paddings for details.
- SHA-256, SHA-384, and SHA-512 are now added. Note: while the public review period has finished, these algorithms have not yet been standardised, in the event that final standardisation changes the algorithms these implementations will be changed.
- It's now possible to set bag attributes on items to go into a PKCS12 store, using the org.bouncycastle.jce.interfaces.PKCS12BagAttributeCarrier interface.
- More classses have been added to the ASN.1 package for dealing with certificate extensions and CRLs including a CRL generator. Note: the CRL generators should be regarded as under development and subject to change.
- There's now an examples package for the JCE (in addition to the examples in org.bouncycastle.jce.provider.test) - org.bouncycastle.jce.examples. It currently consists of a class showing how to generate a PKCS12 file.
- The X.509 CertificateFactory now includes CRL support. DER or PEM CRLs may be processed.
- The BigInteger library has been written with a view to making it less resource hungry and faster - whether it's fast enough remains to be seen!

### 2.21.1 Version

Release 1.08

### 2.21.2 Defects Fixed

- It wasn't possible to specify an ordering for distinguished names in X509 certificates. This is now supported.
- In some circumstances stream Ciphers in the JCE would cause null pointer exceptions on doFinal. This has been fixed.
- Unpadded ciphers would sometimes buffer the last block of input, even if it could be processed. This has been fixed.
- The netscape certificate request class wouldn't compile under JDK 1.1. This has been fixed.

### 2.21.3 Additional Functionality and Features

- ISO 9796-1 padding is now supported with RSA in the lightweight API and the JCE.
- support classes have been added for reading and writing PKCS 12 files, including a keystore for the JCA.
- The message digests MD4, Tiger, and RIPEMD128 have been added to the JCE and the lightweight API. Note: MD4 and RIPEMD128 have been added for compatibility purposes only - we recommend you don't use them for anything new!
- The JDK 1.1 certificate classes didn't conform to the JDK 1.2 API as the collections class was not present. Thanks to a donated collections API this is fixed.

### 2.22.1 Version

Release 1.07

### 2.22.2 Defects Fixed

- It turned out that the setOddParity method in the DESParameter class was indeed doing something odd but not what was intended. This is now fixed. Note:This will affect some PBE encryptions that were carried out with DES, equivalent PBE ciphers to the old PBE DES cipher can be accessed by prepending the work "Broken" in front of the original PBE cipher call. If you want an example of how to deal with this as a migration issue have a look in org.bouncycastle.jce.provider.JDKKeyStore lines 201-291.

### 2.23.1 Version

Release 1.06

### 2.23.2 Defects Fixed

- Diffie-Hellman keys are now properly serialisable as well as encodable.
- Three of the semi-weak keys in the DESParameters, and the DESKeySpec look up table, were incorrect. This has been fixed.
- DESEDE key generators now accept 112 and 168 as the key sizes, as well as 128 and 192 (for those people who don't like to count the parity bits).
- Providing no strength parameter is passed to the DESede key generator in the JCE provider, the provider now generates DESede keys in the k1-k2-k1 format (which is compatible with the Sun reference implementation), otherwise you get what you ask for (3-DES or 2-DES in the minimum number of bytes).
- Base Diffie-Hellman key agreement now works correctly for more than two parties.
- Cipher.getAlgorithmParameters was returing null in cases where a cipher object had generated it's own IV. This has been fixed.
- An error in the key store occasionally caused checks of entry types to result in a null pointer exception. This has been fixed.
- RSA key generator in JCE now recognises RSAKeyGenerationParameterSpec.
- Resetting and resusing HMacs in the lightweight and heavyweight libraries caused a NullPointer exception. This has been fixed.

### 2.23.3 Additional Functionality

- ISO10126Padding is now recognised explicitly for block ciphers as well.
- The Blowfish implementation is now somewhat faster.

### 2.24.1 Version

Release 1.05

### 2.24.2 Defects Fixed

- The DESEDE key generator can now be used to generate 2-Key-DESEDE keys as well as 3-Key-DESEDE keys.
- One of the weak keys in the DESParameters, and the DESKeySpec look up table, was incorrect. This has been fixed.
- The PKCS12 generator was only generating the first 128-160 bits of the key correctly (depending on the digest used). This has been fixed.
- The ASN.1 library was skipping explicitly tagged objects of zero length. This has been fixed.

### 2.24.3 Additional Functionality

- There is now an org.bouncycastle.jce.netscape package which has a class in for dealing with Netscape Certificate Request objects.

### 2.24.4 Additional Notes

Concerning the PKCS12 fix: in a few cases this may cause some backward compatability issues - if this happens to you, drop us a line at feedback-crypto@bouncycastle.org and we will help you get it sorted out.

### 2.25.1 Version

Release 1.04

### 2.25.2 Defects Fixed

- Signatures generated by other providers that include optional null parameters in the AlgorithmIdentifier are now handled correctly by the provider.
- The JCE 1.2.1 states that the names of algorithms associated with the JCE are case insensitive. The class that matches algorithms to names now tries to match the name given with it's equivalent in upper case, before trying to match it as given. If you write a provider and include versions of your algorithm names in uppercase only, this JCE implementation will always match a getInstance regardless of the case of the algorithm passed into the getInstance method.
- If the JCE API and the Provider were in a different class path, the class loader being used sometimes failed to find classes for JCE Ciphers, etc. This has been fixed.
- An error in the ASN.1 library was causing problems serialising Diffie-Hellman keys. This has been fixed.
- The agreement package was left out of the j2me bat file. This has been fixed.
- The BigInteger class for 1.0 and the j2me wasn't able to generate random integers (prime or otherwise). This has been fixed.
- The BigInteger class would sometimes go into a death spiral if the any 32nd bit of an exponent was set when modPow was called. This has been fixed.
- Cipher.getInstance would treat "//" in a transformation as a single "/". This has been fixed.
- PBEWithSHAAndIDEA-CBC was throwing an exception on initialisation. This has been fixed.
- The X509Name class in the asn1.x509 package wasn't initialising its local hash table when the hash table constructor was called. This has been fixed.

### 2.25.3 Additional Functionality

- Added Elliptic Curve DSA (X9.62) - ECDSA - to provider and lightweight library.
- Added Elliptic Curve basic Diffie-Hellman to provider and lightweight library.
- Added DSA support to the provider and the lightweight library.
- Added super class interfaces for basic Diffie-Hellman agreement classes to lightweight library.
- The certificate generators now support ECDSA and DSA certs as well.

### 2.26.1 Version

Release 1.03

### 2.26.2 Defects Fixed

- CFB and OFB modes when specified without padding would insist on input being block aligned. When specified without padding CFB and OFB now behave in a compatible fashion (a doFinal on a partial block will yield just the data that could be processed). In short, it provides another way of generating cipher text the same length as the plain text.

### 2.27.1 Version

Release 1.02

### 2.27.2 Defects Fixed

- The RSA key pair generator occasionally produced keys 1 bit under the requested size. This is now fixed.

### 2.28.1 Version

Release 1.01

### 2.28.2 Defects Fixed

- Buffered ciphers in lightweight library were not resetting correctly on a doFinal. This has been fixed.

### 2.29.1 Version

Release 1.0

### 2.29.2 Defects Fixed

- JDK1.2 version now works with keytool for certificate generation.
- Certificate toString method no longer throws a null pointer exception if a group [3] extension has not been added.
- Under some circumstances the NullCipher would throw a NullPointerException, this has been fixed.
- Under some circumstances CipherInputStream would throw a NullPointerException, this has been fixed.
- OpenSSL/SSLeay private key encodings would cause an exception to be thrown by the RSA key factory. This is now fixed.
- The Cipher class always used the default provider even when one was specified, this has been fixed.

### 2.29.3 Additional functionality

- Argument validation is much improved.
- An X509KeyUsage class has been added to the JCE class to make it easier to specify the KeyUsage extension on X.509 certificates.
- The library now allows creation of version 1 certificates as well.

### 2.30 Notes

The J2ME is only supported under Windows.

If you are trying to use the lightweight provider in a JDK 1.0 applet, you need to change the package names for java.math.BigInteger, java.lang.IllegalStateException, and java.security.SecureRandom

The RSA test under JDK 1.0 and J2ME takes a while to run...