13

I am using com.nimbusds.jose.crypto library in my android client for doing some jwt stuff.

This is what i declare in my gradle file : 

    compile 'com.nimbusds:nimbus-jose-jwt:4.23'

Everything works fine on api >=19, but when I am running the code on api 16, I am getting this exception :

java.lang.NoClassDefFoundError: org.bouncycastle.crypto.engines.AESEngine.

What's the issue here? Why is the class AESENGINE not available on api 16?

Yash
  • 5,225
  • 4
  • 32
  • 65

3 Answers3

15

If you look into the dependecy list of nimbus-jose-jwt there is no bouncycastle library. However, if you look into the source code, and more precisely into the package com.nimbusds.jose.crypto.bc then you can see, that it uses bouncycastle without declaring it as dependency. So the library just assumes the bouncycastle is present.

The solution is to add the dependencies manually. First of all, follow the link to implement a standard way of using bouncycastle on Android.

However that does not solve the problem, because org.bouncycastle.crypto.engines.AESEngine is not in one of those libraries. The solution is to add one more dependency:

dependencies { compile 'org.bouncycastle:bcprov-jdk15on:1.54' }

Then everything should work fine.

SUMMARY:

gradle dependencies should lool like:

dependencies {
    compile 'com.nimbusds:nimbus-jose-jwt:4.23'
    compile 'com.madgag.spongycastle:core:1.54.0.0'
    compile 'com.madgag.spongycastle:prov:1.54.0.0'
    compile 'com.madgag.spongycastle:pkix:1.54.0.0'
    compile 'com.madgag.spongycastle:pg:1.54.0.0'
    compile 'org.bouncycastle:bcprov-jdk15on:1.54'
}

and you should register java.security.Provider:

static {
    Security.insertProviderAt(new org.spongycastle.jce.provider.BouncyCastleProvider(), 1);
}
Community
  • 1
  • 1
R. Zagórski
  • 20,020
  • 5
  • 65
  • 90
2

Android OS is shipped with BouncyCastle already present in it. In API level 16 AESEngine class was not shipped with Android OS(Android decided to ship that class later on).Therefore, it is unable to find that class.

However, at compile time this class is present but at run time it is not.In such cases when you need to use this Class at or below API 16, you have to ship that class/jar with APK.

In addition of writing 

compile "com.madgag.spongycastle:prov:1.54.0.0"

You have to write this also

apk "com.madgag.spongycastle:prov:1.54.0.0"

This will extend the scope of this class from compile time to APK and this will be available in all versions of Android.

Note:You will have to use SpongyCastle instead of BouncyCastle to avoid class name conflicts.

Syed Taruf Naqvi
  • 507
  • 3
  • 18
1

You dependency nimbus-jose-jwt does not have a declared dependency on bouncycastle, thus the error occurs if the environment does not provide a bouncycastle version itself. This happens this case on API Version 16.

While you could say, that this is a problem of the library, this is very likely done on purpose, because Bouncycastle is available for different JDK versions. The Bouncycastle project decided to use different Artifact names to reflect the different JDK Versions instead of reflecting it in the Bouncycastle version number. This leads to problems in dependency management because the version resolver does not recognize the different versions to be actually the same artifact (which they technically are, since they contain a set of the same classes). And cannot resolve the version conflicts and therefore cannot throw version resolve errors e.g. on incompatible major versions.

org.bouncycastle » bcprov-jdk16

vs.

org.bouncycastle » bcprov-jdk15

vs.

org.bouncycastle » bcprov-jdk14

This can lead to multiple concurring versions of bouncycastle on the classpath, which in turn might lead to unpredictable classloader behavior or unpredictable classNotFound /Symbol not found errors (if an old version is used, while a newer is required).

The solution is simple:

Add the required dependency explicitly in your gradle file like this: 

dependencies {compile 'org.bouncycastle:bcprov-jdk16:1.46'}

or

// https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk16
compile group: 'org.bouncycastle', name: 'bcprov-jdk16', version: '1.46'

If further libs are missing, try to identify the library which contains these classes (easiest is to google them) and add them explicitly as well.

fl0w
  • 3,593
  • 30
  • 34