Why are the JCE Unlimited Strength not included by default?

Question

Setup

Java doesn't offer out-of-the-box support for the JCE Unlimited Strength Policy Files
This prevents users from using AES-256, the largest key size of a widely-used encryption standard
Not including the policy files leads to many problems:
- Unexpected exceptions
- Unsatisfying workarounds:
  - Just install them
  - Use a different implementation
  - Use reflection that may violate the Java License Agreement
- Breakage after JRE updates
- Confusion after installation
- And more!
All this noise leads to broken and/or buggy programs

Question

Why are these not provided and treated like a black sheep?

I believe it is connected to the export restrictions on cryptography imposed by the US: https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States — Henrik Aasted Sørensen, Feb 10 '17 at 12:43
There is a good explanation of this in: - https://crypto.stackexchange.com/questions/20524/why-are-there-limitations-on-using-encryption-with-keys-beyond-certain-length — Vinicius Biondi, Aug 21 '19 at 16:49

dminuoso · Accepted Answer · 2017-02-10T20:32:43.240

35

As it turns out, it's not strict crypto export laws, but simply that no one got around to it yet.
In fact, it's been planned for a long time to not have to jump through these hoops.
In Java 9, the ceremony will be condensed down to a one-liner: Security.setProperty("crypto.policy", "unlimited");

edited Feb 10 '17 at 20:32

answered Feb 10 '17 at 16:16

dminuoso

963
1
7
10

14

True for Java 8 as well, since 8u151 or so. And, it's also possible to enable without having to change any Java code, by uncommenting "crypto.policy=unlimited" in jre/lib/security/java.security. Here's a one-liner to do that using sed: `sed -i 's/^#crypto.policy=unlimited/crypto.policy=unlimited/' $JAVA_HOME/jre/lib/security/java.security` – joelhardi Jan 19 '18 at 16:09
Before ChaCha20-Poly1305 it probably was not worth the effort. – Yuhong Bao Jun 07 '19 at 08:51
@dminuoso, you saved my life! there was one post that it was using Security.setProperty("crypto.policy", "limited"); instead of "unlimited"... good thing I have encountered your answer here! Heaps of thanks man! – Artanis Zeratul Jun 25 '19 at 02:39

score 19 · Answer 2 · answered Jan 21 '18 at 20:47

Now Unlimited cryptography enabled by default in the JDK

The JDK uses the Java Cryptography Extension (JCE) Jurisdiction Policy files to configure cryptographic algorithm restrictions. Previously, the Policy files in the JDK placed limits on various algorithms. This release ships with both the limited and unlimited jurisdiction policy files, with unlimited being the default. The behavior can be controlled via the new 'crypto.policy' Security property found in the /lib/java.security file. Please refer to that file for more information on this property.

See: http://www.oracle.com/technetwork/java/javase/8u161-relnotes-4021379.html#JDK-8170157

Does this apply to JRE 8u161 as well? – youfu Mar 13 '18 at 09:11 — youfu, Mar 13 '18 at 09:11

score 4 · Answer 3 · answered Feb 10 '17 at 12:46

4

The US has restrictions on the export of cryptographic technology:

https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States

They used to be very strict -- cryptography was classified as munitions, and you could only download the full strength products from the US and other whitelisted countries.

Restrictions have eased up a lot since then, but some remain, and full strength JCE can't be freely distributed everywhere like the JRE, so it's a separate package.

answered Feb 10 '17 at 12:46

Matt Timmermans

53,709
3
46
87

3

It turns out that this was perhaps the case at one point in time, but is not true now. – dminuoso Feb 10 '17 at 16:17
3

Not entirely correct regarding the current situation, but still useful historical information. – user247702 Jun 30 '17 at 12:49

Why are the JCE Unlimited Strength not included by default?

Setup

Question

3 Answers3

Linked