Download Bouncy Castle for Java

Additional Features and Functionality

• In line with JVM changes, KEM support has been backported to Java 17.
• BCJSSE: Configurable (client) early key_share groups via BCSSLParameters.earlyKeyShares or “org.bouncycastle.jsse.client.earlyKeyShares” system property.
• BCJSSE: Support for curveSM2MLKEM768 hybrid NamedGroup in TLS 1.3 per draft-yang-tls-hybrid-sm2-mlkem-03.
• BCJSSE: Log when default cipher suites are disabled.
• BCJSSE: Experimental support for ShangMi crypto in TLS 1.3 per RFC 8998 (not enabled by default).
• CMS: Added CMSAuthEnvelopedDataStreamGenerator.open taking an explicit content type.
• HKDF: Provider support for HKDFParameterSpec.Expand.
• Added initial support for RFC 9380 (Hashing to Elliptic Curves); see org.bouncycastle.crypto.hash2curve .
• PKCS12: Added default max iteration count of 5,000,000 (configurable via “org.bouncycastle.pkcs12.max_it_count” property).
• TLS: Use javax.crypto.KEM API (when available) to access ML-KEM implementation (incl. hybrids).
• A new KeyStore, PKCS12-PBMAC1, has been added which defaults to using PBMAC1 and supports RFC 9879.
• A new property “org.bouncycastle.asn1.max_cons_depth” has been added to allow setting of the maximum nesting for SETs/SEQUENCESs in ASN.1. Default is 32.
• A new property “org.bouncycastle.asn1.max_limit” has been added to allow setting of the stream size of ASN.1 encodings. The value can be either in bytes, or appended with k (1 kilobyte blocks), m (1 megabyte blocks), or g (1 gigabyte blocks).
• Added NTRU+ support to the lightweight PQC API and the BCPQC provider.
• Added SM4 key wrap/unwrap mode, SM2 key exchange, and logging to SM2Signer.
• OpenPGP: Added encryption‑key filtering by purpose, a new OpenPGPKey constructor, KeyPassphraseProvider‑based passphrase change, wildcard (anonymous) recipient handling, and Web‑of‑Trust methods for third‑party signature chains and delegations.
• CMSSignedDataStreamGenerator can now support the generation of DER/DL encoded SignedData objects (note memory restrictions still apply).
• It is now possible to add extra digest alorithm IDs to CMSSignedDataStreamGenerator when required.

Security Fixes

• CVE-2025-14813 - GOSTCTR implementation unable to process more than 255 blocks correctly.
• CVE-2026-0636 - LDAP Injection Vulnerability in LDAPStoreHelper.java.
• CVE-2026-3505 - Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.
• CVE-2026-5588 - PKIX draft CompositeVerifier accepts empty signature sequence as valid.
• CVE-2026-5598 - Non-constant time comparisons risk private key leakage in FrodoKEM.

Defects Fixed

• Random numbers being generated for DSTU4145 signature calculations were 1 bit shorter than they could be. The code has been corrected to allow the generated numbers to occupy the full numeric range available.
• HKDF implementation has been corrected to use multiple IKMs if available.
• CompositePublic/PrivateKey builders had an issue identifying brainpool and EdDSA curves from the algorithm names due to an error in the OID mapping table. This has been fixed.
• S/MIME: Fix AuthEnveloped support for AES192/GCM and AES256/GCM.
• CMS: Use implicit tag for AuthEnvelopedData.authEncryptedContentInfo.encryptedContent.
• Fixed Strings.split to handle delimiters at position 0.
• Fixed FrodoKEM error sampling to be constant-time.
• Fixed PKIXNameConstraintValidator to treat a DNS name as intersecting itself.
• Fixed PKCS12 key stores not calling getInstance with the original provider (which was forcing provider registration).
• A resource leak due to the SMIMESigned constructor leaving background threads hanging on MessagingException has been fixed.
• OpenPGP: Fixed an issue where a custom signature creation time was ignored when generating message signatures.
• OpenPGP: Fixed SKESK encoding for direct-S2K-encrypted messages.

Additional Notes

• DSA was recently deprecated by NIST and several users have requested that we move to an RSA signing certificate for provider signing instead of our current DSA one. We are grateful to report that Oracle have been very supportive of this and issued us a second RSA certificate based on a new RSA key for signing providers. Providers signed with the previous DSA key will continue to work as before.
• This will be the last release which will recognise Dilithium and SphincsPlus in the BC provider, the Kyber wrapper (which is just ML-KEM) will also be removed. The algorithms won't be deleted in 1.85, but will only be accessible via the low-level APIs and deleted in a later release.