How to include the Spongy Castle JAR in Android?

Question

Apparently Spongy Castle is the Android alternative to using a full version of Bouncy Castle.

However, on importing the jar I'm getting all kinds of "cannot be resolved" errors because it relies on packages not included with Android, primarily javax.mail, javax.activation, and javax.awt.datatransfer.

So what's the best way around this? Responses to this question and this indicate those packages shouldn't be used at all, and this popular question doesn't even consider finding a way to get AWT back. So how is Spongy Castle relying on them? People are using Spongy Castle, right?

Tricornered

Answer 1

These are two very simple examples of how to include Spongy Castle in a project:

• github.com/rtyley/spongycastle-eclipse - Eclipse
• github.com/rtyley/toy-android-ssh-agent - Maven

Since v1.47, Spongy Castle has been split into separate sub-jars that exactly mirror the matching Bouncy Castle artifacts (eg sc-light-jdk15on.jar, scpg-jdk15on.jar, etc), and it is important to ensure you include all the Spongy Castle jars required for what you're doing.

Full information on dependencies can be found at:

http://rtyley.github.com/spongycastle/#downloads

At minimum you'll need the sc-light-jdk15on.jar (the base lightweight-API implementation) and probably scprov-jdk15on.jar (the JCE wrapper around the lightweight-API). If you're using Maven then all this dependency-management stuff is taken care of for you.

The problematic dependencies you describe on javax.mail, javax.activation, etc, indicate that you might have chosen an incorrect jar (e.g. the every-single-library-component one, rather than the 'core provider' one) - as the scprov-jdk15on jar definitely doesn't have any of those weird dependencies, and runs happily on Android.

(disclaimer, I'm the maintainer of Spongy Castle, but I've had plenty of success reports from other users too!)

Julijulia

The thing is, I believe that's the exact JAR file I was using. I went to github.com/rtyley/spongycastle and clicked the "You can directly download the latest jar here" link under the Downloads subheader. Unfortunately I'm not working on that project anymore so I won't likely get a chance to try again soon- but for the sake of others, what are the recommended steps for including your JAR file in an Android project? – Tricornered

I added your lib but it still throws exception class load that bouncycastle.ans1 class didn't find. how to make it search in spongycastle? – Adnopoz

how do I add the lib from this link github.com/rtyley/spongycastle .. there is no jar file ... – Bab

Answer 2

If you are using gradle, then you can just specify your dependencies in build.gradle file like this:

dependencies {
     ....
    compile 'com.madgag.spongycastle:core:1.54.0.0'
    compile 'com.madgag.spongycastle:prov:1.54.0.0'
    compile 'com.madgag.spongycastle:pkix:1.54.0.0'
    compile 'com.madgag.spongycastle:pg:1.54.0.0'

    }

You can find out the latest version of the library here.

Don't forget to insert it as a security provider in your app.

    static {
    Security.insertProviderAt(new org.spongycastle.jce.provider.BouncyCastleProvider(), 1);
}

Shawnna

Where would add the Security provider line? In a custom Application class? – Thermogenesis

Yes, we have added this in our custom class. Whenever that class instance is referred, the provider get's inserted. Make sure that the class in which you are going to insert this is the entry point for your cryptography operations. – Shawnna

In my case, I have placed the static block into my custom application class, the nightmare occurred. The app always complains about invalid SSL certificates and pops up untrusted connections dialog. The I moved the static block to Crypto utils class, the issues was fixed. – Christan

Thanks @LoganGuo . I think AndyRoid's question was misunderstood. – Hydrocephalus

Answer 3

In the meanwhile BouncyCastle can be used directly. In later Android versions the internal BC package name has changed and at least the package name collision is not the problem anymore, but there are still issues. For a solution look at this: https://mcmap.net/q/501342/-can-i-use-latest-bouncycastle-provider-on-android

Sicard