Bouncy Castle is a Java Cryptography Extension provider: it supplies implementations of cryptographic algorithms behind Java’s standard JCA and JCE APIs. It supports strong cryptography, includes more algorithms than the default SunJCE provider, and was optimized for embedded devices with limited CPU resources. section 4.3
Use Bouncy Castle when an application needs:
- An algorithm or implementation not available from the default Java provider. section 4.3
- ECC encryption through the ECIES transformation, selected explicitly with the provider name BC. section 7.2.1
- A straightforward Java implementation while keeping application code on standard cryptography APIs. section 4.3 section 7.2.1
Encrypting refunds with ECIES
An encrypting application registers the provider when needed, obtains an ECIES cipher from BC, and initializes it with the recipient’s public key. The receiving application uses the same transformation with the matching private key. Decryption fails with a different private key or modified ciphertext, demonstrating key dependence and content integrity. section 7.2.1
Figure 4.6 Application code calls the standard JCA and JCE APIs, making the code independent of the crypto algorithm implementation. The JCA and JCE layer routes calls to a provider’s implementation. Java 11-based OpenJDK ships with 13 providers out of the box.
The provider architecture shows how application code remains independent of the underlying cryptographic implementation. section 4.3
