Java Cryptography Extensions provide standardized Java cryptography APIs and provider-based implementations. Application code calls the API, which routes operations to installed providers instead of depending directly on an algorithm implementation. section 4.3
The javax.crypto APIs belong to the standard Java distribution. Providers supply implementations, including the default SunJCE provider and the broader Bouncy Castle provider. section 4.3
Keep these practical distinctions in mind:
- JCA and JCE were historically separated because of United States cryptography export controls; Java 9 and later ship with unlimited-strength encryption. section 4.3
- Provider independence lets application code use standardized APIs while changing or adding implementations when required. section 4.3
- Choose current secure algorithms deliberately; SHA-1 and MD5 are deprecated, while SHA-2 and SHA-3 are generally considered secure for new applications. section 4.8
Hashing a file
A Java application can obtain a SHA3-256 MessageDigest, read a resource, digest its bytes, and return the result as hexadecimal. The provider-backed API keeps this code independent of the implementation. section 4.3
Figure 4.6 Application code calls the standard JCA and JCE APIs, making the code independent of the crypto algorithm implementation. The JCA and JCE layer routes calls to a provider’s implementation. Java 11-based OpenJDK ships with 13 providers out of the box.
Trace how application calls pass through the standard JCA and JCE APIs to provider implementations. section 4.3
