A security provider is a Java component that supplies cryptographic algorithm implementations behind the standard JCA and JCE APIs. Application code calls the stable API, while the installed provider performs the operation. This separation lets applications use algorithms without depending directly on one implementation, but provider choice affects available algorithms and cryptographic strength. section 4.3
Provider choice matters when:
- A default provider lacks an algorithm or historically supplies weaker cryptography, as with Java 8 and earlier export-control configurations. section 4.3
- Bouncy Castle is needed for broader algorithm support or environments with constrained device resources. section 4.3
Hashing through the provider architecture
Calling MessageDigest.getInstance("SHA3-256") uses the standard API; JCA/JCE routes the request to an installed provider. The same SHA3-256 hash is also obtained through Tink’s provider-oriented EngineFactory.
Figure 4.6 Application code calls the standard JCA and JCE APIs, making the code independent of the crypto algorithm implementation. The JCA and JCE layer routes calls to a provider’s implementation. Java 11-based OpenJDK ships with 13 providers out of the box.
Trace how application calls pass through JCA/JCE to provider implementations, including the providers shipped with Java 11-based OpenJDK. section 4.3
