1 bcprov.patch: 2 3 patch against Bouncy Castle's bcprov: 4 5 The main differences involve removing algorithms not included in the 6 reference implementation (RI). The libcore 7 java.security.StandardNames test support class provides the most 8 up-do-date documentation of differences between the RI's list of 9 supported algorithms and Android's. Some notable omissions versus the 10 RI: 11 - LDAP 12 - MD2 13 - RC2 14 15 Other performance (both speed and memory) and correctness changes: 16 - singleton DERNull (BouncyCastle now does this but we make constructor private to be sure) 17 - similarly made DERBoolean constructor private and moved to DERBoolean.{getInstance,TRUE,FALSE} 18 - removed use of Boolean constructor (not-upstreamable due to J2ME requirement upstream) 19 - DERObjectIdentifier interns its internal String indentifer value 20 - changed uses of 'new Integer' to 'Integers.valueOf' 21 - X509CertificateObject.getEncoded caches its result 22 - removed references to SecretKeyFactory.PBE/PKCS5 SecretKeyFactory.PBE/PKCS12 23 - OpenSSLDigest uses NativeCrypto JNI API 24 - JDKKeyStore made more tolerant of non-existant aliases 25 - Make BouncyCastleProvider.PROVIDER_NAME final 26 - Added wrapper for SecretKeyFactory.PBKDF2WithHmacSHA1 27 28 Other security changes: 29 - Blacklist fraudulent Comodo certificates in PKIXCertPathValidatorSpi 30 - Blacklist compromised DigiNotar Root CA by public key to block cross-signed intermediates 31 32 Other changes: 33 - Log entry and exit to DHParametersHelper.generateSafePrimes which has long, unpredictable runtime 34 35 36 bcpkix.patch: 37 38 patch against Bouncy Castle's bcpkix: 39 40 The main differences involve: 41 - removing algorithms not in our bcprov (MD2, MD4, SHA224, RIPEMD, GOST) 42 - using the singleton DERNull.INSTANCE 43
