Why is JCE Unlimited Strength not enabled by default?

Question

Customization

• Java does not offer native support for JCE unlimited strength policy files.
• This prevents users from using AES-256, the largest key size of the widely used encryption standard.
• Not including policy files leads to many problems:
  • Unexpected exceptions
  • Poor workarounds :
    • Just install them
    • Use a different implementation
    • Use reflection that may violate the Java License Agreement.
  • Crash after JRE updates
  • Confusion after installation
  • And further!
• All these noises lead to program violations and / or errors.

Question

• Why are they not provided and are not regarded as a black sheep?

Answer 1

• As it turns out, these are not strict export cryptography laws, but just that I haven’t reached it yet .
• In fact, it was planned for a long time so as not to jump over these hoops.
• In Java 9, the ceremony will be reduced to a single-line window : Security.setProperty("crypto.policy", "unlimited");

Answer 2

Unlimited cryptography is now enabled by default in the JDK

The JDK uses Jurisiction policy files to extend the cryptographic extensions (JCE) to configure the limitations of the cryptographic algorithm. Previously, policy files in the JDK set limits on various algorithms. This release comes with a limited and unlimited jurisdiction policy file with an unlimited default value. The behavior can be controlled using the new crypto.policy Security property found in the /lib/java.security file. For more information about this property, refer to this file.

See: http://www.oracle.com/technetwork/java/javase/8u161-relnotes-4021379.html#JDK-8170157

Answer 3

The USA has restrictions on the export of cryptographic technology:

https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States

They were very strict - cryptography was classified as ammunition, and you could only download strong products from the USA and other countries with white countries.

Since then, the restrictions have greatly weakened, but some remain, and the full strength of JCE cannot be distributed freely like the JRE, so this is a separate package.