bc-fips-1.0.2.5.jar usage of sun.security.provider.SecureRandom and not compatible with Java 17/21

[ilapavuluri]

Hi All,

I am using bc-fips-1.0.2.5.jar in my application, when I run "jdeps --multi-release 21 -jdkinternals" scan I am getting below report:

org.bouncycastle.fips.core -> java.base
org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$CoreSecureRandom -> sun.security.provider.SecureRandom JDK internal API (java.base)
org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$CoreSecureRandom -> sun.security.provider.Sun JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF -> sun.security.internal.spec.TlsPrfParameterSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$BaseTLSKeyGeneratorSpi -> sun.security.internal.spec.TlsPrfParameterSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSExtendedMasterSecretGenerator -> sun.security.internal.spec.TlsMasterSecretParameterSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSExtendedMasterSecretGenerator$1 -> sun.security.internal.spec.TlsMasterSecretParameterSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSExtendedMasterSecretGenerator$2 -> sun.security.internal.spec.TlsMasterSecretParameterSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSExtendedMasterSecretGenerator$2 -> sun.security.internal.spec.TlsPrfParameterSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSKeyMaterialGenerator -> sun.security.internal.spec.TlsKeyMaterialParameterSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSKeyMaterialGenerator$1 -> sun.security.internal.spec.TlsKeyMaterialParameterSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSKeyMaterialGenerator$2 -> sun.security.internal.spec.TlsKeyMaterialParameterSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSKeyMaterialGenerator$2 -> sun.security.internal.spec.TlsKeyMaterialSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSKeyMaterialGenerator$2 -> sun.security.internal.spec.TlsPrfParameterSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSMasterSecretGenerator -> sun.security.internal.spec.TlsMasterSecretParameterSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSMasterSecretGenerator$1 -> sun.security.internal.spec.TlsMasterSecretParameterSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSMasterSecretGenerator$2 -> sun.security.internal.spec.TlsMasterSecretParameterSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSMasterSecretGenerator$2 -> sun.security.internal.spec.TlsPrfParameterSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSPRFKeyGenerator -> sun.security.internal.spec.TlsPrfParameterSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSPRFKeyGenerator$1 -> sun.security.internal.spec.TlsPrfParameterSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSPRFKeyGenerator$2 -> sun.security.internal.spec.TlsPrfParameterSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSRsaPreMasterSecretGenerator -> sun.security.internal.spec.TlsRsaPremasterSecretParameterSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSRsaPreMasterSecretGenerator$1 -> sun.security.internal.spec.TlsRsaPremasterSecretParameterSpec JDK internal API (java.base)
org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSRsaPreMasterSecretGenerator$2 -> sun.security.internal.spec.TlsRsaPremasterSecretParameterSpec JDK internal API (java.base)

Warning: JDK internal APIs are unsupported and private to JDK implementation that are
subject to be removed or changed incompatibly and could break your application.
Please modify your code to eliminate dependence on any JDK internal APIs.
For the most recent update on JDK internal API replacements, please check:
https://wiki.openjdk.org/display/JDK8/Java+Dependency+Analysis+Tool

JDK Internal API Suggested Replacement

sun.security.provider.Sun Use java.security.Security.getProvider(provider-name) @SInCE 1.3

Based on this report it looks like bc-fips-1.0.2.5.jar is not compatible with Java 17/21, correct me if I miss anything.

Appreciate any help on this.

[peterdettman]

I think bc-fips-1.0.X is for Java 7, 8, 11. bc-fips-2.0.X or later should work on Java 8, 11, 17, 21.