bc-fips 2.0.1 and bcprov-jdk18on in classpath

[janhavee-git]

Hi Team,

We have a requirement to make code fips compliant for cryptographic needs. So started by adding bc-fips 2.0.1 jar to the pom.
We also have bcprov jar as part of spring security jar. This means that both bc-fips and bcprov jars are in classpath. It is mentioned at quite a few places that they should not co exist(#1594).

We have not experienced any issues even if both jars are in classpath. Can someone please help us understand the reason? In which scenarios we might experience the conflicts?

[peterdettman]

@janhavee-git It is relevant to all versions of bc-fips so far, whether or not it appears to work for you.

See these other issues:
#714
#1287

The basic reason is that classes might be loaded from bcprov instead of bc-fips, which - besides leading almost certainly to errors - would be non-compliant usage of bc-fips.