title: Bouncycastle fails in android API < 21
body: <p>i am trying to run some spongycastle code in android:</p>
  
  <pre><code>    try {
          Security.addProvider(new org.spongycastle.jce.provider.BouncyCastleProvider());
          ECGenParameterSpec spec = new ECGenParameterSpec("P-256");
          KeyPairGenerator generator = KeyPairGenerator.getInstance("ECDSA", "SC");
          generator.initialize(spec, new SecureRandom());
          KeyPair keyPair = generator.generateKeyPair();
          ECPublicKey publicKey = (ECPublicKey) keyPair.getPublic();
          ECPrivateKey privateKey = (ECPrivateKey) keyPair.getPrivate();
          String publicKeyStr = publicKey.getW().getAffineX().toString() + ":" + publicKey.getW().getAffineY().toString();
          Log.d(TAG, publicKeyStr);
          Calendar c = Calendar.getInstance();
          Date d0 = c.getTime();
          c.add(Calendar.DATE, 1);
          Date expiry = c.getTime();
          String token = Jwts.builder()
                  .setIssuedAt(d0)
                  .setSubject("00000000-0000-0000-0000-000000000001")
                  .setExpiration(expiry)
                  .signWith(privateKey, SignatureAlgorithm.ES256).compact();
          Log.d(TAG, token);
      } catch (Exception e) {
          Log.d(TAG, e.toString());
      }
  </code></pre>
  
  <p>in API version 21+, it works as expected.</p>
  
  <p>in API version 18, it works in debug.  in release, it fails in function <code>generator.generateKeyPair()</code> with <code>java.lang.IllegalArgumentException: Invalid point</code>.</p>
  
  <p>in API version 16, it fails in function <code>Jwts.builder().signWith()</code> with <code>io.jsonwebtoken.security.SignatureException: Invalid Elliptic Curve PrivateKey. can't recognise key type in ECDSA based signer</code>.</p>
  
  <p>any idea what i am doing wrong?</p>
  
  <p><strong>edit</strong>:  i have apparently fixed the problem by switching from spongycastle to bouncycastle.</p>
  
  <p>in my <code>build.gradle</code> i changed this:</p>
  
  <pre><code>implementation 'com.madgag.spongycastle:core:1.58.0.0'
  implementation 'com.madgag.spongycastle:prov:1.58.0.0'
  </code></pre>
  
  <p>to this:</p>
  
  <pre><code>implementation 'org.bouncycastle:bcpkix-jdk15on:1.60'
  </code></pre>
  
  <p>and in my code i got rid of this line:</p>
  
  <pre><code>Security.addProvider(new org.spongycastle.jce.provider.BouncyCastleProvider());
  </code></pre>
  
  <p>and added these lines:</p>
  
  <pre><code>import org.bouncycastle.jce.provider.BouncyCastleProvider;
  
  Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
  Security.insertProviderAt(new BouncyCastleProvider(), 1);
  </code></pre>
  
  <p>and i changed the provider from <code>"SC"</code> to <code>"BC"</code>.</p>
  
  <p>and now my code works as i would like, for all versions of the android API.</p>
  
  <p>my concern now is the comment at this link...</p>
  
  <p><a href="https://github.com/rtyley/spongycastle/issues/34" rel="nofollow noreferrer">Spongy Castle: is it obsolete?</a></p>
  
  <p>...by the author of spongycastle:</p>
  
  <blockquote>
    <p><strong>Why might Spongy Castle <em>not</em> be obsolete?</strong></p>
    
    <p>...</p>
    
    <p>even on post-Android 3.0 devices, device manufacturers are not above
    carelessly bundling libraries, it's possible that Bouncy Castle may
    still be bundled on some obscure devices.</p>
  </blockquote>
  
  <p>what does that mean exactly?  could it cause my code above to malfunction on certain devices?</p>