title: Key length limit with Java Cryptography Extension
body: <p>I am aware that the keylenght in the Sun/Oracle JVM is limited for judical reasons. However as far as I understood the concept of the <strong>JCE (Java Cryptography Extension)</strong> is that a user can choose it's own security provider to compensate this limitation.</p>
  
  <p>For this reason I am trying to operate the <a href="https://www.bouncycastle.org/" rel="noreferrer">Bounce Castle</a> as security provider in conjunction with the <strong>Orcale JDK 1.7</strong>.</p>
  
  <p>In order to figure out the actual allowed keylegths I am using this code:</p>
  
  <pre><code>import org.bouncycastle.jce.provider.BouncyCastleProvider;
  
  import javax.crypto.Cipher;
  import java.security.GeneralSecurityException;
  import java.security.Provider;
  import java.security.Security;
  
  public class JCETest {
  public static void main( String[] args ) throws GeneralSecurityException
  {
  
      BouncyCastleProvider bouncyCastleProvider = new BouncyCastleProvider();
      Security.addProvider(bouncyCastleProvider);
  
      System.out.println( "\nSecurity-Provider:" );
      for( Provider prov : Security.getProviders() ) {
          System.out.println( "  " + prov + ": " + prov.getInfo() );
      }
      System.out.println( "\nMaxAllowedKeyLength (for '" + Cipher.getInstance("AES").getProvider() + "' using current 'JCE Policy Files'):\n"
              + "  DES        = " + Cipher.getMaxAllowedKeyLength( "DES"        ) + "\n"
              + "  Triple DES = " + Cipher.getMaxAllowedKeyLength( "Triple DES" ) + "\n"
              + "  AES        = " + Cipher.getMaxAllowedKeyLength( "AES"        ) + "\n"
              + "  Blowfish   = " + Cipher.getMaxAllowedKeyLength( "Blowfish"   ) + "\n"
              + "  RSA        = " + Cipher.getMaxAllowedKeyLength( "RSA"        ) + "\n" );
  }
  }
  </code></pre>
  
  <p>The output for the <strong>Orcale JDK 1.7</strong> and it's build in providers is:</p>
  
  <pre><code>Security-Provider:
    SUN version 1.7: SUN (DSA key/parameter generation; DSA signing; SHA-1, MD5 digests; SecureRandom; X.509 certificates; JKS keystore; PKIX CertPathValidator; PKIX CertPathBuilder; LDAP, Collection CertStores, JavaPolicy Policy; JavaLoginConfig Configuration)
    SunRsaSign version 1.7: Sun RSA signature provider
    SunEC version 1.7: Sun Elliptic Curve provider (EC, ECDSA, ECDH)
    SunJSSE version 1.7: Sun JSSE provider(PKCS12, SunX509 key/trust factories, SSLv3, TLSv1)
    SunJCE version 1.7: SunJCE Provider (implements RSA, DES, Triple DES, AES, Blowfish, ARCFOUR, RC2, PBE, Diffie-Hellman, HMAC)
    SunJGSS version 1.7: Sun (Kerberos v5, SPNEGO)
    SunSASL version 1.7: Sun SASL provider(implements client mechanisms for: DIGEST-MD5, GSSAPI, EXTERNAL, PLAIN, CRAM-MD5, NTLM; server mechanisms for: DIGEST-MD5, GSSAPI, CRAM-MD5, NTLM)
    XMLDSig version 1.0: XMLDSig (DOM XMLSignatureFactory; DOM KeyInfoFactory)
    SunPCSC version 1.7: Sun PC/SC provider
    BC version 1.46: BouncyCastle Security Provider v1.46
  
  MaxAllowedKeyLength (for 'SunJCE version 1.7' using current 'JCE Policy Files'):
    DES        = 64
    Triple DES = 128
    AES        = 128
    Blowfish   = 128
    RSA        = 2147483647
  </code></pre>
  
  <p>But when I apply BC as provider by switching to</p>
  
  <p><code>Cipher.getInstance("AES", bouncyCastleProvider).getProvider()</code></p>
  
  <p>It still shows me the limited key length (except for RSA) like this:</p>
  
  <pre><code>MaxAllowedKeyLength (for 'BC version 1.46' using current 'JCE Policy Files'):
    DES        = 64
    Triple DES = 128
    AES        = 128
    Blowfish   = 128
    RSA        = 2147483647
  </code></pre>
  
  <p>But when I change the JDK to <strong>openJDK</strong>, I get this output:</p>
  
  <pre><code>MaxAllowedKeyLength (for 'BC version 1.46' using current 'JCE Policy Files'):
    DES        = 2147483647
    Triple DES = 2147483647
    AES        = 2147483647
    Blowfish   = 2147483647
    RSA        = 2147483647
  </code></pre>
  
  <p>This astonishes me since I was under the impression that not the JDK but the security-provider limiting the key length. But my tests are showing that obviously the JDK is limiting the key length, no matter which provider I choose.</p>
  
  <p>My question is: Did I got something wrong? Is there a way to unleash the keyleght with the Oracle JDK?  </p>