Java 为什么默认情况下不包括 JCE Unlimited Strength？

Why are the JCE Unlimited Strength not included by default?

提问by dminuoso

Setup

设置

• Java doesn't offer out-of-the-box support for the JCE Unlimited Strength Policy Files
• This prevents users from using AES-256, the largest key size of a widely-used encryption standard
• Not including the policy files leads to many problems:
  • Unexpected exceptions
  • Unsatisfying workarounds:
    • Just install them
    • Use a different implementation
    • Use reflection that may violate the Java License Agreement
  • Breakage after JRE updates
  • Confusion after installation
  • And more!
• All this noise leads to broken and/or buggy programs

• Java 不为 JCE Unlimited Strength Policy Files 提供开箱即用的支持
• 这可以防止用户使用 AES-256，这是广泛使用的加密标准的最大密钥大小
• 不包括策略文件会导致很多问题：
  • 意外异常
  • 不满意的解决方法：
    • 只需安装它们
    • 使用不同的实现
    • 使用可能违反 Java 许可协议的反射
  • JRE 更新后损坏
  • 安装后的困惑
  • 和更多！
• 所有这些噪音都会导致程序损坏和/或错误

Question

题

• Why are these not provided and treated like a black sheep?

• 为什么不提供这些并像害群之马一样对待？

采纳答案by dminuoso

• As it turns out, it's not strict crypto export laws, but simply that no one got around to it yet.
• In fact, it's been planned for a long timeto not have to jump through these hoops.
• In Java 9, the ceremony will be condensed down to a one-liner: Security.setProperty("crypto.policy", "unlimited");

• 事实证明，这不是严格的加密货币出口法，而只是没有人对此有所了解。
• 事实上，长期以来一直计划不必跳过这些箍。
• 在 Java 9 中，仪式将被压缩为一行：Security.setProperty("crypto.policy", "unlimited");

回答by Matt Timmermans

The US has restrictions on the export of cryptographic technology:

美国对密码技术出口有限制：

https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States

https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States

They used to be very strict -- cryptography was classified as munitions, and you could only download the full strength products from the US and other whitelisted countries.

他们曾经非常严格——密码学被归类为军火，你只能从美国和其他白名单国家下载全强度产品。

Restrictions have eased up a lot since then, but some remain, and full strength JCE can't be freely distributed everywhere like the JRE, so it's a separate package.

从那时起，限制已经放宽了很多，但仍有一些限制，并且完整的 JCE 不能像 JRE 那样在任何地方自由分发，因此它是一个单独的包。

回答by ikarayel

Now Unlimited cryptography enabled by default in the JDK

现在在 JDK 中默认启用无限加密

The JDK uses the Java Cryptography Extension (JCE) Jurisdiction Policy files to configure cryptographic algorithm restrictions. Previously, the Policy files in the JDK placed limits on various algorithms. This release ships with both the limited and unlimited jurisdiction policy files, with unlimited being the default. The behavior can be controlled via the new 'crypto.policy' Security property found in the /lib/java.security file. Please refer to that file for more information on this property.

JDK 使用 Java 加密扩展 (JCE) 权限策略文件来配置加密算法限制。以前，JDK 中的策略文件对各种算法进行了限制。此版本随附有限制和无限制的管辖权策略文件，默认为无限制。该行为可以通过 /lib/java.security 文件中的新“crypto.policy”安全属性进行控制。有关此属性的更多信息，请参阅该文件。

See: http://www.oracle.com/technetwork/java/javase/8u161-relnotes-4021379.html#JDK-8170157

参见：http: //www.oracle.com/technetwork/java/javase/8u161-relnotes-4021379.html#JDK-8170157