For more security spongycastle -> bouncycastle

[Neustradamus]

For more security, can you change old spongycastle (based on old bouncycastle) to bouncycastle?

• https://www.bouncycastle.org/
• https://www.bouncycastle.org/releasenotes.html
• http://www.bouncycastle.org/latest_releases.html
• https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=bouncy%20castle
• https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=bouncycastle
• https://www.cvedetails.com/vulnerability-list/vendor_id-7637/Bouncycastle.html

[mcb30]

I'd be very happy to, but using bouncycastle caused a build failure on Android which is why I switched it in 811148f

If you can get a working gradle build with bouncycastle, please submit a PR and I'll merge it!

[Neustradamus]

@mcb30: It is not complete:

• https://github.com/ipxe/cx/search?q=spongycastle&unscoped_q=spongycastle

[mcb30]

Sorry, I wasn't clear. I had to change from bouncycastle to spongycastle in order to get it to build successfully for Android. If you'd like to submit a working PR to change it back, I will happily merge it.

[Neustradamus]

@mcb30: It is not secure, CVEs, ...

Currently Bouncy Castle last version is 1.65 and Spongy Castle last version is 1.58.
Spongy Castle is a fork of Bouncy Castle.
Please look previous links :)

Since several years, a lot of projects have already moved from Spongy Castle to Bouncy Castle because the project is dead.

You can see discussion "34" in https://github.com/rtyley/spongycastle/issues.

[mcb30]

@Neustradamus I have absolutely zero objections to switching back to bouncycastle. The problem is that the build fails if I do so. Please submit a PR that fixes the build problem.

[Neustradamus]

@mcb30: What is the error?

[Neustradamus]

@mcb30: What is your solution?