[NIFI-1324] Upgrade to correct version of BouncyCastle

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.4.1
• Fix Version/s: 0.5.0
• Component/s: Core Framework
• Labels: dependencies security
• Assignee: Andy LoPresto
• Reporter: Andy LoPresto
• Created: 22/Dec/15 21:57
• Updated: 03/Mar/18 00:56
• Resolved: 12/Jan/16 14:53

Description

The existing Maven dependencies are for org.bouncycastle:bcprov-jdk16:1.46 and org.bouncycastle:bcpg-jdk16:1.46. While jdk16 looks "newer" than jdk15on, this was actually a legacy mistake on the part of BouncyCastle versioning. The correct and current version of BouncyCastle is jdk15on, as evidenced by the age of the releases:

• jdk15on: 03/2012 - 10/2015 "The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8." (http://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk15on)
• jdk16: 11/2007 - 02/2011 "The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.6." (http://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk16)

Issue Links

• is cloned by: NIFI-4928 Upgrade to current version of BouncyCastle (1.55 -> 1.59)
• relates to: NIFI-1364 Audit OCSP certificate validation
• supercedes: NIFI-1314 Encrypt Content appears to live lock in certain configurations