Package
Description
A library for parsing and writing ASN.1 objects.
Support classes for the French ANSSI EC curves.
ASN.1 classes specific to the Bouncy Castle APIs.
Support classes for CRYPTO-PRO related objects - such as GOST identifiers.
Support classes for Chinese Standard (GM) standard curves and algorithms.
Object identifier constants from the IANA-allocated PKIX OID registry — currently
covering the HMAC-SHA-1 OID used by IKE / IPsec.
Support classes for NIST related objects.
Support classes useful for encoding and supporting OCSP objects.
Support classes useful for encoding and supporting the various RSA PKCS documents.
ASN.1 types for the IETF PLANTS working group's Merkle Tree Certificate work
(
draft-ietf-plants-merkle-tree-certs), including the
MerkleTreeCertEntry and MTCProof structures.Classes for support of the SEC standard for Elliptic Curve.
Support classes for TeleTrust related objects.
Support classes for the Ukrainian DSTU standard.
An ASN.1 dump utility.
Support classes for the creation and processing of object based on X.500 names.
Template classes for the common styles used for converting X.500 names to strings and back.
Support classes useful for encoding and processing X.509 certificates.
Support classes useful for encoding and processing messages based around RFC3739
Support classes for the German SigI (Signature Interoperability Specification) standard.
Support classes useful for encoding and supporting X9.62 elliptic curve.
Base classes for the lightweight API.
Basic key agreement classes.
Support classes for Elliptic Curve Password Authenticated Key Exchange by Juggling (EC J-PAKE) key exchange.
Support classes for Password Authenticated Key Exchange by Juggling (J-PAKE) key exchange.
Support classes for KDF based key derivation functions.
Support classes for the Owl augmented PAKE (Hao, Bag, Chen, Lopez 2024).
Support classes for Secure Remote Password (SRP) protocol.
BLS signatures over the BLS12-381 curve, per draft-irtf-cfrg-bls-signature.
Classes for supporting commitment calculation.
Crypto-services-constraint framework: lets callers limit which cryptographic
primitives the lightweight API will produce (by key size, by allowlist, by purpose).
Message digest classes.
Utility classes for support Elliptic Curve cryptographic transforms.
Block encodings for asymmetric ciphers.
Basic cipher classes.
Format-Preserving Encryption per NIST SP 800-38G: FF1 and FF3-1 modes that produce
ciphertext in the same alphabet (digits / strings) as the input plaintext.
Generators for keys, key pairs and password based encryption algorithms.
Hash to curve implementation
Hybrid Public Key Encryption (HPKE) per
RFC 9180.
Classes for doing "enhanced" I/O with Digests and MACs.
Key Encapsulation Mechanisms.
The Classic McEliece key encapsulation mechanism as standardised in ISO/IEC 18033-2:2006/Amd
2:2026 (Clause 13): lightweight engine internals for the non-pc and pc ("plaintext confirmation")
parameter sets, each in a plain and a semi-systematic ("f") key-generation variant.
The FrodoKEM key encapsulation mechanism as standardised in ISO/IEC 18033-2:2006/Amd 2:2026
(Clause 14): lightweight engine internals for the salted "FrodoKEM" and ephemeral "eFrodoKEM"
SHAKE parameter sets.
ML-KEM (FIPS 203) bindings of the lightweight KEM API
(
EncapsulatedSecretGenerator /
EncapsulatedSecretExtractor) sitting on top of the
org.bouncycastle.pqc.crypto.mlkem primitives.Classes for creating MACs and HMACs.
Modes for symmetric ciphers.
GCM mode support classes.
Lookup tables for KGCM (the GCM analogue used by the Ukrainian DSTU 7624 Kalyna
cipher).
Paddings for symmetric ciphers.
Classes for parameter objects for ciphers and generators.
Helper classes for parsing "on the wire" public keys.
Lightweight psuedo-random number generators and SecureRandom builders.
SP800-90A deterministic random bit generators, can be used stand alone or in conjunction with SP800SecureRandomBuilder class.
Basic signers.
ML-DSA (FIPS 204) bindings of the lightweight signer API.
SLH-DSA (FIPS 205) bindings of the lightweight signer API.
Threshold-cryptography helpers — Shamir secret sharing over GF(28) and
supporting polynomial arithmetic.
Legacy lightweight TLS support — predates and is largely superseded by the standalone
org.bouncycastle.tls TLS / JSSE module.Some general utility/conversion classes.
JCA-style key interfaces specific to BC's provider — e.g.
I/O streams that drive JCE primitives —
MessageDigest,
Mac, Signature,
Cipher — as input or output streams, removing the boilerplate
around feeding data into them by hand.JCA/JCE provider classes for the standardised Classic McEliece (ISO/IEC 18033-2:2006/Amd 2:2026,
Clause 13), registered in the BouncyCastle provider: the base, "f", "pc" and "pcf" variants at
each of the four security parameter sets (460896, 6688128, 6960119 and 8192128).
JCA/JCE provider classes for the standardised FrodoKEM (ISO/IEC 18033-2:2006/Amd 2:2026),
registered in the BouncyCastle provider: the salted "FrodoKEM" and ephemeral "eFrodoKEM" SHAKE
parameter sets at security levels 976 and 1344.
AlgorithmParameterSpec / KeySpec
implementations specific to BC's provider — covering PBKDF2 with extended digests,
HKDF, ML-KEM / ML-DSA / SLH-DSA parameter sets, GOST key agreement, ZUC, SM2, EC
implicit-CA, and other JDK-not-shipped algorithms.The
JcaJceHelper abstraction (default / named-provider / pinned-provider
variants) used pervasively in .jcajce packages to make the underlying JCE
provider selection a constructor argument rather than a global Security state lookup.Utility classes for use with the JCE.
JCE-side exception types — including
ExtException, which provides a uniform
place to attach an underlying-cause Throwable to the JCE checked-exception hierarchy
for code that needs to propagate richer error context across the java.security
surface.Interfaces for supporting Elliptic Curve Keys, El Gamal, and PKCS12 attributes.
Netscape Certificate Sequence (NetscapeCertRequest) — the historical browser-side
SPKAC enrolment format.
Parameter specifications for supporting El Gamal, and Elliptic Curve.
The Bouncy Castle math package.
Math support for Elliptic Curve.
Experimental implementation of curve25519.
Custom implementation of SM2 EC curve, SM2-P256V1.
Custom implementations of (most of) the curves over Fp from the SEC specification.
Endomorphism support for the EC math classes — the GLV / GLS decomposition tables
that accelerate scalar multiplication on suitable curves (secp256k1, etc.).
Constant-time scalar-multiplication implementations for the Curve25519 and Curve448
elliptic curves per RFC 7748.
Constant-time implementations of the Ed25519 and Ed448 signature schemes per RFC 8032,
sitting on top of the Curve25519 / Curve448 scalar-multiplication in
org.bouncycastle.math.ec.rfc7748.Standalone tools for working with elliptic curves — discrete log calculators, curve
parameter generators, and table-generation utilities used to bootstrap the named
curves in
org.bouncycastle.math.ec.Polynomial-field math (GF(2m) with various basis representations) used to
back the F2m elliptic curves in
org.bouncycastle.math.ec.Math support for raw multi-precision calculations.
ASN.1 Support classes for PQC algorithms.
Root of the lightweight Post-Quantum Cryptography implementations.
Lightweight implementation of AIMer, an MPC-in-the-Head signature scheme built on the
AIM2 one-way function, in the NIST PQC additional-digital-signatures round.
Lightweight implementation of Classic McEliece (Round 4 NIST PQC KEM finalist).
Lightweight implementation of CRYSTALS-Dilithium (the NIST Round 3 submission that
was subsequently standardised as ML-DSA / FIPS 204).
Lightweight implementation of FAEST — symmetric-primitive digital signature
scheme based on AES and the VOLE-in-the-Head proof system.
Lightweight implementation of Falcon, the NTRU-lattice-based signature scheme
selected for standardisation by NIST.
Lightweight implementation of FrodoKEM (a learning-with-errors KEM that did not
advance past Round 3 of the NIST PQC process; retained as a conservative reference).
Lightweight implementation of HAETAE, a module-lattice-based signature scheme in the
NIST PQC additional-digital-signatures round.
Lightweight implementation of Hawk, an NTRU-lattice-based signature scheme in the
NIST PQC additional-digital-signatures round.
Lightweight implementation of HQC (Hamming Quasi-Cyclic), a code-based KEM that NIST
selected for standardisation as a backup to ML-KEM.
Lightweight implementation of LMS and the HSS multi-tree variant per RFC 8554
(hash-based stateful signatures).
Lightweight implementation of MAYO, a UOV-based signature scheme in the NIST PQC
additional-digital-signatures round.
Lightweight implementation of ML-DSA (Module-Lattice-Based Digital Signature Algorithm)
as standardised by NIST FIPS 204.
Lightweight implementation of ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism)
as standardised by NIST FIPS 203.
Lightweight implementation of MQOM ("MQ on my Mind"), an MPC-in-the-Head signature
scheme in the NIST PQC additional-digital-signatures round.
Low level implementation of the NewHope key exchange algorithm.
The NTRU algorithm based on the round 3 submission of the NIST post-quantum cryptography.
Lightweight implementation of NTRU+ (Korean post-quantum KEM submission).
Lightweight implementation of NTRU Prime — the streamlined-NTRU and NTRU LPRime
KEM variants from the NIST PQC Round 3 alternates.
Lightweight implementation of QR-UOV, a quotient-ring variant of the UOV multivariate
signature scheme in the NIST PQC additional-digital-signatures round.
Lightweight implementation of SABER, a module-lattice KEM from the NIST PQC Round 3
finalists.
Lightweight implementation of SDitH ("Syndrome Decoding in the Head"), a code-based
MPC-in-the-Head signature scheme in the NIST PQC additional-digital-signatures round.
Lightweight implementation of SLH-DSA (Stateless Hash-Based Digital Signature
Algorithm) as standardised by NIST FIPS 205, succeeding the SPHINCS+ submission in
org.bouncycastle.pqc.legacy.sphincsplus.Lightweight implementation of SNOVA, a UOV-variant signature scheme in the NIST PQC
additional-digital-signatures round.
Low level implementation of the SPHINCS-256 signature algorithm.
Lightweight implementation of SQIsign (Short Quaternion and Isogeny Signature), an
isogeny-based signature scheme in the NIST PQC additional-digital-signatures round.
Lightweight implementation of UOV (Unbalanced Oil and Vinegar), a multivariate-quadratic
signature scheme in the NIST PQC additional-digital-signatures round.
Shared PQC factory utilities —
PublicKeyFactory, PrivateKeyFactory,
SubjectPublicKeyInfoFactory, PrivateKeyInfoFactory and the OID lookup
helpers that route PQC parameter sets between the wire-format ASN.1 layer and the
lightweight Parameters types.Low level implementation of the XMSS and XMSS^MT signature algorithms.
Lightweight implementation of X-Wing, the hybrid KEM combining X25519 and ML-KEM-768
(draft-connolly-cfrg-xwing-kem).
JCA-style key interfaces for the BCPQC-provider PQC algorithms, parallel to
org.bouncycastle.jcajce.interfaces — letting callers downcast a
Key into its algorithm-specific accessor shape without depending
on the concrete provider implementation classes.AlgorithmParameterSpec implementations for the BCPQC-provider
algorithms — per-parameter-set constants and fromName(String) lookups for
Falcon, Hawk, MAYO, MQOM, SNOVA, UOV, the legacy SPHINCS+ variants, the legacy
Rainbow / Picnic submissions, and the supporting hash-based schemes.Lightweight implementation of BIKE (Bit-Flipping Key Encapsulation), a code-based
KEM from the NIST PQC Round 4 alternates.
Lightweight implementation of Picnic, a zero-knowledge-proof-based signature scheme
from the NIST PQC Round 3 alternates.
Lightweight implementation of Rainbow, a multivariate-quadratic signature scheme that
was a NIST PQC Round 3 finalist before being broken.
Lightweight implementation of SPHINCS+ (the NIST PQC Round 3 submission that was
subsequently standardised as SLH-DSA / FIPS 205).
Contains the polynomial classes used in the NTRU round 3 algorithm.
Parameter sets and supporting polynomial arithmetic for the NTRU-family KEM
implementations.
General purpose utility classes used throughout the APIs.
Classes for producing and reading Base64 and Hex strings.
General purpose I/O helper classes and wrappers.
Classes for reading and writing raw PEM objects.
Light weight test API.