3 ms·
Does anyone know about the quality of crypto implementations in Java Cryptographic Extension (JCE), the standard crypto library in Java? We use a product that
by aborsy 5y ago
Does anyone know about the quality of crypto implementations in Java Cryptographic Extension (JCE), the standard crypto library in Java?
We use a product that uses JCE. The log4j vulnerabilities worry me about the security of software in Java ecosystem in general.
- staticassertion 5y agoI don't know anything about it but I will say that people tend to audit crypto libraries and tend not to audit logging libraries.
- layer8 5y agoThey are generally high quality and implemented by cryptographers. Parts of the implementations are certified by NIST. Log4j is not part of the JDK and is an open source project with only few regular contributors. There is really no reason to infer any correlation to other parts of the Java ecosystem.
- ncmncm 5y ago"Certified by NIST" absolves people of responsibility without actually indicating any property of the code certified.