PRODUCTS

wolfCrypt JCE Provider (and JNI wrapper)

This package allows Java developers to leverage the industry-leading wolfCrypt cryptography library, providing both a Java JCE Provider and JNI wrapper around the native wolfCrypt library.  This interface gives Java applications access to all the benefits of using wolfCrypt, including current and performant cryptography implementations, FIPS 140-3 support, hardware cryptography support, and more! wolfSSL also provides a JSSE Provider in addition if SSL/TLS operations are needed.

A version of the wolfCrypt cryptography library has been FIPS 140-3 validated. For additional information, visit the wolfCrypt FIPS FAQ or contact fips@wolfssl.com.

Migrating from Bouncy Castle? Check out our Bouncy Castle Migration Guide.

Download Now

Get the latest open source GPLv2 version now!

Version: 1.11.0
Release Date: 08/10/2026
View ChangeLog

Highlights

  • Industry-leading native crypto
  • Java JCE Provider and JNI wrapper
  • Post Quantum Cryptography support
  • Tested against multiple JDK variants
  • Long-Term Service Level Agreements available

Flexibility

  • Allows flexibility of cryptography usage
  • Leverage portability of native wolfSSL and wolfCrypt libraries

Time-Saving

  • Eliminates need to write custom JNI
  • Drop in replacement for other JCE providers
  • Built on the industry-leading wolfCrypt library

 

Platform and Language Support

The native wolfSSL library is built for maximum portability and is generally very easy to compile on new platforms.  If your desired platform is not listed under the supported operating environments, please contact us.

Commercial Support

Support packages for wolfSSL and wolfCrypt JNI/JCE are available on an annual basis directly from wolfSSL.  With three different package options, you can compare them side-by-side and choose the package that best fits your specific needs.  Please see our Support Packages page for more details or contact us with any questions.

JDK Support

wolfCrypt JNI and JCE have been tested against multiple JDK implementations including Oracle JDK, OpenJDK, and Android’s JDK implementation.

Ships with Signed JAR Files

Oracle JDK requires JCE providers to be signed.  This signed JAR is then authenticated at runtime.  wolfCrypt JNI includes JAR files that have been pre-signed by wolfSSL to get you up and running quickly!

FIPS Support

Do you need FIPS 140-3? The wolfCrypt JNI and JCE Provider can sit on top of the FIPS 140-3 validated wolfCrypt library. Learn more about our FIPS 140-3 validation!

Algorithm Expansion

wolfCrypt JNI currently includes a subset of algorithm functionality found in the native wolfCrypt C library.  If you are interested in an algorithm not currently supported in the JNI/JCE wrapper, let us know at facts@wolfssl.com.

wolfSSL Training Course

Interested in getting trained by security experts on subjects related to wolfSSL and SSL/TLS?  For more information, please read our blog, or check out the wolfSSL Comprehensive Training Videos.

JNI Wrapper Features

  • Hash Functions: MD5, SHA-1, SHA-256, SHA-384, SHA-512
  • Block Ciphers: AES (CBC/GCM), 3DES
  • Public Key Options:  RSA, ECDSA
  • HMAC MD5, SHA-1, SHA-256, SHA-384, SHA-512, Blake2b
  • Key Agreement: DH, ECDH
  • RSA and ECC Key Generation
  • PBKDF2
  • Hardware Cryptography Support

JCE Provider Features

MessageDigest Class
    MD5
    SHA-1, SHA-224, SHA-256, SHA-384, SHA-512
    SHA3-224, SHA3-256, SHA3-384, SHA3-512

SecureRandom Class
    DEFAULT (maps to HashDRBG)
    HashDRBG (aliased also as: Hash_DRBG, DRBG)

Cipher Class
    AES/CBC/NoPadding
        Aliases: AES_128/CBC/NoPadding, AES_192/CBC/NoPadding, AES_256/CBC/NoPadding
        OIDs: 2.16.840.1.101.3.4.1.2, 2.16.840.1.101.3.4.1.22, 2.16.840.1.101.3.4.1.42
    AES/CBC/PKCS5Padding
    AES/CTS/NoPadding
    AES/CCM/NoPadding
    AES/CTR/NoPadding
    AES/ECB/NoPadding
Aliases: AES_128/ECB/NoPadding, AES_192/ECB/NoPadding, AES_256/ECB/NoPadding
OIDs: 2.16.840.1.101.3.4.1.1, 2.16.840.1.101.3.4.1.21, 2.16.840.1.101.3.4.1.41
AES/ECB/PKCS5Padding (aliased also as: AES)
AES/GCM/NoPadding
AES/OFB/NoPadding
Aliases: AES_128/OFB/NoPadding, AES_192/OFB/NoPadding, AES_256/OFB/NoPadding
OIDs: 2.16.840.1.101.3.4.1.3, 2.16.840.1.101.3.4.1.23, 2.16.840.1.101.3.4.1.43
DESede/CBC/NoPadding
RSA
RSA/ECB/PKCS1Padding
RSA/ECB/OAEPWithSHA-256AndMGF1Padding
Alias: RSA/ECB/OAEPWithSHA256AndMGF1Padding
RSA/ECB/OAEPWithSHA-1AndMGF1Padding
Alias: RSA/ECB/OAEPWithSHA1AndMGF1Padding

Mac Class
AESCMAC (aliased also as: AES-CMAC)
AESGMAC (aliased also as: AES-GMAC)
HmacMD5
HmacSHA1
OID: 1.2.840.113549.2.7
HmacSHA224
OID: 1.2.840.113549.2.8
HmacSHA256
OID: 1.2.840.113549.2.9
HmacSHA384
OID: 1.2.840.113549.2.10
HmacSHA512
OID: 1.2.840.113549.2.11
HmacSHA3-224
HmacSHA3-256
HmacSHA3-384
HmacSHA3-512

Signature Class
MD5withRSA
SHA1withRSA
SHA224withRSA
SHA256withRSA
SHA384withRSA
SHA512withRSA
SHA3-224withRSA
SHA3-256withRSA
SHA3-384withRSA
SHA3-512withRSA
RSASSA-PSS
SHA224withRSA/PSS
SHA256withRSA/PSS
SHA384withRSA/PSS
SHA512withRSA/PSS
SHA1withECDSA
SHA224withECDSA
SHA256withECDSA
SHA384withECDSA
SHA512withECDSA
SHA3-224withECDSA
SHA3-256withECDSA
SHA3-384withECDSA
SHA3-512withECDSA
SHA256withECDSAinP1363Format
SHA384withECDSAinP1363Format
SHA512withECDSAinP1363Format
SHA3-256withECDSAinP1363Format
SHA3-384withECDSAinP1363Format
SHA3-512withECDSAinP1363Format
ML-DSA (any ML-DSA-44/65/87 key)
ML-DSA-44
OID: 2.16.840.1.101.3.4.3.17
ML-DSA-65
OID: 2.16.840.1.101.3.4.3.18
ML-DSA-87
OID: 2.16.840.1.101.3.4.3.19
XMSS (verify-only)
OID: 1.3.6.1.5.5.7.6.34
XMSSMT (verify-only)
OID: 1.3.6.1.5.5.7.6.35
LMS (also registered as HSS/LMS)
OID: 1.2.840.113549.1.9.16.3.17
SLH-DSA (any SLH-DSA parameter set key)
SLH-DSA-SHA2-128s
OID: 2.16.840.1.101.3.4.3.20
SLH-DSA-SHA2-128f
OID: 2.16.840.1.101.3.4.3.21
SLH-DSA-SHA2-192s
OID: 2.16.840.1.101.3.4.3.22
SLH-DSA-SHA2-192f
OID: 2.16.840.1.101.3.4.3.23
SLH-DSA-SHA2-256s
OID: 2.16.840.1.101.3.4.3.24
SLH-DSA-SHA2-256f
OID: 2.16.840.1.101.3.4.3.25
SLH-DSA-SHAKE-128s
OID: 2.16.840.1.101.3.4.3.26
SLH-DSA-SHAKE-128f
OID: 2.16.840.1.101.3.4.3.27
SLH-DSA-SHAKE-192s
OID: 2.16.840.1.101.3.4.3.28
SLH-DSA-SHAKE-192f
OID: 2.16.840.1.101.3.4.3.29
SLH-DSA-SHAKE-256s
OID: 2.16.840.1.101.3.4.3.30
SLH-DSA-SHAKE-256f
OID: 2.16.840.1.101.3.4.3.31
HASH-SLH-DSA (pre-hash, any SLH-DSA parameter set key)
SLH-DSA-SHA2-128s-WITH-SHA256
OID: 2.16.840.1.101.3.4.3.35
SLH-DSA-SHA2-128f-WITH-SHA256
OID: 2.16.840.1.101.3.4.3.36
SLH-DSA-SHA2-192s-WITH-SHA512
OID: 2.16.840.1.101.3.4.3.37
SLH-DSA-SHA2-192f-WITH-SHA512
OID: 2.16.840.1.101.3.4.3.38
SLH-DSA-SHA2-256s-WITH-SHA512
OID: 2.16.840.1.101.3.4.3.39
SLH-DSA-SHA2-256f-WITH-SHA512
OID: 2.16.840.1.101.3.4.3.40
SLH-DSA-SHAKE-128s-WITH-SHAKE128
OID: 2.16.840.1.101.3.4.3.41
SLH-DSA-SHAKE-128f-WITH-SHAKE128
OID: 2.16.840.1.101.3.4.3.42
SLH-DSA-SHAKE-192s-WITH-SHAKE256
OID: 2.16.840.1.101.3.4.3.43
SLH-DSA-SHAKE-192f-WITH-SHAKE256
OID: 2.16.840.1.101.3.4.3.44
SLH-DSA-SHAKE-256s-WITH-SHAKE256
OID: 2.16.840.1.101.3.4.3.45
SLH-DSA-SHAKE-256f-WITH-SHAKE256
OID: 2.16.840.1.101.3.4.3.46

KeyAgreement Class
DiffieHellman
DH
ECDH

KeyGenerator
AES
HmacSHA1
HmacSHA224
HmacSHA256
HmacSHA384
HmacSHA512
HmacSHA3-224
HmacSHA3-256
HmacSHA3-384
HmacSHA3-512

KeyPairGenerator Class
RSA
RSASSA-PSS
EC
DH
ML-DSA (defaults to ML-DSA-65, level overridable via init())
ML-DSA-44 (alias OID: 2.16.840.1.101.3.4.3.17)
ML-DSA-65 (alias OID: 2.16.840.1.101.3.4.3.18)
ML-DSA-87 (alias OID: 2.16.840.1.101.3.4.3.19)
SLH-DSA (defaults to SLH-DSA-SHA2-128f, set overridable via init())
SLH-DSA-SHA2-128s (alias OID: 2.16.840.1.101.3.4.3.20)
SLH-DSA-SHA2-128f (alias OID: 2.16.840.1.101.3.4.3.21)
SLH-DSA-SHA2-192s (alias OID: 2.16.840.1.101.3.4.3.22)
SLH-DSA-SHA2-192f (alias OID: 2.16.840.1.101.3.4.3.23)
SLH-DSA-SHA2-256s (alias OID: 2.16.840.1.101.3.4.3.24)
SLH-DSA-SHA2-256f (alias OID: 2.16.840.1.101.3.4.3.25)
SLH-DSA-SHAKE-128s (alias OID: 2.16.840.1.101.3.4.3.26)
SLH-DSA-SHAKE-128f (alias OID: 2.16.840.1.101.3.4.3.27)
SLH-DSA-SHAKE-192s (alias OID: 2.16.840.1.101.3.4.3.28)
SLH-DSA-SHAKE-192f (alias OID: 2.16.840.1.101.3.4.3.29)
SLH-DSA-SHAKE-256s (alias OID: 2.16.840.1.101.3.4.3.30)
SLH-DSA-SHAKE-256f (alias OID: 2.16.840.1.101.3.4.3.31)
ML-KEM (defaults to ML-KEM-768, level overridable via init())
ML-KEM-512 (alias OID: 2.16.840.1.101.3.4.4.1)
ML-KEM-768 (alias OID: 2.16.840.1.101.3.4.4.2)
ML-KEM-1024 (alias OID: 2.16.840.1.101.3.4.4.3)

KeyFactory
RSA
EC (alias: 1.2.840.10045.2.1)
DH (aliases: DiffieHellman, 1.2.840.113549.1.3.1)
ML-DSA
ML-DSA-44 (alias OID: 2.16.840.1.101.3.4.3.17)
ML-DSA-65 (alias OID: 2.16.840.1.101.3.4.3.18)
ML-DSA-87 (alias OID: 2.16.840.1.101.3.4.3.19)
SLH-DSA
SLH-DSA-SHA2-128s (alias OID: 2.16.840.1.101.3.4.3.20)
SLH-DSA-SHA2-128f (alias OID: 2.16.840.1.101.3.4.3.21)
SLH-DSA-SHA2-192s (alias OID: 2.16.840.1.101.3.4.3.22)
SLH-DSA-SHA2-192f (alias OID: 2.16.840.1.101.3.4.3.23)
SLH-DSA-SHA2-256s (alias OID: 2.16.840.1.101.3.4.3.24)
SLH-DSA-SHA2-256f (alias OID: 2.16.840.1.101.3.4.3.25)
SLH-DSA-SHAKE-128s (alias OID: 2.16.840.1.101.3.4.3.26)
SLH-DSA-SHAKE-128f (alias OID: 2.16.840.1.101.3.4.3.27)
SLH-DSA-SHAKE-192s (alias OID: 2.16.840.1.101.3.4.3.28)
SLH-DSA-SHAKE-192f (alias OID: 2.16.840.1.101.3.4.3.29)
SLH-DSA-SHAKE-256s (alias OID: 2.16.840.1.101.3.4.3.30)
SLH-DSA-SHAKE-256f (alias OID: 2.16.840.1.101.3.4.3.31)
ML-KEM
ML-KEM-512 (alias OID: 2.16.840.1.101.3.4.4.1)
ML-KEM-768 (alias OID: 2.16.840.1.101.3.4.4.2)
ML-KEM-1024 (alias OID: 2.16.840.1.101.3.4.4.3)
XMSS (verify-only, alias OID: 1.3.6.1.5.5.7.6.34)
XMSSMT (verify-only, alias OID: 1.3.6.1.5.5.7.6.35)
LMS (also HSS/LMS, OID 1.2.840.113549.1.9.16.3.17)

KEM Class (javax.crypto.KEM, requires JDK 21 or later)
ML-KEM
ML-KEM-512 (alias OID: 2.16.840.1.101.3.4.4.1)
ML-KEM-768 (alias OID: 2.16.840.1.101.3.4.4.2)
ML-KEM-1024 (alias OID: 2.16.840.1.101.3.4.4.3)

CertPathValidator Class
PKIX (with PKIXRevocationChecker via getRevocationChecker())

CertPathBuilder Class
PKIX

SecretKeyFactory
PBKDF2WithHmacSHA1
PBKDF2WithHmacSHA224
PBKDF2WithHmacSHA256
PBKDF2WithHmacSHA384
PBKDF2WithHmacSHA512
PBKDF2WithHmacSHA3-224
PBKDF2WithHmacSHA3-256
PBKDF2WithHmacSHA3-384
PBKDF2WithHmacSHA3-512

KeyStore
WKS

AlgorithmParameters
AES
DH
GCM
RSASSA-PSS

AlgorithmParameterGenerator
DH

Supported Chipmakers (wolfCrypt)

Supported Operating Environments

  • Linux, Mac OS X, Windows (Visual Studio)
  • If you would like to test wolfSSL on another environment, let us know and we’ll be happy to support you.

Licensing and Ordering:

wolfCrypt JNI/JCE are dual licensed under both the GPLv2 and commercial licensing. For more information, please see the following links.