49

How can I check, in Java code, if the current JVM have unlimited strength cryptography available?

2

9 Answers 9

48

In the same spirit as the answer of Dan Cruz, but with a single line of code and without going trough exceptions:

boolean limit = Cipher.getMaxAllowedKeyLength("RC5")<256;

So a complete program might be:

import javax.crypto.Cipher;

public class TestUCE {
  public static void main(String args[]) throws Exception {
    boolean unlimited =
      Cipher.getMaxAllowedKeyLength("RC5") >= 256;
    System.out.println("Unlimited cryptography enabled: " + unlimited);
  }
}
3
  • tested and this worked, returning 'false' and 'true' respectively. Thank you.
    – eis
    Feb 12, 2015 at 13:44
  • 3
    This is a better answer than the accepted answer IMO.
    – Y123
    May 4, 2015 at 17:45
  • 2
    This answer uses the "RC5" transform, a rather obscure stream cipher that is not in the list of required algorithms, it checks against 256 (which may be available in future restricted JREs and it also doesn't handle the exception well. Please take a look at my answer that resolves this. Nov 21, 2015 at 22:27
45

If you are on Linux and you have installed the JDK (but Beanshell is not available), you can check with the runscript command provided with the JDK.

jrunscript -e 'exit (javax.crypto.Cipher.getMaxAllowedKeyLength("RC5") >= 256 ? 0 : 1);'; echo $?

This returns a 0 status code if the Unlimited Cryptography is available, or 1 if not available. Zero is the correct 'success' return value for shell functions, and non-zero indicates a failure.

4
  • Just an FYI that jrunscript is included in the Oracle JDK, so you might have to go looking for it. On a RedHat/CentOS/Fedora system you can do rpm -ql jdk | grep jrunscript to find it.
    – slm
    Jan 20, 2016 at 3:40
  • 1
    I'm trying to run this in windows. Is there a special escape character I need to use? Feb 15, 2017 at 21:03
  • This works like a champ on macOS. This should also work fine under PowerShell. Apr 11, 2017 at 1:45
  • 2
    Windows version: jrunscript -e "exit (println(javax.crypto.Cipher.getMaxAllowedKeyLength(\"RC5\") >= 256));"
    – chance
    Jan 31, 2020 at 12:34
25

I think you could probably use Cipher.getMaxAllowedKeyLength(), while also comparing the cypher you're using to known lists of "good", secure cyphers, such as AES.

Here's a reference article that lists maximum key size jurisdiction limitations that were current as of Java 1.4 (these likely haven't changed, unless the law has also changed - see below).

If you are operating in a nation that has cryptographic export/import restrictions, you'd have to consult the law in your nation, but it's probably safe to assume in these situations that you don't have unlimited strength cryptography available (by default) in your JVM. Putting it another way, assuming you're using the official JVM from Oracle, and you happen to live in a nation against which the U.S. has leveled export restrictions for cryptography (and since Oracle is a United States company, it would be subject to these restrictions), then you could also assume in this case that you don't have unlimited strength available.

Of course, that doesn't stop you from building your own, and thereby granting yourself unlimited strength, but depending on your local laws, that might be illegal.

This article outlines the restrictions on export to other nations, from the Unites States.

3
  • 1
    I find it pretty hard to check from Java whether or not I'm running in a machine under USA export laws...
    – Chi-Lan
    Oct 31, 2011 at 17:04
  • Yeah, I suppose there's no API for that. I think Dan Cruz's answer is probably the closest you can get.
    – jefflunt
    Oct 31, 2011 at 18:05
  • No, actually getMaxAllowedKeyLength sounds much better.
    – Chi-Lan
    Nov 1, 2011 at 6:53
19

The way how to check if restrictions apply is documented in the method Cipher.getMaxAllowedKeyLength:

If JCE unlimited strength jurisdiction policy files are installed, Integer.MAX_VALUE will be returned.

This means that if any value other than (or indeed lower than) Integer.MAX_VALUE is returned that restrictions do apply.

Even more information is in the JavaDoc of the method below:

/**
 * Determines if cryptography restrictions apply.
 * Restrictions apply if the value of {@link Cipher#getMaxAllowedKeyLength(String)} returns a value smaller than {@link Integer#MAX_VALUE} if there are any restrictions according to the JavaDoc of the method.
 * This method is used with the transform <code>"AES/CBC/PKCS5Padding"</code> as this is an often used algorithm that is <a href="https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#impl">an implementation requirement for Java SE</a>.
 * 
 * @return <code>true</code> if restrictions apply, <code>false</code> otherwise
 */
public static boolean restrictedCryptography() {
    try {
        return Cipher.getMaxAllowedKeyLength("AES/CBC/PKCS5Padding") < Integer.MAX_VALUE;
    } catch (final NoSuchAlgorithmException e) {
        throw new IllegalStateException("The transform \"AES/CBC/PKCS5Padding\" is not available (the availability of this algorithm is mandatory for Java SE implementations)", e);
    }
}

Note that since Java 9 the unlimited crypto policies are installed by default (with those affected by import / export regulations having to install the limited crypto policies instead). So this code would mainly be required for backwards compatibility and/or other runtimes.

3
  • Added this additional answer because the accepted answer is not very definitive and the answer that currently has the most upvotes uses RC5, a rather obscure stream cipher that is not in the list of required algorithms, it checks against 256 (which may be available in future restricted JREs and it also doesn't handle the exception well. Nov 21, 2015 at 22:20
  • 1
    Note that you can use getMaxAllowedKeyLength("foo") and still get the right answer. I've found that as long as the argument isn't null or "", you'll get the answer you're looking for. Mar 3, 2016 at 15:57
  • 1
    Right. But I'd rather make sure my code is not vulnerable against implementation changes... Mar 3, 2016 at 16:47
7

This is a complete copy paste version to allow for testing

import javax.crypto.Cipher;
import java.security.NoSuchAlgorithmException;

class Test {
    public static void main(String[] args) {
        int allowedKeyLength = 0;

        try {
            allowedKeyLength = Cipher.getMaxAllowedKeyLength("AES");
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        }

        System.out.println("The allowed key length for AES is: " + allowedKeyLength);
    }
}

To run

javac Test.java

java Test

If JCE is not working output: 128 JCE is working something like: 2147483647

1
  • The function getMaxAllowedKeyLength may not return a valid AES key size and as such this answer is incorrect. Personally I hate printStackTrace as the code keeps running. If you throw a RuntimeException instead then you would not have to assign the wrong value 0 to allowedKeyLength. Dec 6, 2018 at 15:52
3

If you are using Linux, you can check it easily with this command

java -version ; \
echo 'System.err.println(javax.crypto.Cipher.getInstance("AES/CBC/PKCS5Padding").getMaxAllowedKeyLength("AES"));'  \
| java -cp /usr/share/java/bsh-*.jar bsh.Interpreter >/dev/null

If the output is something like that, unlimited strength cryptography is not available

java version "1.7.0_76"
Java(TM) SE Runtime Environment (build 1.7.0_76-b13)
Java HotSpot(TM) 64-Bit Server VM (build 24.76-b04, mixed mode)
128
3

You can check it in one step from the command line by using groovy :

groovysh -e 'javax.crypto.Cipher.getMaxAllowedKeyLength("AES")'

If the result is 2147483647, you have unlimited cryptography.

On older version of groovy, you have to remove the -e :

groovysh 'javax.crypto.Cipher.getMaxAllowedKeyLength("AES")'
0

NOTE: Please use jefflunt's answer or KonstantinSpirov's answer. This answer is not a valid answer since it will always return true. I am leaving this answer here only because it is referenced elsewhere in answers and comments and is useful as a reference only.


You could use the following to initialize a static final boolean somewhere that you can then use for testing unlimited crypto support (since AES 256-bit is only supported if the unrestricted policy is installed).

boolean isUnlimitedSupported = false;
try {
    KeyGenerator kgen = KeyGenerator.getInstance("AES", "SunJCE");
    kgen.init(256);
    isUnlimitedSupported = true;
} catch (NoSuchAlgorithmException e) {
    isUnlimitedSupported = false;
} catch (NoSuchProviderException e) {
    isUnlimitedSupported = false;
}
System.out.println("isUnlimitedSupported=" + isUnlimitedSupported);
// set static final variable = isUnlimitedSupported;
3
  • 2
    indeed. This will always return true. Answer should be removed.
    – eis
    Feb 12, 2015 at 14:10
  • @eis, I agree. This will always return true. Updated to note better answers.
    – Go Dan
    Feb 12, 2015 at 16:06
  • 3
    This doesn't work because Cipher tests for the allowed key sizes, while KeyGenerator does not. The restrictions are not specific to a provider. Furthermore, instantiating a KeyGenerator is not a very efficient or logical method to check for the restrictions. Please remove incorrect answers. Nov 21, 2015 at 22:23
-1

I recently had to do add a JCE check and my solution evolved to the following snippet. This was a groovy script, but it should be easy to convert to standard java method with a try catch. This has been tested with Java 7 & Java 8.

import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import javax.crypto.SecretKey;

// Make a blank 256 Bit AES Key
final SecretKey secretKey = new SecretKeySpec(new byte[32], "AES");
final Cipher encryptCipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
// This line will throw a invalid key length exception if you don't have
// JCE Unlimited strength installed
encryptCipher.init(Cipher.ENCRYPT_MODE, secretKey);
// If it makes it here, you have JCE installed
1
  • 1
    There are a few issues with your scheme. First of all, it relies on an exception during the running of the code to perform the test. This makes it harder to debug. It could be that there are future restrictions on e.g. RSA that do not influence the key size of AES, in which case the test would fail. Third, it requires the creation of spurious objects that are not really required at all to perform the test. That said, the test would of course work for Java 7 & 8 and the transformation that you chose is at least mandatory for Java SE implementations. Nov 22, 2015 at 12:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.