Why are the JCE Unlimited Strength not included by default?

Question

Setup

• Java doesn\'t offer out-of-the-box support for the JCE Unlimited Strength Policy Files
• This prevents users from using AES-256, the largest key

Answer 1

Now Unlimited cryptography enabled by default in the JDK

The JDK uses the Java Cryptography Extension (JCE) Jurisdiction Policy files to configure cryptographic algorithm restrictions. Previously, the Policy files in the JDK placed limits on various algorithms. This release ships with both the limited and unlimited jurisdiction policy files, with unlimited being the default. The behavior can be controlled via the new 'crypto.policy' Security property found in the /lib/java.security file. Please refer to that file for more information on this property.

See: http://www.oracle.com/technetwork/java/javase/8u161-relnotes-4021379.html#JDK-8170157

Answer 2

• As it turns out, it's not strict crypto export laws, but simply that no one got around to it yet.
• In fact, it's been planned for a long time to not have to jump through these hoops.
• In Java 9, the ceremony will be condensed down to a one-liner: Security.setProperty("crypto.policy", "unlimited");

Answer 3

The US has restrictions on the export of cryptographic technology:

https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States

They used to be very strict -- cryptography was classified as munitions, and you could only download the full strength products from the US and other whitelisted countries.

Restrictions have eased up a lot since then, but some remain, and full strength JCE can't be freely distributed everywhere like the JRE, so it's a separate package.