Hi Konrad, On Wed, 2026-07-22 at 10:29 +0200, Konrad Windszus wrote: > Hi, > Unfortunately Jasypt used in Commons Crypto > (https://sling.apache.org/documentation/bundles/commons-crypto.html) > is no longer maintained: > > > This library is no longer maintained, but it is kept here for > > historical reference. A lot of effort went into it back in the day, > > and I wouldn't want to just delete it. > > (From https://github.com/jasypt/jasypt/blob/master/README.md) > > Would it make sense to come up with an implementation based on the > JCA > (https://docs.oracle.com/javase/8/docs/technotes/guides/security/cryp > to/CryptoSpec.html#ProviderArch) > That way one would have the option to pick between different > providers. The default one shipping with most JREs ("Sun JCE > provider, > https://docs.oracle.com/javase/8/docs/technotes/guides/security/SunProviders.html#SunJCEProvider > ) already provides quite some algorithms. > Bouncycastle is an alternative provider supporting even more > algorithms: > https://www.bouncycastle.org/documentation/specification_interoperability/#algorithms-and-key-types > .
Yes, I think it makes a lot of sense to move away from Jasypt. I have no strong opinion on whether we should use JCA or Bouncycastle. Thanks, Robert > > In the end I would like to hook this up with CACs > (https://sling.apache.org/documentation/bundles/context-aware-configu > ration/context-aware-configuration.html) so that a property is > optionally only stored in an encrypted fashion (right now this is > always stored as plain text JCR property which is not suitable for > secret data). > > WDYT? > Konrad
