--- title: "JCE" slug: "jce" updated: 2026-08-19T06:37:57Z published: 2026-08-19T06:37:57Z canonical: "support.fortanix.com/jce" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # JCE ## Java Cryptography Extension (JCE) ### Downloads The Java SDK supports Java 8, 11, and 17. [Download Unified JCE and Java SDK here (with all dependencies)](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/sdkms-jce-provider-bundled-5.7.2954.jar) **SHA256 sum:** ```plaintext cdd606b78b77a0016753899d436cad406b2b586b0134785fc979cfe1b53e132e ``` ### Download Using Maven ```plaintext com.fortanix sdkms-jce-provider 5.7.2954 ``` Alternatively, add the following dependency to the `build.gradle` file: ```plaintext compile "com.fortanix:sdkms-jce-provider:5.7.2954" ``` ### Maven Additionally, add the `pom.xml` if you need to use it in [Spring Boot 3.0](/v1/docs/hsm-gateway). ```plaintext       org.springframework.boot       spring-boot-starter               org.springframework.boot       spring-boot-starter-logging            org.springframework.boot    spring-boot-starter-log4j2 ``` ### JCE Provider Documentation [JCE Provider Documentation](https://download.fortanix.com/clients/5.7.2954/apidocs/index.html) ### Java SDK Documentation [Java SDK Documentation](https://download.fortanix.com/clients/5.7.2954/java-docs/index.html) ### Installation *For more information, refer to* [*Java Cryptography Extension (JCE) Provider*](/v1/docs/fortanix-dsm-clients-java-cryptography-extension-jce-provider)*.* ## Operating System (OS) Compatibility Matrix *For more information on the JCE client OS compatibility matrix, refer to* [*Compatibility Matrix*](/v1/docs/fortanix-dsm-clients-compatibility-matrix)*.* ## Change Details ### 4.9.2091 1. Support for Java 11 (OpenJDK 11). 2. Fixed multipart encryption for Galois/Counter Mode (GCM)/ Cipher block chaining - message authentication code (CCM) mode of encryption. 3. Refactored the JCE code to address naming standards, packaging of classes, and duplication. The following classes have been renamed: Modified classes: ```plaintext client/jce/src/main/java/com/fortanix/sdkms/jce/provider/util/ProviderUtil.java change-log: enums ECGenSpec, DigestAlgorithms & ECKeySizeSpec have been moved to their own separate public classes (ref new classes introduced section) ``` New classes added: ```plaintext client/jce/src/main/java/com/fortanix/sdkms/jce/provider/constants/DigestAlgorithms.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/constants/ECGenSpec.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/constants/ECKeySizeSpec.java change-log: public enums extracted from ProviderUtil class client/jce/src/main/java/com/fortanix/sdkms/jce/provider/keys/sym/desede/SdkmsDesede.java change-log: separate class for desede instead of relying on des classes client/jce/src/main/java/com/fortanix/sdkms/jce/provider/service/SdkmsCommonService.java change-log: common code has been moved to this class to reduce duplication ``` Renamed classes: ```plaintext SdkmsCertificate.java → SdkmsCertificateService.java {same package} client/jce/src/main/java/com/fortanix/sdkms/jce/provider/service/SdkmsCertificateService.java service/SdkmsSignature.java → signatures/SdkmsSignatureService.java {package changed} client/jce/src/main/java/com/fortanix/sdkms/jce/provider/signatures/SdkmsSignatureService.java ``` Package change: ```plaintext client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → agreement } /ECDHKeyAgreement.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → ciphers } /AESCipher.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → ciphers } /CipherCore.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → ciphers } /DESCipher.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → ciphers } /RSACipher.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { service → ciphers } /SdkmsCipher.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → ciphers } /TripleDESCipher.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → config } /Configuration.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → constants } /AccessControlKeys.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → constants } /AlgorithmParameters.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { util → constants } /ProviderConstants.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → digests } /MessageDigestImpl.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { service → digests } /SdkmsDigest.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys } /SdkmsCipherKey.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys } /SdkmsKey.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys } /SdkmsSecretKey.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/asym/dsa } /DSAKeyPairGenerator.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/asym/dsa } /DSAPrivateKeyImpl.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/asym/dsa } /DSAPublicKeyImpl.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { service → keys/asym/dsa } /SdkmsDsa.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/asym/elliptic } /ECKeyFactory.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/asym/elliptic } /ECKeyPairGenerator.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/asym/elliptic } /ECPrivateKeyImpl.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/asym/elliptic } /ECPublicKeyImpl.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/{ service → keys/asym/elliptic } /SdKmsEc.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/asym/rsa } /RSAKeyFactory.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/asym/rsa } /RSAKeyPairGenerator.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/asym/rsa } /RSAPrivateKeyImpl.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/asym/rsa } /RSAPublicKeyImpl.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { service → keys/asym/rsa } /SdKmsRsa.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/sym/aes } /AESKeyGenerator.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/sym/aes } /AESSecretKeyFactory.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/sym/aes } /SdkmsAESKey.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { service → keys/sym/aes } /SdkmsAes.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/sym/des } /DESKeyGenerator.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/sym/des } /DESSecretKeyFactory.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/sym/des } /SdkmsDESKey.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { service → keys/sym/des } /SdkmsDes.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/sym/desede } /DESedeKeyGenerator.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/sym/desede } /DESedeSecretKeyFactory.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keys/sym/desede } /SdkmsDESedeKey.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keystore } /KeyStore.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keystore } /LocalKeyStore.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → keystore } /SdkmsKeyStore.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → macs } /HmacCore.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → macs } /KeyGeneratorCore.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → macs } /SdkmsHmacKey.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { service → macs } /SdkmsMac.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → paddings } /IPadding.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → paddings } /NoPadding.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → paddings } /PKCS5Padding.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → signatures } /DSASignature.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → signatures } /ECDSASignature.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → signatures } /Ed25519Signature.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → signatures } /RSASignature.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → spec } /SecurityObjectKeySpec.java client/jce/src/main/java/com/fortanix/sdkms/jce/provider/ { → spec } /SecurityObjectParameterSpec.java ``` ### 3.19.1352 1. Improved Fortanix Data Security Manager (DSM) implementation of Java Cryptographic Key and Key Pair interfaces to support initialization using the Name of the key, besides Key ID. - Old constructor (Deprecated from 3.19 onwards): ```plaintext SdkmsAESKey key = new SdkmsAESKey("", 128, null) ``` - New constructor: Initialize by Key ID ```plaintext SdkmsAESKey key = new SdkmsAESKey(new SobjectDescriptor().kid("")) ``` - New constructor: Initialize by Key Name, for example: ```plaintext SdkmsAESKey key = new SdkmsAESKey(new SobjectDescriptor().name("MyKeyName")) ``` **-** Above changes apply to other Key implementations: `SdkmsDESKey`, `SdkmsDESedeKey`, `RSAPrivateKeyImpl`, `RSAPublicKeyImpl`, `ECPrivateKeyImpl`, `ECPublicKeyImpl`, `SDKMSKmacKey` **-** No changes in the `KeyGenerator`, `KeyPairGenerator`, `Cipher`, `Signature`usage. 2. Optimized to Cipher implementation, which eliminates extra API requests, thus improving client-side throughput by two times. 3. Added support for Multipart Cipher operations for AES GCM mode. This is supported for Fortanix DSM server version 3.19 or higher only. > [!NOTE] > NOTE > > - AES GCM Cipher will still behave as Non-Multipart Cipher for DSM server version < 3.19. in Non -Multipart mode, Cipher.update() returns empty and Cipher.final() will return the full cipher bytes. > - With Fortanix DSM version >= 3.19 and JCE Client version >=3.19, AES GCM Cipher will behave as Multipart by default. > [!WARNING] > WARNING > > - If AES GCM Cipher is being used before 3.19, an upgrade of both server and client to 3.19 will break the behavior due to the change from Non-Multipart to Multipart implementation. If Non-Multipart behavior is still desired, then add this environment variable to force Non-Multipart behavior for AES GCM Cipher: > - `export FORTANIX_CIPHER_SINGLEPART_ONLY=true` 4. Added support for Elliptic Curve Ed25519 for ECDSA operations. 5. Fortanix DSM JCE provider is published to Maven from this release onwards. See the section [*Maven*](/v1/docs/jce#maven) for updated install instructions. 6. Added support for using Local Sun implementation for `MessageDigest` operations using env variable `export FORTANIX_USE_LOCAL_DIGEST=true `. This optimizes signing operations of large files and is helpful in jar signing use-cases. 7. Added support for importing public key by default as a *transient key* (which are not persisted in Fortanix DSM and lives only during a session lifetime) using env variable `export FORTANIX_PUBKEY_IMPORT_TRANSIENT=true`. This is helpful in jar signing use-cases, where `jarsigner `requires to use the public key in a temporary manner. 8. Added support for Fortanix DSM JCE initialization with API Endpoint and API Key in provider constructor. Thus, reducing the requirement of using the env variable for the same. This is helpful in environments, where setting the env variable is not possible. For example: initialize(`<apiEndpoint>, <apiKey>`). ### 3.21.1992 #### Connection Pooling Fortanix DSM version 3.21 and above supports a new feature called Connection Pooling. Connection pooling allows restriction and reuse of connections with a maximum limit specified. This allows setting some safe limits on each JCE application so that no single application can overwhelm the server. **With JCE Connection Pooling** The environment variable `FORTANIX_CONN_MAX `is set to the maximum number of connections from that instance of the JCE application. **Without JCE Connection Pooling** When the environment variable `FORTANIX_CONN_MAX` is not exported or is set to ``0``, JCE will behave without any connection pooling/limit. This is similar to JCE behavior prior to version 3.21. **Scenarios** - `FORTANIX_CONN_MAX = 0`. - Existing behavior: number of sockets is equal to the number of concurrent threads. - `FORTANIX_CONN_MAX = X`, Concurrent threads less than X. - Behavior: Less than X sockets open at a time. - Observation: The sockets are also being reused. - `FORTANIX_CONN_MAX = X`, Concurrent threads greater than X. - Behavior: Maximum X sockets open with reuse. - Observation: higher latency, which is expected since threads are now waiting for connections to get free. #### JCE logging With the 3.21 release, by default the logging option is disabled, and in order to enable it export the following environment variables: - To enable debug logs, set the environment variable: ```plaintext export FORTANIX_LOG_DEBUG=true ``` - To enable only API logs, set the environment variable: ```plaintext export FORTANIX_LOG_API=true ``` - To set a file location for local logs, set the environment variable: ```plaintext export FORTANIX_LOG_FOLDER="/path/to/logfile-folder" ``` This will create a log file `/path/to/logfile-folder/sdkms-jce.log`.