For more security spongycastle -> bouncycastle

[Neustradamus]

For more security, can you change old spongycastle (based on old bouncycastle) to bouncycastle?

• https://www.bouncycastle.org/
• https://www.bouncycastle.org/releasenotes.html
• http://www.bouncycastle.org/latest_releases.html
• https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=bouncy%20castle
• https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=bouncycastle
• https://www.cvedetails.com/vulnerability-list/vendor_id-7637/Bouncycastle.html

[Benson0224]

@Neustradamus could you please list the potential risk or potential attack if we are still on the old spongycastle?

[Neustradamus]

@Benson0224: Thanks for your comment!
Currently Bouncy Castle last version is 1.65 and Spongy Castle last version is 1.58.
Spongy Castle is a fork of Bouncy Castle.
Please look previous links :)

Since several years, a lot of projects have already moved from Spongy Castle to Bouncy Castle because the project is dead.

You can see discussion "34" in https://github.com/rtyley/spongycastle/issues.

[Benson0224]

@Neustradamus Thanks for your clarification.

Checked with Team, replace Spongy Castle with Bouncy Castle is not easy and it affects multiple modules, We will add it in our to-do list and start soon, at the same time, we will keep this issue here, and update the progress timely.

[Benson0224]

Spongy Castle will not be maintained anymore. check detail at:
rtyley/spongycastle#34

[Neustradamus]

@Benson0224: Yes, it is for this I have requested this change because currently there are security problems.

[Neustradamus]

@Benson0224: Any news?

• https://github.com/tronprotocol/java-tron/search?q=spongycastle&unscoped_q=spongycastle

[Benson0224]

@Neustradamus checked with the team, it is already on our to-do list. however this change is a huge change, it cannot be done within a short time. and currently, we are busy with other urgent tasks. we will update this issue once we got any progress. thanks.

[Neustradamus]

@Benson0224: Thanks for your reply!
Please note that this is a security problem, it is important ;)

[Neustradamus]

@Benson0224, @shydesky, @Federico2014: Any news?

[que1414]

Duplicate of #

[Federico2014]

@Benson0224 @Neustradamus The bouncy castle library will be updated in release 4.3.0, please refer to #3919

[Neustradamus]

@Federico2014: Good job, thanks!

[Benson0224]

Thanks for your support to java-tron.
This issue will be closed as it is already implemented in https://github.com/tronprotocol/java-tron/releases/tag/GreatVoyage-v4.3.0

[Neustradamus]

@Benson0224: Thanks a lot, more one year after ^^
You can remove https://github.com/tronprotocol/java-tron/search?q=spongycastle&unscoped_q=spongycastle too no?

And do not other repos too:

• https://github.com/search?q=org%3Atronprotocol+spongycastle&type=code