Repository navigation
Support PBEKeys in a Bouncy Castle FIPS library #2164
Description
Activity
Okay, we'll add it the list. We'll probably do it in bc-java first, it may take a while to get into a FIPS module, although once the support is done, as long as the FIPS import requirements for keys are followed it should be possible to have it as an add on.
This is now added to BCFKS in bc-java.
- added a commit that references this issue
on May 3, 2026 - added a commit that references this issue
on Oct 5, 2026
Currently, the Bouncy Castle FIPS KeyStore (BCFKS) lacks a direct mechanism for storing generic passwords or password-based encryption (PBE) keys. The common workaround is to store a password as an HMAC key, which is semantically incorrect and misleading.
This request is to add support for storing and retrieving PBEKeys within the Bouncy Castle FIPS KeyStore.
This would allow the BCFKS provider to recognise, store, and correctly retrieve entries of type PBEKey. This would also allow users to store passwords and other PBE-based secrets in a semantically correct format.