Check the allowed crypto key size and disable MSE if insufficient

[atomashpolskiy]

Code snippet here: https://gist.github.com/jehrhardt/5167854
Currently Bt just won't connect to peers if JCE unlimited strength is not installed. It would be better to automatically disable MSE negotiation and fallback to standard BitTorrent handshake (and throw an exception in CLI client if -e flag is provided, i.e. encryption is required).

[zimmi]

Just as an FYI, the upcoming JDK 8u152 will bring a programmatic way to enable unlimited key strength, without the user having to copy policy files around.

The API is backward compatible, so it might make sense to do this right away. The incantation is:

java.security.Security.setProperty("crypto.policy", "unlimited");

P.S.: I haven't used your library yet, but it looks really good! :)

[atomashpolskiy]

This is very timely and useful info, thank you for sharing! However, I'm struggling to understand from the text, whether this new property will be undefined or set to 'limited' by default in 8u125 (and later)? Common sense tells me that it should be the latter, otherwise this property would be useless in earlier versions. Is my assumption correct?

[zimmi]

First off, I'm not an OpenJDK developer.
However, the text says:

By default, the property will be undefined. If the property is undefined and the legacy JCE jurisdiction files don't exist in the legacy lib/security directory, then the default cryptographic level will remain at 'limited'.

Reading that, my understanding is the following:

• JDK 8u152 and later: With an unmodified JDK, the property will be undefined by default, therefore the cryptographic level will be 'limited' (as it is today)
• before JDK 8u152: Property will be ignored, still need to copy policy files

So to find out what the current cryptographic level is, it seems like you would still need to do a check for the supported key length like in your first post.
Setting the property might be a useful convenience though, but I'm not sure if that's something a library should do implicitly, because it's a global setting. Maybe just some documentation / demo code?

Edit: For the CLI it does seem like a good default though. Much less hassle! :)