AmazonS3EncryptionV2 & Bouncy Castle Version Error

[ldadams]

Describe the bug

I am attempting to use AmazonS3EncryptionV2 for client side S3 encryption and getting the below runtime error. I am following the documenting in the development guide.

A more recent version of Bouncy castle is required for authenticated encryption

Expected Behavior

Using the latest AWS and Bouncy Castle libraries should work based on error and documentation.

Current Behavior

Runtime error:
A more recent version of Bouncy castle is required for authenticated encryption

Steps to Reproduce

Exception in thread "main" java.lang.UnsupportedOperationException: A more recent version of Bouncy castle is required for authenticated encryption.
	at com.amazonaws.services.s3.model.CryptoConfigurationV2.checkBountyCastle(CryptoConfigurationV2.java:379)
	at com.amazonaws.services.s3.model.CryptoConfigurationV2.checkCryptoMode(CryptoConfigurationV2.java:366)
	at com.amazonaws.services.s3.model.CryptoConfigurationV2.<init>(CryptoConfigurationV2.java:68)
	at com.amazonaws.services.s3.model.CryptoConfigurationV2.<init>(CryptoConfigurationV2.java:47)
	at securities.CryptoUtil.Encrypt(CryptoUtil.java:41)
	at securities.App.main(App.java:19)

        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
        keyPairGenerator.initialize(2048);

        KeyPair keyPair = keyPairGenerator.generateKeyPair();

        String s3ObjectKey = "test.txt";
        String s3ObjectContent = "This should be encrypt";

        AmazonS3EncryptionV2 s3EncryptionClientV2 = AmazonS3EncryptionClientV2Builder.standard()
                .withRegion(Regions.DEFAULT_REGION)
                .withClientConfiguration(new ClientConfiguration())
                .withCryptoConfiguration(new CryptoConfigurationV2().withCryptoMode(CryptoMode.AuthenticatedEncryption))
                .withEncryptionMaterialsProvider(new StaticEncryptionMaterialsProvider(new EncryptionMaterials(keyPair)))
                .build();

        s3EncryptionClientV2.putObject(bucketName, s3ObjectKey, s3ObjectContent);
        s3EncryptionClientV2.shutdown();

        return s3EncryptionClientV2.getObjectAsString(bucketName, s3ObjectKey);

   <dependencies>
        <dependency>
            <groupId>com.amazonaws</groupId>
            <artifactId>aws-java-sdk-core</artifactId>
            <version>1.11.877</version>
            <type>jar</type>
        </dependency>
        <dependency>
            <groupId>com.amazonaws</groupId>
            <artifactId>aws-java-sdk-kms</artifactId>
            <version>1.11.877</version>
            <type>jar</type>
        </dependency>
        <dependency>
            <groupId>com.amazonaws</groupId>
            <artifactId>aws-java-sdk-s3</artifactId>
            <version>1.11.877</version>
            <type>jar</type>
        </dependency>
        <dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcprov-ext-jdk15on</artifactId>
            <version>1.66</version>
        </dependency>
    </dependencies>

Possible Solution

Context

Unable to use latest Java Client side encryption SDK.

Your Environment

• AWS Java SDK version used: 1.11.877
• JDK version used: 14
• Operating System and version: Mac 10.15.7

[debora-ito]

Hi @ldadams thank you for reaching out. When the S3 Encryption client library initializes it attempts to load Bouncy Castle and attempts to perform AES-GCM encryption with it to assert that it's a recent enough version of Bouncy Castle to be able to be used with the library. If this operation fails then that exception is thrown.

I was not able to reproduce the issue with bcprov-ext-jdk15on 1.66. One possible cause you're seeing the exception is a version conflict in your classpath, maybe maven is resolving to an older version as a transient dependency. You can check for dependency version resolution by running mvn dependency:tree.

If all the dependencies you are using are in the list above, you can try to clean up your maven local cache.

[github-actions]

It looks like this issue hasn’t been active in longer than a week. In the absence of more information, we will be closing this issue soon. If you find that this is still a problem, please add a comment to prevent automatic closure, or if the issue is already closed please feel free to reopen it.