For more security spongycastle -> bouncycastle

[Neustradamus]

For more security, can you change old spongycastle (based on old bouncycastle) to bouncycastle?

• https://www.bouncycastle.org/
• https://www.bouncycastle.org/releasenotes.html
• http://www.bouncycastle.org/latest_releases.html
• https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=bouncy%20castle
• https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=bouncycastle
• https://www.cvedetails.com/vulnerability-list/vendor_id-7637/Bouncycastle.html

[bitgamma]

we use bouncycastle since some releases already. Did we forget removing references to spongycastle anywhere? Could you please give a pointer, I cannot find it

[Neustradamus]

@bitgamma: Thanks for your message!

• Here in this project "status-keycard-java": https://github.com/status-im/status-keycard-java/search?q=spongycastle&unscoped_q=spongycastle

• In "ethereumj-personal": https://github.com/status-im/ethereumj-personal/search?q=spongycastle&unscoped_q=spongycastle

• In "syng-client": https://github.com/status-im/syng-client/search?q=spongycastle&unscoped_q=spongycastle

It is for this I have created:

• For more security spongycastle -> bouncycastle #20
• For more security spongycastle -> bouncycastle ethereumj-personal#10
• For more security spongycastle -> bouncycastle syng-client#40

[Neustradamus]

@bitgamma: And in the same time an update of Bouncy Castle, currently last version is 1.65.

[Neustradamus]

@bitgamma: Thanks :)

[Neustradamus]

@bitgamma: Can you update Bouncy Castle to 1.69?
Note that there were CVEs before.