How to Resolve java.security.InvalidKeyException: Illegal Key Size When Using BouncyCastle in Java?

What causes the 'java.security.InvalidKeyException: Illegal key size' error when running a BouncyCastle encryption on a TeamCity server?

private byte[] aesEncryptedInfo(String info) throws UnsupportedEncodingException, IllegalBlockSizeException, BadPaddingException, InvalidKeyException, NoSuchAlgorithmException, NoSuchPaddingException, InvalidParameterSpecException, InvalidAlgorithmParameterException, NoSuchProviderException {
    Security.addProvider(new BouncyCastleProvider());
    SecretKey secret = new SecretKeySpec(CUSTOMLONGSECRETKEY.substring(0, 32).getBytes(), "AES");
    Cipher cipher = Cipher.getInstance("AES/CBC/PKCS7Padding", "BC");
    cipher.init(Cipher.ENCRYPT_MODE, secret, new IvParameterSpec(VECTOR_SECRET_KEY.getBytes()));
    return cipher.doFinal(info.getBytes("UTF-8"));
}

The 'java.security.InvalidKeyException: Illegal key size' error typically occurs when the application tries to use an encryption key that exceeds the legal size set by the Java Cryptography Extension (JCE) policy files. This can be a common issue when transitioning code from a local development environment where the policy allows larger key sizes, to a CI/CD environment like TeamCity where the default policy may still apply, particularly when using Java 1.6.

// Example code for AES encryption using BouncyCastle
private byte[] aesEncryptedInfo(String info) throws UnsupportedEncodingException, IllegalBlockSizeException, BadPaddingException, InvalidKeyException, NoSuchAlgorithmException, NoSuchPaddingException, InvalidParameterSpecException, InvalidAlgorithmParameterException, NoSuchProviderException {
    Security.addProvider(new BouncyCastleProvider());
    SecretKey secret = new SecretKeySpec(CUSTOMLONGSECRETKEY.substring(0, 32).getBytes(), "AES");
    Cipher cipher = Cipher.getInstance("AES/CBC/PKCS7Padding", "BC");
    cipher.init(Cipher.ENCRYPT_MODE, secret, new IvParameterSpec(VECTOR_SECRET_KEY.getBytes()));
    return cipher.doFinal(info.getBytes("UTF-8"));
}

Causes

• Java Cryptography Extension (JCE) policy restrictions that limit key sizes to less than 256 bits in some installations of Java 6.
• Different configurations between local development environment and CI servers that may not support the same key sizes or have different security providers set up.

Solutions

• Install the Unlimited Strength Jurisdiction Policy Files for Java 6 on the TeamCity server to allow the use of larger keys.
• Alternatively, switch to a cryptographic library like BouncyCastle that does not enforce these restrictions and can handle larger key sizes without additional configuration.

Mistake: Assuming the same JCE settings are applied on both the development and CI environments.

Solution: Verify and ensure that Unlimited Strength Policy Files are installed on the CI/CD environment.

Mistake: Using default Java security settings, which may not allow for higher key sizes in older Java versions.

Solution: Consider updating the Java version or explicitly installing the required policy files.