Properties (Bouncy Castle Library 1.87 API Specification)

java.lang.Object
- org.bouncycastle.util.Properties

```
public class Properties
extends java.lang.Object
```
Utility method for accessing properties values - properties can be set in java.security, thread local, and system properties. They are checked for in the same order with checking stopped as soon as a value is found.

Field Summary

Fields
Modifier and Type	Field and Description
`static java.lang.String`	`ASN1_ALLOW_NON_DER_TIME` Controls whether an ASN.1 `UTCTime` / `GeneralizedTime` carrying non-DER contents may be serialized through a `DEROutputStream`.
`static java.lang.String`	`ASN1_ALLOW_ZONELESS_UTCTIME` Decode the zone-less ASN.1 `UTCTime` `"YYMMDDHHMMSS"`.
`static java.lang.String`	`ASN1_MAX_CONS_DEPTH` Maximum depth of nested constructed ASN.1 objects the parser will descend before failing with "maximum nested construction level reached", guarding against stack exhaustion from deeply nested crafted input.
`static java.lang.String`	`ASN1_MAX_LIMIT` Overrides the maximum length accepted for a single definite-length ASN.1 object read from a stream whose length is not otherwise known.
`static java.lang.String`	`BCFKS_MAX_IT_COUNT` Upper bound on the PBKDF2 iteration count honoured when deriving the integrity-MAC key of a BCFKS keystore during load.
`static java.lang.String`	`BCFKS_MAX_SCRYPT_MEMORY` Upper bound, in bytes, on the working memory (~128 * N * r) of the scrypt KDF honoured when deriving the integrity-MAC key of a BCFKS keystore during load.
`static java.lang.String`	`BCFKS_SCRYPT_P_EQ_R` Write BCFKS scrypt parameters with the parallelization parameter p set equal to the block size r, whatever p the caller's `ScryptConfig` asked for.
`static java.lang.String`	`BCFKS_STORE_IT_COUNT` The PBKDF2 iteration count the BCFKS keystore uses when writing a file through the plain `KeyStore.store(OutputStream, char[])` path - the write-side counterpart of `BCFKS_MAX_IT_COUNT`, which only bounds what is accepted on load, and the BCFKS analogue of `PKCS12_STORE_IT_COUNT`.
`static java.lang.String`	`BKS_ENABLE_V1` Opt in to handling legacy version 0/1 BKS keystores.
`static java.lang.String`	`BKS_MAX_IT_COUNT` Upper bound on the PKCS#12-PBE iteration count honoured when loading a BKS keystore.
`static java.lang.String`	`CMS_ALLOW_LEGACY_KEYAGREE_KDF` Whether a CMS key agreement recipient, having failed to unwrap the content-encryption key with the RFC 5753 derivation, may retry with the raw user keying material as the KDF's SharedInfo.
`static java.lang.String`	`CMS_ALLOW_UNAUTHENTICATED_CBC_MAC_IV` Whether a CMS AuthenticatedData message without authenticated attributes may carry a non-zero initialisation vector for a CBC-MAC (des-ede3-cbc or rc2-cbc as its macAlgorithm).
`static java.lang.String`	`CMS_MAX_DIGEST_ALGORITHMS` The largest number of distinct digest algorithms BC will compute over the content of one SignedData message: the content digests CMSSignedData computes while its signers are verified (one per digest algorithm, shared by the signers using it) and the digest calculators CMSSignedDataParser runs over the content for the message's digestAlgorithms field.
`static java.lang.String`	`CONSTRAINTS_ALLOW_OVERRIDE` Set to "true" to let `CryptoServicesRegistrar.setServicesConstraints()` replace a constraint installed from a property at start-up, such as `CONSTRAINTS_QUANTUM_VULNERABLE`; otherwise such an attempt is logged and ignored.
`static java.lang.String`	`CONSTRAINTS_QUANTUM_VULNERABLE` Selects the crypto services constraint `CryptoServicesRegistrar` installs at start-up when no other is set: "nist" for the NIST IR 8547 timetable on the quantum-vulnerable public-key algorithms (deprecated after 2030, disallowed after 2035 except for verification and decryption), "log" to log their use, "legacy" to refuse them for anything but verification and decryption, "reject" to refuse them outright, and "none" - the default when unset - for no constraint (see `QuantumVulnerableConstraint.forPolicy(String)`).
`static java.lang.String`	`DH_ALLOW_SHORT_PRIVATE_VALUE` When set to "true", DH and ElGamal key pair generation accepts a private value length l below twice the security strength of p (the 2s floor of SP 800-56A Rev3 sec. 5.6.1.1, with the Appendix D strengths of 152, 176 and 200 bits from 4096, 6144 and 8192-bit p, and SP 800-57's below 4096 bits). l can arrive with parameters taken from someone else, such as a recipient's public key, and a short l makes the generated private value easy to recover.
`static java.lang.String`	`DH_MAX_SIZE` Upper bound (in bits) on the prime modulus p accepted when validating an imported Diffie-Hellman public key.
`static java.lang.String`	`DRBG_EFFECTIVE_256BITS_ENTROPY` Effective bits-of-entropy assumed per real bit when the BC DRBG provider seeds for a 256-bit security level — used to compute the byte-oriented samples requested from the underlying entropy source.
`static java.lang.String`	`DRBG_ENTROPY_SOURCE` Fully-qualified name of an `EntropySourceProvider` class to use as the BC DRBG provider's seed source.
`static java.lang.String`	`DRBG_ENTROPY_THREAD` If set to "true", the BC DRBG provider runs a background thread that samples the platform entropy source on a fixed schedule and feeds the DRBG, rather than blocking on a fresh sample at each reseed.
`static java.lang.String`	`DRBG_GATHER_PAUSE_SECS` Pause, in seconds, between background entropy-thread samples (see `DRBG_ENTROPY_THREAD`).
`static java.lang.String`	`DSA_MAX_SIZE` Upper bound (in bits) on the prime modulus p accepted when validating an imported DSA public key.
`static java.lang.String`	`EC_MAX_F2M_FIELD_SIZE` Upper bound on the field size m accepted when building a characteristic-2 (F2m) elliptic curve.
`static java.lang.String`	`EMULATE_ORACLE` If set the provider will attempt, where possible, to behave the same way as the oracle one.
`static java.lang.String`	`GCM_ALLOW_SHORT_TAGS` Opt in to short AEAD authentication tags for AES-GCM parameters.
`static java.lang.String`	`JSSE_CLIENT_ENABLE_DELEGATED_TASKS` Boolean system property, read per SSLContext initialisation: set to "true", a BCJSSE SSLEngine of that context in client mode hands out its handshake work through getDelegatedTask() - one task for the initial ClientHello and one for each inbound handshake message, each performing that message's processing and any response flight - rather than doing it inside wrap() and unwrap().
`static java.lang.String`	`JSSE_HOSTNAME_CHECK_CN_FALLBACK` Opt-in to the legacy "use the subject CN as a fallback identifier" behaviour in the BC JSSE provider's hostname verifier.
`static java.lang.String`	`JSSE_SERVER_ENABLE_DELEGATED_TASKS` Boolean system property, read per SSLContext initialisation: set to "true", a BCJSSE SSLEngine of that context in server mode hands out the work for each inbound handshake message through getDelegatedTask() rather than doing it inside wrap() and unwrap().
`static java.lang.String`	`JSSE_USE_NAMED_GROUPS_ORDER` Boolean system property setting the BCJSSE default for TLS 1.3 server named group selection, read per SSLContext initialisation.
`static java.lang.String`	`LMS_MAX_SEED_LENGTH` The largest SEED, in bytes, accepted in an LMS or HSS private key encoding.
`static java.lang.String`	`MIME_MAX_DEPTH` Maximum depth of nested `multipart/*` content the S/MIME canonicalisers will descend before failing, the MIME analogue of `ASN1_MAX_CONS_DEPTH`.
`static java.lang.String`	`OCSP_MAX_RESPONSE_AGE` The oldest, in seconds before the validation date, an OCSP response stating no nextUpdate may be for the CertPath validator to accept it.
`static java.lang.String`	`OCSP_MAX_RESPONSE_SIZE` The largest OCSP response, in bytes, the CertPath validator - or the JSSE server's OCSP stapling fetch - will read from a responder.
`static java.lang.String`	`OPENPGP_CSF_BARE_CR_LINE_ENDING` If set to "true", ArmoredInputStream treats a CR not followed by a LF as a line ending in the clear text of every cleartext signed message, as releases before 1.87 did: a dash after one is un-escaped or starts the signature armor, and the CR is returned as LF.
`static java.lang.String`	`OPENPGP_MAX_ARMOR_HEADER_LENGTH` The longest OpenPGP ASCII armor header line, in bytes, ArmoredInputStream will accumulate.
`static java.lang.String`	`OPENPGP_MAX_ARMOR_HEADERS` The largest number of OpenPGP ASCII armor header lines ArmoredInputStream will accept before the blank line that ends the header block.
`static java.lang.String`	`OPENPGP_STRICT_PARTIAL_BODY_LENGTH` If set to "true", BCPGInputStream rejects a packet whose first Partial Body Length is less than 512 octets, which RFC 9580 sec. 4.2.1.4 forbids.
`static java.lang.String`	`OPENPGP_TEXT_SIG_ALLOW_LEGACY_CR` If set to "true" (the default), verifying an OpenPGP text signature (type 0x01) over data containing a bare CR - one not followed by a LF - also accepts the signature over the form releases before 1.87 hashed, in which that CR was hashed as CR LF.
`static java.lang.String`	`OPENSSH_MAX_ROUNDS` Upper bound on the bcrypt round count honoured when decrypting an encrypted OpenSSH v1 private key.
`static java.lang.String`	`PBE_MAX_ITERATION_COUNT` Upper bound on the PBE iteration count honoured when BC takes that count from an untrusted encoding: decrypting a PBES2-protected PKCS#8 / PEM private key or PKCS#12 bag, verifying an RFC 9579 PBMAC1, unwrapping a CMS password recipient, and the raw JCA PBKDF2 provider (both the `SecretKeyFactory` derivation and the `AlgorithmParameters` parse a `Cipher` performs for PBES2).
`static java.lang.String`	`PBE_MAX_SCRYPT_MEMORY` Upper bound, in bytes, on the scrypt working memory (~128 * N * r) honoured when decrypting a PBES2-protected PKCS#8 / PEM private key.
`static java.lang.String`	`PBKDF2_LEGACY_CIPHER_PRF` When set to "true", a password-only PBKDF2 key from a SecretKeyFactory used with a Cipher and a PBEParameterSpec is derived with HMAC-SHA512 whatever PRF the factory was for, as releases 1.80 to 1.86 did, so data encrypted that way by those releases can still be decrypted.
`static java.lang.String`	`PKCS1_STRICT_DIGESTINFO` If set to "true", RSA PKCS#1 v1.5 signature verification rejects DigestInfo encodings whose AlgorithmIdentifier omits the `NULL` parameters octets required by RFC 8017 sec. 9.2 / Appendix A.2.4.
`static java.lang.String`	`PKCS12_ALLOW_SUN_SECRET_KEYS` If set to "true", the BC PKCS#12 KeyStore will additionally accept (on load only) SafeBags of type secretBag that use SunJCE's non-standard nested encoding — a SecretBag whose secretTypeId is pkcs8ShroudedKeyBag and whose secretValue is an EncryptedPrivateKeyInfo wrapping a PKCS#8 PrivateKeyInfo carrying the raw secret-key bytes.
`static java.lang.String`	`PKCS12_IGNORE_USELESS_PASSWD` A PKCS12 file which does not require a password will normally throw an exception if a password is provided.
`static java.lang.String`	`PKCS12_MAX_IT_COUNT` If set, a PKCS12 file with a larger iteration count on PBE processing will rejected.
`static java.lang.String`	`PKCS12_PBKDF2_IT_COUNT` The PBKDF2 iteration count the PKCS12 keystore uses for an RFC 9579 PBMAC1 integrity MAC when writing a file.
`static java.lang.String`	`PKCS12_STORE_IT_COUNT` The PBE iteration count the PKCS12 keystore uses when writing a file - the write-side counterpart of `PKCS12_MAX_IT_COUNT`, which only bounds what is accepted on load.
`static java.lang.String`	`PKMAC_MAX_ITERATION_COUNT` Upper bound on the RFC 4211 PKMAC / CMP password-based-MAC iteration count honoured when no explicit ceiling was supplied to `org.bouncycastle.cert.crmf.PKMACBuilder`.
`static java.lang.String`	`SM9_ALLOW_MULTI_USE` Set to "true" for a deployment that uses one SM9 encryption user key for both the SM9 KEM and SM9 public-key decryption.
`static java.lang.String`	`TSP_ALLOW_INCONSISTENT_SIGNING_TIME` Whether a time-stamp token whose signing-time signed attribute disagrees with the genTime of its TSTInfo is accepted.
`static java.lang.String`	`TSP_ALLOWED_IMPRINT_ALGORITHMS` The hash algorithms `TimeStampToken.validate(SignerInformationVerifier)` accepts for a token's message imprint, as a comma separated list of digest names or dotted OIDs (for example "SHA-256,SHA-384,SHA-512").
`static java.lang.String`	`X509_ALLOW_EMPTY_ISSUER_CERT` If set to "true", the certificate parser (TBSCertificate and everything built on it, such as the X.509 CertificateFactory) will accept a certificate whose issuer is an empty distinguished name.
`static java.lang.String`	`X509_ALLOW_LENIENT_RFC822_NAME` Fall back to the legacy lenient parsing of rfc822Name values in X.509 name-constraint checks.
`static java.lang.String`	`X509_CRL_CACHE_TTL` Maximum time, in seconds, that a downloaded CRL is cached by the internal CrlCache used by the CertPath validator and X509RevocationChecker.
`static java.lang.String`	`X509_CRLDP_PROTOCOLS` Optional comma separated list of the protocols a CRL Distribution Point may name, applied by the internal CrlCache used by the CertPath validator and X509RevocationChecker before any connection is opened.
`static java.lang.String`	`X509_ENABLE_CRLDP` If set to "true", the BC CertPath validator, X509RevocationChecker and both PKIXCertPathReviewer classes (and so SignedMailValidator, which uses the pkix one by default) will attempt to download CRLs over the network using URIs from each certificate's CRL Distribution Points extension when no PKIXCRLStore on the supplied PKIXParameters can satisfy the lookup.
`static java.lang.String`	`X509_MAX_CERT_PATH_BUILD_NODES` Upper bound on the total number of nodes the PKIX certification-path builder visits while searching for a chain.
`static java.lang.String`	`X509_MAX_POLICY_NODES` Upper bound on the total number of valid-policy-tree nodes retained (across all depth levels) during PKIX certification-path validation.
`static java.lang.String`	`X509_SGP22_NAME_CONSTRAINTS` Opt in to the relaxed directoryName name-constraint matching required by GSMA SGP.22 v2.5 (Remote SIM Provisioning), sections 4.5.2.1.0.2 / 4.5.2.1.0.3.

Method Summary

All Methods Static Methods Concrete Methods
Modifier and Type	Method and Description
`static java.math.BigInteger`	`asBigInteger(java.lang.String propertyName)` Return propertyName as a BigInteger.
`static int`	`asInteger(java.lang.String propertyName, int defaultValue)` Return propertyName as an integer, defaultValue used if not defined.
`static java.util.Set<java.lang.String>`	`asKeySet(java.lang.String propertyName)`
`static java.lang.String`	`getPropertyValue(java.lang.String propertyName)` Return the String value of the property propertyName.
`static java.lang.String`	`getPropertyValue(java.lang.String propertyName, java.lang.String defValue)`
`static boolean`	`isOverrideSet(java.lang.String propertyName)` Return whether a particular override has been set to true.
`static boolean`	`isOverrideSet(java.lang.String propertyName, boolean defIsTrue)` Return whether a particular override has been set to true.
`static boolean`	`isOverrideSetTo(java.lang.String propertyName, boolean isTrue)` Return whether a particular override has been set to false.
`static boolean`	`removeThreadOverride(java.lang.String propertyName)` Remove any value for the specified override property for the current thread only.
`static boolean`	`setThreadOverride(java.lang.String propertyName, boolean enable)` Enable the specified override property for the current thread only.

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Field Detail
  - EMULATE_ORACLE
```
public static final java.lang.String EMULATE_ORACLE
```
    If set the provider will attempt, where possible, to behave the same way as the oracle one.
    
    See Also:
    
    Constant Field Values
  - PKCS12_IGNORE_USELESS_PASSWD
```
public static final java.lang.String PKCS12_IGNORE_USELESS_PASSWD
```
    A PKCS12 file which does not require a password will normally throw an exception if a password is provided. Setting PKCS12_IGNORE_USELESS_PASSWD to "true" will result in the provider ignoring a password if one is provided and not required.
    
    See Also:
    
    Constant Field Values
  - PKCS12_MAX_IT_COUNT
```
public static final java.lang.String PKCS12_MAX_IT_COUNT
```
    If set, a PKCS12 file with a larger iteration count on PBE processing will rejected.
    
    See Also:
    
    Constant Field Values
  - PKCS12_STORE_IT_COUNT
```
public static final java.lang.String PKCS12_STORE_IT_COUNT
```
    The PBE iteration count the PKCS12 keystore uses when writing a file - the write-side counterpart of PKCS12_MAX_IT_COUNT, which only bounds what is accepted on load. Default 300,000 for the key and certificate encryption, twice that for the integrity MAC.
    Note that Windows currently reports an error importing a PKCS#12 file whose key and certificate encryption uses a PBE iteration count of 600,000 or greater (it accepts 600,000 for the MAC), so setting this property to 600,000 or more produces files Windows may refuse.
    Lowering this trades password-cracking resistance for store/load time, and is only worth doing where something other than the passphrase carries the confidentiality of the file - a machine-generated high-entropy password, or a keystore held somewhere already protected. It is deliberately an operator decision rather than a per-call one: a deployment that wants cheaper files sets it once at startup for the whole JVM.
    A value outside 1 .. 2,500,000 is ignored and the default used, so a mistyped property fails towards the default rather than towards a file with no PBE work in it; the upper bound keeps the doubled MAC count inside the 5,000,000 that PKCS12_MAX_IT_COUNT defaults to, so a file written under this property can always be read back. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - PKCS12_PBKDF2_IT_COUNT
```
public static final java.lang.String PKCS12_PBKDF2_IT_COUNT
```
    The PBKDF2 iteration count the PKCS12 keystore uses for an RFC 9579 PBMAC1 integrity MAC when writing a file. Default 65,536.
    This is the count that sets the work factor of a PBMAC1 MAC - the MacData count beside it is unused ballast under RFC 9579 sec. 6 - and it is also the floor for a count taken from a file that has been loaded: a file keeps its own count where that is at least this, and is raised to it otherwise, since the file being re-stored is no longer the one its count was chosen for. Reading is unaffected: a file's MAC can only be verified with the count it was made with.
    A value outside 1 .. 2,500,000 is ignored and the default used, so a mistyped property fails towards the default rather than towards a file with no work in its MAC. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - X509_CRL_CACHE_TTL
```
public static final java.lang.String X509_CRL_CACHE_TTL
```
    Maximum time, in seconds, that a downloaded CRL is cached by the internal CrlCache used by the CertPath validator and X509RevocationChecker. When set to a positive value, cached entries are evicted whichever expires sooner: the configured TTL or the CRL's own nextUpdate. Default (or 0) preserves the legacy behaviour of evicting only when nextUpdate has passed.
    
    See Also:
    
    Constant Field Values
  - X509_ENABLE_CRLDP
```
public static final java.lang.String X509_ENABLE_CRLDP
```
    If set to "true", the BC CertPath validator, X509RevocationChecker and both PKIXCertPathReviewer classes (and so SignedMailValidator, which uses the pkix one by default) will attempt to download CRLs over the network using URIs from each certificate's CRL Distribution Points extension when no PKIXCRLStore on the supplied PKIXParameters can satisfy the lookup. Default (unset / "false") preserves the legacy behaviour of relying entirely on caller-supplied CertStore / PKIXCRLStore registrations — "No CRLs found for issuer ..." is the result when the caller hasn't registered a store and this property is off.
    
    See Also:
    
    Constant Field Values
  - X509_CRLDP_PROTOCOLS
```
public static final java.lang.String X509_CRLDP_PROTOCOLS
```
    Optional comma separated list of the protocols a CRL Distribution Point may name, applied by the internal CrlCache used by the CertPath validator and X509RevocationChecker before any connection is opened. Protocol names are matched without regard to case, so "http,https,ldap" refuses a distribution point naming ftp, file, jar or anything else the JVM happens to have a URL handler for. Default (unset or empty) leaves the protocol unrestricted: RFC 5280 sec. 4.2.1.13 requires a distribution point URI to name a protocol but does not limit which, and BC supports http, https, ftp and ldap here, so this is an operator policy for deployments that want a narrower set rather than a default.
    Note the CRL fetch this governs only happens at all when X509_ENABLE_CRLDP is set.
    
    See Also:
    
    Constant Field Values
  - OCSP_MAX_RESPONSE_SIZE
```
public static final java.lang.String OCSP_MAX_RESPONSE_SIZE
```
    The largest OCSP response, in bytes, the CertPath validator - or the JSSE server's OCSP stapling fetch - will read from a responder. A responder's Content-Length can narrow this but never widen it, so a responder declaring (and sending) hundreds of megabytes is cut off rather than read into the heap. Default is 64K, which is far above any real response; a value that is not a positive integer is ignored and the default used, so a mistyped value cannot turn the limit off. Exceeding the limit fails the OCSP check the same way an unreachable responder does, so a caller with CRLs configured falls back to those.
    
    See Also:
    
    Constant Field Values
  - OCSP_MAX_RESPONSE_AGE
```
public static final java.lang.String OCSP_MAX_RESPONSE_AGE
```
    The oldest, in seconds before the validation date, an OCSP response stating no nextUpdate may be for the CertPath validator to accept it. RFC 6960 sec. 3.2 leaves it to the client to judge whether thisUpdate is sufficiently recent, and a response without a nextUpdate gives no other indication of how long it may be relied on. Default is 3600 (one hour, the default lifetime of a staple in SunJSSE's server cache, so a BCJSSE client accepts such a staple for as long as a SunJSSE server will offer it); narrow it, or widen it for responders that pre-produce responses without a nextUpdate. A value that is not a positive integer number of seconds is ignored and the default used, so a mistyped value cannot turn the bound off. A response that states a nextUpdate is judged by that instead.
    
    See Also:
    
    Constant Field Values
  - OPENPGP_MAX_ARMOR_HEADER_LENGTH
```
public static final java.lang.String OPENPGP_MAX_ARMOR_HEADER_LENGTH
```
    The longest OpenPGP ASCII armor header line, in bytes, ArmoredInputStream will accumulate. The headers are parsed when the stream is constructed, so this bounds what merely wrapping an untrusted stream can allocate: a "header line" that never reaches a line terminator is refused rather than read until the heap is gone. Default is 4096, far above the short Version / Comment lines RFC 9580 sec. 6.2 describes; a value of zero or less is ignored and the default used.
    
    See Also:
    
    Constant Field Values
  - OPENPGP_MAX_ARMOR_HEADERS
```
public static final java.lang.String OPENPGP_MAX_ARMOR_HEADERS
```
    The largest number of OpenPGP ASCII armor header lines ArmoredInputStream will accept before the blank line that ends the header block. Bounds the companion case to OPENPGP_MAX_ARMOR_HEADER_LENGTH, where each line is short but they never stop arriving. Default is 64, counting the armor header line itself; a value of zero or less is ignored and the default used.
    
    See Also:
    
    Constant Field Values
  - OPENPGP_STRICT_PARTIAL_BODY_LENGTH
```
public static final java.lang.String OPENPGP_STRICT_PARTIAL_BODY_LENGTH
```
    If set to "true", BCPGInputStream rejects a packet whose first Partial Body Length is less than 512 octets, which RFC 9580 sec. 4.2.1.4 forbids. Off by default, so that messages written by earlier versions of BC with a partial-body buffer shorter than 512 bytes (which BCPGOutputStream no longer produces) can still be read.
    
    See Also:
    
    Constant Field Values
  - OPENPGP_TEXT_SIG_ALLOW_LEGACY_CR
```
public static final java.lang.String OPENPGP_TEXT_SIG_ALLOW_LEGACY_CR
```
    If set to "true" (the default), verifying an OpenPGP text signature (type 0x01) over data containing a bare CR - one not followed by a LF - also accepts the signature over the form releases before 1.87 hashed, in which that CR was hashed as CR LF. The signature is first checked against the current form, which hashes a bare CR unaltered as GnuPG, GopenPGP, OpenPGP.js, RNP and most other implementations do (github #2553); signatures are always generated in the current form. The legacy form is also what Sequoia 2.x generates. Set it to "false" to accept only the current form, at the cost of no longer verifying text signatures earlier BC releases (or Sequoia) made over such data. Read via isOverrideSet(String, boolean).
    
    See Also:
    
    Constant Field Values
  - OPENPGP_CSF_BARE_CR_LINE_ENDING
```
public static final java.lang.String OPENPGP_CSF_BARE_CR_LINE_ENDING
```
    If set to "true", ArmoredInputStream treats a CR not followed by a LF as a line ending in the clear text of every cleartext signed message, as releases before 1.87 did: a dash after one is un-escaped or starts the signature armor, and the CR is returned as LF. Off by default, where only LF and CR LF end a line and a bare CR is ordinary text, as in RFC 9580 sec. 7 and GnuPG (github #2553); a message whose armor lines themselves end in a bare CR is read the old way whatever this is set to. Set it to read cleartext signed messages that an earlier release wrote over CR-only text under LF or CR LF armor. ArmoredOutputStream always writes the current form. Read via isOverrideSet(String).
    
    See Also:
    
    Constant Field Values
  - PKCS12_ALLOW_SUN_SECRET_KEYS
```
public static final java.lang.String PKCS12_ALLOW_SUN_SECRET_KEYS
```
    If set to "true", the BC PKCS#12 KeyStore will additionally accept (on load only) SafeBags of type secretBag that use SunJCE's non-standard nested encoding — a SecretBag whose secretTypeId is pkcs8ShroudedKeyBag and whose secretValue is an EncryptedPrivateKeyInfo wrapping a PKCS#8 PrivateKeyInfo carrying the raw secret-key bytes. Off by default; the BC keystore always writes the standards compliant RFC 7292 sec. 4.2.5 form regardless.
    
    See Also:
    
    Constant Field Values
  - PKCS1_STRICT_DIGESTINFO
```
public static final java.lang.String PKCS1_STRICT_DIGESTINFO
```
    If set to "true", RSA PKCS#1 v1.5 signature verification rejects DigestInfo encodings whose AlgorithmIdentifier omits the NULL parameters octets required by RFC 8017 sec. 9.2 / Appendix A.2.4. By default (or "false") the verifier falls back to accepting that two-byte-shorter encoding for compatibility with implementations that have historically produced it; setting this property to "true" disables the fallback so only strictly RFC-compliant signatures verify (github #2273). Affects both the BC JCE provider's DigestSignatureSpi and the lightweight RSADigestSigner.
    
    See Also:
    
    Constant Field Values
  - JSSE_HOSTNAME_CHECK_CN_FALLBACK
```
public static final java.lang.String JSSE_HOSTNAME_CHECK_CN_FALLBACK
```
    Opt-in to the legacy "use the subject CN as a fallback identifier" behaviour in the BC JSSE provider's hostname verifier. When the property is set to "true", a TLS server certificate that carries no SAN dNSName entries falls back to the most specific commonName attribute of the subject DN — this matches SunJSSE and historical OpenSSL behaviour.
    Default ("false" / unset) follows RFC 9525 sec. 6.3 (which deprecates CN-based identity for TLS) and CAB Forum Baseline Requirements 7.1.4.2 (which requires SAN dNSName entries for publicly-trusted TLS server certs). It also closes a Name-Constraint bypass surface (the 2026-03 cross-implementation X.509 audit): a constrained intermediate CA can omit dNSName SAN entries entirely so the path validator's Name-Constraint dNSName checks never fire, then embed an attacker-controlled hostname in CN — the JSSE verifier would have accepted the connection. Setting the property "false" (or leaving it unset) disables this fallback path and the JSSE verifier rejects any cert that doesn't carry a matching SAN identifier.
    
    See Also:
    
    Constant Field Values
  - JSSE_USE_NAMED_GROUPS_ORDER
```
public static final java.lang.String JSSE_USE_NAMED_GROUPS_ORDER
```
    Boolean system property setting the BCJSSE default for TLS 1.3 server named group selection, read per SSLContext initialisation. Set to "true", connections of that context default to the server choosing the key share group by its own named group order rather than the client's; the default ("false" / unset) follows the client's order. A value set on a connection's BCSSLParameters (useNamedGroupsOrder) still takes precedence over this default.
    
    See Also:
    
    Constant Field Values
  - JSSE_CLIENT_ENABLE_DELEGATED_TASKS
```
public static final java.lang.String JSSE_CLIENT_ENABLE_DELEGATED_TASKS
```
    Boolean system property, read per SSLContext initialisation: set to "true", a BCJSSE SSLEngine of that context in client mode hands out its handshake work through getDelegatedTask() - one task for the initial ClientHello and one for each inbound handshake message, each performing that message's processing and any response flight - rather than doing it inside wrap() and unwrap(). Default false.
    
    See Also:
    
    Constant Field Values
  - JSSE_SERVER_ENABLE_DELEGATED_TASKS
```
public static final java.lang.String JSSE_SERVER_ENABLE_DELEGATED_TASKS
```
    Boolean system property, read per SSLContext initialisation: set to "true", a BCJSSE SSLEngine of that context in server mode hands out the work for each inbound handshake message through getDelegatedTask() rather than doing it inside wrap() and unwrap(). Default false. See JSSE_CLIENT_ENABLE_DELEGATED_TASKS.
    
    See Also:
    
    Constant Field Values
  - DRBG_EFFECTIVE_256BITS_ENTROPY
```
public static final java.lang.String DRBG_EFFECTIVE_256BITS_ENTROPY
```
    Effective bits-of-entropy assumed per real bit when the BC DRBG provider seeds for a 256-bit security level — used to compute the byte-oriented samples requested from the underlying entropy source. Defaults to 282 bits (about 0.9 effective bits per raw bit) and is rounded up to the next whole byte.
    
    See Also:
    
    Constant Field Values
  - DRBG_ENTROPY_SOURCE
```
public static final java.lang.String DRBG_ENTROPY_SOURCE
```
    Fully-qualified name of an EntropySourceProvider class to use as the BC DRBG provider's seed source. When set, the named class is loaded reflectively and instantiated in place of the platform default. When unset, the BC DRBG falls back to the configured securerandom.source or its own background entropy thread.
    
    See Also:
    
    Constant Field Values
  - DRBG_ENTROPY_THREAD
```
public static final java.lang.String DRBG_ENTROPY_THREAD
```
    If set to "true", the BC DRBG provider runs a background thread that samples the platform entropy source on a fixed schedule and feeds the DRBG, rather than blocking on a fresh sample at each reseed.
    
    See Also:
    
    Constant Field Values
  - DRBG_GATHER_PAUSE_SECS
```
public static final java.lang.String DRBG_GATHER_PAUSE_SECS
```
    Pause, in seconds, between background entropy-thread samples (see DRBG_ENTROPY_THREAD). Parsed as an integer; absent or non-positive values use the implementation default.
    
    See Also:
    
    Constant Field Values
  - ASN1_ALLOW_NON_DER_TIME
```
public static final java.lang.String ASN1_ALLOW_NON_DER_TIME
```
    Controls whether an ASN.1 UTCTime / GeneralizedTime carrying non-DER contents may be serialized through a DEROutputStream. Reading is always lenient: a wire value that is valid ASN.1 but not valid DER - for example a UTCTime without the seconds element ("YYMMDDHHMMZ"), a time terminated with a "+hhmm"/"-hhmm" offset rather than "Z", or a GeneralizedTime fraction carrying trailing zeros - parses without complaint into a usable ASN1UTCTime / ASN1GeneralizedTime.
    Default (unset or "true") preserves BC's historical pass-through: such a primitive may be re-emitted unchanged via either BER or DER. Setting this property to "false" enforces the DER restrictions of X.690 sec. 11.7 / 11.8 (and hence the RFC 5280 sec. 4.1.2.5 profile, which requires seconds and Zulu) on the DER write side: the primitive's toDERObject() throws an IllegalStateException if it would emit non-conformant content, so any attempt to write it to a DEROutputStream fails (github #1973 / #1986). BER serialization is unaffected. Programmatically constructing a time from a Date always produces DER content, so this setting only matters for primitives whose contents arrived non-conformant from the wire.
    "Lenient" here means legal-but-non-DER formatting. Structurally malformed content is a separate matter, rejected on read since 1.85 - see ASN1_ALLOW_ZONELESS_UTCTIME, which makes an exception of exactly one such value.
    Setting this property also admits, on read, a day the month it names does not have - the 30th of February and the like. Such a value is refused by default because the lenient calendar behind getDate() rolls it into the next month, so what is read back is not what the encoding carries; OpenSSL refuses it too, while the JDK's own CertificateFactory rolls it silently, which is the behaviour this property restores.
    
    See Also:
    
    Constant Field Values
  - ASN1_ALLOW_ZONELESS_UTCTIME
```
public static final java.lang.String ASN1_ALLOW_ZONELESS_UTCTIME
```
    Decode the zone-less ASN.1 UTCTime "YYMMDDHHMMSS".
    X.680 sec. 47.3 makes the zone mandatory for a UTCTime, so a twelve-digit value carrying none is not a legal one and, since 1.85, the decoder rejects it along with the rest of the structurally malformed time content it screens out - non-digit or out-of-range fields, an illegal length, a missing or garbage zone terminator - with "invalid UTCTime format". That is raised while the enclosing structure is being read, so a single such field fails the whole parse: a CMS SignedData whose signing-time attribute lacks its trailing "Z" cannot be loaded at all, let alone have the rest of its content examined (github #2411).
    That one value is nonetheless readable - ASN1UTCTime.getTime() has always carried an explicit branch taking a zone-less value as GMT, so it denotes a real instant, and it re-encodes unchanged - and it is produced by tools in the field. Setting this property admits it, and admits nothing else: every other malformed value is still rejected with the property set, and the zone-less "YYMMDDHHMM" (no seconds) is not admitted either, getTime() having never been able to read one. GeneralizedTime is unaffected, its zone being optional to begin with.
    The property has to be set for the value to decode: the default is to reject it. Generation is unaffected, as is DER conformance - the value is still not DER, so writing it through a DEROutputStream is refused when ASN1_ALLOW_NON_DER_TIME is "false". This property is independent of that one, which governs writing rather than reading. Read via isOverrideSet(String).
    
    See Also:
    
    Constant Field Values
  - ASN1_MAX_CONS_DEPTH
```
public static final java.lang.String ASN1_MAX_CONS_DEPTH
```
    Maximum depth of nested constructed ASN.1 objects the parser will descend before failing with "maximum nested construction level reached", guarding against stack exhaustion from deeply nested crafted input. Read as an integer; default 64.
    
    See Also:
    
    Constant Field Values
  - ASN1_MAX_LIMIT
```
public static final java.lang.String ASN1_MAX_LIMIT
```
    Overrides the maximum length accepted for a single definite-length ASN.1 object read from a stream whose length is not otherwise known. The value is a byte count and may carry a trailing 'k', 'm' or 'g' multiplier (e.g. "16m"); when unset the limit falls back to the available heap size. Can also be set per stream via the ASN1InputStream(InputStream, int) constructor.
    
    See Also:
    
    Constant Field Values
  - DH_MAX_SIZE
```
public static final java.lang.String DH_MAX_SIZE
```
    Upper bound (in bits) on the prime modulus p accepted when validating an imported Diffie-Hellman public key. Validation performs a modular exponentiation / Legendre computation whose cost is super-linear in the size of p, so an unbounded p taken from a crafted key encoding would turn key import into a CPU-exhaustion denial of service. The default (16384) is the analogue of org.bouncycastle.rsa.max_size and is well above any standardised DH group. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - DH_ALLOW_SHORT_PRIVATE_VALUE
```
public static final java.lang.String DH_ALLOW_SHORT_PRIVATE_VALUE
```
    When set to "true", DH and ElGamal key pair generation accepts a private value length l below twice the security strength of p (the 2s floor of SP 800-56A Rev3 sec. 5.6.1.1, with the Appendix D strengths of 152, 176 and 200 bits from 4096, 6144 and 8192-bit p, and SP 800-57's below 4096 bits). l can arrive with parameters taken from someone else, such as a recipient's public key, and a short l makes the generated private value easy to recover. Default false; keys that carry a short l can always be read and used.
    
    See Also:
    
    Constant Field Values
  - DSA_MAX_SIZE
```
public static final java.lang.String DSA_MAX_SIZE
```
    Upper bound (in bits) on the prime modulus p accepted when validating an imported DSA public key. As with DH_MAX_SIZE, validation runs a modular exponentiation whose cost grows super-linearly in the size of p, so an unbounded p from a crafted encoding is an import-time CPU-exhaustion vector. Default 16384. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - BCFKS_MAX_IT_COUNT
```
public static final java.lang.String BCFKS_MAX_IT_COUNT
```
    Upper bound on the PBKDF2 iteration count honoured when deriving the integrity-MAC key of a BCFKS keystore during load. The KDF runs on parameters taken from the (not-yet-verified) keystore, so an unbounded iteration count is a pre-integrity CPU-exhaustion vector. Default 5,000,000 (the BCFKS writer uses ~51,200). Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - BCFKS_MAX_SCRYPT_MEMORY
```
public static final java.lang.String BCFKS_MAX_SCRYPT_MEMORY
```
    Upper bound, in bytes, on the working memory (~128 * N * r) of the scrypt KDF honoured when deriving the integrity-MAC key of a BCFKS keystore during load. As with BCFKS_MAX_IT_COUNT the scrypt cost parameters are taken from the not-yet-verified keystore, so an unbounded cost is a pre-integrity memory-exhaustion vector. Default 1073741824 (1 GiB); the BCFKS writer uses N=16384, r=8 (~16 MiB). Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - BCFKS_STORE_IT_COUNT
```
public static final java.lang.String BCFKS_STORE_IT_COUNT
```
    The PBKDF2 iteration count the BCFKS keystore uses when writing a file through the plain KeyStore.store(OutputStream, char[]) path - the write-side counterpart of BCFKS_MAX_IT_COUNT, which only bounds what is accepted on load, and the BCFKS analogue of PKCS12_STORE_IT_COUNT. Default 51,200 (PBKDF2-HMAC-SHA512), applied to the integrity MAC key and to the key-encryption keys of the entries. A caller supplying a BCFKSLoadStoreParameter with its own PBKDFConfig is unaffected.
    Lowering this trades password-cracking resistance for store/load time, and is only worth doing where something other than the passphrase carries the confidentiality of the file. A value outside 1 .. 5,000,000 is ignored and the default used, so a mistyped property fails towards the default rather than towards a file with no PBE work in it; the upper bound is the BCFKS_MAX_IT_COUNT default, so a file written under this property can always be read back. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - BCFKS_SCRYPT_P_EQ_R
```
public static final java.lang.String BCFKS_SCRYPT_P_EQ_R
```
    Write BCFKS scrypt parameters with the parallelization parameter p set equal to the block size r, whatever p the caller's ScryptConfig asked for. Default true.
    Releases up to 1.86 derived a BCFKS scrypt key with r in place of p while encoding the configured p, so a store whose p differed from its r encoded parameters that did not derive its own keys: a conformant RFC 7914 reader failed it, and BC failed a conformant writer's. Derivation now follows RFC 7914, and with this property set the written p is made to agree with what those releases derive, so a store written here is both RFC 7914 correct and readable by 1.86 and earlier. Clearing it honours the configured p instead, at the cost of a store that those releases cannot read unless p already equals r.
    Reading is unaffected either way - a store written by an earlier release is recognised and read on its own terms, and the encoded parallelization parameter is what a store written here is derived with whichever way this is set.
    This is transitional: the default is intended to become false once enough of the installed base is writing parameters that describe themselves, at which point a configured p is honoured as written. Callers who need that now, and who do not need 1.86 and earlier to read what they write, can clear it already. Read via isOverrideSet(String, boolean).
    
    See Also:
    
    Constant Field Values
  - PBE_MAX_ITERATION_COUNT
```
public static final java.lang.String PBE_MAX_ITERATION_COUNT
```
    Upper bound on the PBE iteration count honoured when BC takes that count from an untrusted encoding: decrypting a PBES2-protected PKCS#8 / PEM private key or PKCS#12 bag, verifying an RFC 9579 PBMAC1, unwrapping a CMS password recipient, and the raw JCA PBKDF2 provider (both the SecretKeyFactory derivation and the AlgorithmParameters parse a Cipher performs for PBES2). It also bounds the legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families in the raw JCA provider: the AlgorithmParameters parse, and every Cipher, Mac and SecretKeyFactory derivation, whichever provider decoded the parameters. In each case the key-derivation parameters travel inside an unauthenticated container, so an unbounded count makes processing attacker-supplied material a CPU-exhaustion vector. The PKCS#12 key store derives through the same provider code, so a PKCS12_MAX_IT_COUNT raised above this bound needs this one raised too. Default 10,000,000 - the count RFC 8018 sec. 4.2 names as possibly appropriate for especially critical keys, so generous enough for deliberately strong settings. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - PBKDF2_LEGACY_CIPHER_PRF
```
public static final java.lang.String PBKDF2_LEGACY_CIPHER_PRF
```
    When set to "true", a password-only PBKDF2 key from a SecretKeyFactory used with a Cipher and a PBEParameterSpec is derived with HMAC-SHA512 whatever PRF the factory was for, as releases 1.80 to 1.86 did, so data encrypted that way by those releases can still be decrypted. Default false: the key's own PRF is used, for example HMAC-SHA256 for PBKDF2WITHHMACSHA256 and HMAC-SHA1 for PBKDF2.
    
    See Also:
    
    Constant Field Values
  - PBE_MAX_SCRYPT_MEMORY
```
public static final java.lang.String PBE_MAX_SCRYPT_MEMORY
```
    Upper bound, in bytes, on the scrypt working memory (~128 * N * r) honoured when decrypting a PBES2-protected PKCS#8 / PEM private key. As with PBE_MAX_ITERATION_COUNT the scrypt cost travels in the unauthenticated container, so an unbounded cost is a memory-exhaustion vector. Default 1073741824 (1 GiB). Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - PKMAC_MAX_ITERATION_COUNT
```
public static final java.lang.String PKMAC_MAX_ITERATION_COUNT
```
    Upper bound on the RFC 4211 PKMAC / CMP password-based-MAC iteration count honoured when no explicit ceiling was supplied to org.bouncycastle.cert.crmf.PKMACBuilder. The count travels in the (unauthenticated) PBMParameter of an incoming CMP message and drives an iterated hash, so an unbounded count makes verifying an attacker-supplied message a CPU-exhaustion vector. Default 10,000,000, generous enough for any legitimate setting. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - X509_MAX_POLICY_NODES
```
public static final java.lang.String X509_MAX_POLICY_NODES
```
    Upper bound on the total number of valid-policy-tree nodes retained (across all depth levels) during PKIX certification-path validation. Certificate policy mapping combined with the anyPolicy expansion of RFC 5280 6.1.3/6.1.4 can grow the tree multiplicatively per certificate, so a crafted chain that still chains to a trust anchor could drive the validator into exponential memory/CPU consumption -- a denial of service of the class of CVE-2023-0464. The tree size is checked once per certificate and validation is aborted with a CertPathValidatorException once it exceeds this bound. The default (8192) is far above any legitimate policy tree (a real chain produces a handful of nodes) and is configurable for unusual deployments. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - X509_MAX_CERT_PATH_BUILD_NODES
```
public static final java.lang.String X509_MAX_CERT_PATH_BUILD_NODES
```
    Upper bound on the total number of nodes the PKIX certification-path builder visits while searching for a chain. The builder does a depth-first walk up the PKI graph, bounded per path by cycle detection and the caller's maxPathLength. Because candidate issuers are matched by subject name only, a certificate store containing many certificates that share a subject name without chaining to a trust anchor can make the search explore a large number of partial paths before it concludes no chain exists. This bound keeps that work predictable: the visited-node count is checked on entry to each build step and the build is aborted with a CertPathBuilderException once it exceeds the bound. This is a hardening measure and the builder-side companion to X509_MAX_POLICY_NODES. The default (262144) is far above any legitimate build (a real build returns on the first path that chains to an anchor) and is configurable for unusual cross-certified meshes. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - X509_SGP22_NAME_CONSTRAINTS
```
public static final java.lang.String X509_SGP22_NAME_CONSTRAINTS
```
    Opt in to the relaxed directoryName name-constraint matching required by GSMA SGP.22 v2.5 (Remote SIM Provisioning), sections 4.5.2.1.0.2 / 4.5.2.1.0.3. When set, a permitted-subtree RDN is satisfied by any matching subject RDN regardless of position, additional subject attributes beyond those named in the subtree are tolerated, and a serialNumber RDN is matched with a startsWith comparison wherever it appears. This is deliberately looser than the contiguous-prefix DN matching mandated by RFC 5280 7.1, so it defaults to off and must be enabled explicitly; BC's default validation remains RFC 5280 strict. See github #2327. Read via isOverrideSet(String).
    
    See Also:
    
    Constant Field Values
  - X509_ALLOW_LENIENT_RFC822_NAME
```
public static final java.lang.String X509_ALLOW_LENIENT_RFC822_NAME
```
    Fall back to the legacy lenient parsing of rfc822Name values in X.509 name-constraint checks. By default the validator is strict about rfc822Name conformance; today that means a tested rfc822Name with more than one '@' is rejected as ambiguous when email constraints apply (RFC 5321 sec. 4.1.2 allows '@' inside a quoted local part, so the domain is not simply the text after the first '@', and a wrong split could evade a constraint). When this property is set, that strictness (and any future rfc822Name conformance strictness) is disabled and the historical permissive parsing is used instead. Strict is the default; set this only to restore the old behaviour. This is a safety valve, not a recommended mode. Read via isOverrideSet(String).
    
    See Also:
    
    Constant Field Values
  - X509_ALLOW_EMPTY_ISSUER_CERT
```
public static final java.lang.String X509_ALLOW_EMPTY_ISSUER_CERT
```
    If set to "true", the certificate parser (TBSCertificate and everything built on it, such as the X.509 CertificateFactory) will accept a certificate whose issuer is an empty distinguished name. RFC 5280 sec. 4.1.2.4 requires the issuer field to contain a non-empty DN and the parser rejects an empty one by default, but some non-PKIX certificate profiles - notably the libp2p TLS profile, which uses a self-signed certificate purely as a peer-identity carrier - place no requirements on the issuer and such certificates are in circulation. This is a read-side concession only: certificate generation still requires a non-empty issuer unconditionally, and X509CertificateReviewer reports the empty issuer whether or not the property is set. Read via isOverrideSet(String).
    
    See Also:
    
    Constant Field Values
  - GCM_ALLOW_SHORT_TAGS
```
public static final java.lang.String GCM_ALLOW_SHORT_TAGS
```
    Opt in to short AEAD authentication tags for AES-GCM parameters. RFC 5084 constrains the AES-GCM ICV (tag) length carried in GCMParameters to 12..16 octets (96..128 bits), and BC enforces that by default. When this property is set, GCMParameters additionally accepts tags down to the NIST SP 800-38D minimum of 4 octets (32 bits; SP 800-38D sec. 5.2.1.2 permits a 32-bit tag for limited applications). Short tags weaken integrity protection, so this defaults to off and must be enabled explicitly; anything below 4 octets or above 16 octets is still rejected. Read via isOverrideSet(String).
    
    See Also:
    
    Constant Field Values
  - BKS_ENABLE_V1
```
public static final java.lang.String BKS_ENABLE_V1
```
    Opt in to handling legacy version 0/1 BKS keystores. Those stores derive the HMAC integrity key at only the digest size in bits (a 16-bit key for SHA-1; CVE-2018-5382), which is brute-forceable offline, so by default the default BKS keystore type refuses to load them and only writes the current version 2 format. Set this property to read or create the weak legacy format (e.g. to migrate an old store); it also gates registration of the separate BKS-V1 keystore type. Read via isOverrideSet(String).
    
    See Also:
    
    Constant Field Values
  - BKS_MAX_IT_COUNT
```
public static final java.lang.String BKS_MAX_IT_COUNT
```
    Upper bound on the PKCS#12-PBE iteration count honoured when loading a BKS keystore. The count drives the integrity-MAC key derivation in BcKeyStoreSpi.engineLoad (and the per-entry sealed-key decryption), and is read from the (not-yet-verified) keystore ahead of the HMAC integrity check, so an unbounded value is a pre-integrity CPU-exhaustion vector - the analogue of BCFKS_MAX_IT_COUNT / PKCS12_MAX_IT_COUNT for the BKS format (the sibling UBER store already caps its own count). Default 1048576 (1 << 20); the BKS writer uses ~1024-2047. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - OPENSSH_MAX_ROUNDS
```
public static final java.lang.String OPENSSH_MAX_ROUNDS
```
    Upper bound on the bcrypt round count honoured when decrypting an encrypted OpenSSH v1 private key. The count is read from the key's kdfoptions, which arrive unauthenticated, and drives the KDF before anything about the key has been verified, so an unbounded value is a pre-integrity CPU-exhaustion vector - the OpenSSH analogue of BCFKS_MAX_IT_COUNT / PKCS12_MAX_IT_COUNT. A round costs several milliseconds, so the 2^31-1 the wire format allows is worth CPU-months from a key file of a few hundred bytes. Reached only when a passphrase is supplied, i.e. on the key-import path. Default 1048576 (1 << 20); ssh-keygen defaults to 16 and its -a option is rarely taken far beyond a few hundred. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - EC_MAX_F2M_FIELD_SIZE
```
public static final java.lang.String EC_MAX_F2M_FIELD_SIZE
```
    Upper bound on the field size m accepted when building a characteristic-2 (F2m) elliptic curve. The field polynomial is evaluated when the curve is constructed, and the cost grows with m, so an unbounded value taken from a certificate's or key's explicit EC parameters is an import-time CPU-exhaustion vector (CVE-2024-29857). Default 1142 (twice the 571 of the largest standardised binary curve, B-571/K-571); a larger m is rejected with an IllegalArgumentException. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - MIME_MAX_DEPTH
```
public static final java.lang.String MIME_MAX_DEPTH
```
    Maximum depth of nested multipart/* content the S/MIME canonicalisers will descend before failing, the MIME analogue of ASN1_MAX_CONS_DEPTH. Each level of nesting in the signed half of an inbound multipart/signed costs a stack frame in SMIMEUtil.outputBodyPart plus the frames JavaMail spends resolving the part, so an unbounded depth turns a few hundred KB of crafted mail into a StackOverflowError. RFC 8551 sec. 3.1 requires an agent to receive nested S/MIME but does not require unbounded depth. Default 64; real mail nests two or three deep. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - CMS_ALLOW_LEGACY_KEYAGREE_KDF
```
public static final java.lang.String CMS_ALLOW_LEGACY_KEYAGREE_KDF
```
    Whether a CMS key agreement recipient, having failed to unwrap the content-encryption key with the RFC 5753 derivation, may retry with the raw user keying material as the KDF's SharedInfo.
    RFC 5753 sec. 7.2 fixes the SharedInfo of the ECDH and 1-Pass ECMQV KDF as the DER-encoded ECC-CMS-SharedInfo, which carries the ukm (the addedukm for ECMQV) as its entityUInfo. Some senders feed the KDF the ukm itself instead, and BC did so for ECMQV from 1.53 to 1.86. Default (unset or "true") keeps that retry, so such messages remain readable; set to "false" to accept only the RFC 5753 form (and, for the SHA-1 KDF schemes, the RFC 3278 form that preceded it). Read via isOverrideSet(String, boolean).
    
    See Also:
    
    Constant Field Values
  - CMS_MAX_DIGEST_ALGORITHMS
```
public static final java.lang.String CMS_MAX_DIGEST_ALGORITHMS
```
    The largest number of distinct digest algorithms BC will compute over the content of one SignedData message: the content digests CMSSignedData computes while its signers are verified (one per digest algorithm, shared by the signers using it) and the digest calculators CMSSignedDataParser runs over the content for the message's digestAlgorithms field. Each algorithm beyond the limit raises a CMSException. Unset or 0, the default, leaves the number unlimited, so the work a sender can demand is the content length times the algorithms it names. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - CMS_ALLOW_UNAUTHENTICATED_CBC_MAC_IV
```
public static final java.lang.String CMS_ALLOW_UNAUTHENTICATED_CBC_MAC_IV
```
    Whether a CMS AuthenticatedData message without authenticated attributes may carry a non-zero initialisation vector for a CBC-MAC (des-ede3-cbc or rc2-cbc as its macAlgorithm). Default false.
    RFC 5652 sec. 9.2 makes the eContent octets alone the MAC input when authAttrs are absent, so nothing covers the IV carried in the macAlgorithm parameters: the same difference XORed into the IV and the first content block leaves a CBC-MAC unchanged. BC therefore writes these MACs with a zero IV and refuses a non-zero one when authenticated attributes are absent; set to "true" to read such messages, as written by BC before 1.87, accepting that their first eight content bytes are not protected. A message with authenticated attributes is unaffected, as those bind the content.
    
    See Also:
    
    Constant Field Values
  - LMS_MAX_SEED_LENGTH
```
public static final java.lang.String LMS_MAX_SEED_LENGTH
```
    The largest SEED, in bytes, accepted in an LMS or HSS private key encoding. Default 1024.
    SP 800-208 sec. 6.1 makes SEED n bytes (24 or 32 for the defined parameter sets), so the default is far above any legitimate value; the bound keeps what a decoder commits to on the strength of a length field read from untrusted data finite. A value below the parameter set's n is ignored, since SEED may not be shorter than that.
    
    See Also:
    
    Constant Field Values
  - TSP_ALLOW_INCONSISTENT_SIGNING_TIME
```
public static final java.lang.String TSP_ALLOW_INCONSISTENT_SIGNING_TIME
```
    Whether a time-stamp token whose signing-time signed attribute disagrees with the genTime of its TSTInfo is accepted. Default false.
    Both values are the TSA's own statement of when the token was produced, so a genuine RFC 3161 token carries either no signing-time attribute or one within the token's accuracy of genTime. The TimeStampToken constructor rejects a token in which the two differ by more than the accuracy plus a one minute allowance; set to "true" to accept such a token regardless. Read via isOverrideSet(String).
    
    See Also:
    
    Constant Field Values
  - TSP_ALLOWED_IMPRINT_ALGORITHMS
```
public static final java.lang.String TSP_ALLOWED_IMPRINT_ALGORITHMS
```
    The hash algorithms TimeStampToken.validate(SignerInformationVerifier) accepts for a token's message imprint, as a comma separated list of digest names or dotted OIDs (for example "SHA-256,SHA-384,SHA-512"). If not set, TSPAlgorithms.ALLOWED is used. Read via asKeySet(String).
    
    See Also:
    
    Constant Field Values
  - CONSTRAINTS_QUANTUM_VULNERABLE
```
public static final java.lang.String CONSTRAINTS_QUANTUM_VULNERABLE
```
    Selects the crypto services constraint CryptoServicesRegistrar installs at start-up when no other is set: "nist" for the NIST IR 8547 timetable on the quantum-vulnerable public-key algorithms (deprecated after 2030, disallowed after 2035 except for verification and decryption), "log" to log their use, "legacy" to refuse them for anything but verification and decryption, "reject" to refuse them outright, and "none" - the default when unset - for no constraint (see QuantumVulnerableConstraint.forPolicy(String)). A constraint installed this way can be replaced through CryptoServicesRegistrar.setServicesConstraints() only when CONSTRAINTS_ALLOW_OVERRIDE is set. An unrecognised value is logged as a warning and no constraint is installed. Read once, via getPropertyValue(String), when CryptoServicesRegistrar is loaded.
    
    See Also:
    
    Constant Field Values
  - CONSTRAINTS_ALLOW_OVERRIDE
```
public static final java.lang.String CONSTRAINTS_ALLOW_OVERRIDE
```
    Set to "true" to let CryptoServicesRegistrar.setServicesConstraints() replace a constraint installed from a property at start-up, such as CONSTRAINTS_QUANTUM_VULNERABLE; otherwise such an attempt is logged and ignored. Read via isOverrideSet(String).
    
    See Also:
    
    Constant Field Values
  - SM9_ALLOW_MULTI_USE
```
public static final java.lang.String SM9_ALLOW_MULTI_USE
```
    Set to "true" for a deployment that uses one SM9 encryption user key for both the SM9 KEM and SM9 public-key decryption. By default an SM9 encryption user key is held, within the copy of the library in use (one per class loader that loads it), to the first of the two it is used for, and refused for the other; the key is recognised by its value, so the same key rebuilt as a new object is held to the same use (see SM9EncPrivateKeyParameters.recordUsage(int)). Setting the property turns that check off, and nothing is recorded while it is set; a key declared for one of the two when it was derived or imported is still held to that one. Read via isOverrideSet(String, boolean) each time a key is handed to the KEM or to decryption.
    
    See Also:
    
    Constant Field Values
- Method Detail
  - isOverrideSet
```
public static boolean isOverrideSet(java.lang.String propertyName)
```
    Return whether a particular override has been set to true.
    
    Parameters:
    
    propertyName - the property name for the override.
    
    Returns:
    
    true if the property is set to "true", false otherwise.
  - isOverrideSet
```
public static boolean isOverrideSet(java.lang.String propertyName,
                                    boolean defIsTrue)
```
    Return whether a particular override has been set to true.
    
    Parameters:
    
    propertyName - the property name for the override.
    
    Returns:
    
    true if the property is set to "true", false otherwise.
  - isOverrideSetTo
```
public static boolean isOverrideSetTo(java.lang.String propertyName,
                                      boolean isTrue)
```
    Return whether a particular override has been set to false.
    
    Parameters:
    
    propertyName - the property name for the override.
    
    isTrue - true if the override should be true, false otherwise.
    
    Returns:
    
    true if the property is set to the value of isTrue, false otherwise.
  - setThreadOverride
```
public static boolean setThreadOverride(java.lang.String propertyName,
                                        boolean enable)
```
    Enable the specified override property for the current thread only.
    
    Parameters:
    
    propertyName - the property name for the override.
    
    enable - true if the override should be enabled, false if it should be disabled.
    
    Returns:
    
    true if the override was already set true, false otherwise.
  - removeThreadOverride
```
public static boolean removeThreadOverride(java.lang.String propertyName)
```
    Remove any value for the specified override property for the current thread only.
    
    Parameters:
    
    propertyName - the property name for the override.
    
    Returns:
    
    true if the override was already set true in thread local, false otherwise.
  - asInteger
```
public static int asInteger(java.lang.String propertyName,
                            int defaultValue)
```
    Return propertyName as an integer, defaultValue used if not defined.
    
    Parameters:
    
    propertyName - name of property.
    
    defaultValue - integer to return if property not defined.
    
    Returns:
    
    value of property, or default if not found, as an int.
  - asBigInteger
```
public static java.math.BigInteger asBigInteger(java.lang.String propertyName)
```
    Return propertyName as a BigInteger.
    
    Parameters:
    
    propertyName - name of property.
    
    Returns:
    
    value of property as a BigInteger, null if not defined.
  - asKeySet
```
public static java.util.Set<java.lang.String> asKeySet(java.lang.String propertyName)
```
  - getPropertyValue
```
public static java.lang.String getPropertyValue(java.lang.String propertyName)
```
    Return the String value of the property propertyName. Property valuation starts with java.security, then thread local, then system properties.
    
    Parameters:
    
    propertyName - name of property.
    
    Returns:
    
    value of property as a String, null if not defined.
  - getPropertyValue
```
public static java.lang.String getPropertyValue(java.lang.String propertyName,
                                                java.lang.String defValue)
```

Class Properties

Field Summary

Method Summary

Methods inherited from class java.lang.Object

Field Detail

EMULATE_ORACLE

PKCS12_IGNORE_USELESS_PASSWD

PKCS12_MAX_IT_COUNT

PKCS12_STORE_IT_COUNT

PKCS12_PBKDF2_IT_COUNT

X509_CRL_CACHE_TTL

X509_ENABLE_CRLDP

X509_CRLDP_PROTOCOLS

OCSP_MAX_RESPONSE_SIZE

OCSP_MAX_RESPONSE_AGE

OPENPGP_MAX_ARMOR_HEADER_LENGTH

OPENPGP_MAX_ARMOR_HEADERS

OPENPGP_STRICT_PARTIAL_BODY_LENGTH

OPENPGP_TEXT_SIG_ALLOW_LEGACY_CR

OPENPGP_CSF_BARE_CR_LINE_ENDING

PKCS12_ALLOW_SUN_SECRET_KEYS

PKCS1_STRICT_DIGESTINFO

JSSE_HOSTNAME_CHECK_CN_FALLBACK

JSSE_USE_NAMED_GROUPS_ORDER

JSSE_CLIENT_ENABLE_DELEGATED_TASKS

JSSE_SERVER_ENABLE_DELEGATED_TASKS

DRBG_EFFECTIVE_256BITS_ENTROPY

DRBG_ENTROPY_SOURCE

DRBG_ENTROPY_THREAD

DRBG_GATHER_PAUSE_SECS

ASN1_ALLOW_NON_DER_TIME

ASN1_ALLOW_ZONELESS_UTCTIME

ASN1_MAX_CONS_DEPTH

ASN1_MAX_LIMIT

DH_MAX_SIZE

DH_ALLOW_SHORT_PRIVATE_VALUE

DSA_MAX_SIZE

BCFKS_MAX_IT_COUNT

BCFKS_MAX_SCRYPT_MEMORY

BCFKS_STORE_IT_COUNT

BCFKS_SCRYPT_P_EQ_R

PBE_MAX_ITERATION_COUNT

PBKDF2_LEGACY_CIPHER_PRF

PBE_MAX_SCRYPT_MEMORY

PKMAC_MAX_ITERATION_COUNT

X509_MAX_POLICY_NODES

X509_MAX_CERT_PATH_BUILD_NODES

X509_SGP22_NAME_CONSTRAINTS

X509_ALLOW_LENIENT_RFC822_NAME

X509_ALLOW_EMPTY_ISSUER_CERT

GCM_ALLOW_SHORT_TAGS

BKS_ENABLE_V1

BKS_MAX_IT_COUNT

OPENSSH_MAX_ROUNDS

EC_MAX_F2M_FIELD_SIZE

MIME_MAX_DEPTH

CMS_ALLOW_LEGACY_KEYAGREE_KDF

CMS_MAX_DIGEST_ALGORITHMS

CMS_ALLOW_UNAUTHENTICATED_CBC_MAC_IV

LMS_MAX_SEED_LENGTH

TSP_ALLOW_INCONSISTENT_SIGNING_TIME

TSP_ALLOWED_IMPRINT_ALGORITHMS

CONSTRAINTS_QUANTUM_VULNERABLE

CONSTRAINTS_ALLOW_OVERRIDE

SM9_ALLOW_MULTI_USE

Method Detail

isOverrideSet

isOverrideSet

isOverrideSetTo

setThreadOverride

removeThreadOverride

asInteger

asBigInteger

asKeySet

getPropertyValue

getPropertyValue