如果针对Android 3.0及更高版本，使用SpongyCastle而不是BouncyCastle有优势吗？ [英] Are there advantages for using SpongyCastle over BouncyCastle, if targeting Android 3.0 and later?

问题描述

如果我正确理解了情况，则SpongyCastle是BouncyCastle的重命名，其创建目的是使人们能够在Android上包含新版本的BouncyCastle，因为仅包含最新的BouncyCastle jar会导致与旧的和剥离的冲突

If I understand the situation correctly, SpongyCastle is a renaming of BouncyCastle and it was created to give people the ability to include a new version of BouncyCastle on Android, since just including the latest BouncyCastle jar would cause conflicts with the old and stripped down version of BouncyCastle that came with Android.

但是，显然自3.0版（2011年-6年前！）以来，Android BouncyCastle软件包已重命名为 com.android.org.bouncycastle ，因此，现在，如果您包含常规的 org.bouncycastle ，则不再与打包剥离了BouncyCastle，您就可以使用最新版本。

However, apparently since version 3.0 (in 2011 - 6 years ago!) the Android BouncyCastle package was renamed to com.android.org.bouncycastle, so that now if you included the regular org.bouncycastle, this would no longer conflict with the pre-packaged stripped down BouncyCastle, and you could use the newest version that way.

让我感到困惑的是，似乎SpongyCastle项目仍然非常活跃，每当我搜索时对于 Android上的BouncyCastle或其他相关内容，最近几年我得到了很多建议使用SpongyCastle的结果，理由是类冲突是尽管他们（显然）在2011年就已经解决了，但仍将其作为推理。我看到的另一个对我来说更有意义的论点是SpongyCastle具有向后兼容性，因为您不会遇到任何问题。设备运行的Android版本早于3.0。

What confuses me is that it seems like the SpongyCastle project is still quite active and whenever I search for "BouncyCastle on Android" or anything related, I get a lot of results from the last couple of years which recommend using SpongyCastle, citing the class conflict issues as the reasoning, even though they were (apparently) resolved all the way back in 2011. Another argument I've seen that makes more sense to me, is that SpongyCastle is more backwards compatible, since you won't get any issues on devices running earlier versions Android than 3.0.

因此，我的问题是，如果您不针对Android版本早于3.0，那么使用SpongyCastle而不是BouncyCastle是否还有任何好处？ ？

So my question is, are there still any benefits to using SpongyCastle over BouncyCastle, if you are not targeting earlier versions of Android than 3.0?

推荐答案

以下是《海绵城堡》的作者写上：

Here's what the author of Spongy Castle wrote on this:

为什么海绵城堡不会过时？

• Android 3.0之前的设备仍在积极使用中。较贫穷的国家/地区使用范围更大，而这些人仍然需要安全的密码学。 Signal（据我所知不是一个SC用户）目前仍支持Android 2.3及更高版本。


• 即使在Android 3.0之后的设备上，设备制造商也不是在漫不经心地捆绑库


• 尽管与Android捆绑在一起的Bouncy Castle版本的软件包名称已更改，但仍带有 BC字样。作为提供者名称，在将自己的Bouncy Castle副本添加到应用程序并选择 BC时，在实现方式选择上会有些歧义。作为您的提供者。

但是他接着继续指出，海绵城堡的发布通常落后于Bouncy Castle的发布...出于完全可以理解的原因。

But he then he went on to note that Spongy Castle releases often lag behind the Bouncy Castle releases ... for reasons which are entirely understandable.

简而言之，对于Android设备，使用Spongy Castle的唯一可能好处似乎是在某些情况下，您的应用程序需要最新的Bouncy Castle功能，而设备制造商则捆绑了旧版本。

In short, for an Android device the only possible benefits in using Spongy Castle would appear to be to deal with cases where your application needs a recent Bouncy Castle functionality, but device manufacturers have bundled an old version.

这篇关于如果针对Android 3.0及更高版本，使用SpongyCastle而不是BouncyCastle有优势吗？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！