Hacker News new | ask | show | jobs
by theandrewbailey 3531 days ago
JDK 10 will have TLS Fallback SCSV and native ChaCha20 support, though I wish they were in JDK 9.
1 comments

Not sure why you have to wait. I use ChaCha in production in JDK 8: https://github.com/bcgit/bc-java/blob/master/core/src/main/j...

Why would native be any better? I would think that as long as the implementation matches the reference it wouldn't matter.

Last weekend, I added Bouncy Castle as the security provider in my dev environment, but my server did not show ChaCha20 in the list of available TLS ciphers. I was not convinced that my server was even using BC. Knowing that if you don't know what you're doing and mess around with crypto too much that you can get burned, I gave up. ECDHE RSA AES GCM for now.
I think I see where you're coming on that. For most of my applications, I terminate TLS connections with nginx. I do use ChaCha for high-speed encryption in other areas, though. The BC libraries have always worked great for me.