Please update Bouncy Castle

[Neustradamus]

Please update Bouncy Castle

• https://www.bouncycastle.org/
• https://www.bouncycastle.org/releasenotes.html
• http:https://www.bouncycastle.org/latest_releases.html
• https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=bouncy%20castle
• https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=bouncycastle
• https://www.cvedetails.com/vulnerability-list/vendor_id-7637/Bouncycastle.html

[petrdvorak]

Hello @Neustradamus, thank you for the report! Could you please elaborate if there is a strong reason to rush the update from 1.67 (that we currently use) to 1.68 (latest)? We will update the dependency in a reasonable time ahead of the next release, most likely in 03/2021...

[Neustradamus]

@petrdvorak: You can update easily now, please look the changelog of the 1.68.
Why do not create more builds?

[petrdvorak]

@Neustradamus We are releasing our authentication stack every ~6 months. Probably still too frequent for some of our customers. I saw the changelog for BC 1.68 and this is why I asked what specifically do you think we should address from it.

[Neustradamus]

@petrdvorak: Ok, I understand.
It is less important than 1.67.
But you can already update in upstream and before your next release verify if there is not a new...

[romanstrobl]

I went through the diffs between versions 1.67 and 1.68 and the changes in Bouncy Castle code have no impact on cryptography used in in this project. We will migrate to a newer version of Bouncy Castle in Spring 2021 together with the rest of the PowerAuth stack. Given that there are multiple projects with the BC dependency we always do the migration at once to avoid compatibility issues. We do not want to migrate all PowerAuth projects to the 1.68 release right now because there is no reason for it and our backend projects would have conflicting dependencies (2 different versions of BC library). We will reassess the library upgrade in Spring, most likely there will be a newer release of Bouncy Caste library available at that time.

[Neustradamus]

@petrdvorak, @romanstrobl: Can you update to 1.69?