Snowflake-Labs/amazon-corretto-crypto-provider

Snowflake-Labs/amazon-corretto-crypto-provider

Description: The Amazon Corretto Crypto Provider is a collection of high-performance cryptographic implementations exposed via standard JCA/JCE interfaces.

License: Apache-2.0

Stars: 0

Forks: 0

Open issues: 0

Created: 2026-08-13T05:48:05Z

Pushed: 2026-07-31T17:15:20Z

Default branch: main

Fork: yes

Parent repository: corretto/amazon-corretto-crypto-provider

Archived: no

README:

Amazon Corretto Crypto Provider

The Amazon Corretto Crypto Provider (ACCP) is a collection of high-performance cryptographic implementations exposed via the standard JCA/JCE interfaces. This means that it can be used as a drop in replacement for many different Java applications. (Differences from the default OpenJDK implementations are [documented here](./DIFFERENCES.md).) As of 2.0.0, algorithms exposed by ACCP are primarily backed by AWS-LC's implementations.

[Security issue notifications](./CONTRIBUTING.md#security-issue-notifications)

Build Status

| Build Name | main branch | | ---------- |---------------| | Linux x86_64 |  | | Linux aarch64 |  |

Performance Benchmarks

We provide complete benchmarking data from our [benchmarking suite](./benchmarks/README.md) for the current tip of main.

| Build Name | Data | EC2 Instance Type | | - | - | - | | Linux x86_64 | link | c7i.xlarge | | Linux aarch64 | link | c8g.xlarge |

Supported Algorithms

MessageDigest algorithms:

• SHA-512
• SHA-384
• SHA-256
• SHA-1
• MD5

Mac algorithms:

• HmacSHA512
• HmacSHA384
• HmacSHA224
• HmacSHA256
• HmacSHA1
• HmacMD5

Cipher algorithms:

• AES/GCM/NoPadding
• AES_\/GCM/NoPadding, where n can be 128, or 256
• AES/KW/NoPadding
• AES/KWP/NoPadding
• AES/XTS/NoPadding
• AES/CBC/NoPadding
• AES_\/CBC/NoPadding, where n can be 128, 192, or 256
• AES/CBC/PKCS5Padding
• AES_\/CBC/PKCS5Padding, where n can be 128, 192, or 256
• PKCS7Padding is also accepted with AES/CBC and it is treated the same as PKCS5.
• AES/CBC/ISO10126Padding
• AES_\/CBC/ISO10126Padding, where n can be 128, 192, or 256
• AES/CFB/NoPadding
• AES_\/CFB/NoPadding, where n can be 128 or 256
• RSA/ECB/NoPadding
• RSA/ECB/PKCS1Padding
• RSA/ECB/OAEPPadding
• RSA/ECB/OAEPWithSHA-1AndMGF1Padding
• RSA/ECB/OAEPWithSHA1AndMGF1Padding

Signature algorithms:

• SHA1withRSA
• SHA224withRSA
• SHA256withRSA
• SHA384withRSA
• SHA512withRSA
• NONEwithECDSA
• SHA1withECDSA
• SHA1withECDSAinP1363Format
• SHA224withECDSA
• SHA224withECDSAinP1363Format
• SHA256withECDSA
• SHA256withECDSAinP1363Format
• SHA384withECDSA
• SHA384withECDSAinP1363Format
• SHA512withECDSA
• SHA512withECDSAinP1363Format
• RSASSA-PSS
• NONEwithRSASSA-PSS
• NONEwithRSA
• ED25519
• ED25519ph
• NONEwithED25519ph
• ML-DSA
• ML-DSA-ExtMu

KeyPairGenerator:

• EC
• RSA
• ED25519
• X25519 (JDK 12+)

KeyGenerator:

• AES

KeyAgreement:

• ECDH
• X25519 (JDK 12+)

KEM algorithms:

• ML-KEM (JDK 17+ LTS, also see [ML-KEM Considerations](#ml-kem-considerations))

SecretKeyFactory:

• HkdfWithHmacSHA1
• HkdfWithHmacSHA256
• HkdfWithHmacSHA384
• HkdfWithHmacSHA512
• ConcatenationKdfWithSHA256
• ConcatenationKdfWithSHA384
• ConcatenationKdfWithSHA512
• ConcatenationKdfWithHmacSHA256
• ConcatenationKdfWithHmacSHA512
• CounterKdfWithHmacSHA256
• CounterKdfWithHmacSHA384
• CounterKdfWithHmacSHA512

SecureRandom:

• ACCP's SecureRandom uses AWS-LC's DRBG implementation.

KeyFactory:

• EC
• RSA
• ED25519 (JDK 15+). Please refer to system properties for more information.
• X25519 (JDK 12+)

AlgorithmParameters:

• EC. Please refer to system properties for more information.

Mac algorithms with precomputed key and associated secret key factories (expert use only, refer to HMAC with Precomputed Key for more information):

• HmacSHA512WithPrecomputedKey
• HmacSHA384WithPrecomputedKey
• HmacSHA224WithPrecomputedKey
• HmacSHA256WithPrecomputedKey
• HmacSHA1WithPrecomputedKey
• HmacMD5WithPrecomputedKey

ML-KEM Considerations

JDK's KEM interface was backported to JDK17, but not to earlier JDK versions. ACCP JARs support all LTS JDK versions since JDK8, so ACCP's default build configuration and maven artifacts omit ML-KEM as it relies on the KEM interface. To enable ML-KEM in locally built JARs, you'll need to build with a JDK ≥17 and specify TARGET_JDK_VERSION ≥17 like so:

./gradlew -DTARGET_JDK_VERSION=17 build

Notes on ACCP-FIPS

ACCP-FIPS is a variation of ACCP which uses AWS-LC-FIPS 2.x as its cryptographic module. This version of AWS-LC-FIPS has FIPS certificate 4816.

Version 2.3.0 is the first release of ACCP-FIPS. The Maven coordinates for ACCP-FIPS are the same as ACCP with one difference that ACCP-FIPS's artifact ID is AmazonCorrettoCryptoProvider-FIPS.

The table below shows which AWS-LC and AWS-LC-FIPS release versions are used in each ACCP(-FIPS) release. ACCP did not track a FIPS branch/release version of AWS-LC until ACCP v2.3.0. Before then, ACCP-FIPS simply built its tracked AWS-LC commit in FIPS mode.

| ACCP(-FIPS) version | AWS-LC version | AWS-LC-FIPS version | |---------------------|----------------|---------------------| | 2.0.0 | 1.4.0 | --- | | 2.1.0 | 1.5.0 |...