simcrypt

Symmetric encryption library covering all JDK SunJCE + BouncyCastle symmetric ciphers (~300 configurations). Picks a random cipher per operation so there's no way to guess which algorithm was used.

Dependency

<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-jdk18on</artifactId>
<version>1.79</version>
</dependency>

Quickstart

// Step 1 — generate your master key once and store it in env / secrets vault:StringmasterKey = EncryptionService.generateMasterKey();
// Step 2 — use it:Encryptorsc = newEncryptionService(System.getenv("ENCRYPTION_KEY"));
// Encrypt — picks a random strong cipher, embeds cipher metadata in the tokenStringtoken = sc.seal("my API key");
// Decrypt — fully self-contained, no need to track which cipher was usedStringplain = sc.open(token);

Advanced usage

// Pick a cipher explicitlyCryptoKeykey = EncryptionService.randomKey(); // any of ~400 ciphersCryptoKeykey = EncryptionService.randomStrongKey(); // AEAD / modern stream onlyStringenc = sc.encrypt("data", key);
Stringdec = sc.decrypt(enc, key);
// Seal with a specific cipher (both overloads available via Encryptor interface)Stringtoken = sc.seal("data", key);
// Persist the cipher choice alongside the ciphertext (e.g. in a DB column)Stringserial = key.serialize();
CryptoKeyrestored = CryptoKey.deserialize(serial);

Key tiers

EncryptionService.getAllCryptoKeys(); // all ~300 configurationsEncryptionService.getStrongKeys(); // AEAD + modern stream (recommended)EncryptionService.getLegacyKeys(); // DES, RC2, ARCFOUR, TEA, GOST, ...key.isAead() // GCM, Poly1305, EAX, CCM, OCBkey.isStrong() // AEAD + ChaCha20 / Salsa20 familykey.isLegacy() // weak / deprecated ciphers

Covered algorithms by family

JDK — AES : CBC, CTR, CTS, CFB, CFB8, OFB, OFB8, PCBC · keys 128/192/256

JDK — AES-GCM : tags 96/104/112/120/128 bits · keys 128/192/256

JDK — Legacy : Blowfish, DES, DESede, RC2, ARCFOUR

JDK — Stream : ChaCha20, ChaCha20-Poly1305

BC — 128-bit block : Twofish, Serpent, Camellia, CAST6, ARIA, SEED, SM4, RC6, Noekeon, DSTU7624/Kalyna

BC — 64-bit block : CAST5, IDEA, TEA, XTEA, SKIPJACK, GOST28147

**BC — Stream** : HC-128, HC-256, Salsa20, XSalsa20, Grain-128

Security note

seal() always picks from getStrongKeys() (AEAD only). getLegacyKeys() exists for interoperability with legacy systems — avoid it for new data.