New Releases: Bouncy Castle Java 1.82 and Bouncy Castle Java LTS 2.73.9

2025-09-23

The Bouncy Castle team is pleased to announce the release of Bouncy Castle Java 1.82 and Bouncy Castle Java LTS 2.73.9. These releases deliver important updates to support post-quantum cryptography (PQC) adoption, supply chain transparency, and cryptographic interoperability across industries.

Key Updates

ML-DSA Client Authentication (Experimental PQC Support)

Support for the emerging draft-ietf-tls-mldsa specification has been added, enabling experimentation with ML-DSA in client-side authentication. This addition supports customers beginning their migration to PQC by offering new use cases for ML-DSA certificates issued by EJBCA.

Composite Post-Quantum Signatures (Draft 07 Update)

The composite signature implementation has been updated to draft-ietf-lamps-pq-composite-sigs-07. PREHASH support is also included, allowing users to sign and verify message digests directly. Composite signatures combine classical and PQC algorithms, ensuring long-term resilience while maintaining interoperability.

Software Bill of Material (SBOM) Files Published to Maven Central

For the first time, SBOM files are now available for both Java 1.82 and Java LTS 2.73.9. This simplifies dependency management for developers using tools like Maven and Gradle and helps organizations improve supply chain visibility.

Ascon Algorithm Updates (Bouncy Castle Java 1.82)

BC Java 1.82 includes updates to the Ascon family of algorithms, aligning with the latest changes in their standardization process. Ascon is a lightweight cryptographic family widely adopted in IoT environments, and these updates help ensure interoperability with other vendor implementations.

HQC KEM Updates (Bouncy Castle Java 1.82)

The HQC KEM implementation has been refreshed to align with the latest reference specifications. This ensures continued interoperability with other implementations and supports organizations exploring PQC KEMs as alternatives to traditional key transport and key agreement mechanisms.

What this means for developers and security teams

These updates continue to demonstrate Bouncy Castle’s ongoing commitment to advancing post-quantum cryptography, supply chain security, and standards alignment. With these releases, developers and security teams can confidently experiment with emerging cryptographic algorithms while ensuring interoperability and readiness for future adoption.