I am writing a java program to encrypt a message using 256-bit AES encryption, but I am getting illegal key size error, I have read that I have to use some JCE Unlimited Strength Jurisdiction Policy Files to encrypt/decrypt message with key of 256-bit or longer, but I do not understand why there is a limit on using a key size? Why using 256-bit encryption is disabled in Java by default?

Is it a crime to encrypt/decrypt files using 256-bit keys?

  • 1
    $\begingroup$ Actually Oracle Java requires the Unlimited Policy addon to do symmetric crypto more than 128 bits; that includes AES-192 and AES-256. It is impossible to use more than 256 bits key in any AES implementation, Java or other, because AES doesn't do that. $\endgroup$ Oct 29, 2016 at 3:26

1 Answer 1


There are many different cryptography laws in different nations. Some countries prohibit export of cryptography software and/or encryption algorithms or cryptoanalysis methods.

In some countries a license is required to use encryption software, and a few countries ban citizens from encrypting their internet communication. Some countries require decryption keys to be recoverable in case of a police investigation.

Issues regarding cryptography law fall into four categories:

  • Export control, which is the restriction on export of cryptography methods within a country to other countries or commercial entities. There are international export control agreements, the main one being the Wassenaar Arrangement. The Wassenaar Arrangement was created after the dissolution of COCOM (Coordinating committee for Multilateral Export Controls), which in 1989 "decontrolled password and authentication-only cryptography."
  • Import controls, which is the restriction on using certain types of cryptography within a country.
  • Patent issues, which deal with the use of cryptography tools that are patented.
  • Search and seizure issues, on whether and under what circumstances, a person can be compelled to decrypt data files or reveal an encryption key.

Restrictions on the import of cryptography

Countries may wish to restrict import of cryptography technologies for a number of reasons:

  • Cryptography may increase levels of privacy within the country beyond what the government wishes.
  • Citizens can anonymously communicate with each other, preventing any external party from monitoring them.
  • Encrypted transactions may impede external entities to control the conducting of business.
  • Imported cryptography may have backdoors or security holes, intentional or not, which allow foreigners to spy on persons using the imported cryptography; therefore the use of cryptography is restricted to that which the government thinks is safe, or which it develops itself.

The Electronic Privacy Information Center and Global Internet Liberty Campaign reports use a color code to indicate the level of restriction, with the following meanings:

  • Green: No restriction
  • Yellow: License required for importation
  • Red: Total ban

Here is List of Countries, each with their level of import restrictions.

enter image description here

and List of Countries with their import/export restrictions details and explanation

Import Limits on Cryptographic Algorithms in Java

Due to import regulations in some countries, the Oracle implementation provides a default cryptographic jurisdiction policy file that limits the strength of cryptographic algorithms.

If stronger algorithms are needed (for example, AES with 256-bit keys), the JCE Unlimited Strength Jurisdiction Policy Files must be obtained and installed in the JDK/JRE.

It is the user's responsibility to verify that this action is permissible under local regulations.

  • 1
    $\begingroup$ Note that since 8u161 circa Jan 2018 the default is now unlimited "Enable unlimited cryptographic policy by default in Oracle JDK builds", bugs.openjdk.java.net/browse/JDK-8170157. $\endgroup$
    – buzz3791
    Mar 26, 2018 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.