java - local_policy.jar and US_export_policy.jar different with Unlimited Strength Vs Default. -

in java platform documentation http://www.oracle.com/technetwork/java/javase/jrereadme-182762.html. regarding comment

/lib/security/local_policy.jar /lib/security/us_export_policy.jar

---

unlimited strength java cryptography extension

due import control restrictions countries, java cryptography extension (jce) policy files shipped java se development kit , java se runtime environment allow strong limited cryptography used.

an unlimited strength version of these files indicating no restrictions on cryptographic strengths available on jdk web site living in eligible countries. living in eligible countries may download unlimited strength version , replace strong cryptography jar files unlimited strength files. questions

1. does every jdk bundle comes local_policy.jar , us_export_policy.jar ?
2. what limitation in default local_policy.jar , us_export_policy.jar. key size ?
3. if need use 128 bit keys required go unlimited strength java cryptography
   extension
4. is there way can keep these 2 jars in external path , load it. because have more 50 servers rather coping in each jdk prefer maintain in central place.

does every jdk bundle comes local_policy.jar , us_export_policy.jar ?

yup. jce has been integrated java 2 sdk since 1.4 release.

what limitation in default local_policy.jar , us_export_policy.jar. key size ?

yes key size. thing more 128 bit not allowed. can check maximum size of algorithm using int maxkeylen = cipher.getmaxallowedkeylength("aes");

if need use 128 bit keys required go unlimited strength java cryptography extension

for 128 bit key encryption dont think need unlimited strength java cryptography extension jars. default ones should work fine.

is there way can keep these 2 jars in external path , load it. because have more 50 servers rather coping in each jdk prefer maintain in central place.

as mentioned above scenario should not occur if using 128 bit key encryption if using more lengthy key (eg 256) need unlimited strength jars , replace them in $java_home/jre/lib/security. in jdk/jre cannot make centralized not in case of distributed servers. need replace on each of servers.

refer oracles reference guide.

also if don't want can refer following thread alternatives -

how avoid installing “unlimited strength” jce policy files when deploying application?

reflection user in thread work around. though not recommend can take @ it.

i have summarized in post. can refer -

how install java cryptography extension (jce) unlimited strength jurisdiction policy files