title: Android RSA Keypair Generation - Should I use Standard Java/Bouncy Castle/Spongy Castle/JSch/Other?
body: <p>I've been looking around for about a week+ to implement a method I have in mind. I have came across (and read) many articles on all of these different methods, but I am still left confused, so I was hoping maybe someone can spread their knowledge of these topics so I can more easily go about creating my sought after method and implementing it in Android.</p>
  
  <p><strong>My "sought after" method:</strong></p>
  
  <ol>
  <li>Must generate RSA Public &amp; Private keys</li>
  <li>Public must have PKCS#1 padding</li>
  <li>Must be RSA 2048</li>
  <li>Return Public Key in Byte array</li>
  </ol>
  
  <p><strong>Apparently you can go about it four ways:</strong></p>
  
  <ol>
  <li>Standard Java</li>
  <li>Bouncy Castle</li>
  <li>Spongy Castle <em>(Android Friendly?)</em></li>
  <li>JSch</li>
  </ol>
  
  <p>Since I'm very new to security and Java as a whole I was wondering if someone could finally give a good clear cut explanation of all of this.</p>
  
  <p>Below are the ways I have tried to implement my sought after method (mentioned above) in the 4 different programming methods. If I don't know something it's because I can't figure out through the respective documentation. Please feel free to correct me.</p>
  
  <h2>1. Standard Java (Not sure if PKCS#1):</h2>
  
  <pre><code>public byte[] returnPublicKeyInBytes() throws NoSuchAlgorithmException {
      KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
      kpg.initialize(2048);
      KeyPair keyPair = kpg.genKeyPair();
      byte[] pri = keyPair.getPrivate().getEncoded();
      byte[] pub = keyPair.getPublic().getEncoded();
      return pub;
  }
  </code></pre>
  
  <h2>2. Bouncy Castle (Not yet functional =/ Ideas?):</h2>
  
  <pre><code>public byte[] returnPublicKeyInBytes() throws NoSuchAlgorithmException {
      RSAKeyPairGenerator r = new RSAKeyPairGenerator();
      r.init(new KeyGenerationParameters(new SecureRandom(),4096));
      AsymmetricCipherKeyPair keys = r.generateKeyPair();
      CipherParameters pri = keys.getPrivate();
      CipherParameters pub = keys.getPublic();
      byte[] pubbyte = pub.toString().getBytes();
      return pubbyte; //NOT WORKING
  }
  </code></pre>
  
  <h2>3. SpongyCastle (Havn't started it/Same as Bouncy Castle?):</h2>
  
  <h2>4. JSch (Very Dis-functional/Work in progress)</h2>
  
  <pre><code>public byte[] returnPublicKeyInBytes(JSch jSch) {
      try { 
          KeyPair keyPair = KeyPair.genKeyPair(jSch, KeyPair.RSA);
          ByteArrayOutputStream bs = new ByteArrayOutputStream(); 
          keyPair.writePrivateKey(bs); 
          jSch.addIdentity("Generated", bs.toByteArray(), keyPair.getPublicKeyBlob(), null);
          return keyPair.getPublicKeyBlob(); 
      } catch (JSchException e) { 
          // TODO Auto-generated catch block 
          e.printStackTrace(); 
      }
      return null;
  }
  </code></pre>
  
  <p>I'd like this to really become more of a resource for anyone that has problems with RSA key generation in Android (like I, and many others have had).</p>
  
  <hr>
  
  <p>I feel that Bouncy Castle has <em>very little</em> information about it's API which makes it <em>extremely difficult</em> for a beginner (like me) to understand it. From my research, people use Bouncy Castle in Java instead of the built-in security provider because <em>Bouncy Castle is much more robust</em>. Using <em>Bouncy Castle in Android is not desired</em> because it "ships with a crippled version of Bouncy Castle" which may be prone to errors. Spongy Castle is simply a <em>repackage</em> of Bouncy Castle.</p>
  
  <p>To this end, I will ask my final question of, which method should be used for Android?</p>
  
  <h2>Update</h2>
  
  <p>I hope someone can answer this later on. As for what I did to solve my problem was to just use NDK.</p>