Legion of the Bouncy Castle

What Legion of the Bouncy Castle does

Legion of the Bouncy Castle is a registered Australian not-for-profit charity (registered in Victoria, November 2013) that maintains a widely deployed open-source cryptographic API library for the Java, C#, and Kotlin ecosystems. First released in May 2000 by a developer group formed in 1999, the library now records approximately 6.2 million downloads per month and has been continuously FIPS-validated for over eight years, with active FIPS 140-3 certifications across multiple modules (BC-FJA, BC-FNA). The codebase has accumulated 25+ years of cryptographic engineering expertise, including first-to-market implementations of post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA) and composite signatures (RFC 9883).

The business operates on a hybrid open-source/sponsored model. The library is distributed under the permissive MIT license at no cost through Maven Central, NuGet, and GitHub, monetizing indirectly via paid support contracts, donations, and corporate sponsorships. Since Keyfactor's June 2021 acquisition of Crypto Workshop — the entity stewarding the project — the operational team has consisted of Keyfactor employees working full-time on Bouncy Castle, with paid support contracts sold through Keyfactor as the primary commercial channel. The charity's customer base spans government, financial services, healthcare, general software developers, and increasingly industrial/IoT PKI use cases, served alongside its founding-membership role in the Open Industrial PKI Service.

Revenue is not publicly disclosed and the organization is small (1–10 employees), but its strategic relevance is disproportionate to its size: Bouncy Castle is a default or co-default cryptographic dependency across a substantial share of JVM and .NET applications worldwide, and its FIPS certifications make it one of a handful of open-source libraries eligible for use in U.S. federal and other regulated environments.

Name

Legion of the Bouncy Castle

Legal name

Legion of the Bouncy Castle Inc.

Website

https://www.bouncycastle.org

Company type

Private

Founded year

2013

Operating status

Operating

Headcount range

1–10 employees

Short description

Australian not-for-profit maintaining the Bouncy Castle open-source cryptographic API library for Java, C#, and Kotlin, serving government, financial, healthcare, and IoT developers with FIPS-validated, post-quantum-ready primitives.

Ownership category

akta.pro rank

Product category

Cryptographic Libraries

akta.pro industry

PRIMARYFSADACAI

Transaction Policy Controls & Wallet Security (Allowlisting, Limits, Approvals)

Financial & Insurance/Crypto & Digital Assets/Custody, Key Management & Wallet Infrastructure

SECONDARYFSADALAF

Fraud Detection, Scam Prevention & Account Takeover (Crypto)

Financial & Insurance/Crypto & Digital Assets/Compliance, AML/KYC, Risk & Forensics (Crypto)

Keywords

• Cryptographic libraries
• Open source cryptography
• FIPS certified crypto
• Post-quantum cryptography
• PKI software

Headquarters

HQ city

Coral Gables

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Others

Revenue model

1. MIT Open Source License: Bouncy Castle APIs are released under the MIT license and are free to download, use, modify, and distribute without charge.
2. Support Contracts: Commercial support contracts offered through Keyfactor providing access to early access programs, FIPS documentation, consulting time, and private label validation support.
3. Sponsorships and Donations: Funding derived from donations and sponsorship from Keyfactor (primary sponsor since Crypto Workshop acquisition in 2021) and community contributions.

Pricing tiers

Go-to-market motion2 records

Distribution channels4 records

Marketing channels6 records

Core offering

Legion of the Bouncy Castle develops and maintains the Bouncy Castle open-source cryptographic APIs for Java, C#/.NET, and Kotlin, providing implementations of cryptographic algorithms (AES, RSA, Elliptic Curve, post-quantum ML-KEM/ML-DSA/SLH-DSA) and protocols (TLS, CMS, S/MIME, OpenPGP, CMP, TSP). It also offers FIPS 140-2 and FIPS 140-3 certified editions (BC-FJA for Java, BC-FNA for C#/.NET) under the MIT license, with commercial support contracts provided through Keyfactor.

Product overview

Legion of the Bouncy Castle provides a suite of open-source cryptographic APIs spanning Java, C# .NET, and Kotlin platforms. The product portfolio includes three main editions: the general Bouncy Castle Java and C# .NET releases (with current versions 1.84 and latest C# respectively), the Long-Term Stable (LTS) Java release (2.73.x branch offering 5-year support), and FIPS-certified editions for both Java (BC-FJA, NIST certificate #4743) and C# .NET (BC-FNA, NIST certificate #4416). The core library consists of modular components including bcprov (cryptographic provider), bctls (TLS/JSSE), bcpkix (PKI protocols), bcpg (OpenPGP), bcmail/bcjmail (S/MIME), bcmls (Messaging Layer Security), and bcutil (ASN.1 utilities). All editions support post-quantum cryptography algorithms standardized by NIST: ML-KEM for key encapsulation, ML-DSA for digital signatures, and SLH-DSA for hash-based signatures. The LTS release includes a JNI hardware acceleration layer for Intel platforms. Commercial support is available through Keyfactor.

Differentiator

Problem solved

Functional benefit

Products and services

• Bouncy Castle Java General-purpose open-source cryptographic API for Java platforms, supporting cryptographic algorithms (AES, Elliptic Curve, RSA), protocols (TLS, CMS, S/MIME, OpenPGP, CMP), and post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA). Available in versions for JDK 1.2 through JDK 25+.
• Bouncy Castle Java LTS Long-term stable release of Bouncy Castle Java API offering 5-year support (4 years of security and non-breaking API updates, 1 year of security patches only). Based on BC 1.73, includes PQC algorithms ML-KEM, ML-DSA, and SLH-DSA. Current version 2.73.11 supported until end of 2027.
• Bouncy Castle Java FIPS (BC-FJA) FIPS 140-3 certified cryptographic module for Java. BC-FJA 2.0.0 holds NIST certificate #4743. Certified for Java 8, 11, 17, and 21. Available in pure Java and hardware-accelerated variants (2.1.x stream). Supports ML-KEM, ML-DSA, and SLH-DSA in 2.2.0 stream.
• Bouncy Castle C# .NET Open-source cryptographic API for C# and .NET platforms, mirroring the functionality of the Java edition. Supports cryptographic algorithms, protocols (TLS, CMS, S/MIME, OpenPGP), and post-quantum algorithms.
• Bouncy Castle C# .NET FIPS (BC-FNA) FIPS 140-3 certified cryptographic module for C# .NET. BC-FNA 1.0.2 holds NIST certificate #4416 targeting CLR 4. Planned 2.0.0 release adds ML-KEM, ML-DSA, SLH-DSA, EdDSA, X448, X25519, ChaCha20, and Poly1305 under FIPS 140-3 using .NET Core.
• Bouncy Castle Kotlin Kotlin language bindings for Bouncy Castle cryptographic APIs, available via GitHub repository.
• Commercial Support Contracts (via Keyfactor) Commercial support contracts offered through Keyfactor providing access to early access programs, FIPS documentation, consulting time, full source for CAVP and operations test harnesses, original documentation, and private label validation support. Targeted at enterprise and government customers using Bouncy Castle in production and regulated environments.

Quantifiable outcome

• 6.2 million downloads per month
• +1 more outcomes

Named customers5 records

Segments4 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature8 records

Partnerships

Seven partnerships are on record, tiered flagship, core and minor.

• KeyfactorflagshipStrategic or Co-development Partner · 1 June 2021Keyfactor is the primary sponsor of Bouncy Castle following acquisition of Crypto Workshop in June 2021. Keyfactor manages support contracts, provides full-time development team, and offers commercial support services for the open-source project. The partnership enables Bouncy Castle to expand the team and improve support contract holder experience.
• Open Industrial PKI ServicecoreStrategic or Co-development PartnerKeyfactor is a founding member of the Open Industrial PKI Service, which provides complimentary X.509 certificate and PKI services for organizations in the industrial sector for initial testing and prototyping without establishing their own PKI infrastructure.
• EJBCAcoreTechnology or IntegrationRelated open-source PKI software project under the same open-source community ecosystem. EJBCA is a robust, reliable Certificate Authority software that can be tailored to meet PKI requirements, often used alongside Bouncy Castle for complete PKI solutions.
• SignServercoreTechnology or IntegrationRelated open-source digital signing software project for code, documents, timestamps, and more. SignServer provides digital signing engine for automating signing workflows, often used with Bouncy Castle for cryptographic operations.
• FIPS ConsultantscoreImplementation/ SI/ Consulting PartnerList of vetted FIPS consultants including Corsec Security, KeyPair Consulting, and Symbiotic Systems Research who have experience working with Bouncy Castle FIPS modules and can assist organizations with certification processes.
• FIPS Accredited Testing LabscoreImplementation/ SI/ Consulting PartnerAccredited testing labs including Acumen Security, Advanced Data Security, Aegisolve, Lightship Security, Teron Labs, and UL InfoGard that work with Bouncy Castle for FIPS validation testing.
• PKI ConsortiumminorStrategic or Co-development PartnerIndustry consortium focused on PKI maturity models and best practices. Roman Cinkais from 3Key presented on PKI maturity assessment models at Keyfactor Community Tech Meetup.

Scale indicators6 records

Recent moves7 records

Expansion highlights5 records

Direct peers

• OpenSSL: Open-source, general-purpose cryptography and TLS toolkit maintained by the OpenSSL Corporation and Foundation. Directly comparable to Bouncy Castle as a cross-language (C-based) foundational crypto library widely embedded in commercial and open-source software; listed as a related open-source project on bouncycastle.org.
• Cryptlib: Open-source security SDK focused on long-term stability, supporting encryption, authentication, certificate management, and secure session protocols. Comparable to Bouncy Castle as a similarly positioned general-purpose crypto toolkit and listed as a related project on bouncycastle.org.
• libsodium: Portable, easy-to-use NaCl-based cryptography library offering authenticated encryption, signatures, and key exchange across many languages. Comparable to Bouncy Castle as a widely adopted, cross-platform open-source crypto primitive library often chosen for greenfield application development.

Emerging players

• wolfSSL: Lightweight, embedded-focused SSL/TLS and cryptography library with FIPS 140-2/140-3 certifications, targeting IoT, automotive, and embedded use cases. Comparable to Bouncy Castle on FIPS-validated TLS/crypto and on embedded/IoT positioning, though optimized for C-based constrained devices.
• Google Tink: Google-maintained multi-language cryptography library offering a higher-level, misuse-resistant API for common crypto operations. Comparable to Bouncy Castle as a developer-facing crypto library with language bindings (including Java), competing for the same application-developer persona.
• EJBCA: Open-source enterprise-grade Certificate Authority software under the same Keyfactor/community ecosystem as Bouncy Castle. Comparable as a sibling open-source PKI project that uses BC as its crypto provider and is bundled together with BC in Keyfactor's PKI stack.
• SignServer: Open-source digital signing server for code, documents, and timestamps that integrates with Bouncy Castle for cryptographic operations. Comparable as a sibling project in the same Keyfactor-sponsored open-source PKI ecosystem, frequently deployed alongside BC.

Broad incumbents

• Keyfactor: Enterprise PKI and certificate lifecycle management platform; primary commercial sponsor of Bouncy Castle since the June 2021 acquisition of Crypto Workshop. Comparable as the commercial vehicle through which BC's support contracts, FIPS consulting, and PKI ecosystem (EJBCA, SignServer) reach enterprise customers.
• Microsoft .NET Cryptography: Built-in cryptography APIs shipping with .NET Core/5+ and the legacy .NET Framework, providing CNG/CSP-backed algorithms for application developers. Comparable to Bouncy Castle as the default first-party crypto option for .NET developers that competes with Bouncy Castle's C# edition.
• Apple CryptoKit: Apple's Swift-first cryptography framework providing secure hashing, public-key cryptography, and secure storage across Apple platforms. Comparable to Bouncy Castle as a first-party, platform-native crypto library for application developers that constrains BC's addressable developer pool on Apple platforms.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks6 records

Key highlights7 records

Customer concentration

• GitHubgithub.com/bcgit
• Xx.com/bccrypto
• Facebookfacebook.com/legionofthebouncycastle
• LinkedInlinkedin.com/company/bouncy-castles

Compliance5 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Legion of the Bouncy Castle