feat(android): migrate from SpongyCastle to BouncyCastle

[diegolmello]

Summary

Migrates the Android implementation off the unmaintained SpongyCastle fork (com.madgag.spongycastle:core + :prov 1.58.0.0) to BouncyCastle org.bouncycastle:bcprov-jdk18on:1.84 (latest on Maven Central).

SpongyCastle is a package-renamed BouncyCastle fork, so this is a pure mechanical swap:

• android/build.gradle: 2 deps → 1 (bcprov-jdk18on covers everything previously supplied by core+prov for the classes used: crypto.digests/generators/params, asn1.*, util.io.pem)
• PBKDF2Crypto.kt + RSACrypto.kt: org.spongycastle.* → org.bouncycastle.* (imports + fully-qualified refs). Class names identical, no logic changes.

The library is used as plain classes only — never registered as a JCE provider (no Security.addProvider), so there is no collision with Android's platform BC (com.android.org.bouncycastle namespace).

No iOS, TypeScript, CI, or ProGuard changes. Zero spongycastle/madgag references remain repo-wide.

Verification

Known-answer harness (example/src/App.tsx) on Android emulator (API 36): 31/31 entries pass, including the fixed-vector KATs (RSA OAEP-SHA256 decrypt, deterministic PKCS#1 v1.5 SHA-256 sign exact-match, JWK export fixed n/e, JWK import→verify) that compare against literal pinned bytes from before the migration — proving byte-compatibility for E2E encryption. KAT expected values are shared with iOS, so cross-platform equality holds by construction.

Unit tests are deliberately out of scope — tracked separately in NATIVE-1378.

Jira: NATIVE-1284

Summary by CodeRabbit

• Bug Fixes
  • Updated the app’s cryptography backend to use a newer Bouncy Castle provider.
  • Improved compatibility for RSA and PBKDF2 key handling while keeping existing encryption behavior unchanged.

[coderabbitai]

Warning

Review limit reached

@diegolmello, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 55 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 143b200e-c9d0-4b67-89f4-2057206a226c

📥 Commits

Reviewing files that changed from the base of the PR and between e96b15b and adbcf7c.

📒 Files selected for processing (1)

• package.json

Walkthrough

This PR migrates the Android cryptography implementation from SpongyCastle to BouncyCastle. The Gradle dependency was replaced with org.bouncycastle:bcprov-jdk18on:1.84, and import statements plus key-parsing calls in PBKDF2Crypto.kt and RSACrypto.kt were updated to use BouncyCastle namespaces.

Changes

BouncyCastle Migration

Layer / File(s)	Summary
Dependency declaration update android/build.gradle	Removed Spongycastle core/prov dependencies and added a single org.bouncycastle:bcprov-jdk18on:1.84 dependency.
PBKDF2 crypto import migration android/.../algorithms/PBKDF2Crypto.kt	Replaced SpongyCastle digest, PBEParametersGenerator, and KeyParameter imports with BouncyCastle equivalents; PBKDF2 logic unchanged.
RSA PEM/PKCS#1 parsing migration android/.../algorithms/RSACrypto.kt	Replaced SpongyCastle PEM/ASN.1 imports with BouncyCastle equivalents and updated RSAPublicKey/RSAPrivateKey getInstance calls in createPublicKeyFromPem, pkcs1ToPublicKey, and pkcs1ToPrivateKey.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• RocketChat/rocket.chat-mobile-crypto#14: Both PRs modify the same RSACrypto.kt key-handling code paths, with the main PR migrating PKCS#1 parsing to BouncyCastle types used by the other PR's verify fix.

Suggested labels: type: chore

Suggested reviewers: OtavioStasiak

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately summarizes the main Android crypto dependency migration from SpongyCastle to BouncyCastle.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Warning

Review ran into problems

🔥 Problems

Errors were encountered while retrieving linked issues.

Errors (3)

• SHA-256: Request failed with status code 401
• NATIVE-1378: Request failed with status code 401
• NATIVE-1284: Request failed with status code 401

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[OtavioStasiak]

LGTM