Why are the JCE Unlimited Strength not included by default?

Question

Setup

• Java doesn't offer out-of-the-box support for the JCE Unlimited Strength Policy Files
• This prevents users from using AES-256, the largest key size of a widely-used encryption standard
• Not including the policy files leads to many problems:
  • Unexpected exceptions
  • Unsatisfying workarounds:
    • Just install them
    • Use a different implementation
    • Use reflection that may violate the Java License Agreement
  • Breakage after JRE updates
  • Confusion after installation
  • And more!
• All this noise leads to broken and/or buggy programs

Question

• Why are these not provided and treated like a black sheep?

Answer 1

• As it turns out, it's not strict crypto export laws, but simply that no one got around to it yet.
• In fact, it's been planned for a long time to not have to jump through these hoops.
• In Java 9, the ceremony will be condensed down to a one-liner: Security.setProperty("crypto.policy", "unlimited");