rails/rails — pull request #12256 by BanzaiMan (2013-09-17 04:41:09+00:00)
Title: Default cipher for ActiveSupport::MessageEncryptor is too strong for JRuby

The default cipher for `ActiveSupport::MessageEncryptor` ([aes-256-cbc](https://github.com/rails/rails/blob/051d289030a6cb86590cd1b619eae1879b48458a/activesupport/lib/active_support/message_encryptor.rb#L49)) is too strong for JRuby without installing [Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files](http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html). While some users have figured out how [this](http://jira.codehaus.org/browse/JRUBY-7093) [problem](https://github.com/jruby/jruby/issues/919) [manifests](http://deployingjruby.blogspot.com/2013/05/how-to-run-rails-400rc1-on-jruby.html), it is far from obvious how to solve this problem, and I would like to have a reasonable workaround.

A couple of possible solutions:

1. Change the default with a smaller key size, say 'aes-128-cbc'. Given that there are applications in the wild which assume 'aes-256-cbc', this is probably not a good way to address this problem.
1. Provide a means of specifying cipher for `EncryptedCookieJar`. Within Rails, `EncryptedCookieJar` appears to be the only thing that uses `MessageEncryptor`. If there is an option to specify a reasonable cipher, we can advise JRuby users to deal with the encryption strength effectively.