Back to DashboardSoftware InfrastructureFoundationsintermediate80 min

Cryptographic APIs & Developer Languages

Compare JCA/JCE, OpenSSL, PKCS#11, CNG, and Bouncy Castle across 7 languages — with PQC readiness, provider patterns, library selection, and migration guidance.

Why this matters: The crypto API your language calls determines how hard your PQC migration will be — JCA sends you down a different path than raw OpenSSL EVP, and getting that provider choice wrong early means rewriting integration code twice.

Start here: Open the Provider Pattern Workshop: KeyGen, Sign, Verify, Encrypt and KEM Encapsulate shown side by side across JCA/JCE, OpenSSL, PKCS#11, CNG and Bouncy Castle.

For your role

Developer / Engineer
Compare JCA/JCE, OpenSSL EVP, PKCS#11, Windows CNG and Bouncy Castle across seven languages, then work through the provider-pattern examples for KeyGen, Sign, Verify, Encrypt and KEM and the API-by-algorithm support matrix.
Researcher / Academic
The eight-library deep dive (liboqs, AWS-LC, Bouncy Castle and others) and the support matrix with status badges and versions are the current state of PQC library support, with the build-versus-buy scoring wizard on top.
Certification & Validation Engineer
Compare PKCS#11 with JCA/JCE, OpenSSL EVP and Windows CNG in the API-by-algorithm support matrix, then use the eight-library deep dive for the versions to check against a certificate record.
Practice in the Simulation

Cryptographic APIs have grown organically over decades. Each emerged from a specific need: PKCS#11 was created by RSA Laboratories in the mid-1990s to provide a vendor-neutral interface to hardware security modules. JCA/JCE debuted in the late 1990s as Sun Microsystems built cryptography into the Java platform with a pluggable provider model. CNG replaced the legacy CryptoAPI in Windows Vista, separating key storage providers from algorithm providers. OpenSSL's EVP API evolved to abstract over multiple algorithm implementations, with v3.x adding a loadable provider system.

These APIs are not interchangeable — they reflect different design philosophies, security models, and deployment targets. Understanding their relationships helps you choose correctly and design for crypto agility.

JCA/JCE
1997 · Sun Microsystems
PKCS#11
1995 · RSA Labs
OpenSSL EVP
1998 · Community
CNG
2007 · Microsoft
Bouncy Castle
2000 · Legion of the BC
JCProv
2004 · Thales / SafeNet

Related Resources

Crypto Agility
Design provider-agnostic APIs to swap algorithms at runtime
HSM & PQC
PKCS#11 from the HSM admin view vs. developer API perspective
KMS & PQC
KMIP protocol and API-level key management integration
Code Signing
Signing operations and API selection for CI/CD pipelines
OS Cryptographic Stacks
OS-level crypto providers that application APIs build on top of
Platform Engineering
CI/CD pipeline crypto inventory and library selection

Products shown here are a representative selection — not an exhaustive list. For the full vendor landscape with PQC readiness status, visit the Tools & Products tab in this module or browse the Migrate catalog →

Check off all sections and mark this reading done.

Related modules

In the Industry Landscape

Check your understanding

15 questions on Cryptographic APIs & Developer Languages, each with its answer and the reason.

Take the quiz

Next step

Produce the artifact: KPI Dashboard Builder

This module belongs to the Foundations phase; KPI Dashboard Builder produces a deliverable of that phase in the Command Center.

Learning module content can be inaccurate. Please double-check its information. Report inaccuracies in PQC Today GitHub Discussions.