Better late than never -- yes that was the limitation.
Yes, a quick review shows we are currently using SHA-1: private Key buildKey(char[]...
Insure SHA-1 is removed