According to http://www.jcraft.com/jsch/, JSch is in pure Java, but it depends on Java Cryptography Extension (JCE). JSch has been known to work with J2SE 1.4.0 or later (no additional libraries required).
Before anyone suggests I upgrade (which would indeed make my life easier), it is not an option: I have to get this working under Java 1.4.2.
So, I downloaded the JSch 0.1.54 source (and the JZLib 1.1.3 source) and fixed a few minor problems here and there. The remaining stumbling block is JCE. Without it, the following classes (found under java.security.interfaces starting with Java 1.5) are missing:
Error:(40, 3) java: cannot find symbol
symbol: class ECFieldFp
symbol: class ECGenParameterSpec
symbol: class ECParameterSpec
symbol: class ECPoint
symbol: class ECPrivateKey
symbol: class ECPrivateKeySpec
symbol: class ECPublicKey
symbol: class ECPublicKeySpec
symbol: class EllipticCurve
Where is the JCE source or jar that will fill this need? The Bouncy Castle page (https://www.bouncycastle.org/latest_releases.html) seems to be part of the solution, but there is a bewildering choice of downloads for Java 1.4. I tried lcrypto-jdk14-157 but it's incomplete against the above list: it supplies only ECPoint and ECPrivateKey.