CryptoProWrapEngine now diversifies a copy of the KEK rather than the caller's KeyParameter array, and with no S-box uses the GOST 28147 default S-box instead of failing with a NullPointerException.

Author: peterdettman

core/src/main/java/org/bouncycastle/crypto/engines/CryptoProWrapEngine.java

@@ -7,13 +7,20 @@
 import org.bouncycastle.crypto.params.ParametersWithRandom;
 import org.bouncycastle.crypto.params.ParametersWithSBox;
 import org.bouncycastle.crypto.params.ParametersWithUKM;
+import org.bouncycastle.util.Arrays;
 import org.bouncycastle.util.Pack;
 
 public class CryptoProWrapEngine
     extends GOST28147WrapEngine
 {
     public void init(boolean forWrapping, CipherParameters param)
     {
+        /*
+         * The random is stripped on both sides of the UKM on purpose: UKM(Random(..)) is the documented
+         * order, and Random(UKM(..)) is the earlier one, kept for existing callers. Not a pattern to copy -
+         * see the org.bouncycastle.crypto.params package documentation. This repeats GOST28147WrapEngine,
+         * whose init is handed a rebuilt UKM(..) with no random, so the unwrapping has to happen here too.
+         */
         if (param instanceof ParametersWithRandom)
         {
             ParametersWithRandom pr = (ParametersWithRandom)param;
@@ -41,7 +48,8 @@ public void init(boolean forWrapping, CipherParameters param)
             kParam = (KeyParameter)inner;
         }
 
-        kParam = new KeyParameter(cryptoProDiversify(kParam.getKey(), pU.getUKM(), sBox));
+        // diversify a copy - getKey() is the caller's own array
+        kParam = new KeyParameter(cryptoProDiversify(Arrays.clone(kParam.getKey()), pU.getUKM(), sBox));
 
         if (sBox != null)
         {
@@ -99,7 +107,14 @@ private static byte[] cryptoProDiversify(byte[] K, byte[] ukm, byte[] sBox)
 
             GCFBBlockCipher c = new GCFBBlockCipher(new GOST28147Engine());
 
-            c.init(true, new ParametersWithIV(new ParametersWithSBox(new KeyParameter(K), sBox), s));
+            // with no S-box, the engine's default - the one the wrap itself then uses
+            CipherParameters kParam = new KeyParameter(K);
+            if (sBox != null)
+            {
+                kParam = new ParametersWithSBox(kParam, sBox);
+            }
+
+            c.init(true, new ParametersWithIV(kParam, s));
 
             c.processBlock(K, 0, K, 0);
             c.processBlock(K, 8, K, 8);

core/src/main/java/org/bouncycastle/crypto/engines/GOST28147WrapEngine.java

@@ -17,6 +17,11 @@ public class GOST28147WrapEngine
 
     public void init(boolean forWrapping, CipherParameters param)
     {
+        /*
+         * The random is stripped on both sides of the UKM on purpose: UKM(Random(..)) is the documented
+         * order, and Random(UKM(..)) is the earlier one, kept for existing callers. Not a pattern to copy -
+         * see the org.bouncycastle.crypto.params package documentation. CryptoProWrapEngine does the same.
+         */
         if (param instanceof ParametersWithRandom)
         {
             ParametersWithRandom pr = (ParametersWithRandom)param;

core/src/test/java/org/bouncycastle/crypto/test/CryptoProWrapEngineTest.java

@@ -0,0 +1,85 @@
+package org.bouncycastle.crypto.test;
+
+import org.bouncycastle.crypto.CipherParameters;
+import org.bouncycastle.crypto.engines.CryptoProWrapEngine;
+import org.bouncycastle.crypto.engines.GOST28147Engine;
+import org.bouncycastle.crypto.params.KeyParameter;
+import org.bouncycastle.crypto.params.ParametersWithSBox;
+import org.bouncycastle.crypto.params.ParametersWithUKM;
+import org.bouncycastle.util.encoders.Hex;
+import org.bouncycastle.util.test.SimpleTest;
+
+/**
+ * {@link CryptoProWrapEngine} (RFC 4357 sec. 6.3, with the sec. 6.5 KEK diversification) given no
+ * S-box uses the GOST 28147 engine's default one throughout, and never modifies the caller's key.
+ */
+public class CryptoProWrapEngineTest
+    extends SimpleTest
+{
+    private static final byte[] KEK = Hex.decode("8b2f3a41c6d5e7091a2b3c4d5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f7081");
+    private static final byte[] CEK = Hex.decode("0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20");
+    private static final byte[] UKM = Hex.decode("1d80603c8544c727");
+
+    public String getName()
+    {
+        return "CryptoProWrapEngine";
+    }
+
+    public void performTest()
+        throws Exception
+    {
+        defaultSBoxTest();
+
+        keyUnmodifiedTest(null);
+        keyUnmodifiedTest(GOST28147Engine.getSBox("E-A"));
+    }
+
+    private void defaultSBoxTest()
+        throws Exception
+    {
+        CryptoProWrapEngine engine = new CryptoProWrapEngine();
+
+        engine.init(true, new ParametersWithUKM(
+            new ParametersWithSBox(new KeyParameter(KEK), GOST28147Engine.getSBox("Default")), UKM));
+        byte[] expected = engine.wrap(CEK, 0, CEK.length);
+
+        engine.init(true, new ParametersWithUKM(new KeyParameter(KEK), UKM));
+        isTrue("no S-box wrap differs from the default S-box", areEqual(expected, engine.wrap(CEK, 0, CEK.length)));
+
+        engine.init(false, new ParametersWithUKM(new KeyParameter(KEK), UKM));
+        isTrue("no S-box unwrap failed", areEqual(CEK, engine.unwrap(expected, 0, expected.length)));
+    }
+
+    private void keyUnmodifiedTest(byte[] sBox)
+        throws Exception
+    {
+        String label = sBox == null ? "no S-box" : "S-box";
+
+        KeyParameter key = new KeyParameter(KEK);
+        CipherParameters kParam = key;
+        if (sBox != null)
+        {
+            kParam = new ParametersWithSBox(kParam, sBox);
+        }
+        ParametersWithUKM params = new ParametersWithUKM(kParam, UKM);
+
+        CryptoProWrapEngine engine = new CryptoProWrapEngine();
+
+        engine.init(true, params);
+        byte[] wrapped = engine.wrap(CEK, 0, CEK.length);
+        isTrue(label + ": caller's key modified by init", areEqual(KEK, key.getKey()));
+
+        engine.init(true, params);
+        isTrue(label + ": wrap differs on re-init with the same parameters",
+            areEqual(wrapped, engine.wrap(CEK, 0, CEK.length)));
+
+        engine.init(false, params);
+        isTrue(label + ": unwrap with the same parameters failed", areEqual(CEK, engine.unwrap(wrapped, 0, wrapped.length)));
+        isTrue(label + ": caller's key modified by re-init", areEqual(KEK, key.getKey()));
+    }
+
+    public static void main(String[] args)
+    {
+        runTest(new CryptoProWrapEngineTest());
+    }
+}

core/src/test/java/org/bouncycastle/crypto/test/RegressionTest.java

@@ -159,6 +159,7 @@ public class RegressionTest
             new SM2SignerTest(),
             new ShortWrapCipherTextTest(),
             new UKMParametersNestingTest(),
+            new CryptoProWrapEngineTest(),
             new SM4Test(),
             new SM9KEMTest(),
             new SM9EngineTest(),

core/src/test/java/org/bouncycastle/crypto/test/UKMParametersNestingTest.java

@@ -18,7 +18,6 @@
 import org.bouncycastle.crypto.params.ParametersWithRandom;
 import org.bouncycastle.crypto.params.ParametersWithSBox;
 import org.bouncycastle.crypto.params.ParametersWithUKM;
-import org.bouncycastle.util.Arrays;
 import org.bouncycastle.util.encoders.Hex;
 import org.bouncycastle.util.test.SimpleTest;
 
@@ -47,6 +46,7 @@ public void performTest()
     {
         wrapTest("GOST28147Wrap", new GOST28147WrapEngine(), null);
         wrapTest("GOST28147Wrap/SBox", new GOST28147WrapEngine(), GOST28147Engine.getSBox("E-A"));
+        wrapTest("CryptoProWrap", new CryptoProWrapEngine(), null);
         wrapTest("CryptoProWrap/SBox", new CryptoProWrapEngine(), GOST28147Engine.getSBox("E-A"));
 
         vkoTest();
@@ -73,12 +73,9 @@ private void wrapTest(String label, Wrapper wrapper, byte[] sBox)
         }
     }
 
-    /*
-     * A fresh key each time: CryptoProWrapEngine diversifies the KeyParameter's bytes in place.
-     */
     private static CipherParameters createWrapParameters(int nesting, byte[] sBox)
     {
-        CipherParameters key = new KeyParameter(Arrays.clone(KEK));
+        CipherParameters key = new KeyParameter(KEK);
         if (sBox != null)
         {
             key = new ParametersWithSBox(key, sBox);

docs/releasenotes.md

@@ -62,6 +62,7 @@ Date: 2026, TBD
 - JceKeyAgreeRecipientInfoGenerator created its 1-pass ECMQV ephemeral key pair once per generator rather than once per message, so a generator used for more than one message sent the same ephemeral key in each and derived the same key-encryption key for every recipient each time, withdrawing the ephemeral contribution RFC 5753 sec. 3.2 relies on. The messages were well formed and decrypted correctly. A fresh key pair is now generated for each KeyAgreeRecipientInfo, still shared by all of its recipients.
 - The ML-KEM KeyGenerator (KEMGenerateSpec/KEMExtractSpec), Cipher (wrap/unwrap), javax.crypto.KEM and KeyFactory.translateKey services accepted only BC's own ML-KEM key objects, and the KeyGenerator failed with a ClassCastException at generateKey() rather than at init, so an ML-KEM key from another provider could not be used with BC even though its standard encoding was one BC reads. This broke BCJSSE handshakes over the ML-KEM and hybrid groups whenever another provider ahead of BC decoded the peer's key or generated the ephemeral key pair. A foreign key is now converted from its X.509 or PKCS#8 encoding, with the usual parameter-set checks, and an unusable one is rejected at init (github #2466).
 - The raw JCA provider bounded the PBKDF2 iteration count taken from an encoding (org.bouncycastle.pbe.max_iteration_count, default 10,000,000) but not the counts of the legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families beside it. Their AlgorithmParameters (PKCS12PBE and its OID aliases, PBKDF1) accepted any count, narrowing one beyond the int range with intValue() so that 2^32 arrived as 0, and every Cipher, Mac and SecretKeyFactory derivation ran with whatever count it was given - including a count decoded by another provider's AlgorithmParameters, as when javax.crypto.EncryptedPrivateKeyInfo.getKeySpec() decrypts a PKCS#12 PBE-protected key with BC. As these schemes carry the count in unauthenticated parameters and derive before anything can be checked, a supplied blob could hold a derivation for tens of minutes. The parameter parse now rejects a negative, beyond-int or over-limit count, and the derivations reject a negative or over-limit count, under the same property as PBKDF2. The PKCS#12 key store derives through the same code, so a org.bouncycastle.pkcs12.max_it_count raised above 10,000,000 now needs org.bouncycastle.pbe.max_iteration_count raised with it.
+- The light-weight CryptoProWrapEngine (RFC 4357 sec. 6.3) diversified the key encryption key in the caller's own array, so after init the KeyParameter it was given held the diversified key, and initialising again with the same parameters - to unwrap what had just been wrapped, say - diversified it a second time and used a different key. It also failed with a NullPointerException when given no S-box, although init has a branch for that case. It now diversifies a copy, and given no S-box uses the GOST 28147 engine's default S-box for the diversification, the one the wrap itself then uses. The provider's GOST 28147 key wrap ciphers were unaffected, as they always supply an S-box and build a new KeyParameter on every init.
 
 ### 2.1.3 Additional Features and Functionality