The X25519 and X448 KeyAgreements now take the unified agreement and curve binding from their own algorithm name rather than the XDH name reported under org.bouncycastle.emulate.oracle, which only changes exception messages.

Author: dghgit

docs/releasenotes.md

@@ -70,6 +70,8 @@ Date: 2026, TBD
 
 - The BCPQC MAYO, SDitH, SNOVA and NTRU+ KeyPairGenerators refused every java.security.spec.NamedParameterSpec with InvalidAlgorithmParameterException, whatever parameter set it named and in whatever case: they lower-cased the name and then looked it up in a table of upper-case names. The name is now upper-cased, so NamedParameterSpec("MAYO-1") and NamedParameterSpec("mayo-1") both select MAYO-1, as the other BCPQC families already allowed. The generators' own ParameterSpec classes were never affected.
 
+- With org.bouncycastle.emulate.oracle set, the X25519 and X448 KeyAgreements took the name they report under it, XDH, for the algorithm itself: the unified agreements (X25519UwithSHA256KDF, X448UwithSHA512KDF and their CKDF forms) refused a DHUParameterSpec and ran as plain static agreements without one, and the curve specific agreements accepted a key on the other curve. The property now affects only the name used in exception messages.
+
 ### 2.1.3 Additional Features and Functionality
 
 - The CRMF certificate request message controls now include the RFC 4211 sec. 6.6 protocolEncrKey control, which names the key a CA is to encrypt its response with: org.bouncycastle.cert.crmf.ProtocolEncrKeyControl carries the SubjectPublicKeyInfo the control is defined to take, and CertificateRequestMessage.getControl() recognises id-regCtrl-protocolEncrKey alongside the regToken, authenticator and pkiArchiveOptions controls it already returned (github PR #2443).

prov/src/main/java/org/bouncycastle/jcajce/provider/asymmetric/edec/KeyAgreementSpi.java

@@ -30,18 +30,25 @@
 public class KeyAgreementSpi
     extends BaseAgreementSpi
 {
+    // taken from the real algorithm name: under EMULATE_ORACLE kaAlgorithm is "XDH" and is only for messages.
+    private final boolean isUnified;
+    private final String curve;
+
     private RawAgreement agreement;
     private DHUParameterSpec dhuSpec;
     private byte[] result;
 
     KeyAgreementSpi(String algorithm)
     {
-        super(Properties.isOverrideSet(Properties.EMULATE_ORACLE) ? "XDH" : algorithm, null);
+        this(algorithm, null);
     }
 
     KeyAgreementSpi(String algorithm, DerivationFunction kdf)
     {
         super(Properties.isOverrideSet(Properties.EMULATE_ORACLE) ? "XDH" : algorithm, kdf);
+
+        this.isUnified = algorithm.indexOf('U') >= 0;
+        this.curve = algorithm.startsWith("XDH") ? null : (algorithm.startsWith("X448") ? "X448" : "X25519");
     }
 
     protected byte[] doCalcSecret()
@@ -77,7 +84,7 @@ else if (priv instanceof X448PrivateKeyParameters)
         ukmParametersSalt = null;
         if (params instanceof DHUParameterSpec)
         {
-            if (kaAlgorithm.indexOf('U') < 0)
+            if (!isUnified)
             {
                 throw new InvalidAlgorithmParameterException("agreement algorithm not DHU based");
             }
@@ -92,7 +99,7 @@ else if (priv instanceof X448PrivateKeyParameters)
         }
         else if (params != null)
         {
-            if (kaAlgorithm.indexOf('U') >= 0)
+            if (isUnified)
             {
                 throw new InvalidAlgorithmParameterException(kaAlgorithm + " key agreement requires DHUParameterSpec for initialisation");
             }
@@ -116,7 +123,7 @@ else if (params != null)
         }
         else
         {
-            if (kaAlgorithm.indexOf('U') >= 0)
+            if (isUnified)
             {
                 throw new InvalidAlgorithmParameterException(kaAlgorithm + " key agreement requires DHUParameterSpec for initialisation");
             }
@@ -165,12 +172,12 @@ protected Key engineDoPhase(Key key, boolean lastPhase)
     private RawAgreement getAgreement(String alg)
         throws InvalidKeyException
     {
-        if (!(kaAlgorithm.equals("XDH") || kaAlgorithm.startsWith(alg)))
+        if (!(curve == null || curve.equals(alg)))
         {
             throw new InvalidKeyException("inappropriate key for " + kaAlgorithm);
         }
 
-        if (kaAlgorithm.indexOf('U') > 0)
+        if (isUnified)
         {
             if (alg.startsWith("X448"))
             {

prov/src/test/java/org/bouncycastle/jce/provider/test/KeyAgreementInitParametersTest.java

@@ -18,6 +18,7 @@
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.bouncycastle.jce.spec.ECNamedCurveGenParameterSpec;
 import org.bouncycastle.util.Arrays;
+import org.bouncycastle.util.Properties;
 import org.bouncycastle.util.test.SimpleTest;
 
 /**
@@ -84,6 +85,91 @@ public void performTest()
         checkAcceptsSalt("ECDHwithSHA256HKDF", ecKey);
 
         checkNoUkm(ecKey, xKey);
+
+        checkEmulateOracle(xKey, generate("X448", null));
+    }
+
+    /**
+     * Properties.EMULATE_ORACLE makes the XDH agreements report themselves as "XDH", and the SPI
+     * used to take that name for the algorithm too: the unified agreements lost the DHU requirement
+     * (refusing a DHUParameterSpec, running a plain agreement without one) and the curve specific
+     * ones accepted a key on the other curve. The name is only for messages.
+     */
+    private void checkEmulateOracle(KeyPair xKey, KeyPair x448Key)
+        throws Exception
+    {
+        Properties.setThreadOverride(Properties.EMULATE_ORACLE, true);
+        try
+        {
+            checkRejectsPlainUKM("X25519UwithSHA256KDF", xKey);
+            checkRejectsPlainUKM("X448UwithSHA512KDF", x448Key);
+            checkRejectsNoSpec("X25519UwithSHA256KDF", xKey);
+            checkRejectsNoSpec("X448UwithSHA512KDF", x448Key);
+
+            checkRejectsOtherCurve("X25519", x448Key);
+            checkRejectsOtherCurve("X25519withSHA256KDF", x448Key);
+            checkRejectsOtherCurve("X448", xKey);
+            checkRejectsOtherCurve("X448withSHA512KDF", xKey);
+
+            checkUnifiedAgreement("X25519UwithSHA256KDF", xKey, generate("X25519", null));
+            checkUnifiedAgreement("X448UwithSHA512KDF", x448Key, generate("X448", null));
+
+            // the XDH names are not tied to a curve
+            KeyAgreement agreement = agreement("XDH");
+            if (agreement != null)
+            {
+                agreement.init(xKey.getPrivate());
+                agreement.init(x448Key.getPrivate());
+            }
+        }
+        finally
+        {
+            Properties.removeThreadOverride(Properties.EMULATE_ORACLE);
+        }
+    }
+
+    private void checkRejectsOtherCurve(String algorithm, KeyPair kp)
+        throws Exception
+    {
+        KeyAgreement agreement = agreement(algorithm);
+        if (agreement == null)
+        {
+            return;
+        }
+
+        try
+        {
+            agreement.init(kp.getPrivate());
+
+            fail(algorithm + " accepted a key on the other curve");
+        }
+        catch (InvalidKeyException e)
+        {
+            // expected
+        }
+    }
+
+    private void checkUnifiedAgreement(String algorithm, KeyPair kp, KeyPair other)
+        throws Exception
+    {
+        String keyAlg = algorithm.startsWith("X448") ? "X448" : "X25519";
+        KeyPair ephemeral = generate(keyAlg, null);
+        KeyPair otherEphemeral = generate(keyAlg, null);
+
+        KeyAgreement a = agreement(algorithm);
+        KeyAgreement b = agreement(algorithm);
+        if (a == null)
+        {
+            return;
+        }
+
+        a.init(kp.getPrivate(), new DHUParameterSpec(ephemeral, otherEphemeral.getPublic(), UKM));
+        b.init(other.getPrivate(), new DHUParameterSpec(otherEphemeral, ephemeral.getPublic(), UKM));
+        a.doPhase(other.getPublic(), true);
+        b.doPhase(kp.getPublic(), true);
+
+        isTrue(algorithm + " unified agreement did not agree",
+            Arrays.areEqual(a.generateSecret("AES[256]").getEncoded(), b.generateSecret("AES[256]").getEncoded()));
     }
 
     /**