The HMAC SHA-512/224 and SHA-512/256 object identifiers are now registered as Mac and KeyGenerator aliases, which the SHA512 mappings had omitted while registering them for SecretKeyFactory, so getInstance by those OIDs resolves as it does for every other HMAC.

Author: dghgit

docs/releasenotes.md

@@ -16,6 +16,7 @@ Date: 2026, TBD
 ### 2.1.2 Defects Fixed
 
 - A KeyAgreement asked for its shared secret before doPhase returned data rather than refusing. javax.crypto.KeyAgreement specifies IllegalStateException for that state, but nothing in the provider tracked it, so each SPI handed back whatever its result field held: for Diffie-Hellman that was the private value itself - engineInit seeded result with x, so generateSecret() returned the private exponent padded to the prime's length and generateSecret("AES") an all-zero key taken from that padding - while ECDH returned null and its named-algorithm overload raised NullPointerException. BaseAgreementSpi now records whether a doPhase has completed the agreement since the last init and refuses the request with an IllegalStateException naming the algorithm, so every family in the provider - DH, ECDH and ECMQV, the SM2 exchange, both ECGOST families, XDH, SM9 and NewHope - answers the same way, and the DH SPI no longer holds the private value in that field at all.
+- Mac.getInstance and KeyGenerator.getInstance by the HMAC SHA-512/224 and SHA-512/256 object identifiers (1.2.840.113549.2.12 and .13) failed, although the same algorithms resolved by name and the matching SecretKeyFactory aliases were registered: the SHA512 mappings called addHMACAlgorithm for the two truncated variants without the addHMACAlias that registers their OIDs against Mac and KeyGenerator. Both are now aliased, as every other HMAC in that class already was.
 
 ### 2.1.3 Additional Features and Functionality
 

prov/src/main/java/org/bouncycastle/jcajce/provider/digest/SHA512.java

@@ -208,7 +208,10 @@ public void configure(ConfigurableProvider provider)
             addHMACAlias(provider, "SHA512", PKCSObjectIdentifiers.id_hmacWithSHA512);
 
             addHMACAlgorithm(provider, "SHA512/224", PREFIX + "$HashMacT224",  PREFIX + "$KeyGeneratorT224");
+            addHMACAlias(provider, "SHA512/224", PKCSObjectIdentifiers.id_hmacWithSHA512_224);
+
             addHMACAlgorithm(provider, "SHA512/256", PREFIX + "$HashMacT256",  PREFIX + "$KeyGeneratorT256");
+            addHMACAlias(provider, "SHA512/256", PKCSObjectIdentifiers.id_hmacWithSHA512_256);
 
             provider.addAlgorithm("SecretKeyFactory.HMACSHA512", PREFIX + "$KeyFactory");
             provider.addAlgorithm("Alg.Alias.SecretKeyFactory." + PKCSObjectIdentifiers.id_hmacWithSHA512, "HMACSHA512");