The ML-DSA public key (rho, t1) constructor and the ML-DSA and SLH-DSA private key component constructors now reject components whose length does not match the parameter set.

Author: dghgit

core/src/main/java/org/bouncycastle/crypto/params/MLDSAPrivateKeyParameters.java

@@ -40,6 +40,24 @@ public MLDSAPrivateKeyParameters(MLDSAParameters params, byte[] rho, byte[] K, b
     public MLDSAPrivateKeyParameters(MLDSAParameters params, byte[] rho, byte[] K, byte[] tr, byte[] s1, byte[] s2, byte[] t0, byte[] t1, byte[] seed)
     {
         super(true, params);
+
+        MLDSAEngine eng = MLDSAEngine.getInstance(params, null);
+
+        checkLength(rho, MLDSAEngine.SeedBytes, "rho");
+        checkLength(K, MLDSAEngine.SeedBytes, "K");
+        checkLength(tr, MLDSAEngine.TrBytes, "tr");
+        checkLength(s1, eng.getDilithiumL() * eng.getDilithiumPolyEtaPackedBytes(), "s1");
+        checkLength(s2, eng.getDilithiumK() * eng.getDilithiumPolyEtaPackedBytes(), "s2");
+        checkLength(t0, eng.getDilithiumK() * MLDSAEngine.DilithiumPolyT0PackedBytes, "t0");
+        if (t1 != null)
+        {
+            checkLength(t1, eng.getDilithiumK() * MLDSAEngine.DilithiumPolyT1PackedBytes, "t1");
+        }
+        if (seed != null)
+        {
+            checkLength(seed, MLDSAEngine.SeedBytes, "seed");
+        }
+
         this.rho = Arrays.clone(rho);
         this.k = Arrays.clone(K);
         this.tr = Arrays.clone(tr);
@@ -256,6 +274,18 @@ public boolean isDestroyed()
         return destroyed;
     }
 
+    private static void checkLength(byte[] value, int expectedLength, String name)
+    {
+        if (value == null)
+        {
+            throw new NullPointerException("'" + name + "' cannot be null");
+        }
+        if (value.length != expectedLength)
+        {
+            throw new IllegalArgumentException("'" + name + "' has invalid length");
+        }
+    }
+
     private byte[] cloneWithCheck(byte[] fieldValue)
     {
         byte[] rv = Arrays.clone(fieldValue);

core/src/main/java/org/bouncycastle/crypto/params/MLDSAPublicKeyParameters.java

@@ -39,6 +39,17 @@ public MLDSAPublicKeyParameters(MLDSAParameters params, byte[] rho, byte[] t1)
         {
             throw new NullPointerException("t1 cannot be null");
         }
+
+        MLDSAEngine engine = MLDSAEngine.getInstance(params, null);
+        if (rho.length != MLDSAEngine.SeedBytes)
+        {
+            throw new IllegalArgumentException("'rho' has invalid length");
+        }
+        if (t1.length != engine.getDilithiumK() * MLDSAEngine.DilithiumPolyT1PackedBytes)
+        {
+            throw new IllegalArgumentException("'t1' has invalid length");
+        }
+
         this.rho = Arrays.clone(rho);
         this.t1 = Arrays.clone(t1);
     }

core/src/main/java/org/bouncycastle/crypto/params/SLHDSAPrivateKeyParameters.java

@@ -28,6 +28,13 @@ public SLHDSAPrivateKeyParameters(SLHDSAParameters parameters, byte[] skpkEncode
     public SLHDSAPrivateKeyParameters(SLHDSAParameters parameters, byte[] skSeed, byte[] prf, byte[] pkSeed, byte[] pkRoot)
     {
         super(true, parameters);
+
+        int n = parameters.getN();
+        checkLength(skSeed, n, "skSeed");
+        checkLength(prf, n, "prf");
+        checkLength(pkSeed, n, "pkSeed");
+        checkLength(pkRoot, n, "pkRoot");
+
         this.sk = new SK(skSeed, prf);
         this.pk = new PK(pkSeed, pkRoot);
     }
@@ -94,6 +101,18 @@ public boolean isDestroyed()
         return destroyed;
     }
 
+    private static void checkLength(byte[] value, int expectedLength, String name)
+    {
+        if (value == null)
+        {
+            throw new NullPointerException("'" + name + "' cannot be null");
+        }
+        if (value.length != expectedLength)
+        {
+            throw new IllegalArgumentException("'" + name + "' has invalid length");
+        }
+    }
+
     private byte[] cloneWithCheck(byte[] fieldValue)
     {
         byte[] rv = Arrays.clone(fieldValue);

core/src/test/java/org/bouncycastle/pqc/crypto/test/MLDSATest.java

@@ -13,6 +13,9 @@
 import java.util.regex.Pattern;
 
 import junit.framework.TestCase;
+import org.bouncycastle.asn1.ASN1Encodable;
+import org.bouncycastle.asn1.DEROctetString;
+import org.bouncycastle.asn1.DERSequence;
 import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
 import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
 import org.bouncycastle.crypto.AsymmetricCipherKeyPair;
@@ -762,6 +765,85 @@ public void testPrivateKeyRejectsMalformedLength()
         }
     }
 
+    public void testComponentLengthChecks()
+        throws Exception
+    {
+        MLDSAKeyPairGenerator kpGen = new MLDSAKeyPairGenerator();
+        kpGen.init(new MLDSAKeyGenerationParameters(new SecureRandom(), MLDSAParameters.ml_dsa_44));
+        AsymmetricCipherKeyPair kp = kpGen.generateKeyPair();
+        MLDSAPrivateKeyParameters priv = (MLDSAPrivateKeyParameters)kp.getPrivate();
+        MLDSAPublicKeyParameters pub = (MLDSAPublicKeyParameters)kp.getPublic();
+
+        byte[][] parts = new byte[][]{ priv.getRho(), priv.getK(), priv.getTr(), priv.getS1(), priv.getS2(), priv.getT0(), priv.getT1(), priv.getSeed() };
+        String[] names = new String[]{ "rho", "K", "tr", "s1", "s2", "t0", "t1", "seed" };
+
+        // correct lengths are accepted, with and without the optional seed and t1
+        new MLDSAPrivateKeyParameters(MLDSAParameters.ml_dsa_44, parts[0], parts[1], parts[2], parts[3], parts[4], parts[5], parts[6], parts[7]);
+        new MLDSAPrivateKeyParameters(MLDSAParameters.ml_dsa_44, parts[0], parts[1], parts[2], parts[3], parts[4], parts[5], null);
+
+        for (int i = 0; i != parts.length; i++)
+        {
+            for (int delta = -1; delta <= 1; delta += 2)
+            {
+                byte[][] bad = new byte[parts.length][];
+                System.arraycopy(parts, 0, bad, 0, parts.length);
+                bad[i] = Arrays.copyOf(parts[i], parts[i].length + delta);
+                try
+                {
+                    new MLDSAPrivateKeyParameters(MLDSAParameters.ml_dsa_44, bad[0], bad[1], bad[2], bad[3], bad[4], bad[5], bad[6], bad[7]);
+                    fail("no exception for " + names[i] + " of length " + bad[i].length);
+                }
+                catch (IllegalArgumentException e)
+                {
+                    assertEquals("'" + names[i] + "' has invalid length", e.getMessage());
+                }
+            }
+        }
+
+        byte[] rho = pub.getRho();
+        byte[] t1 = pub.getT1();
+
+        new MLDSAPublicKeyParameters(MLDSAParameters.ml_dsa_44, rho, t1);
+
+        for (int delta = -1; delta <= 1; delta += 2)
+        {
+            try
+            {
+                new MLDSAPublicKeyParameters(MLDSAParameters.ml_dsa_44, Arrays.copyOf(rho, rho.length + delta), t1);
+                fail("no exception for rho of length " + (rho.length + delta));
+            }
+            catch (IllegalArgumentException e)
+            {
+                assertEquals("'rho' has invalid length", e.getMessage());
+            }
+
+            byte[] badT1 = Arrays.copyOf(t1, t1.length + delta);
+            try
+            {
+                new MLDSAPublicKeyParameters(MLDSAParameters.ml_dsa_44, rho, badT1);
+                fail("no exception for t1 of length " + badT1.length);
+            }
+            catch (IllegalArgumentException e)
+            {
+                assertEquals("'t1' has invalid length", e.getMessage());
+            }
+
+            // SEQUENCE { OCTET STRING rho, OCTET STRING t1 } public key form via PublicKeyFactory
+            SubjectPublicKeyInfo spki = SubjectPublicKeyInfoFactory.createSubjectPublicKeyInfo(pub);
+            SubjectPublicKeyInfo badSpki = new SubjectPublicKeyInfo(spki.getAlgorithm(),
+                new DERSequence(new ASN1Encodable[]{ new DEROctetString(rho), new DEROctetString(badT1) }));
+            try
+            {
+                PublicKeyFactory.createKey(badSpki);
+                fail("no exception for SEQUENCE encoded public key with t1 of length " + badT1.length);
+            }
+            catch (IllegalArgumentException e)
+            {
+                // expected
+            }
+        }
+    }
+
     private interface RejectionOperation
     {
         byte[] processSign(MLDSAPrivateKeyParameters privParams, byte[] msg)

core/src/test/java/org/bouncycastle/pqc/crypto/test/SLHDSATest.java

@@ -579,6 +579,38 @@ public void testBasicKeyGenerationShake256128fSimpleSign()
         assertTrue(Arrays.areEqual(sigGenerated, signature));
     }
 
+    public void testComponentLengthChecks()
+    {
+        byte[] sk = Hex.decode("2F896D61D9CD9038CA303394FADAA22A24AC5EC1D86A989CA2196C3C8632419C1A05A42FE300E87B16AEE116CB2E236358E2C3E62632C9DE03D08A535A0EB7E7");
+        int n = SLHDSAParameters.sha2_128s.getN();
+
+        byte[][] parts = new byte[][]{
+            Arrays.copyOfRange(sk, 0, n), Arrays.copyOfRange(sk, n, 2 * n), Arrays.copyOfRange(sk, 2 * n, 3 * n), Arrays.copyOfRange(sk, 3 * n, 4 * n) };
+        String[] names = new String[]{ "skSeed", "prf", "pkSeed", "pkRoot" };
+
+        SLHDSAPrivateKeyParameters privParams = new SLHDSAPrivateKeyParameters(SLHDSAParameters.sha2_128s, parts[0], parts[1], parts[2], parts[3]);
+        assertTrue(Arrays.areEqual(sk, privParams.getEncoded()));
+
+        for (int i = 0; i != parts.length; i++)
+        {
+            for (int delta = -1; delta <= 1; delta += 2)
+            {
+                byte[][] bad = new byte[parts.length][];
+                System.arraycopy(parts, 0, bad, 0, parts.length);
+                bad[i] = Arrays.copyOf(parts[i], parts[i].length + delta);
+                try
+                {
+                    new SLHDSAPrivateKeyParameters(SLHDSAParameters.sha2_128s, bad[0], bad[1], bad[2], bad[3]);
+                    fail("no exception for " + names[i] + " of length " + bad[i].length);
+                }
+                catch (IllegalArgumentException e)
+                {
+                    assertEquals("'" + names[i] + "' has invalid length", e.getMessage());
+                }
+            }
+        }
+    }
+
     public void testUninitialisedSignerThrowsIllegalStateException()
         throws Exception
     {

docs/releasenotes.md

@@ -62,6 +62,7 @@ Date: 2026, TBD
 - JceKeyAgreeRecipientInfoGenerator created its 1-pass ECMQV ephemeral key pair once per generator rather than once per message, so a generator used for more than one message sent the same ephemeral key in each and derived the same key-encryption key for every recipient each time, withdrawing the ephemeral contribution RFC 5753 sec. 3.2 relies on. The messages were well formed and decrypted correctly. A fresh key pair is now generated for each KeyAgreeRecipientInfo, still shared by all of its recipients.
 - The ML-KEM KeyGenerator (KEMGenerateSpec/KEMExtractSpec), Cipher (wrap/unwrap), javax.crypto.KEM and KeyFactory.translateKey services accepted only BC's own ML-KEM key objects, and the KeyGenerator failed with a ClassCastException at generateKey() rather than at init, so an ML-KEM key from another provider could not be used with BC even though its standard encoding was one BC reads. This broke BCJSSE handshakes over the ML-KEM and hybrid groups whenever another provider ahead of BC decoded the peer's key or generated the ephemeral key pair. A foreign key is now converted from its X.509 or PKCS#8 encoding, with the usual parameter-set checks, and an unusable one is rejected at init (github #2466).
 - The raw JCA provider bounded the PBKDF2 iteration count taken from an encoding (org.bouncycastle.pbe.max_iteration_count, default 10,000,000) but not the counts of the legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families beside it. Their AlgorithmParameters (PKCS12PBE and its OID aliases, PBKDF1) accepted any count, narrowing one beyond the int range with intValue() so that 2^32 arrived as 0, and every Cipher, Mac and SecretKeyFactory derivation ran with whatever count it was given - including a count decoded by another provider's AlgorithmParameters, as when javax.crypto.EncryptedPrivateKeyInfo.getKeySpec() decrypts a PKCS#12 PBE-protected key with BC. As these schemes carry the count in unauthenticated parameters and derive before anything can be checked, a supplied blob could hold a derivation for tens of minutes. The parameter parse now rejects a negative, beyond-int or over-limit count, and the derivations reject a negative or over-limit count, under the same property as PBKDF2. The PKCS#12 key store derives through the same code, so a org.bouncycastle.pkcs12.max_it_count raised above 10,000,000 now needs org.bouncycastle.pbe.max_iteration_count raised with it.
+- The ML-DSA public key constructor taking rho and t1 separately checked only for null, so an ML-DSA SubjectPublicKeyInfo in the SEQUENCE { OCTET STRING rho, OCTET STRING t1 } form with a t1 of the wrong length was accepted by PublicKeyFactory and the JCA KeyFactory, unlike the same key in the standard raw encoding. The component constructors for ML-DSA private keys (rho, K, tr, s1, s2, t0, t1, seed) and SLH-DSA private keys (skSeed, prf, pkSeed, pkRoot) likewise accepted components of any length. All three now reject a component whose length does not match the parameter set with an IllegalArgumentException.
 
 ### 2.1.3 Additional Features and Functionality