The jdk1.4 and jdk1.3 providers no longer register the AES256 PKCS12 KeyStore variants, which their PKCS12KeyStoreSpi does not implement.

Author: dghgit

docs/releasenotes.md

@@ -72,6 +72,8 @@ Date: 2026, TBD
 
 - With org.bouncycastle.emulate.oracle set, the X25519 and X448 KeyAgreements took the name they report under it, XDH, for the algorithm itself: the unified agreements (X25519UwithSHA256KDF, X448UwithSHA512KDF and their CKDF forms) refused a DHUParameterSpec and ran as plain static agreements without one, and the curve specific agreements accepted a key on the other curve. The property now affects only the name used in exception messages.
 
+- The jdk1.4 and jdk1.3 providers registered the PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM, PKCS12-DEF-AES256-AES128 and PKCS12-DEF-AES256-AES128-GCM KeyStores against classes those distributions do not contain. They are no longer registered there; the legacy PKCS12 stores can still read PBES2/AES protected files.
+
 ### 2.1.3 Additional Features and Functionality
 
 - The CRMF certificate request message controls now include the RFC 4211 sec. 6.6 protocolEncrKey control, which names the key a CA is to encrypt its response with: org.bouncycastle.cert.crmf.ProtocolEncrKeyControl carries the SubjectPublicKeyInfo the control is defined to take, and CertificateRequestMessage.getControl() recognises id-regCtrl-protocolEncrKey alongside the regToken, authenticator and pkiArchiveOptions controls it already returned (github PR #2443).

prov/src/main/jdk1.4/org/bouncycastle/jcajce/provider/keystore/PKCS12.java

@@ -0,0 +1,52 @@
+package org.bouncycastle.jcajce.provider.keystore;
+
+import org.bouncycastle.jcajce.provider.config.ConfigurableProvider;
+import org.bouncycastle.jcajce.provider.util.AsymmetricAlgorithmProvider;
+import org.bouncycastle.util.Properties;
+
+/**
+ * NOTE: this overlay exists because the jdk1.4 (and, by layering, jdk1.3) PKCS12KeyStoreSpi
+ * overlays do not implement the AES256 store variants, so the PKCS12-AES256-AES128(-GCM) and
+ * PKCS12-DEF-AES256-AES128(-GCM) registrations of the base class are left out here - they would
+ * name classes that do not exist. The legacy stores can still read PBES2/AES protected files.
+ * Keep everything else in step with the base PKCS12.java.
+ */
+public class PKCS12
+{
+    private static final String PREFIX = "org.bouncycastle.jcajce.provider.keystore" + ".pkcs12.";
+
+    public static class Mappings
+        extends AsymmetricAlgorithmProvider
+    {
+        public Mappings()
+        {
+        }
+
+        public void configure(ConfigurableProvider provider)
+        {
+            String defType = Properties.getPropertyValue("org.bouncycastle.pkcs12.default");
+
+            if (defType != null)
+            {
+                provider.addAlgorithm("Alg.Alias.KeyStore.PKCS12", defType);
+                provider.addAlgorithm("Alg.Alias.KeyStore.BCPKCS12", defType);
+                provider.addAlgorithm("Alg.Alias.KeyStore.PKCS12-DEF", defType.substring(0, 5) + "-DEF" + defType.substring(6));
+            }
+            else
+            {
+                provider.addAlgorithm("KeyStore.PKCS12", PREFIX + "PKCS12KeyStoreSpi$BCPKCS12KeyStore");
+                provider.addAlgorithm("KeyStore.BCPKCS12", PREFIX + "PKCS12KeyStoreSpi$BCPKCS12KeyStore");
+                provider.addAlgorithm("KeyStore.PKCS12-DEF", PREFIX + "PKCS12KeyStoreSpi$DefPKCS12KeyStore");
+            }
+
+            provider.addAlgorithm("KeyStore.PKCS12-3DES-40RC2", PREFIX + "PKCS12KeyStoreSpi$BCPKCS12KeyStore");
+            provider.addAlgorithm("KeyStore.PKCS12-3DES-3DES", PREFIX + "PKCS12KeyStoreSpi$BCPKCS12KeyStore3DES");
+
+            provider.addAlgorithm("KeyStore.PKCS12-DEF-3DES-40RC2", PREFIX + "PKCS12KeyStoreSpi$DefPKCS12KeyStore");
+            provider.addAlgorithm("KeyStore.PKCS12-DEF-3DES-3DES", PREFIX + "PKCS12KeyStoreSpi$DefPKCS12KeyStore3DES");
+
+            provider.addAlgorithm("KeyStore.PKCS12-PBMAC1", PREFIX + "PKCS12PBMAC1KeyStoreSpi$BCPKCS12KeyStore");
+
+        }
+    }
+}