The KTS key-wrapping Ciphers now validate a KTSParameterSpec's key derivation function when they take it, so a KDF the provider cannot service is reported as the InvalidAlgorithmParameterException engineInit declares rather than an unchecked exception out of wrap or unwrap.

Author: dghgit

docs/releasenotes.md

@@ -17,6 +17,7 @@ Date: 2026, TBD
 
 - A KeyAgreement asked for its shared secret before doPhase returned data rather than refusing. javax.crypto.KeyAgreement specifies IllegalStateException for that state, but nothing in the provider tracked it, so each SPI handed back whatever its result field held: for Diffie-Hellman that was the private value itself - engineInit seeded result with x, so generateSecret() returned the private exponent padded to the prime's length and generateSecret("AES") an all-zero key taken from that padding - while ECDH returned null and its named-algorithm overload raised NullPointerException. BaseAgreementSpi now records whether a doPhase has completed the agreement since the last init and refuses the request with an IllegalStateException naming the algorithm, so every family in the provider - DH, ECDH and ECMQV, the SM2 exchange, both ECGOST families, XDH, SM9 and NewHope - answers the same way, and the DH SPI no longer holds the private value in that field at all.
 - Mac.getInstance and KeyGenerator.getInstance by the HMAC SHA-512/224 and SHA-512/256 object identifiers (1.2.840.113549.2.12 and .13) failed, although the same algorithms resolved by name and the matching SecretKeyFactory aliases were registered: the SHA512 mappings called addHMACAlgorithm for the two truncated variants without the addHMACAlias that registers their OIDs against Mac and KeyGenerator. Both are now aliased, as every other HMAC in that class already was.
+- A KTSParameterSpec naming an HKDF key-derivation function with a parameters field - a form the provider does not service - was accepted at Cipher init and then failed out of wrap or unwrap with an unchecked IllegalStateException neither method declares. The KTS key-wrapping Ciphers (ML-KEM, Classic McEliece, FrodoKEM, the composite KEM and RSA-KEM) now validate the spec's KDF when they take it, reporting an unserviceable one as the InvalidAlgorithmParameterException engineInit declares, which is what the javax.crypto.KEM services already did through KdfUtil.resolveKemSpec.
 
 ### 2.1.3 Additional Features and Functionality
 

prov/src/main/java/org/bouncycastle/jcajce/provider/asymmetric/cmce/CMCECipherSpi.java

@@ -28,6 +28,7 @@
 import org.bouncycastle.jcajce.provider.asymmetric.util.WrapUtil;
 import org.bouncycastle.jcajce.provider.util.SecurityExceptions;
 import org.bouncycastle.jcajce.spec.CMCEParameterSpec;
+import org.bouncycastle.jcajce.provider.asymmetric.util.KdfUtil;
 import org.bouncycastle.jcajce.spec.KTSParameterSpec;
 import org.bouncycastle.util.Arrays;
 import org.bouncycastle.util.Exceptions;
@@ -136,6 +137,8 @@ protected void engineInit(int opmode, Key key, AlgorithmParameterSpec paramSpec,
             }
 
             kemParameterSpec = (KTSParameterSpec)paramSpec;
+
+            KdfUtil.checkKdfSupported(kemParameterSpec);
         }
 
         if (opmode == Cipher.WRAP_MODE)

prov/src/main/java/org/bouncycastle/jcajce/provider/asymmetric/compositekem/CompositeKEMCipherSpi.java

@@ -27,6 +27,7 @@
 import org.bouncycastle.jcajce.CompositePublicKey;
 import org.bouncycastle.jcajce.provider.asymmetric.util.WrapUtil;
 import org.bouncycastle.jcajce.provider.util.SecurityExceptions;
+import org.bouncycastle.jcajce.provider.asymmetric.util.KdfUtil;
 import org.bouncycastle.jcajce.spec.KTSParameterSpec;
 import org.bouncycastle.util.Arrays;
 import org.bouncycastle.util.Exceptions;
@@ -116,6 +117,8 @@ protected void engineInit(int opmode, Key key, AlgorithmParameterSpec paramSpec,
             }
 
             kemParameterSpec = (KTSParameterSpec)paramSpec;
+
+            KdfUtil.checkKdfSupported(kemParameterSpec);
         }
 
         if (opmode == Cipher.WRAP_MODE)

prov/src/main/java/org/bouncycastle/jcajce/provider/asymmetric/frodokem/FrodoKEMCipherSpi.java

@@ -28,6 +28,7 @@
 import org.bouncycastle.jcajce.provider.asymmetric.util.WrapUtil;
 import org.bouncycastle.jcajce.provider.util.SecurityExceptions;
 import org.bouncycastle.jcajce.spec.FrodoKEMParameterSpec;
+import org.bouncycastle.jcajce.provider.asymmetric.util.KdfUtil;
 import org.bouncycastle.jcajce.spec.KTSParameterSpec;
 import org.bouncycastle.util.Arrays;
 import org.bouncycastle.util.Exceptions;
@@ -136,6 +137,8 @@ protected void engineInit(int opmode, Key key, AlgorithmParameterSpec paramSpec,
             }
 
             kemParameterSpec = (KTSParameterSpec)paramSpec;
+
+            KdfUtil.checkKdfSupported(kemParameterSpec);
         }
 
         if (opmode == Cipher.WRAP_MODE)

prov/src/main/java/org/bouncycastle/jcajce/provider/asymmetric/mlkem/MLKEMCipherSpi.java

@@ -27,6 +27,7 @@
 import org.bouncycastle.crypto.params.MLKEMParameters;
 import org.bouncycastle.jcajce.provider.asymmetric.util.WrapUtil;
 import org.bouncycastle.jcajce.provider.util.SecurityExceptions;
+import org.bouncycastle.jcajce.provider.asymmetric.util.KdfUtil;
 import org.bouncycastle.jcajce.spec.KTSParameterSpec;
 import org.bouncycastle.jcajce.spec.MLKEMParameterSpec;
 import org.bouncycastle.util.Arrays;
@@ -146,6 +147,8 @@ protected void engineInit(int opmode, Key key, AlgorithmParameterSpec paramSpec,
             }
 
             kemParameterSpec = (KTSParameterSpec)paramSpec;
+
+            KdfUtil.checkKdfSupported(kemParameterSpec);
         }
 
         if (opmode == Cipher.WRAP_MODE)

prov/src/main/java/org/bouncycastle/jcajce/provider/asymmetric/rsa/RSAKEMCipherSpi.java

@@ -29,6 +29,7 @@
 import org.bouncycastle.crypto.params.ParametersWithRandom;
 import org.bouncycastle.jcajce.provider.asymmetric.util.WrapUtil;
 import org.bouncycastle.jcajce.provider.util.SecurityExceptions;
+import org.bouncycastle.jcajce.provider.asymmetric.util.KdfUtil;
 import org.bouncycastle.jcajce.spec.KTSParameterSpec;
 import org.bouncycastle.util.Arrays;
 import org.bouncycastle.util.BigIntegers;
@@ -139,6 +140,8 @@ protected void engineInit(int opmode, Key key, AlgorithmParameterSpec paramSpec,
 
         this.ktsSpec = (KTSParameterSpec)paramSpec;
 
+        KdfUtil.checkKdfSupported(this.ktsSpec);
+
         if (opmode == Cipher.WRAP_MODE)
         {
             if (!(key instanceof RSAPublicKey))

prov/src/main/java/org/bouncycastle/jcajce/provider/asymmetric/util/KdfUtil.java

@@ -223,6 +223,26 @@ public static String resolveAlgorithm(KTSParameterSpec parameterSpec, String alg
     /**
      * Return true if makeKeyBytes can service the passed in KDF algorithm identifier.
      */
+    /**
+     * Refuse a KDF this provider cannot service, at the point the spec is accepted rather than at
+     * wrap or unwrap, where it would surface as an unchecked exception those methods do not declare.
+     * The KEM services reach the same check through {@link #resolveKemSpec}; this is for the KTS
+     * key-wrapping Ciphers, which take their spec at init.
+     *
+     * @param ktsSpec the caller-supplied spec; a null KDF algorithm means no KDF and is accepted.
+     * @throws InvalidAlgorithmParameterException if the spec names a KDF that cannot be serviced.
+     */
+    public static void checkKdfSupported(KTSParameterSpec ktsSpec)
+        throws InvalidAlgorithmParameterException
+    {
+        AlgorithmIdentifier kdfAlgorithm = ktsSpec.getKdfAlgorithm();
+
+        if (kdfAlgorithm != null && !isSupportedKdf(kdfAlgorithm))
+        {
+            throw new InvalidAlgorithmParameterException("unsupported KDF: " + kdfAlgorithm.getAlgorithm());
+        }
+    }
+
     private static boolean isSupportedKdf(AlgorithmIdentifier kdfAlgorithm)
     {
         ASN1ObjectIdentifier kdfOid = kdfAlgorithm.getAlgorithm();
@@ -360,7 +380,7 @@ else if (PKCSObjectIdentifiers.id_alg_hkdf_with_sha256.equals(kdfAlgorithm.getAl
             }
             else
             {
-                throw new IllegalStateException("HDKF parameter support not added");
+                throw new IllegalStateException("HKDF parameter support not added");
             }
         }
         else if (PKCSObjectIdentifiers.id_alg_hkdf_with_sha384.equals(kdfAlgorithm.getAlgorithm()))
@@ -375,7 +395,7 @@ else if (PKCSObjectIdentifiers.id_alg_hkdf_with_sha384.equals(kdfAlgorithm.getAl
             }
             else
             {
-                throw new IllegalStateException("HDKF parameter support not added");
+                throw new IllegalStateException("HKDF parameter support not added");
             }
         }
         else if (PKCSObjectIdentifiers.id_alg_hkdf_with_sha512.equals(kdfAlgorithm.getAlgorithm()))
@@ -390,7 +410,7 @@ else if (PKCSObjectIdentifiers.id_alg_hkdf_with_sha512.equals(kdfAlgorithm.getAl
             }
             else
             {
-                throw new IllegalStateException("HDKF parameter support not added");
+                throw new IllegalStateException("HKDF parameter support not added");
             }
         }
         else if (NISTObjectIdentifiers.id_Kmac128.equals(kdfAlgorithm.getAlgorithm()))