CMS: resolve the RFC 9709 key-derivation wrapper in one place per package, reporting an absent or unreadable content-encryption algorithm as the CMSException the callers declare.

Author: dghgit

docs/releasenotes.md

@@ -30,6 +30,7 @@ Date: 2026, TBD
 - Grain-128AEAD returned corrupted plaintext from a decryption driven in chunks. The stream cipher data operator splits a processBytes() call that spans the buffered authentication tag into two output segments, the bytes released from the tag buffer and then the bytes taken straight from the caller's input, and wrote the second segment at the caller's output offset instead of after the first, so the second segment overwrote the head of the first and the tail of the reported output was never written at all. The call still returned the full byte count, and because the engine's state update depends on the input and the keystream rather than on where the output lands, the tag still verified: the wrong plaintext came back with no error raised. Any chunk after the first that carried more than the 8 byte tag length was affected. Grain-128AEAD is the only engine that uses this operator, and one shot decryption, the encryption path and every other AEAD engine were unaffected. The second segment is now written at the advanced offset, matching the equivalent step of the general decryption path (github PR #2447).
 - The AEAD stream cipher data operator, which Grain-128AEAD alone uses, wrote its output without first checking that the caller's buffer was long enough, so a short output buffer surfaced as an ArrayIndexOutOfBoundsException from inside the engine rather than as the OutputLengthException the general path reports for every other AEAD engine. Both directions of processBytes(), and processByte(), now check before anything is written or buffered, and only when the call releases output, as the general path does.
 - The RFC 9709 content-encryption AlgorithmIdentifier, which carries the real algorithm inside the parameters of an outer id-alg-cek-hkdf-sha256, was unwrapped at only one of the points where a CMS recipient makes a decision about it. Key-size validation was corrected for plain key transport in 1.86, but the same call in the KEK, RSA-KTS and KEM recipients, and in the key-transport recipient's own ORI-KEM branch, still compared the recovered key against the outer identifier, which registers no key size, so setKeySizeValidation(true) silently checked nothing there; the setAllowedContentAlgorithms allow-list and the setMinimumTagSize floor were applied to the outer identifier on every recipient family, including the one already corrected, so neither constrained an RFC 9709 message. The unwrap now happens once for the key-size check and once for the two policy checks, and every recipient polices and validates the content-encryption algorithm the message actually carries. A recipient with no allow-list, no tag floor and no key-size validation configured behaves exactly as before; a caller who listed id-alg-cek-hkdf-sha256 in an allow-list in order to admit RFC 9709 messages must now list the content-encryption algorithms themselves (github PR #2446).
+- A CMS message whose EncryptedContentInfo named the RFC 9709 key derivation but carried no readable content-encryption AlgorithmIdentifier in its parameters was reported as a NullPointerException, or as an IllegalArgumentException from the ASN.1 decoder, out of methods declared to throw CMSException, RecipientInformation.getContent() among them. The four places that resolve the wrapper - the CEK derivation, the content cipher selection, the key-size check, and the recipient's allowed-algorithm and tag-size checks - now share one resolver, which reports an absent or unreadable inner algorithm as a CMSException.
 
 ### 2.1.3 Additional Features and Functionality
 

pkix/src/main/java/org/bouncycastle/cms/AbstractRecipient.java

@@ -4,7 +4,6 @@
 import java.util.Set;
 
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
-import org.bouncycastle.asn1.cms.CMSObjectIdentifiers;
 import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
 
 /**
@@ -67,18 +66,9 @@ protected final void checkTagSize(AlgorithmIdentifier contentAlgorithm)
     protected final void checkContentAlgorithm(AlgorithmIdentifier contentAlgorithm)
         throws CMSException
     {
-        AlgorithmIdentifier encAlgId;
-
-        // RFC 9709: the EncryptedContentInfo carries an outer id-alg-cek-hkdf-sha256 wrapping the
-        // real inner content-encryption AlgorithmIdentifier - it is the inner one these checks apply to.
-        if (contentAlgorithm.getAlgorithm().equals(CMSObjectIdentifiers.id_alg_cek_hkdf_sha256))
-        {
-            encAlgId = AlgorithmIdentifier.getInstance(contentAlgorithm.getParameters());
-        }
-        else
-        {
-            encAlgId = contentAlgorithm;
-        }
+        // an RFC 9709 key derivation wraps the real content-encryption algorithm in its parameters,
+        // and it is that one these checks apply to
+        AlgorithmIdentifier encAlgId = CMSUtils.getContentEncryptionAlgorithm(contentAlgorithm);
 
         if (!isContentAlgorithmAllowed(encAlgId.getAlgorithm()))
         {

pkix/src/main/java/org/bouncycastle/cms/CMSUtils.java

@@ -555,6 +555,42 @@ static long getDefiniteLengthAEADOutput(AlgorithmIdentifier encAlgId, long input
      * Return the AEAD tag length carried in AuthEnvelopedData's mac field, or
      * -1 when the algorithm is not recognised.
      */
+    /**
+     * Return the content-encryption algorithm an EncryptedContentInfo actually names, resolving the
+     * RFC 9709 id-alg-cek-hkdf-sha256 wrapper to the AlgorithmIdentifier carried in its parameters.
+     * <p>
+     * org.bouncycastle.cms.jcajce.CMSUtils carries the same method for the JCE side of the package,
+     * which cannot see this one - keep the two in step.
+     *
+     * @param contentAlgorithm the content-encryption AlgorithmIdentifier taken from the message.
+     * @return the algorithm the content is encrypted under.
+     * @throws CMSException if the key derivation carries no readable content-encryption algorithm.
+     */
+    static AlgorithmIdentifier getContentEncryptionAlgorithm(AlgorithmIdentifier contentAlgorithm)
+        throws CMSException
+    {
+        if (!CMSObjectIdentifiers.id_alg_cek_hkdf_sha256.equals(contentAlgorithm.getAlgorithm()))
+        {
+            return contentAlgorithm;
+        }
+
+        ASN1Encodable params = contentAlgorithm.getParameters();
+
+        if (params == null)
+        {
+            throw new CMSException("RFC 9709 key derivation names no content-encryption algorithm");
+        }
+
+        try
+        {
+            return AlgorithmIdentifier.getInstance(params);
+        }
+        catch (IllegalArgumentException e)
+        {
+            throw new CMSException("unable to read RFC 9709 content-encryption algorithm: " + e.getMessage(), e);
+        }
+    }
+
     static int getAEADMacLength(AlgorithmIdentifier encAlgId)
     {
         ASN1ObjectIdentifier algorithm = encAlgId.getAlgorithm();

pkix/src/main/java/org/bouncycastle/cms/jcajce/CMSUtils.java

@@ -20,6 +20,7 @@
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
 import org.bouncycastle.asn1.ASN1OctetString;
 import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.cms.CMSObjectIdentifiers;
 import org.bouncycastle.asn1.cms.IssuerAndSerialNumber;
 import org.bouncycastle.asn1.cryptopro.CryptoProObjectIdentifiers;
 import org.bouncycastle.asn1.iso.ISOIECObjectIdentifiers;
@@ -38,6 +39,42 @@
 
 class CMSUtils
 {
+    /**
+     * Return the content-encryption algorithm an EncryptedContentInfo actually names, resolving the
+     * RFC 9709 id-alg-cek-hkdf-sha256 wrapper to the AlgorithmIdentifier carried in its parameters.
+     * <p>
+     * org.bouncycastle.cms.CMSUtils carries the same method for the lightweight side of the package,
+     * which cannot see this one - keep the two in step.
+     *
+     * @param contentAlgorithm the content-encryption AlgorithmIdentifier taken from the message.
+     * @return the algorithm the content is encrypted under.
+     * @throws CMSException if the key derivation carries no readable content-encryption algorithm.
+     */
+    static AlgorithmIdentifier getContentEncryptionAlgorithm(AlgorithmIdentifier contentAlgorithm)
+        throws CMSException
+    {
+        if (!CMSObjectIdentifiers.id_alg_cek_hkdf_sha256.equals(contentAlgorithm.getAlgorithm()))
+        {
+            return contentAlgorithm;
+        }
+
+        ASN1Encodable params = contentAlgorithm.getParameters();
+
+        if (params == null)
+        {
+            throw new CMSException("RFC 9709 key derivation names no content-encryption algorithm");
+        }
+
+        try
+        {
+            return AlgorithmIdentifier.getInstance(params);
+        }
+        catch (IllegalArgumentException e)
+        {
+            throw new CMSException("unable to read RFC 9709 content-encryption algorithm: " + e.getMessage(), e);
+        }
+    }
+
     private static final Map asymmetricWrapperAlgNames = new HashMap();
 
     private static Map<ASN1ObjectIdentifier,String> wrapAlgNames = new HashMap();

pkix/src/main/java/org/bouncycastle/cms/jcajce/EnvelopedDataHelper.java

@@ -234,7 +234,7 @@ public Key getJceKey(AlgorithmIdentifier algId, GenericKey key)
                 keyData = (byte[])key.getRepresentation();
             }
 
-            AlgorithmIdentifier encAlgId = AlgorithmIdentifier.getInstance(algId.getParameters());
+            AlgorithmIdentifier encAlgId = CMSUtils.getContentEncryptionAlgorithm(algId);
 
             // TODO: at the moment assumes HKDF with SHA256
             HKDFBytesGenerator kdf = new HKDFBytesGenerator(new SHA256Digest());
@@ -260,19 +260,8 @@ public Key getJceKey(AlgorithmIdentifier algId, GenericKey key)
     public void keySizeCheck(AlgorithmIdentifier keyAlgorithm, Key key)
         throws CMSException
     {
-        AlgorithmIdentifier encAlgId;
-
-        // RFC 9709: the EncryptedContentInfo carries an outer id-alg-cek-hkdf-sha256 wrapping the
-        // real inner content-encryption AlgorithmIdentifier - it is the inner one that fixes the
-        // key size the recovered CEK is expected to have.
-        if (keyAlgorithm.getAlgorithm().equals(CMSObjectIdentifiers.id_alg_cek_hkdf_sha256))
-        {
-            encAlgId = AlgorithmIdentifier.getInstance(keyAlgorithm.getParameters());
-        }
-        else
-        {
-            encAlgId = keyAlgorithm;
-        }
+        // an RFC 9709 key derivation wraps the algorithm that fixes the size of the recovered CEK
+        AlgorithmIdentifier encAlgId = CMSUtils.getContentEncryptionAlgorithm(keyAlgorithm);
 
         int expectedKeySize = EnvelopedDataHelper.KEY_SIZE_PROVIDER.getKeySize(encAlgId);
         if (expectedKeySize > 0)
@@ -436,19 +425,10 @@ public Object doInJCE()
                 InvalidKeyException, InvalidParameterSpecException, NoSuchAlgorithmException,
                 NoSuchPaddingException, NoSuchProviderException
             {
-                AlgorithmIdentifier encAlgId;
-                // RFC 9709: the EncryptedContentInfo carries an outer id-alg-cek-hkdf-sha256
-                // wrapping the real inner content-encryption AlgorithmIdentifier. The HKDF
-                // derivation of the CEK happens upstream in getJceKey(AlgorithmIdentifier, ...);
-                // here we only need to unwrap to the inner algId to select the right cipher.
-                if (encryptionAlgID.getAlgorithm().equals(CMSObjectIdentifiers.id_alg_cek_hkdf_sha256))
-                {
-                    encAlgId = AlgorithmIdentifier.getInstance(encryptionAlgID.getParameters());
-                }
-                else
-                {
-                    encAlgId = encryptionAlgID;
-                }
+                // the HKDF derivation of the CEK happens upstream in getJceKey(AlgorithmIdentifier, ...);
+                // here the RFC 9709 wrapper is resolved only to select the right cipher
+                AlgorithmIdentifier encAlgId = CMSUtils.getContentEncryptionAlgorithm(encryptionAlgID);
+
                 Cipher cipher = createCipher(encAlgId.getAlgorithm());
                 ASN1Encodable sParams = encAlgId.getParameters();
                 String encAlg = encAlgId.getAlgorithm().getId();

pkix/src/test/java/org/bouncycastle/cms/test/NewEnvelopedDataTest.java

@@ -2038,6 +2038,81 @@ public void testKeyTransWithHKDFMinimumTagSize()
         }
     }
 
+    public void testHKDFWithMalformedContentEncryptionAlgorithm()
+        throws Exception
+    {
+        byte[] data = "WallaWallaWashington".getBytes();
+
+        SecretKey kek = new SecretKeySpec(new byte[]{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}, "AES");
+        byte[] kekId = new byte[]{1, 2, 3, 4, 5};
+
+        CMSEnvelopedDataGenerator edGen = new CMSEnvelopedDataGenerator();
+
+        edGen.addRecipientInfoGenerator(new JceKEKRecipientInfoGenerator(kekId, kek).setProvider(BC));
+
+        CMSEnvelopedData ed = edGen.generate(
+            new CMSProcessableByteArray(data),
+            new JceCMSContentEncryptorBuilder(CMSAlgorithm.AES128_CBC)
+                .setEnableSha256HKdf(true)
+                .setProvider(BC).build());
+
+        // the key derivation is meant to carry the content-encryption AlgorithmIdentifier in its
+        // parameters, and every path that resolves it reports a message that carries nothing
+        // readable there as the CMSException getContent() declares
+        checkMalformedHKdf(ed, kek, new AlgorithmIdentifier(CMSObjectIdentifiers.id_alg_cek_hkdf_sha256),
+            "RFC 9709 key derivation names no content-encryption algorithm");
+
+        checkMalformedHKdf(ed, kek, new AlgorithmIdentifier(CMSObjectIdentifiers.id_alg_cek_hkdf_sha256, new ASN1Integer(7)),
+            "unable to read RFC 9709 content-encryption algorithm: unknown object in getInstance: org.bouncycastle.asn1.ASN1Integer");
+    }
+
+    private void checkMalformedHKdf(CMSEnvelopedData ed, SecretKey kek, AlgorithmIdentifier contentAlgorithm, String message)
+        throws Exception
+    {
+        EnvelopedData env = EnvelopedData.getInstance(ContentInfo.getInstance(ed.getEncoded()).getContent());
+        EncryptedContentInfo eci = env.getEncryptedContentInfo();
+
+        ContentInfo doctored = new ContentInfo(CMSObjectIdentifiers.envelopedData,
+            new EnvelopedData(env.getOriginatorInfo(), env.getRecipientInfos(),
+                new EncryptedContentInfo(eci.getContentType(), contentAlgorithm, eci.getEncryptedContent()),
+                env.getUnprotectedAttrs()));
+
+        CMSEnvelopedData malformed = new CMSEnvelopedData(doctored.getEncoded(ASN1Encoding.DER));
+
+        RecipientInformation recipient = (RecipientInformation)malformed.getRecipientInfos().getRecipients().iterator().next();
+
+        try
+        {
+            recipient.getContent(new JceKEKEnvelopedRecipient(kek).setProvider(BC));
+            fail("content recovered under an unreadable content-encryption algorithm");
+        }
+        catch (CMSException e)
+        {
+            assertEquals(message, e.getMessage());
+        }
+
+        try
+        {
+            recipient.getContent(new JceKEKEnvelopedRecipient(kek).setKeySizeValidation(true).setProvider(BC));
+            fail("content recovered under an unreadable content-encryption algorithm");
+        }
+        catch (CMSException e)
+        {
+            assertEquals(message, e.getMessage());
+        }
+
+        try
+        {
+            recipient.getContent(new JceKEKEnvelopedRecipient(kek).setProvider(BC)
+                .setAllowedContentAlgorithms(Collections.singleton(CMSAlgorithm.AES128_CBC)));
+            fail("content recovered under an unreadable content-encryption algorithm");
+        }
+        catch (CMSException e)
+        {
+            assertEquals(message, e.getMessage());
+        }
+    }
+
     public void testKeyTransOAEPDefault()
         throws Exception
     {