Merge branch 'bcpqc-signature-reinit' into 'main'

Discard the message buffered by the AIMer, FAEST, Falcon, HAETAE, MAYO, MQOM,...

See merge request root/bc-java!332

Author: dghgit

docs/releasenotes.md

@@ -94,6 +94,9 @@ Date: 2026, TBD
 
 - ITSExplicitCertificateBuilder chose the certificate's Signature CHOICE from the VerificationKeyIndicator CHOICE rather than from the signing key's curve, so brainpoolP256r1 signatures were labelled as NIST P-256 and rejected by BC's own verifier, brainpoolP384r1 keys could not sign a certificate at all, and a P-256 signature under an implicit issuer was labelled as brainpoolP256r1. The signature type is now taken from the content signer's curve (github PR #2463).
 
+- The Signature implementations for AIMer, FAEST, HAETAE, MAYO, MQOM, QR-UOV, SDitH, SNOVA and SQIsign in the BCPQC provider, and for Falcon in both the BC and BCPQC providers, kept the message bytes passed to update() across a re-initialisation: initSign and initVerify left in place the data buffered for the operation they ended, and sign() or verify() then took it as the start of the next message. A Signature initialised again before completing an operation, or switched between signing and verifying, therefore signed the abandoned bytes followed by the new message, or rejected a valid signature. The buffer is now discarded at the start of every initSign and initVerify, before the key is checked, so a re-initialisation ends the message in progress even when it refuses the key. UOV in the BCPQC provider already discarded the buffer, but only after accepting the new key, so following an initSign or initVerify that refused its key the Signature, still in its previous mode, signed or verified the earlier bytes followed by the new ones; it now discards the buffer at the start as well.
+- The Signature implementations for AIMer, FAEST, HAETAE, MAYO, MQOM, QR-UOV, SDitH, SNOVA and UOV in the BCPQC provider discarded the underlying exception when initVerify refused a public key it could not decode, and those implementations, together with Falcon in the BC and BCPQC providers and SPHINCS-256, did the same when sign() failed, keeping only its text in the InvalidKeyException or SignatureException they threw. The SMAUG-T Cipher in the BCPQC provider did the same when wrap() or unwrap() failed, in the IllegalBlockSizeException, InvalidKeyException or NoSuchAlgorithmException it threw, where the other KEM Ciphers already kept the cause. The original exception is now attached as the cause through the SecurityExceptions factories, so callers can walk getCause(); exception types and message texts are unchanged.
+
 ### 2.1.3 Additional Features and Functionality
 
 - The CRMF certificate request message controls now include the RFC 4211 sec. 6.6 protocolEncrKey control, which names the key a CA is to encrypt its response with: org.bouncycastle.cert.crmf.ProtocolEncrKeyControl carries the SubjectPublicKeyInfo the control is defined to take, and CertificateRequestMessage.getControl() recognises id-regCtrl-protocolEncrKey alongside the regToken, authenticator and pkiArchiveOptions controls it already returned (github PR #2443).

prov/src/main/java/org/bouncycastle/pqc/jcajce/provider/aimer/SignatureSpi.java

@@ -11,6 +11,7 @@
 import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
 import org.bouncycastle.crypto.CipherParameters;
 import org.bouncycastle.crypto.params.ParametersWithRandom;
+import org.bouncycastle.jcajce.provider.util.SecurityExceptions;
 import org.bouncycastle.pqc.crypto.aimer.AIMerParameters;
 import org.bouncycastle.pqc.crypto.aimer.AIMerSigner;
 import org.bouncycastle.util.Strings;
@@ -44,6 +45,8 @@ protected SignatureSpi(AIMerSigner signer, AIMerParameters parameters)
     protected void engineInitVerify(PublicKey publicKey)
         throws InvalidKeyException
     {
+        bOut.reset();
+
         if (!(publicKey instanceof BCAIMerPublicKey))
         {
             try
@@ -52,7 +55,7 @@ protected void engineInitVerify(PublicKey publicKey)
             }
             catch (Exception e)
             {
-                throw new InvalidKeyException("unknown public key passed to AIMer: " + e.getMessage());
+                throw SecurityExceptions.invalidKeyException("unknown public key passed to AIMer: " + e.getMessage(), e);
             }
         }
 
@@ -80,6 +83,8 @@ protected void engineInitSign(PrivateKey privateKey, SecureRandom random)
     protected void engineInitSign(PrivateKey privateKey)
         throws InvalidKeyException
     {
+        bOut.reset();
+
         if (privateKey instanceof BCAIMerPrivateKey)
         {
             BCAIMerPrivateKey key = (BCAIMerPrivateKey)privateKey;
@@ -134,7 +139,7 @@ protected byte[] engineSign()
         }
         catch (Exception e)
         {
-            throw new SignatureException(e.toString());
+            throw SecurityExceptions.signatureException(e.toString(), e);
         }
     }
 

prov/src/main/java/org/bouncycastle/pqc/jcajce/provider/faest/SignatureSpi.java

@@ -11,6 +11,7 @@
 import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
 import org.bouncycastle.crypto.CipherParameters;
 import org.bouncycastle.crypto.params.ParametersWithRandom;
+import org.bouncycastle.jcajce.provider.util.SecurityExceptions;
 import org.bouncycastle.pqc.crypto.faest.FaestParameters;
 import org.bouncycastle.pqc.crypto.faest.FaestSigner;
 import org.bouncycastle.util.Strings;
@@ -44,6 +45,8 @@ protected SignatureSpi(FaestSigner signer, FaestParameters parameters)
     protected void engineInitVerify(PublicKey publicKey)
         throws InvalidKeyException
     {
+        bOut.reset();
+
         if (!(publicKey instanceof BCFaestPublicKey))
         {
             try
@@ -52,7 +55,7 @@ protected void engineInitVerify(PublicKey publicKey)
             }
             catch (Exception e)
             {
-                throw new InvalidKeyException("unknown public key passed to Faest: " + e.getMessage());
+                throw SecurityExceptions.invalidKeyException("unknown public key passed to Faest: " + e.getMessage(), e);
             }
         }
 
@@ -80,6 +83,8 @@ protected void engineInitSign(PrivateKey privateKey, SecureRandom random)
     protected void engineInitSign(PrivateKey privateKey)
         throws InvalidKeyException
     {
+        bOut.reset();
+
         if (privateKey instanceof BCFaestPrivateKey)
         {
             BCFaestPrivateKey key = (BCFaestPrivateKey)privateKey;
@@ -134,7 +139,7 @@ protected byte[] engineSign()
         }
         catch (Exception e)
         {
-            throw new SignatureException(e.toString());
+            throw SecurityExceptions.signatureException(e.toString(), e);
         }
     }
 

prov/src/main/java/org/bouncycastle/pqc/jcajce/provider/falcon/SignatureSpi.java

@@ -48,6 +48,8 @@ protected SignatureSpi(FalconSigner signer, FalconParameters parameters)
     protected void engineInitVerify(PublicKey publicKey)
         throws InvalidKeyException
     {
+        bOut.reset();
+
         if (!(publicKey instanceof BCFalconPublicKey))
         {
             try
@@ -84,6 +86,8 @@ protected void engineInitSign(PrivateKey privateKey, SecureRandom random)
     protected void engineInitSign(PrivateKey privateKey)
         throws InvalidKeyException
     {
+        bOut.reset();
+
         if (privateKey instanceof BCFalconPrivateKey)
         {
             BCFalconPrivateKey key = (BCFalconPrivateKey)privateKey;
@@ -138,7 +142,7 @@ protected byte[] engineSign()
         }
         catch (Exception e)
         {
-            throw new SignatureException(e.toString());
+            throw SecurityExceptions.signatureException(e.toString(), e);
         }
     }
 

prov/src/main/java/org/bouncycastle/pqc/jcajce/provider/haetae/SignatureSpi.java

@@ -11,6 +11,7 @@
 import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
 import org.bouncycastle.crypto.CipherParameters;
 import org.bouncycastle.crypto.params.ParametersWithRandom;
+import org.bouncycastle.jcajce.provider.util.SecurityExceptions;
 import org.bouncycastle.pqc.crypto.haetae.HAETAEParameters;
 import org.bouncycastle.pqc.crypto.haetae.HAETAESigner;
 import org.bouncycastle.util.Strings;
@@ -53,6 +54,8 @@ protected SignatureSpi(HAETAESigner signer, HAETAEParameters parameters)
     protected void engineInitVerify(PublicKey publicKey)
         throws InvalidKeyException
     {
+        bOut.reset();
+
         if (!(publicKey instanceof BCHaetaePublicKey))
         {
             try
@@ -61,7 +64,7 @@ protected void engineInitVerify(PublicKey publicKey)
             }
             catch (Exception e)
             {
-                throw new InvalidKeyException("unknown public key passed to Haetae: " + e.getMessage());
+                throw SecurityExceptions.invalidKeyException("unknown public key passed to Haetae: " + e.getMessage(), e);
             }
         }
 
@@ -89,6 +92,8 @@ protected void engineInitSign(PrivateKey privateKey, SecureRandom random)
     protected void engineInitSign(PrivateKey privateKey)
         throws InvalidKeyException
     {
+        bOut.reset();
+
         if (privateKey instanceof BCHaetaePrivateKey)
         {
             BCHaetaePrivateKey key = (BCHaetaePrivateKey)privateKey;
@@ -143,7 +148,7 @@ protected byte[] engineSign()
         }
         catch (Exception e)
         {
-            throw new SignatureException(e.toString());
+            throw SecurityExceptions.signatureException(e.toString(), e);
         }
     }
 

prov/src/main/java/org/bouncycastle/pqc/jcajce/provider/mayo/SignatureSpi.java

@@ -11,6 +11,7 @@
 import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
 import org.bouncycastle.crypto.CipherParameters;
 import org.bouncycastle.crypto.params.ParametersWithRandom;
+import org.bouncycastle.jcajce.provider.util.SecurityExceptions;
 import org.bouncycastle.pqc.crypto.mayo.MayoParameters;
 import org.bouncycastle.pqc.crypto.mayo.MayoSigner;
 import org.bouncycastle.util.Strings;
@@ -44,6 +45,8 @@ protected SignatureSpi(MayoSigner signer, MayoParameters parameters)
     protected void engineInitVerify(PublicKey publicKey)
         throws InvalidKeyException
     {
+        bOut.reset();
+
         if (!(publicKey instanceof BCMayoPublicKey))
         {
             try
@@ -52,7 +55,7 @@ protected void engineInitVerify(PublicKey publicKey)
             }
             catch (Exception e)
             {
-                throw new InvalidKeyException("unknown public key passed to Mayo: " + e.getMessage());
+                throw SecurityExceptions.invalidKeyException("unknown public key passed to Mayo: " + e.getMessage(), e);
             }
         }
 
@@ -80,6 +83,8 @@ protected void engineInitSign(PrivateKey privateKey, SecureRandom random)
     protected void engineInitSign(PrivateKey privateKey)
         throws InvalidKeyException
     {
+        bOut.reset();
+
         if (privateKey instanceof BCMayoPrivateKey)
         {
             BCMayoPrivateKey key = (BCMayoPrivateKey)privateKey;
@@ -134,7 +139,7 @@ protected byte[] engineSign()
         }
         catch (Exception e)
         {
-            throw new SignatureException(e.toString());
+            throw SecurityExceptions.signatureException(e.toString(), e);
         }
     }
 

prov/src/main/java/org/bouncycastle/pqc/jcajce/provider/mqom/SignatureSpi.java

@@ -11,6 +11,7 @@
 import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
 import org.bouncycastle.crypto.CipherParameters;
 import org.bouncycastle.crypto.params.ParametersWithRandom;
+import org.bouncycastle.jcajce.provider.util.SecurityExceptions;
 import org.bouncycastle.pqc.crypto.mqom.MQOMParameters;
 import org.bouncycastle.pqc.crypto.mqom.MQOMSigner;
 import org.bouncycastle.util.Strings;
@@ -42,6 +43,8 @@ protected SignatureSpi(MQOMSigner signer, MQOMParameters parameters)
     protected void engineInitVerify(PublicKey publicKey)
             throws InvalidKeyException
     {
+        bOut.reset();
+
         if (!(publicKey instanceof BCMQOMPublicKey))
         {
             try
@@ -50,7 +53,7 @@ protected void engineInitVerify(PublicKey publicKey)
             }
             catch (Exception e)
             {
-                throw new InvalidKeyException("unknown public key passed to MQOM: " + e.getMessage());
+                throw SecurityExceptions.invalidKeyException("unknown public key passed to MQOM: " + e.getMessage(), e);
             }
         }
 
@@ -78,6 +81,8 @@ protected void engineInitSign(PrivateKey privateKey, SecureRandom random)
     protected void engineInitSign(PrivateKey privateKey)
             throws InvalidKeyException
     {
+        bOut.reset();
+
         if (privateKey instanceof BCMQOMPrivateKey)
         {
             BCMQOMPrivateKey key = (BCMQOMPrivateKey) privateKey;
@@ -130,7 +135,7 @@ protected byte[] engineSign()
         }
         catch (Exception e)
         {
-            throw new SignatureException(e.toString());
+            throw SecurityExceptions.signatureException(e.toString(), e);
         }
     }
 

prov/src/main/java/org/bouncycastle/pqc/jcajce/provider/qruov/SignatureSpi.java

@@ -11,6 +11,7 @@
 import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
 import org.bouncycastle.crypto.CipherParameters;
 import org.bouncycastle.crypto.params.ParametersWithRandom;
+import org.bouncycastle.jcajce.provider.util.SecurityExceptions;
 import org.bouncycastle.pqc.crypto.qruov.QRUOVParameters;
 import org.bouncycastle.pqc.crypto.qruov.QRUOVSigner;
 import org.bouncycastle.util.Strings;
@@ -49,6 +50,8 @@ private static String canonicalName(QRUOVParameters parameters)
     protected void engineInitVerify(PublicKey publicKey)
         throws InvalidKeyException
     {
+        bOut.reset();
+
         if (!(publicKey instanceof BCQRUOVPublicKey))
         {
             try
@@ -57,7 +60,7 @@ protected void engineInitVerify(PublicKey publicKey)
             }
             catch (Exception e)
             {
-                throw new InvalidKeyException("unknown public key passed to QRUOV: " + e.getMessage());
+                throw SecurityExceptions.invalidKeyException("unknown public key passed to QRUOV: " + e.getMessage(), e);
             }
         }
 
@@ -85,6 +88,8 @@ protected void engineInitSign(PrivateKey privateKey, SecureRandom random)
     protected void engineInitSign(PrivateKey privateKey)
         throws InvalidKeyException
     {
+        bOut.reset();
+
         if (privateKey instanceof BCQRUOVPrivateKey)
         {
             BCQRUOVPrivateKey key = (BCQRUOVPrivateKey)privateKey;
@@ -137,7 +142,7 @@ protected byte[] engineSign()
         }
         catch (Exception e)
         {
-            throw new SignatureException(e.toString());
+            throw SecurityExceptions.signatureException(e.toString(), e);
         }
     }
 

prov/src/main/java/org/bouncycastle/pqc/jcajce/provider/sdith/SignatureSpi.java

@@ -11,6 +11,7 @@
 import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
 import org.bouncycastle.crypto.CipherParameters;
 import org.bouncycastle.crypto.params.ParametersWithRandom;
+import org.bouncycastle.jcajce.provider.util.SecurityExceptions;
 import org.bouncycastle.pqc.crypto.sdith.SDitHParameters;
 import org.bouncycastle.pqc.crypto.sdith.SDitHSigner;
 import org.bouncycastle.util.Strings;
@@ -44,6 +45,8 @@ protected SignatureSpi(SDitHSigner signer, SDitHParameters parameters)
     protected void engineInitVerify(PublicKey publicKey)
         throws InvalidKeyException
     {
+        bOut.reset();
+
         if (!(publicKey instanceof BCSDitHPublicKey))
         {
             try
@@ -52,7 +55,7 @@ protected void engineInitVerify(PublicKey publicKey)
             }
             catch (Exception e)
             {
-                throw new InvalidKeyException("unknown public key passed to SDitH: " + e.getMessage());
+                throw SecurityExceptions.invalidKeyException("unknown public key passed to SDitH: " + e.getMessage(), e);
             }
         }
 
@@ -80,6 +83,8 @@ protected void engineInitSign(PrivateKey privateKey, SecureRandom random)
     protected void engineInitSign(PrivateKey privateKey)
         throws InvalidKeyException
     {
+        bOut.reset();
+
         if (privateKey instanceof BCSDitHPrivateKey)
         {
             BCSDitHPrivateKey key = (BCSDitHPrivateKey) privateKey;
@@ -132,7 +137,7 @@ protected byte[] engineSign()
         }
         catch (Exception e)
         {
-            throw new SignatureException(e.toString());
+            throw SecurityExceptions.signatureException(e.toString(), e);
         }
     }
 

prov/src/main/java/org/bouncycastle/pqc/jcajce/provider/smaugt/SmaugTCipherSpi.java

@@ -25,6 +25,7 @@
 import org.bouncycastle.crypto.Wrapper;
 import org.bouncycastle.crypto.params.KeyParameter;
 import org.bouncycastle.jcajce.provider.asymmetric.util.WrapUtil;
+import org.bouncycastle.jcajce.provider.util.SecurityExceptions;
 import org.bouncycastle.jcajce.spec.KEMParameterSpec;
 import org.bouncycastle.jcajce.spec.KTSParameterSpec;
 import org.bouncycastle.pqc.crypto.smaugt.SmaugTKEMExtractor;
@@ -267,11 +268,11 @@ protected byte[] engineWrap(
         }
         catch (IllegalArgumentException e)
         {
-            throw new IllegalBlockSizeException("unable to generate KTS secret: " + e.getMessage());
+            throw SecurityExceptions.illegalBlockSizeException("unable to generate KTS secret: " + e.getMessage(), e);
         }
         catch (DestroyFailedException e)
         {
-            throw new IllegalBlockSizeException("unable to destroy interim values: " + e.getMessage());
+            throw SecurityExceptions.illegalBlockSizeException("unable to destroy interim values: " + e.getMessage(), e);
         }
     }
 
@@ -309,11 +310,11 @@ protected Key engineUnwrap(
         }
         catch (IllegalArgumentException e)
         {
-            throw new NoSuchAlgorithmException("unable to extract KTS secret: " + e.getMessage());
+            throw SecurityExceptions.noSuchAlgorithmException("unable to extract KTS secret: " + e.getMessage(), e);
         }
         catch (InvalidCipherTextException e)
         {
-            throw new InvalidKeyException("unable to extract KTS secret: " + e.getMessage());
+            throw SecurityExceptions.invalidKeyException("unable to extract KTS secret: " + e.getMessage(), e);
         }
     }