ML-DSA and SLH-DSA KeyFactory.translateKey now convert keys from other providers via their encodings.

Author: dghgit

docs/releasenotes.md

@@ -71,6 +71,7 @@ Date: 2026, TBD
 - The CMS 1-Pass ECMQV key agreement schemes (mqvSinglePass-sha1kdf-scheme and the SHA-2 variants, RFC 5753) gave the X9.63 KDF the raw addedukm as its SharedInfo, or nothing when there was none, where RFC 5753 sec. 3.2.2, 3.2.3 and 7.2 require the DER-encoded ECC-CMS-SharedInfo carrying the addedukm as its entityUInfo, exactly as the ECDH schemes already did. Both JceKeyAgreeRecipientInfoGenerator and JceKeyAgreeRecipient had done this since 1.53, so BC read its own ECMQV messages but a conformant implementation could not, and BC could read a conformant ECMQV message only for the SHA-1 KDF with a NULL-parameter key wrap. Both sides now use ECC-CMS-SharedInfo, for EnvelopedData, AuthenticatedData and AuthEnvelopedData alike. Messages from earlier BC versions are still read, through the raw-ukm retry the recipient already made for ECDH, which the new property org.bouncycastle.cms.allow_legacy_keyagree_kdf (default true) now controls for both schemes; earlier BC versions cannot read ECMQV messages from this one unless the SHA-1 KDF is used with a NULL-parameter key wrap. The recipient's retry chain also now falls through from the RFC 3278 form to the raw-ukm form and reports the original failure, where a failed RFC 3278 retry used to end the attempt with its own exception.
 - JceKeyAgreeRecipientInfoGenerator created its 1-pass ECMQV ephemeral key pair once per generator rather than once per message, so a generator used for more than one message sent the same ephemeral key in each and derived the same key-encryption key for every recipient each time, withdrawing the ephemeral contribution RFC 5753 sec. 3.2 relies on. The messages were well formed and decrypted correctly. A fresh key pair is now generated for each KeyAgreeRecipientInfo, still shared by all of its recipients.
 - The ML-KEM KeyGenerator (KEMGenerateSpec/KEMExtractSpec), Cipher (wrap/unwrap), javax.crypto.KEM and KeyFactory.translateKey services accepted only BC's own ML-KEM key objects, and the KeyGenerator failed with a ClassCastException at generateKey() rather than at init, so an ML-KEM key from another provider could not be used with BC even though its standard encoding was one BC reads. This broke BCJSSE handshakes over the ML-KEM and hybrid groups whenever another provider ahead of BC decoded the peer's key or generated the ephemeral key pair. A foreign key is now converted from its X.509 or PKCS#8 encoding, with the usual parameter-set checks, and an unusable one is rejected at init (github #2466).
+- The ML-DSA and SLH-DSA KeyFactory.translateKey accepted only BC's own key objects and refused any other with "unsupported key type", so a key from another provider - such as the ML-DSA keys of the JDK's SUN provider from Java 24, which report only the family name "ML-DSA" - could not be translated, although its standard encoding is one BC reads. A foreign key is now converted from its X.509 or PKCS#8 encoding, as ML-KEM keys already are; a key for a parameter set the factory does not handle is refused with an InvalidKeyException carrying the decoding failure as its cause.
 - The raw JCA provider bounded the PBKDF2 iteration count taken from an encoding (org.bouncycastle.pbe.max_iteration_count, default 10,000,000) but not the counts of the legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families beside it. Their AlgorithmParameters (PKCS12PBE and its OID aliases, PBKDF1) accepted any count, narrowing one beyond the int range with intValue() so that 2^32 arrived as 0, and every Cipher, Mac and SecretKeyFactory derivation ran with whatever count it was given - including a count decoded by another provider's AlgorithmParameters, as when javax.crypto.EncryptedPrivateKeyInfo.getKeySpec() decrypts a PKCS#12 PBE-protected key with BC. As these schemes carry the count in unauthenticated parameters and derive before anything can be checked, a supplied blob could hold a derivation for tens of minutes. The parameter parse now rejects a negative, beyond-int or over-limit count, and the derivations reject a negative or over-limit count, under the same property as PBKDF2. The PKCS#12 key store derives through the same code, so a org.bouncycastle.pkcs12.max_it_count raised above 10,000,000 now needs org.bouncycastle.pbe.max_iteration_count raised with it.
 - The ML-DSA public key constructor taking rho and t1 separately checked only for null, so an ML-DSA SubjectPublicKeyInfo in the SEQUENCE { OCTET STRING rho, OCTET STRING t1 } form with a t1 of the wrong length was accepted by PublicKeyFactory and the JCA KeyFactory, unlike the same key in the standard raw encoding. The component constructors for ML-DSA private keys (rho, K, tr, s1, s2, t0, t1, seed) and SLH-DSA private keys (skSeed, prf, pkSeed, pkRoot) likewise accepted components of any length. All three now reject a component whose length does not match the parameter set with an IllegalArgumentException.
 - The light-weight CryptoProWrapEngine (RFC 4357 sec. 6.3) diversified the key encryption key in the caller's own array, so after init the KeyParameter it was given held the diversified key, and initialising again with the same parameters - to unwrap what had just been wrapped, say - diversified it a second time and used a different key. It also failed with a NullPointerException when given no S-box, although init has a branch for that case. It now diversifies a copy, and given no S-box uses the GOST 28147 engine's default S-box for the diversification, the one the wrap itself then uses. The provider's GOST 28147 key wrap ciphers were unaffected, as they always supply an S-box and build a new KeyParameter on every init.

prov/src/main/java/org/bouncycastle/jcajce/provider/asymmetric/mldsa/MLDSAKeyFactorySpi.java

@@ -20,6 +20,7 @@
 import org.bouncycastle.crypto.params.MLDSAPrivateKeyParameters;
 import org.bouncycastle.crypto.params.MLDSAPublicKeyParameters;
 import org.bouncycastle.jcajce.provider.asymmetric.util.BasePQCKeyFactorySpi;
+import org.bouncycastle.jcajce.provider.util.SecurityExceptions;
 import org.bouncycastle.jcajce.spec.MLDSAPrivateKeySpec;
 import org.bouncycastle.jcajce.spec.MLDSAPublicKeySpec;
 import org.bouncycastle.util.Arrays;
@@ -117,6 +118,38 @@ public final Key engineTranslateKey(Key key)
             return key;
         }
 
+        // a key from another provider is re-read from its standard encoding
+        try
+        {
+            if (key instanceof PublicKey && "X.509".equals(key.getFormat()))
+            {
+                byte[] enc = key.getEncoded();
+                if (enc != null)
+                {
+                    return engineGeneratePublic(new X509EncodedKeySpec(enc));
+                }
+            }
+            else if (key instanceof PrivateKey && "PKCS#8".equals(key.getFormat()))
+            {
+                byte[] enc = key.getEncoded();
+                if (enc != null)
+                {
+                    try
+                    {
+                        return engineGeneratePrivate(new PKCS8EncodedKeySpec(enc));
+                    }
+                    finally
+                    {
+                        Arrays.clear(enc);
+                    }
+                }
+            }
+        }
+        catch (InvalidKeySpecException e)
+        {
+            throw SecurityExceptions.invalidKeyException("unsupported key type: " + e.getMessage(), e);
+        }
+
         throw new InvalidKeyException("unsupported key type");
     }
 

prov/src/main/java/org/bouncycastle/jcajce/provider/asymmetric/slhdsa/SLHDSAKeyFactorySpi.java

@@ -16,7 +16,9 @@
 import org.bouncycastle.asn1.nist.NISTObjectIdentifiers;
 import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
 import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
+import org.bouncycastle.jcajce.provider.util.SecurityExceptions;
 import org.bouncycastle.pqc.jcajce.provider.util.BaseKeyFactorySpi;
+import org.bouncycastle.util.Arrays;
 
 public class SLHDSAKeyFactorySpi
     extends BaseKeyFactorySpi
@@ -113,6 +115,38 @@ public final Key engineTranslateKey(Key key)
             return key;
         }
 
+        // a key from another provider is re-read from its standard encoding
+        try
+        {
+            if (key instanceof PublicKey && "X.509".equals(key.getFormat()))
+            {
+                byte[] enc = key.getEncoded();
+                if (enc != null)
+                {
+                    return engineGeneratePublic(new X509EncodedKeySpec(enc));
+                }
+            }
+            else if (key instanceof PrivateKey && "PKCS#8".equals(key.getFormat()))
+            {
+                byte[] enc = key.getEncoded();
+                if (enc != null)
+                {
+                    try
+                    {
+                        return engineGeneratePrivate(new PKCS8EncodedKeySpec(enc));
+                    }
+                    finally
+                    {
+                        Arrays.clear(enc);
+                    }
+                }
+            }
+        }
+        catch (InvalidKeySpecException e)
+        {
+            throw SecurityExceptions.invalidKeyException("Unsupported key type: " + e.getMessage(), e);
+        }
+
         throw new InvalidKeyException("Unsupported key type");
     }
 

prov/src/test/java/org/bouncycastle/pqc/jcajce/provider/test/MLDSATest.java

@@ -11,6 +11,7 @@
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.security.PrivateKey;
+import java.security.PublicKey;
 import java.security.SecureRandom;
 import java.security.Security;
 import java.security.Signature;
@@ -93,6 +94,126 @@ public void testParametersAndParamSpecs()
         }
     }
 
+    /**
+     * KeyFactory.translateKey converts ML-DSA keys from another provider via their encodings. The
+     * JDK's own keys report only the family name, "ML-DSA", whatever their parameter set.
+     */
+    public void testTranslateForeignKeys()
+        throws Exception
+    {
+        for (int i = 0; i != names.length; i++)
+        {
+            KeyPair kp = KeyPairGenerator.getInstance(names[i], "BC").generateKeyPair();
+
+            PublicKey fPub = new ForeignPublicKey("ML-DSA", kp.getPublic().getEncoded());
+            PrivateKey fPriv = new ForeignPrivateKey("ML-DSA", kp.getPrivate().getEncoded());
+
+            String[] kfNames = { names[i].indexOf("WITH") > 0 ? "HASH-ML-DSA" : "ML-DSA", names[i] };
+            for (int j = 0; j != kfNames.length; j++)
+            {
+                KeyFactory kf = KeyFactory.getInstance(kfNames[j], "BC");
+                assertEquals(kp.getPublic(), kf.translateKey(fPub));
+                assertEquals(kp.getPrivate(), kf.translateKey(fPriv));
+            }
+        }
+
+        // a parameter set the factory is not for is refused, with the decoding failure as the cause
+        KeyPair kp65 = KeyPairGenerator.getInstance("ML-DSA-65", "BC").generateKeyPair();
+        checkTranslateRefused(KeyFactory.getInstance("ML-DSA-44", "BC"),
+            new ForeignPublicKey("ML-DSA", kp65.getPublic().getEncoded()), true);
+        checkTranslateRefused(KeyFactory.getInstance("ML-DSA-44", "BC"),
+            new ForeignPrivateKey("ML-DSA", kp65.getPrivate().getEncoded()), true);
+
+        // as is a key with no encoding, or not in the standard format
+        checkTranslateRefused(KeyFactory.getInstance("ML-DSA", "BC"), new ForeignPublicKey("ML-DSA", null), false);
+        checkTranslateRefused(KeyFactory.getInstance("ML-DSA", "BC"), new ForeignPrivateKey("ML-DSA", null), false);
+        checkTranslateRefused(KeyFactory.getInstance("ML-DSA", "BC"),
+            new ForeignPublicKey("ML-DSA", "RAW", kp65.getPublic().getEncoded()), false);
+    }
+
+    static void checkTranslateRefused(KeyFactory kf, java.security.Key key, boolean hasCause)
+    {
+        try
+        {
+            kf.translateKey(key);
+            fail("no exception");
+        }
+        catch (InvalidKeyException e)
+        {
+            assertTrue(e.getMessage(), e.getMessage().toLowerCase().startsWith("unsupported key type"));
+            assertEquals(hasCause, e.getCause() instanceof InvalidKeySpecException);
+        }
+    }
+
+    /**
+     * A public key as another provider might present it: only the algorithm family name, X.509 encoding.
+     */
+    static class ForeignPublicKey
+        implements PublicKey
+    {
+        private final String algorithm;
+        private final String format;
+        private final byte[] encoding;
+
+        ForeignPublicKey(String algorithm, byte[] encoding)
+        {
+            this(algorithm, "X.509", encoding);
+        }
+
+        ForeignPublicKey(String algorithm, String format, byte[] encoding)
+        {
+            this.algorithm = algorithm;
+            this.format = format;
+            this.encoding = encoding;
+        }
+
+        public String getAlgorithm()
+        {
+            return algorithm;
+        }
+
+        public String getFormat()
+        {
+            return format;
+        }
+
+        public byte[] getEncoded()
+        {
+            return Arrays.clone(encoding);
+        }
+    }
+
+    /**
+     * A private key as another provider might present it: only the algorithm family name, PKCS#8 encoding.
+     */
+    static class ForeignPrivateKey
+        implements PrivateKey
+    {
+        private final String algorithm;
+        private final byte[] encoding;
+
+        ForeignPrivateKey(String algorithm, byte[] encoding)
+        {
+            this.algorithm = algorithm;
+            this.encoding = encoding;
+        }
+
+        public String getAlgorithm()
+        {
+            return algorithm;
+        }
+
+        public String getFormat()
+        {
+            return "PKCS#8";
+        }
+
+        public byte[] getEncoded()
+        {
+            return Arrays.clone(encoding);
+        }
+    }
+
     public void testKeyFactory()
         throws Exception
     {

prov/src/test/java/org/bouncycastle/pqc/jcajce/provider/test/SLHDSATest.java

@@ -5,6 +5,8 @@
 import java.io.ObjectInputStream;
 import java.io.ObjectOutputStream;
 import java.security.AlgorithmParameters;
+import java.security.PrivateKey;
+import java.security.PublicKey;
 import java.security.KeyFactory;
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
@@ -118,6 +120,41 @@ public void testParametersAndParamSpecs()
         }
     }
 
+    /**
+     * KeyFactory.translateKey converts SLH-DSA keys from another provider via their encodings.
+     */
+    public void testTranslateForeignKeys()
+        throws Exception
+    {
+        String[] kpNames = { "SLH-DSA-SHA2-128F", "SLH-DSA-SHAKE-128F-WITH-SHAKE128" };
+        for (int i = 0; i != kpNames.length; i++)
+        {
+            KeyPair kp = KeyPairGenerator.getInstance(kpNames[i], "BC").generateKeyPair();
+
+            PublicKey fPub = new MLDSATest.ForeignPublicKey("SLH-DSA", kp.getPublic().getEncoded());
+            PrivateKey fPriv = new MLDSATest.ForeignPrivateKey("SLH-DSA", kp.getPrivate().getEncoded());
+
+            String[] kfNames = { i == 0 ? "SLH-DSA" : "HASH-SLH-DSA", kpNames[i] };
+            for (int j = 0; j != kfNames.length; j++)
+            {
+                KeyFactory kf = KeyFactory.getInstance(kfNames[j], "BC");
+                assertEquals(kp.getPublic(), kf.translateKey(fPub));
+                assertEquals(kp.getPrivate(), kf.translateKey(fPriv));
+            }
+        }
+
+        // a parameter set the factory is not for is refused, with the decoding failure as the cause
+        KeyPair kp192 = KeyPairGenerator.getInstance("SLH-DSA-SHA2-192F", "BC").generateKeyPair();
+        MLDSATest.checkTranslateRefused(KeyFactory.getInstance("SLH-DSA-SHA2-128F", "BC"),
+            new MLDSATest.ForeignPublicKey("SLH-DSA", kp192.getPublic().getEncoded()), true);
+        MLDSATest.checkTranslateRefused(KeyFactory.getInstance("SLH-DSA-SHA2-128F", "BC"),
+            new MLDSATest.ForeignPrivateKey("SLH-DSA", kp192.getPrivate().getEncoded()), true);
+
+        // as is a key with no encoding
+        MLDSATest.checkTranslateRefused(KeyFactory.getInstance("SLH-DSA", "BC"),
+            new MLDSATest.ForeignPublicKey("SLH-DSA", null), false);
+    }
+
     public void testKeyFactory()
         throws Exception
     {