ML-KEM KeyGenerator, Cipher, KEM and KeyFactory.translateKey now convert ML-KEM keys from other providers via their encodings, with TLS tests for keys supplied ahead of BC, relates to github #2466.

Author: dghgit

CONTRIBUTORS.md

@@ -552,3 +552,4 @@ We also wish to acknowledge financial and collaborative support from [CISCO](htt
 - sfeng-c \<https://github.com/sfeng-c\> - initial implementation of the CRMF protocolEncrKey control (RFC 4211 sec. 6.6), with round-trip test coverage (PR #2443).
 - Carsten Hammer \<https://github.com/carstenartur\> - deriving the c6 and c7 constants of the generic RFC 9380 sqrt_ratio calculator from a shared z^c3, saving a modular exponentiation per instance, with tests comparing the stored constants against the direct powers (PR #2455).
 - pyj kor \<pyjkor&#064;gmail.com\> - report of the RFC 5990 RSA-KTS CMS recipient deriving to the keyLength declared in the message rather than the length the key-wrapping algorithm of its data encapsulation mechanism fixes, with the crafted message and the reproduction that showed what the declared length was worth.
+- Will Childs-Klein \<https://github.com/WillChilds-Klein\> - initial implementation of ML-KEM key conversion for BCJSSE when another provider supplies the keys, with the diagnosis and reproduction of the resulting handshake failure (PR #2466).

docs/releasenotes.md

@@ -59,6 +59,7 @@ Date: 2026, TBD
 - DSTU7624WrapEngine.unwrap had no bound check on its input and accepted a single block, whose unwrapping is empty, and wrap accepted empty input; unwrap now rejects an input shorter than two blocks or beyond the buffer, and wrap requires at least one block.
 - Cipher.getInstance("DSTU7624/CCM/NoPadding") and the -128/-256/-512 forms generated the generic 12 byte CCM nonce when initialised without parameters, while the OID-registered DSTU 7624 CCM ciphers generate a whole block; the mode-string form now generates a whole-block nonce too.
 - JceKeyAgreeRecipientInfoGenerator created its 1-pass ECMQV ephemeral key pair once per generator rather than once per message, so a generator used for more than one message sent the same ephemeral key in each and derived the same key-encryption key for every recipient each time, withdrawing the ephemeral contribution RFC 5753 sec. 3.2 relies on. The messages were well formed and decrypted correctly. A fresh key pair is now generated for each KeyAgreeRecipientInfo, still shared by all of its recipients.
+- The ML-KEM KeyGenerator (KEMGenerateSpec/KEMExtractSpec), Cipher (wrap/unwrap), javax.crypto.KEM and KeyFactory.translateKey services accepted only BC's own ML-KEM key objects, and the KeyGenerator failed with a ClassCastException at generateKey() rather than at init, so an ML-KEM key from another provider could not be used with BC even though its standard encoding was one BC reads. This broke BCJSSE handshakes over the ML-KEM and hybrid groups whenever another provider ahead of BC decoded the peer's key or generated the ephemeral key pair. A foreign key is now converted from its X.509 or PKCS#8 encoding, with the usual parameter-set checks, and an unusable one is rejected at init (github #2466).
 
 ### 2.1.3 Additional Features and Functionality
 

prov/src/main/java/org/bouncycastle/jcajce/provider/asymmetric/mlkem/MLKEMCipherSpi.java

@@ -153,26 +153,28 @@ protected void engineInit(int opmode, Key key, AlgorithmParameterSpec paramSpec,
 
         if (opmode == Cipher.WRAP_MODE)
         {
-            if (key instanceof BCMLKEMPublicKey)
+            try
             {
-                wrapKey = (BCMLKEMPublicKey)key;
-                kemGen = new MLKEMGenerator(random);
+                wrapKey = Utils.toBCPublicKey(key);
             }
-            else
+            catch (InvalidKeyException e)
             {
-                throw new InvalidKeyException("Only a " + algorithmName + " public key can be used for wrapping");
+                throw SecurityExceptions.invalidKeyException("Only a " + algorithmName + " public key can be used for wrapping", e);
             }
+            kemGen = new MLKEMGenerator(random);
+            key = wrapKey;
         }
         else if (opmode == Cipher.UNWRAP_MODE)
         {
-            if (key instanceof BCMLKEMPrivateKey)
+            try
             {
-                unwrapKey = (BCMLKEMPrivateKey)key;
+                unwrapKey = Utils.toBCPrivateKey(key);
             }
-            else
+            catch (InvalidKeyException e)
             {
-                throw new InvalidKeyException("Only a " + algorithmName + " private key can be used for unwrapping");
+                throw SecurityExceptions.invalidKeyException("Only a " + algorithmName + " private key can be used for unwrapping", e);
             }
+            key = unwrapKey;
         }
         else
         {

prov/src/main/java/org/bouncycastle/jcajce/provider/asymmetric/mlkem/MLKEMKeyFactorySpi.java

@@ -20,6 +20,7 @@
 import org.bouncycastle.crypto.params.MLKEMPrivateKeyParameters;
 import org.bouncycastle.crypto.params.MLKEMPublicKeyParameters;
 import org.bouncycastle.jcajce.provider.asymmetric.util.BasePQCKeyFactorySpi;
+import org.bouncycastle.jcajce.provider.util.SecurityExceptions;
 import org.bouncycastle.jcajce.spec.MLKEMPrivateKeySpec;
 import org.bouncycastle.jcajce.spec.MLKEMPublicKeySpec;
 import org.bouncycastle.util.Arrays;
@@ -102,6 +103,38 @@ public final Key engineTranslateKey(Key key)
             return key;
         }
 
+        // a key from another provider is re-read from its standard encoding
+        try
+        {
+            if (key instanceof PublicKey && "X.509".equals(key.getFormat()))
+            {
+                byte[] enc = key.getEncoded();
+                if (enc != null)
+                {
+                    return engineGeneratePublic(new X509EncodedKeySpec(enc));
+                }
+            }
+            else if (key instanceof PrivateKey && "PKCS#8".equals(key.getFormat()))
+            {
+                byte[] enc = key.getEncoded();
+                if (enc != null)
+                {
+                    try
+                    {
+                        return engineGeneratePrivate(new PKCS8EncodedKeySpec(enc));
+                    }
+                    finally
+                    {
+                        Arrays.clear(enc);
+                    }
+                }
+            }
+        }
+        catch (InvalidKeySpecException e)
+        {
+            throw SecurityExceptions.invalidKeyException("unsupported key type: " + e.getMessage(), e);
+        }
+
         throw new InvalidKeyException("unsupported key type");
     }
 

prov/src/main/java/org/bouncycastle/jcajce/provider/asymmetric/mlkem/MLKEMKeyGeneratorSpi.java

@@ -1,6 +1,7 @@
 package org.bouncycastle.jcajce.provider.asymmetric.mlkem;
 
 import java.security.InvalidAlgorithmParameterException;
+import java.security.InvalidKeyException;
 import java.security.SecureRandom;
 import java.security.spec.AlgorithmParameterSpec;
 
@@ -15,6 +16,7 @@
 import org.bouncycastle.crypto.params.MLKEMParameters;
 import org.bouncycastle.jcajce.SecretKeyWithEncapsulation;
 import org.bouncycastle.jcajce.provider.asymmetric.util.KdfUtil;
+import org.bouncycastle.jcajce.provider.util.SecurityExceptions;
 import org.bouncycastle.jcajce.spec.KEMExtractSpec;
 import org.bouncycastle.jcajce.spec.KEMGenerateSpec;
 import org.bouncycastle.jcajce.spec.MLKEMParameterSpec;
@@ -28,6 +30,8 @@ public class MLKEMKeyGeneratorSpi
     private KEMGenerateSpec genSpec;
     private SecureRandom random;
     private KEMExtractSpec extSpec;
+    private BCMLKEMPublicKey pubKey;
+    private BCMLKEMPrivateKey privKey;
 
     public MLKEMKeyGeneratorSpi()
     {
@@ -50,29 +54,53 @@ protected void engineInit(AlgorithmParameterSpec algorithmParameterSpec, SecureR
         this.random = secureRandom;
         if (algorithmParameterSpec instanceof KEMGenerateSpec)
         {
-            this.genSpec = (KEMGenerateSpec)algorithmParameterSpec;
-            this.extSpec = null;
+            KEMGenerateSpec spec = (KEMGenerateSpec)algorithmParameterSpec;
+            BCMLKEMPublicKey key;
+            try
+            {
+                key = Utils.toBCPublicKey(spec.getPublicKey());
+            }
+            catch (InvalidKeyException e)
+            {
+                throw SecurityExceptions.invalidAlgorithmParameterException(e.getMessage(), e);
+            }
             if (mlkemParameters != null)
             {
                 String canonicalAlgName = MLKEMParameterSpec.fromName(mlkemParameters.getName()).getName();
-                if (!canonicalAlgName.equals(genSpec.getPublicKey().getAlgorithm()))
+                if (!canonicalAlgName.equals(key.getAlgorithm()))
                 {
                     throw new InvalidAlgorithmParameterException("key generator locked to " + canonicalAlgName);
                 }
             }
+            this.genSpec = spec;
+            this.pubKey = key;
+            this.extSpec = null;
+            this.privKey = null;
         }
         else if (algorithmParameterSpec instanceof KEMExtractSpec)
         {
-            this.genSpec = null;
-            this.extSpec = (KEMExtractSpec)algorithmParameterSpec;
+            KEMExtractSpec spec = (KEMExtractSpec)algorithmParameterSpec;
+            BCMLKEMPrivateKey key;
+            try
+            {
+                key = Utils.toBCPrivateKey(spec.getPrivateKey());
+            }
+            catch (InvalidKeyException e)
+            {
+                throw SecurityExceptions.invalidAlgorithmParameterException(e.getMessage(), e);
+            }
             if (mlkemParameters != null)
             {
                 String canonicalAlgName = MLKEMParameterSpec.fromName(mlkemParameters.getName()).getName();
-                if (!canonicalAlgName.equals(extSpec.getPrivateKey().getAlgorithm()))
+                if (!canonicalAlgName.equals(key.getAlgorithm()))
                 {
                     throw new InvalidAlgorithmParameterException("key generator locked to " + canonicalAlgName);
                 }
             }
+            this.genSpec = null;
+            this.pubKey = null;
+            this.extSpec = spec;
+            this.privKey = key;
         }
         else
         {
@@ -89,7 +117,6 @@ protected SecretKey engineGenerateKey()
     {
         if (genSpec != null)
         {
-            BCMLKEMPublicKey pubKey = (BCMLKEMPublicKey)genSpec.getPublicKey();
             MLKEMGenerator kemGen = new MLKEMGenerator(random);
 
             SecretWithEncapsulation secEnc = kemGen.generateEncapsulated(pubKey.getKeyParams());
@@ -117,7 +144,6 @@ protected SecretKey engineGenerateKey()
         }
         else
         {
-            BCMLKEMPrivateKey privKey = (BCMLKEMPrivateKey)extSpec.getPrivateKey();
             MLKEMExtractor kemExt = new MLKEMExtractor(privKey.getKeyParams());
 
             byte[] encapsulation = extSpec.getEncapsulation();

prov/src/main/java/org/bouncycastle/jcajce/provider/asymmetric/mlkem/Utils.java

@@ -1,5 +1,7 @@
 package org.bouncycastle.jcajce.provider.asymmetric.mlkem;
 
+import java.security.InvalidKeyException;
+import java.security.Key;
 import java.util.HashMap;
 import java.util.Map;
 
@@ -10,6 +12,8 @@ class Utils
 {
     private static Map parameters = new HashMap();
 
+    private static final MLKEMKeyFactorySpi keyFactory = new MLKEMKeyFactorySpi();
+
     static
     {
         parameters.put(MLKEMParameterSpec.ml_kem_512.getName(), MLKEMParameters.ml_kem_512);
@@ -21,4 +25,52 @@ static MLKEMParameters getParameters(String name)
     {
         return (MLKEMParameters)parameters.get(name);
     }
+
+    /**
+     * Return the BC form of an ML-KEM public key, converting a key from another provider via its X.509 encoding.
+     *
+     * @param key the key to convert.
+     * @return a BCMLKEMPublicKey for the same key.
+     * @throws InvalidKeyException if key is not an ML-KEM public key.
+     */
+    static BCMLKEMPublicKey toBCPublicKey(Key key)
+        throws InvalidKeyException
+    {
+        if (key instanceof BCMLKEMPublicKey)
+        {
+            return (BCMLKEMPublicKey)key;
+        }
+
+        Key bcKey = keyFactory.engineTranslateKey(key);
+        if (!(bcKey instanceof BCMLKEMPublicKey))
+        {
+            throw new InvalidKeyException("unsupported key type");
+        }
+
+        return (BCMLKEMPublicKey)bcKey;
+    }
+
+    /**
+     * Return the BC form of an ML-KEM private key, converting a key from another provider via its PKCS#8 encoding.
+     *
+     * @param key the key to convert.
+     * @return a BCMLKEMPrivateKey for the same key.
+     * @throws InvalidKeyException if key is not an extractable ML-KEM private key.
+     */
+    static BCMLKEMPrivateKey toBCPrivateKey(Key key)
+        throws InvalidKeyException
+    {
+        if (key instanceof BCMLKEMPrivateKey)
+        {
+            return (BCMLKEMPrivateKey)key;
+        }
+
+        Key bcKey = keyFactory.engineTranslateKey(key);
+        if (!(bcKey instanceof BCMLKEMPrivateKey))
+        {
+            throw new InvalidKeyException("unsupported key type");
+        }
+
+        return (BCMLKEMPrivateKey)bcKey;
+    }
 }

prov/src/main/jdk17/org/bouncycastle/jcajce/provider/asymmetric/mlkem/MLKEMSpi.java

@@ -28,10 +28,7 @@ public abstract class MLKEMSpi
     public EncapsulatorSpi engineNewEncapsulator(PublicKey publicKey, AlgorithmParameterSpec spec,
         SecureRandom secureRandom) throws InvalidAlgorithmParameterException, InvalidKeyException
     {
-        if (!(publicKey instanceof BCMLKEMPublicKey bcPublicKey))
-        {
-            throw new InvalidKeyException("unsupported key type");
-        }
+        BCMLKEMPublicKey bcPublicKey = Utils.toBCPublicKey(publicKey);
 
         checkKeyParameters(bcPublicKey.getKeyParams());
 
@@ -44,10 +41,7 @@ public EncapsulatorSpi engineNewEncapsulator(PublicKey publicKey, AlgorithmParam
     public DecapsulatorSpi engineNewDecapsulator(PrivateKey privateKey, AlgorithmParameterSpec spec)
         throws InvalidAlgorithmParameterException, InvalidKeyException
     {
-        if (!(privateKey instanceof BCMLKEMPrivateKey bcPrivateKey))
-        {
-            throw new InvalidKeyException("unsupported key type");
-        }
+        BCMLKEMPrivateKey bcPrivateKey = Utils.toBCPrivateKey(privateKey);
 
         checkKeyParameters(bcPrivateKey.getKeyParams());