Repository navigation
JCE: match SunJCE AES Key Wrap default IV and update() behavior - #294
Conversation
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #294
Scan targets checked: wolfcrypt-jni-src, wolfcrypt-jni-bugs
Coverage: 2 of 4 in-scope changed file(s) opened by the reviewer; not opened: src/test/java/com/wolfssl/provider/jce/test/WolfCryptCipherAesWrapTest.java, src/test/java/com/wolfssl/provider/jce/test/WolfCryptUtilTest.java
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
Review tier: Lite
There was a problem hiding this comment.
🟢 Approval recommended
The implementation is consistent with the stated compatibility behavior and includes focused regression coverage.
0 open findings
What changed in this PR
Aligns wolfJCE AES Key Wrap IV and update() behavior with SunJCE across supported Java versions.
Changes:
- Reports the RFC 3394 default IV on Java 17+.
- Makes AES Key Wrap
update()returnnull. - Adds Java-version detection, tests, and documentation.
| File | Description |
|---|---|
WolfCryptCipher.java |
Implements IV reporting and update() behavior. |
WolfCryptUtil.java |
Adds Java major-version detection. |
WolfCryptCipherAesWrapTest.java |
Tests IV, parameters, interoperability, and updates. |
WolfCryptUtilTest.java |
Tests version parsing. |
README_JCE.md |
Documents version-dependent behavior. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…7+, add WolfCryptUtil.getJavaVersion()
6ba4fce to
a3aa98d
Compare
This PR matches SunJCE behavior for AES Key Wrap Ciphers (
AESWrap,AES/KW/*), fixing the OpenJDKNISTWrapKATtest on wolfJCE:getIV()returns the RFC 3394 default IV (A6A6A6A6A6A6A6A6) afterinit(), andgetParameters()returns it before and afterinit(), like SunJCE. Java 8-16 still returnnullunless an IV was set, since older SunJCE rejects all AES Key Wrap parameters.update()returnsnullinstead of an empty array, like SunJCE.WolfCryptUtil.getJavaVersion(), which returns 0 on Android or when the version is unknown.README_JCE.mdand tests, including agetIV()comparison against the running JDK's SunJCE.