Skip to content

JCE: match SunJCE AES Key Wrap default IV and update() behavior - #294

Merged
rlm2002 merged 1 commit into
wolfSSL:masterfrom
cconlon:kwDefaultIvJava17
Oct 13, 2026
Merged

rlm2002 merged 1 commit into
wolfSSL:masterfrom
cconlon:kwDefaultIvJava17

Conversation

@cconlon

@cconlon cconlon commented Oct 8, 2026

Copy link
Copy Markdown
Member

This PR matches SunJCE behavior for AES Key Wrap Ciphers (AESWrap, AES/KW/*), fixing the OpenJDK NISTWrapKAT test on wolfJCE:

  • On Java 17+, getIV() returns the RFC 3394 default IV (A6A6A6A6A6A6A6A6) after init(), and getParameters() returns it before and after init(), like SunJCE. Java 8-16 still return null unless an IV was set, since older SunJCE rejects all AES Key Wrap parameters.
  • update() returns null instead of an empty array, like SunJCE.
  • Adds WolfCryptUtil.getJavaVersion(), which returns 0 on Android or when the version is unknown.
  • Updates README_JCE.md and tests, including a getIV() comparison against the running JDK's SunJCE.

@cconlon cconlon self-assigned this Oct 8, 2026
@cconlon
cconlon requested review from wolfSSL-Fenrir-bot and a balanced review from Copilot October 8, 2026 21:38

@wolfSSL-Fenrir-bot wolfSSL-Fenrir-bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fenrir Automated Review — PR #294

Scan targets checked: wolfcrypt-jni-src, wolfcrypt-jni-bugs
Coverage: 2 of 4 in-scope changed file(s) opened by the reviewer; not opened: src/test/java/com/wolfssl/provider/jce/test/WolfCryptCipherAesWrapTest.java, src/test/java/com/wolfssl/provider/jce/test/WolfCryptUtilTest.java

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The implementation is consistent with the stated compatibility behavior and includes focused regression coverage.

0 open findings

What changed in this PR

Aligns wolfJCE AES Key Wrap IV and update() behavior with SunJCE across supported Java versions.

Changes:

  • Reports the RFC 3394 default IV on Java 17+.
  • Makes AES Key Wrap update() return null.
  • Adds Java-version detection, tests, and documentation.
File Description
WolfCryptCipher.java Implements IV reporting and update() behavior.
WolfCryptUtil.java Adds Java major-version detection.
WolfCryptCipherAesWrapTest.java Tests IV, parameters, interoperability, and updates.
WolfCryptUtilTest.java Tests version parsing.
README_JCE.md Documents version-dependent behavior.

🧠 Review effort: Balanced


💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@cconlon
cconlon force-pushed the kwDefaultIvJava17 branch from 6ba4fce to a3aa98d Compare October 8, 2026 23:04
@cconlon cconlon assigned rlm2002 and unassigned cconlon Oct 9, 2026
@rlm2002
rlm2002 merged commit 64d4d29 into wolfSSL:master Oct 13, 2026
189 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants