BCFKS isKeyEntry() now reports PBE key entries, so KeyStore.getEntry() returns them, relates to github #2164.

Author: dghgit

docs/releasenotes.md

@@ -15,6 +15,7 @@ Date: 2026, TBD
 
 ### 2.1.2 Defects Fixed
 
+- A PBEKey stored in a BCFKS KeyStore was not reported as a key entry: isKeyEntry() returned false for it, so KeyStore.getEntry() returned null rather than a SecretKeyEntry, although getKey() recovered it. The PBE key entry type added for github #2164 was missing from engineIsKeyEntry, and is now included.
 - A KeyAgreement asked for its shared secret before doPhase returned data rather than refusing. javax.crypto.KeyAgreement specifies IllegalStateException for that state, but nothing in the provider tracked it, so each SPI handed back whatever its result field held: for Diffie-Hellman that was the private value itself - engineInit seeded result with x, so generateSecret() returned the private exponent padded to the prime's length and generateSecret("AES") an all-zero key taken from that padding - while ECDH returned null and its named-algorithm overload raised NullPointerException. BaseAgreementSpi now records whether a doPhase has completed the agreement since the last init and refuses the request with an IllegalStateException naming the algorithm, so every family in the provider - DH, ECDH and ECMQV, the SM2 exchange, both ECGOST families, XDH, SM9 and NewHope - answers the same way, and the DH SPI no longer holds the private value in that field at all.
 - Mac.getInstance and KeyGenerator.getInstance by the HMAC SHA-512/224 and SHA-512/256 object identifiers (1.2.840.113549.2.12 and .13) failed, although the same algorithms resolved by name and the matching SecretKeyFactory aliases were registered: the SHA512 mappings called addHMACAlgorithm for the two truncated variants without the addHMACAlias that registers their OIDs against Mac and KeyGenerator. Both are now aliased, as every other HMAC in that class already was.
 - A KTSParameterSpec naming an HKDF key-derivation function with a parameters field - a form the provider does not service - was accepted at Cipher init and then failed out of wrap or unwrap with an unchecked IllegalStateException neither method declares. The KTS key-wrapping Ciphers (ML-KEM, Classic McEliece, FrodoKEM, the composite KEM and RSA-KEM) now validate the spec's KDF when they take it, reporting an unserviceable one as the InvalidAlgorithmParameterException engineInit declares, which is what the javax.crypto.KEM services already did through KdfUtil.resolveKemSpec.

prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/bcfks/BcFKSKeyStoreSpi.java

@@ -778,7 +778,8 @@ public boolean engineIsKeyEntry(String alias)
         {
             BigInteger entryType = ent.getType();
             return entryType.equals(PRIVATE_KEY) || entryType.equals(SECRET_KEY)
-                || entryType.equals(PROTECTED_PRIVATE_KEY) || entryType.equals(PROTECTED_SECRET_KEY);
+                || entryType.equals(PROTECTED_PRIVATE_KEY) || entryType.equals(PROTECTED_SECRET_KEY)
+                || entryType.equals(PBKDF_KEY);
         }
 
         return false;

prov/src/main/jdk1.4/org/bouncycastle/jcajce/provider/keystore/bcfks/BcFKSKeyStoreSpi.java

@@ -717,7 +717,8 @@ public boolean engineIsKeyEntry(String alias)
         {
             BigInteger entryType = ent.getType();
             return entryType.equals(PRIVATE_KEY) || entryType.equals(SECRET_KEY)
-                || entryType.equals(PROTECTED_PRIVATE_KEY) || entryType.equals(PROTECTED_SECRET_KEY);
+                || entryType.equals(PROTECTED_PRIVATE_KEY) || entryType.equals(PROTECTED_SECRET_KEY)
+                || entryType.equals(PBKDF_KEY);
         }
 
         return false;

prov/src/test/java/org/bouncycastle/jce/provider/test/BCFKSStoreTest.java

@@ -1199,6 +1199,21 @@ public void shouldStoreOnePBEKey()
         isTrue("algorithm mismatch: " + rPbe.getAlgorithm(), origAlg.equals(rPbe.getAlgorithm()));
         isTrue("encoded mismatch", Arrays.areEqual(origEncoded, rPbe.getEncoded()));
 
+        // a PBE key entry is a key entry, so getEntry() must return it as a SecretKeyEntry
+        isTrue("PBE key not a key entry", store2.isKeyEntry("pbeKey"));
+        isTrue("PBE key reported as certificate entry", !store2.isCertificateEntry("pbeKey"));
+
+        KeyStore.Entry entry = store2.getEntry("pbeKey", new KeyStore.PasswordProtection(testPassword));
+        isTrue("entry not a SecretKeyEntry: " + entry, entry instanceof KeyStore.SecretKeyEntry);
+
+        SecretKey entryKey = ((KeyStore.SecretKeyEntry)entry).getSecretKey();
+        isTrue("entry key not a PBEKey", entryKey instanceof javax.crypto.interfaces.PBEKey);
+
+        javax.crypto.interfaces.PBEKey ePbe = (javax.crypto.interfaces.PBEKey)entryKey;
+        isTrue("entry password mismatch", Arrays.areEqual(pwd, ePbe.getPassword()));
+        isTrue("entry salt mismatch", Arrays.areEqual(salt, ePbe.getSalt()));
+        isEquals(iterations, ePbe.getIterationCount());
+
         // chain must be rejected
         try
         {