Refactoring in CMS

peterdettman · peterdettman · commit 752603039ab0 · 2026-01-23T00:15:48.000+07:00
diff --git a/pkix/src/main/java/org/bouncycastle/cms/jcajce/JceKeyAgreeRecipient.java b/pkix/src/main/java/org/bouncycastle/cms/jcajce/JceKeyAgreeRecipient.java
@@ -253,52 +253,59 @@ protected Key extractSecretKey(AlgorithmIdentifier keyEncryptionAlgorithm, Algor
     {
         try
         {
-            AlgorithmIdentifier wrapAlg =
-                AlgorithmIdentifier.getInstance(keyEncryptionAlgorithm.getParameters());
+            AlgorithmIdentifier wrapAlgID = AlgorithmIdentifier.getInstance(keyEncryptionAlgorithm.getParameters());
+            ASN1ObjectIdentifier wrapAlgOID = wrapAlgID.getAlgorithm();
 
             X509EncodedKeySpec pubSpec = new X509EncodedKeySpec(senderKey.getEncoded());
             KeyFactory fact = helper.createKeyFactory(senderKey.getAlgorithm().getAlgorithm());
             PublicKey senderPublicKey = fact.generatePublic(pubSpec);
 
             try
             {
-                SecretKey agreedWrapKey = calculateAgreedWrapKey(keyEncryptionAlgorithm, wrapAlg,
-                    senderPublicKey, userKeyingMaterial, recipientKey, ecc_cms_Generator);
+                SecretKey agreedWrapKey = calculateAgreedWrapKey(keyEncryptionAlgorithm, wrapAlgID, senderPublicKey,
+                    userKeyingMaterial, recipientKey, ecc_cms_Generator);
 
-                if (wrapAlg.getAlgorithm().equals(CryptoProObjectIdentifiers.id_Gost28147_89_None_KeyWrap)
-                    || wrapAlg.getAlgorithm().equals(CryptoProObjectIdentifiers.id_Gost28147_89_CryptoPro_KeyWrap))
+                if (CryptoProObjectIdentifiers.id_Gost28147_89_None_KeyWrap.equals(wrapAlgOID) ||
+                    CryptoProObjectIdentifiers.id_Gost28147_89_CryptoPro_KeyWrap.equals(wrapAlgOID))
                 {
                     Gost2814789EncryptedKey encKey = Gost2814789EncryptedKey.getInstance(encryptedContentEncryptionKey);
-                    Gost2814789KeyWrapParameters wrapParams = Gost2814789KeyWrapParameters.getInstance(wrapAlg.getParameters());
+                    Gost2814789KeyWrapParameters wrapParams = Gost2814789KeyWrapParameters.getInstance(
+                        wrapAlgID.getParameters());
 
-                    Cipher keyCipher = helper.createCipher(wrapAlg.getAlgorithm());
+                    Cipher keyCipher = helper.createCipher(wrapAlgOID);
 
-                    keyCipher.init(Cipher.UNWRAP_MODE, agreedWrapKey, new GOST28147WrapParameterSpec(wrapParams.getEncryptionParamSet(), userKeyingMaterial.getOctets()));
+                    keyCipher.init(Cipher.UNWRAP_MODE, agreedWrapKey,
+                        new GOST28147WrapParameterSpec(wrapParams.getEncryptionParamSet(), userKeyingMaterial.getOctets()));
 
-                    return keyCipher.unwrap(Arrays.concatenate(encKey.getEncryptedKey(), encKey.getMacKey()), helper.getBaseCipherName(contentEncryptionAlgorithm.getAlgorithm()), Cipher.SECRET_KEY);
+                    byte[] wrappedKey = Arrays.concatenate(encKey.getEncryptedKey(), encKey.getMacKey());
+                    return keyCipher.unwrap(wrappedKey, helper.getBaseCipherName(contentEncryptionAlgorithm.getAlgorithm()),
+                        Cipher.SECRET_KEY);
                 }
 
-                return unwrapSessionKey(wrapAlg.getAlgorithm(), agreedWrapKey, contentEncryptionAlgorithm.getAlgorithm(), encryptedContentEncryptionKey);
+                return unwrapSessionKey(wrapAlgOID, agreedWrapKey, contentEncryptionAlgorithm.getAlgorithm(),
+                    encryptedContentEncryptionKey);
             }
             catch (InvalidKeyException e)
             {
                 // might be a pre-RFC 5753 message
                 if (possibleOldMessages.contains(keyEncryptionAlgorithm.getAlgorithm()))
                 {
-                    SecretKey agreedWrapKey = calculateAgreedWrapKey(keyEncryptionAlgorithm, wrapAlg,
+                    SecretKey agreedWrapKey = calculateAgreedWrapKey(keyEncryptionAlgorithm, wrapAlgID,
                         senderPublicKey, userKeyingMaterial, recipientKey, old_ecc_cms_Generator);
 
-                    return unwrapSessionKey(wrapAlg.getAlgorithm(), agreedWrapKey, contentEncryptionAlgorithm.getAlgorithm(), encryptedContentEncryptionKey);
+                    return unwrapSessionKey(wrapAlgOID, agreedWrapKey, contentEncryptionAlgorithm.getAlgorithm(),
+                        encryptedContentEncryptionKey);
                 }
                 // one last try - people do actually do this it turns out
                 if (userKeyingMaterial != null)
                 {
                     try
                     {
-                        SecretKey agreedWrapKey = calculateAgreedWrapKey(keyEncryptionAlgorithm, wrapAlg,
+                        SecretKey agreedWrapKey = calculateAgreedWrapKey(keyEncryptionAlgorithm, wrapAlgID,
                             senderPublicKey, userKeyingMaterial, recipientKey, simple_ecc_cmsGenerator);
 
-                        return unwrapSessionKey(wrapAlg.getAlgorithm(), agreedWrapKey, contentEncryptionAlgorithm.getAlgorithm(), encryptedContentEncryptionKey);
+                        return unwrapSessionKey(wrapAlgOID, agreedWrapKey, contentEncryptionAlgorithm.getAlgorithm(),
+                            encryptedContentEncryptionKey);
                     }
                     catch (InvalidKeyException ex)
                     {
diff --git a/pkix/src/main/java/org/bouncycastle/cms/jcajce/JceKeyAgreeRecipientInfoGenerator.java b/pkix/src/main/java/org/bouncycastle/cms/jcajce/JceKeyAgreeRecipientInfoGenerator.java
@@ -146,19 +146,19 @@ public JceKeyAgreeRecipientInfoGenerator addRecipient(byte[] subjectKeyID, Publi
         return this;
     }
 
-    public ASN1Sequence generateRecipientEncryptedKeys(AlgorithmIdentifier keyAgreeAlgorithm, AlgorithmIdentifier keyEncryptionAlgorithm, GenericKey contentEncryptionKey)
-        throws CMSException
+    public ASN1Sequence generateRecipientEncryptedKeys(AlgorithmIdentifier keyAgreeAlgorithm,
+        AlgorithmIdentifier keyEncryptionAlgorithm, GenericKey contentEncryptionKey) throws CMSException
     {
         if (recipientIDs.isEmpty())
         {
             throw new CMSException("No recipients associated with generator - use addRecipient()");
         }
 
-        init(keyAgreeAlgorithm.getAlgorithm());
+        ASN1ObjectIdentifier keyAgreementOID = keyAgreeAlgorithm.getAlgorithm();
 
-        PrivateKey senderPrivateKey = this.senderPrivateKey;
+        init(keyAgreementOID);
 
-        ASN1ObjectIdentifier keyAgreementOID = keyAgreeAlgorithm.getAlgorithm();
+        PrivateKey senderPrivateKey = this.senderPrivateKey;
 
         ASN1EncodableVector recipientEncryptedKeys = new ASN1EncodableVector();
         for (int i = 0; i != recipientIDs.size(); i++)
@@ -169,15 +169,16 @@ public ASN1Sequence generateRecipientEncryptedKeys(AlgorithmIdentifier keyAgreeA
             try
             {
                 AlgorithmParameterSpec agreementParamSpec;
-                ASN1ObjectIdentifier keyEncAlg = keyEncryptionAlgorithm.getAlgorithm();
+                ASN1ObjectIdentifier keyEncryptionOID = keyEncryptionAlgorithm.getAlgorithm();
 
                 if (CMSUtils.isMQV(keyAgreementOID))
                 {
                     agreementParamSpec = new MQVParameterSpec(ephemeralKP, recipientPublicKey, userKeyingMaterial);
                 }
                 else if (CMSUtils.isEC(keyAgreementOID))
                 {
-                    byte[] ukmKeyingMaterial = ecc_cms_Generator.generateKDFMaterial(keyEncryptionAlgorithm, keySizeProvider.getKeySize(keyEncAlg), userKeyingMaterial);
+                    byte[] ukmKeyingMaterial = ecc_cms_Generator.generateKDFMaterial(keyEncryptionAlgorithm,
+                        keySizeProvider.getKeySize(keyEncryptionOID), userKeyingMaterial);
 
                     agreementParamSpec = new UserKeyingMaterialSpec(ukmKeyingMaterial);
                 }
@@ -217,37 +218,36 @@ else if (CMSUtils.isGOST(keyAgreementOID))
                 keyAgreement.init(senderPrivateKey, agreementParamSpec, random);
                 keyAgreement.doPhase(recipientPublicKey, true);
 
-                SecretKey keyEncryptionKey = keyAgreement.generateSecret(keyEncAlg.getId());
+                SecretKey keyEncryptionKey = keyAgreement.generateSecret(keyEncryptionOID.getId());
 
                 EnvelopedDataHelper keyWrapHelper = (wrappingHelper != null) ? wrappingHelper : helper;
 
                 // Wrap the content encryption key with the agreement key
-                Cipher keyEncryptionCipher = keyWrapHelper.createCipher(keyEncAlg);
-                ASN1OctetString encryptedKey;
+                Cipher keyEncryptionCipher = keyWrapHelper.createCipher(keyEncryptionOID);
 
-                if (keyEncAlg.equals(CryptoProObjectIdentifiers.id_Gost28147_89_None_KeyWrap)
-                    || keyEncAlg.equals(CryptoProObjectIdentifiers.id_Gost28147_89_CryptoPro_KeyWrap))
+                byte[] encryptedKeyOctets;
+                if (CryptoProObjectIdentifiers.id_Gost28147_89_None_KeyWrap.equals(keyEncryptionOID) ||
+                    CryptoProObjectIdentifiers.id_Gost28147_89_CryptoPro_KeyWrap.equals(keyEncryptionOID))
                 {
-                    keyEncryptionCipher.init(Cipher.WRAP_MODE, keyEncryptionKey, new GOST28147WrapParameterSpec(CryptoProObjectIdentifiers.id_Gost28147_89_CryptoPro_A_ParamSet, userKeyingMaterial));
+                    keyEncryptionCipher.init(Cipher.WRAP_MODE, keyEncryptionKey,
+                        new GOST28147WrapParameterSpec(CryptoProObjectIdentifiers.id_Gost28147_89_CryptoPro_A_ParamSet, userKeyingMaterial));
 
                     byte[] encKeyBytes = keyEncryptionCipher.wrap(keyWrapHelper.getJceKey(contentEncryptionKey));
 
                     Gost2814789EncryptedKey encKey = new Gost2814789EncryptedKey(
                         Arrays.copyOfRange(encKeyBytes, 0, encKeyBytes.length - 4),
                         Arrays.copyOfRange(encKeyBytes, encKeyBytes.length - 4, encKeyBytes.length));
 
-                    encryptedKey = new DEROctetString(encKey.getEncoded(ASN1Encoding.DER));
+                    encryptedKeyOctets = encKey.getEncoded(ASN1Encoding.DER);
                 }
                 else
                 {
                     keyEncryptionCipher.init(Cipher.WRAP_MODE, keyEncryptionKey, random);
 
-                    byte[] encryptedKeyBytes = keyEncryptionCipher.wrap(keyWrapHelper.getJceKey(contentEncryptionKey));
-
-                    encryptedKey = new DEROctetString(encryptedKeyBytes);
+                    encryptedKeyOctets = keyEncryptionCipher.wrap(keyWrapHelper.getJceKey(contentEncryptionKey));
                 }
 
-                recipientEncryptedKeys.add(new RecipientEncryptedKey(karId, encryptedKey));
+                recipientEncryptedKeys.add(new RecipientEncryptedKey(karId, new DEROctetString(encryptedKeyOctets)));
             }
             catch (GeneralSecurityException e)
             {
@@ -274,7 +274,7 @@ protected byte[] getUserKeyingMaterial(AlgorithmIdentifier keyAgreeAlg)
 
             try
             {
-                ASN1OctetString addedukm = DEROctetString.withContentsOptional(userKeyingMaterial);
+                ASN1OctetString addedukm = DEROctetString.fromContentsOptional(userKeyingMaterial);
 
                 return new MQVuserKeyingMaterial(originatorPublicKey, addedukm).getEncoded();
             }
diff --git a/util/src/main/java/org/bouncycastle/asn1/cms/OriginatorIdentifierOrKey.java b/util/src/main/java/org/bouncycastle/asn1/cms/OriginatorIdentifierOrKey.java
@@ -154,30 +154,16 @@ public IssuerAndSerialNumber getIssuerAndSerialNumber()
 
     public SubjectKeyIdentifier getSubjectKeyIdentifier()
     {
-        if (id instanceof ASN1TaggedObject)
-        {
-            ASN1TaggedObject taggedObject = (ASN1TaggedObject)id;
-            if (taggedObject.hasContextTag(0))
-            {
-                return SubjectKeyIdentifier.getInstance(taggedObject, false);
-            }
-        }
+        ASN1TaggedObject tag0 = ASN1TaggedObject.getContextOptional(id, 0);
 
-        return null;
+        return tag0 == null ? null : SubjectKeyIdentifier.getInstance(tag0, false);
     }
 
     public OriginatorPublicKey getOriginatorKey()
     {
-        if (id instanceof ASN1TaggedObject)
-        {
-            ASN1TaggedObject taggedObject = (ASN1TaggedObject)id;
-            if (taggedObject.hasContextTag(1))
-            {
-                return OriginatorPublicKey.getInstance(taggedObject, false);
-            }
-        }
+        ASN1TaggedObject tag1 = ASN1TaggedObject.getContextOptional(id, 1);
 
-        return null;
+        return tag1 == null ? null : OriginatorPublicKey.getInstance(tag1, false);
     }
 
     /**

Original file line number	Diff line number	Diff line change
`@@ -253,52 +253,59 @@ protected Key extractSecretKey(AlgorithmIdentifier keyEncryptionAlgorithm, Algor`
`253`	`253`	`{`
`254`	`254`	`try`
`255`	`255`	`{`
`256`		`- AlgorithmIdentifier wrapAlg =`
`257`		`- AlgorithmIdentifier.getInstance(keyEncryptionAlgorithm.getParameters());`
	`256`	`+ AlgorithmIdentifier wrapAlgID = AlgorithmIdentifier.getInstance(keyEncryptionAlgorithm.getParameters());`
	`257`	`+ ASN1ObjectIdentifier wrapAlgOID = wrapAlgID.getAlgorithm();`
`258`	`258`
`259`	`259`	`X509EncodedKeySpec pubSpec = new X509EncodedKeySpec(senderKey.getEncoded());`
`260`	`260`	`KeyFactory fact = helper.createKeyFactory(senderKey.getAlgorithm().getAlgorithm());`
`261`	`261`	`PublicKey senderPublicKey = fact.generatePublic(pubSpec);`
`262`	`262`
`263`	`263`	`try`
`264`	`264`	`{`
`265`		`- SecretKey agreedWrapKey = calculateAgreedWrapKey(keyEncryptionAlgorithm, wrapAlg,`
`266`		`- senderPublicKey, userKeyingMaterial, recipientKey, ecc_cms_Generator);`
	`265`	`+ SecretKey agreedWrapKey = calculateAgreedWrapKey(keyEncryptionAlgorithm, wrapAlgID, senderPublicKey,`
	`266`	`+ userKeyingMaterial, recipientKey, ecc_cms_Generator);`
`267`	`267`
`268`		`- if (wrapAlg.getAlgorithm().equals(CryptoProObjectIdentifiers.id_Gost28147_89_None_KeyWrap)`
`269`		`- \|\| wrapAlg.getAlgorithm().equals(CryptoProObjectIdentifiers.id_Gost28147_89_CryptoPro_KeyWrap))`
	`268`	`+ if (CryptoProObjectIdentifiers.id_Gost28147_89_None_KeyWrap.equals(wrapAlgOID) \|\|`
	`269`	`+ CryptoProObjectIdentifiers.id_Gost28147_89_CryptoPro_KeyWrap.equals(wrapAlgOID))`
`270`	`270`	`{`
`271`	`271`	`Gost2814789EncryptedKey encKey = Gost2814789EncryptedKey.getInstance(encryptedContentEncryptionKey);`
`272`		`- Gost2814789KeyWrapParameters wrapParams = Gost2814789KeyWrapParameters.getInstance(wrapAlg.getParameters());`
	`272`	`+ Gost2814789KeyWrapParameters wrapParams = Gost2814789KeyWrapParameters.getInstance(`
	`273`	`+ wrapAlgID.getParameters());`
`273`	`274`
`274`		`- Cipher keyCipher = helper.createCipher(wrapAlg.getAlgorithm());`
	`275`	`+ Cipher keyCipher = helper.createCipher(wrapAlgOID);`
`275`	`276`
`276`		`- keyCipher.init(Cipher.UNWRAP_MODE, agreedWrapKey, new GOST28147WrapParameterSpec(wrapParams.getEncryptionParamSet(), userKeyingMaterial.getOctets()));`
	`277`	`+ keyCipher.init(Cipher.UNWRAP_MODE, agreedWrapKey,`
	`278`	`+ new GOST28147WrapParameterSpec(wrapParams.getEncryptionParamSet(), userKeyingMaterial.getOctets()));`
`277`	`279`
`278`		`- return keyCipher.unwrap(Arrays.concatenate(encKey.getEncryptedKey(), encKey.getMacKey()), helper.getBaseCipherName(contentEncryptionAlgorithm.getAlgorithm()), Cipher.SECRET_KEY);`
	`280`	`+ byte[] wrappedKey = Arrays.concatenate(encKey.getEncryptedKey(), encKey.getMacKey());`
	`281`	`+ return keyCipher.unwrap(wrappedKey, helper.getBaseCipherName(contentEncryptionAlgorithm.getAlgorithm()),`
	`282`	`+ Cipher.SECRET_KEY);`
`279`	`283`	`}`
`280`	`284`
`281`		`- return unwrapSessionKey(wrapAlg.getAlgorithm(), agreedWrapKey, contentEncryptionAlgorithm.getAlgorithm(), encryptedContentEncryptionKey);`
	`285`	`+ return unwrapSessionKey(wrapAlgOID, agreedWrapKey, contentEncryptionAlgorithm.getAlgorithm(),`
	`286`	`+ encryptedContentEncryptionKey);`
`282`	`287`	`}`
`283`	`288`	`catch (InvalidKeyException e)`
`284`	`289`	`{`
`285`	`290`	`// might be a pre-RFC 5753 message`
`286`	`291`	`if (possibleOldMessages.contains(keyEncryptionAlgorithm.getAlgorithm()))`
`287`	`292`	`{`
`288`		`- SecretKey agreedWrapKey = calculateAgreedWrapKey(keyEncryptionAlgorithm, wrapAlg,`
	`293`	`+ SecretKey agreedWrapKey = calculateAgreedWrapKey(keyEncryptionAlgorithm, wrapAlgID,`
`289`	`294`	`senderPublicKey, userKeyingMaterial, recipientKey, old_ecc_cms_Generator);`
`290`	`295`
`291`		`- return unwrapSessionKey(wrapAlg.getAlgorithm(), agreedWrapKey, contentEncryptionAlgorithm.getAlgorithm(), encryptedContentEncryptionKey);`
	`296`	`+ return unwrapSessionKey(wrapAlgOID, agreedWrapKey, contentEncryptionAlgorithm.getAlgorithm(),`
	`297`	`+ encryptedContentEncryptionKey);`
`292`	`298`	`}`
`293`	`299`	`// one last try - people do actually do this it turns out`
`294`	`300`	`if (userKeyingMaterial != null)`
`295`	`301`	`{`
`296`	`302`	`try`
`297`	`303`	`{`
`298`		`- SecretKey agreedWrapKey = calculateAgreedWrapKey(keyEncryptionAlgorithm, wrapAlg,`
	`304`	`+ SecretKey agreedWrapKey = calculateAgreedWrapKey(keyEncryptionAlgorithm, wrapAlgID,`
`299`	`305`	`senderPublicKey, userKeyingMaterial, recipientKey, simple_ecc_cmsGenerator);`
`300`	`306`
`301`		`- return unwrapSessionKey(wrapAlg.getAlgorithm(), agreedWrapKey, contentEncryptionAlgorithm.getAlgorithm(), encryptedContentEncryptionKey);`
	`307`	`+ return unwrapSessionKey(wrapAlgOID, agreedWrapKey, contentEncryptionAlgorithm.getAlgorithm(),`
	`308`	`+ encryptedContentEncryptionKey);`
`302`	`309`	`}`
`303`	`310`	`catch (InvalidKeyException ex)`
`304`	`311`	`{`
Original file line number	Diff line number	Diff line change
`@@ -146,19 +146,19 @@ public JceKeyAgreeRecipientInfoGenerator addRecipient(byte[] subjectKeyID, Publi`
`146`	`146`	`return this;`
`147`	`147`	`}`
`148`	`148`
`149`		`- public ASN1Sequence generateRecipientEncryptedKeys(AlgorithmIdentifier keyAgreeAlgorithm, AlgorithmIdentifier keyEncryptionAlgorithm, GenericKey contentEncryptionKey)`
`150`		`- throws CMSException`
	`149`	`+ public ASN1Sequence generateRecipientEncryptedKeys(AlgorithmIdentifier keyAgreeAlgorithm,`
	`150`	`+ AlgorithmIdentifier keyEncryptionAlgorithm, GenericKey contentEncryptionKey) throws CMSException`
`151`	`151`	`{`
`152`	`152`	`if (recipientIDs.isEmpty())`
`153`	`153`	`{`
`154`	`154`	`throw new CMSException("No recipients associated with generator - use addRecipient()");`
`155`	`155`	`}`
`156`	`156`
`157`		`- init(keyAgreeAlgorithm.getAlgorithm());`
	`157`	`+ ASN1ObjectIdentifier keyAgreementOID = keyAgreeAlgorithm.getAlgorithm();`
`158`	`158`
`159`		`- PrivateKey senderPrivateKey = this.senderPrivateKey;`
	`159`	`+ init(keyAgreementOID);`
`160`	`160`
`161`		`- ASN1ObjectIdentifier keyAgreementOID = keyAgreeAlgorithm.getAlgorithm();`
	`161`	`+ PrivateKey senderPrivateKey = this.senderPrivateKey;`
`162`	`162`
`163`	`163`	`ASN1EncodableVector recipientEncryptedKeys = new ASN1EncodableVector();`
`164`	`164`	`for (int i = 0; i != recipientIDs.size(); i++)`
`@@ -169,15 +169,16 @@ public ASN1Sequence generateRecipientEncryptedKeys(AlgorithmIdentifier keyAgreeA`
`169`	`169`	`try`
`170`	`170`	`{`
`171`	`171`	`AlgorithmParameterSpec agreementParamSpec;`
`172`		`- ASN1ObjectIdentifier keyEncAlg = keyEncryptionAlgorithm.getAlgorithm();`
	`172`	`+ ASN1ObjectIdentifier keyEncryptionOID = keyEncryptionAlgorithm.getAlgorithm();`
`173`	`173`
`174`	`174`	`if (CMSUtils.isMQV(keyAgreementOID))`
`175`	`175`	`{`
`176`	`176`	`agreementParamSpec = new MQVParameterSpec(ephemeralKP, recipientPublicKey, userKeyingMaterial);`
`177`	`177`	`}`
`178`	`178`	`else if (CMSUtils.isEC(keyAgreementOID))`
`179`	`179`	`{`
`180`		`- byte[] ukmKeyingMaterial = ecc_cms_Generator.generateKDFMaterial(keyEncryptionAlgorithm, keySizeProvider.getKeySize(keyEncAlg), userKeyingMaterial);`
	`180`	`+ byte[] ukmKeyingMaterial = ecc_cms_Generator.generateKDFMaterial(keyEncryptionAlgorithm,`
	`181`	`+ keySizeProvider.getKeySize(keyEncryptionOID), userKeyingMaterial);`
`181`	`182`
`182`	`183`	`agreementParamSpec = new UserKeyingMaterialSpec(ukmKeyingMaterial);`
`183`	`184`	`}`
`@@ -217,37 +218,36 @@ else if (CMSUtils.isGOST(keyAgreementOID))`
`217`	`218`	`keyAgreement.init(senderPrivateKey, agreementParamSpec, random);`
`218`	`219`	`keyAgreement.doPhase(recipientPublicKey, true);`
`219`	`220`
`220`		`- SecretKey keyEncryptionKey = keyAgreement.generateSecret(keyEncAlg.getId());`
	`221`	`+ SecretKey keyEncryptionKey = keyAgreement.generateSecret(keyEncryptionOID.getId());`
`221`	`222`
`222`	`223`	`EnvelopedDataHelper keyWrapHelper = (wrappingHelper != null) ? wrappingHelper : helper;`
`223`	`224`
`224`	`225`	`// Wrap the content encryption key with the agreement key`
`225`		`- Cipher keyEncryptionCipher = keyWrapHelper.createCipher(keyEncAlg);`
`226`		`- ASN1OctetString encryptedKey;`
	`226`	`+ Cipher keyEncryptionCipher = keyWrapHelper.createCipher(keyEncryptionOID);`
`227`	`227`
`228`		`- if (keyEncAlg.equals(CryptoProObjectIdentifiers.id_Gost28147_89_None_KeyWrap)`
`229`		`- \|\| keyEncAlg.equals(CryptoProObjectIdentifiers.id_Gost28147_89_CryptoPro_KeyWrap))`
	`228`	`+ byte[] encryptedKeyOctets;`
	`229`	`+ if (CryptoProObjectIdentifiers.id_Gost28147_89_None_KeyWrap.equals(keyEncryptionOID) \|\|`
	`230`	`+ CryptoProObjectIdentifiers.id_Gost28147_89_CryptoPro_KeyWrap.equals(keyEncryptionOID))`
`230`	`231`	`{`
`231`		`- keyEncryptionCipher.init(Cipher.WRAP_MODE, keyEncryptionKey, new GOST28147WrapParameterSpec(CryptoProObjectIdentifiers.id_Gost28147_89_CryptoPro_A_ParamSet, userKeyingMaterial));`
	`232`	`+ keyEncryptionCipher.init(Cipher.WRAP_MODE, keyEncryptionKey,`
	`233`	`+ new GOST28147WrapParameterSpec(CryptoProObjectIdentifiers.id_Gost28147_89_CryptoPro_A_ParamSet, userKeyingMaterial));`
`232`	`234`
`233`	`235`	`byte[] encKeyBytes = keyEncryptionCipher.wrap(keyWrapHelper.getJceKey(contentEncryptionKey));`
`234`	`236`
`235`	`237`	`Gost2814789EncryptedKey encKey = new Gost2814789EncryptedKey(`
`236`	`238`	`Arrays.copyOfRange(encKeyBytes, 0, encKeyBytes.length - 4),`
`237`	`239`	`Arrays.copyOfRange(encKeyBytes, encKeyBytes.length - 4, encKeyBytes.length));`
`238`	`240`
`239`		`- encryptedKey = new DEROctetString(encKey.getEncoded(ASN1Encoding.DER));`
	`241`	`+ encryptedKeyOctets = encKey.getEncoded(ASN1Encoding.DER);`
`240`	`242`	`}`
`241`	`243`	`else`
`242`	`244`	`{`
`243`	`245`	`keyEncryptionCipher.init(Cipher.WRAP_MODE, keyEncryptionKey, random);`
`244`	`246`
`245`		`- byte[] encryptedKeyBytes = keyEncryptionCipher.wrap(keyWrapHelper.getJceKey(contentEncryptionKey));`
`246`		`-`
`247`		`- encryptedKey = new DEROctetString(encryptedKeyBytes);`
	`247`	`+ encryptedKeyOctets = keyEncryptionCipher.wrap(keyWrapHelper.getJceKey(contentEncryptionKey));`
`248`	`248`	`}`
`249`	`249`
`250`		`- recipientEncryptedKeys.add(new RecipientEncryptedKey(karId, encryptedKey));`
	`250`	`+ recipientEncryptedKeys.add(new RecipientEncryptedKey(karId, new DEROctetString(encryptedKeyOctets)));`
`251`	`251`	`}`
`252`	`252`	`catch (GeneralSecurityException e)`
`253`	`253`	`{`
`@@ -274,7 +274,7 @@ protected byte[] getUserKeyingMaterial(AlgorithmIdentifier keyAgreeAlg)`
`274`	`274`
`275`	`275`	`try`
`276`	`276`	`{`
`277`		`- ASN1OctetString addedukm = DEROctetString.withContentsOptional(userKeyingMaterial);`
	`277`	`+ ASN1OctetString addedukm = DEROctetString.fromContentsOptional(userKeyingMaterial);`
`278`	`278`
`279`	`279`	`return new MQVuserKeyingMaterial(originatorPublicKey, addedukm).getEncoded();`
`280`	`280`	`}`