create generateHKDFBytes, isX25519. Refactor: makeKeyFromPassPhrase

gefeili · gefeili · commit 225fcaf5d7c0 · 2024-05-28T16:55:53.000+09:30
diff --git a/pg/src/main/java/org/bouncycastle/bcpg/SymmetricKeyEncSessionPacket.java b/pg/src/main/java/org/bouncycastle/bcpg/SymmetricKeyEncSessionPacket.java
@@ -71,6 +71,9 @@ else if (version == VERSION_5 || version == VERSION_6)
 
             // https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#section-5.3.2-3.5
             int s2kOctetCount = in.read();
+
+            //TODO: use this line to replace the following code?
+            //s2k = new S2K(in);
             s2kBytes = new byte[s2kOctetCount];
             in.readFully(s2kBytes);
             try
diff --git a/pg/src/main/java/org/bouncycastle/openpgp/operator/PGPUtil.java b/pg/src/main/java/org/bouncycastle/openpgp/operator/PGPUtil.java
@@ -94,6 +94,7 @@ else if (s2k.getHashAlgorithm() != digestCalculator.getAlgorithm())
 
         try
         {
+            byte[] iv = s2k != null? s2k.getIV() : null;
             while (generatedBytes < keyBytes.length)
             {
                 if (s2k != null)
@@ -103,8 +104,6 @@ else if (s2k.getHashAlgorithm() != digestCalculator.getAlgorithm())
                         dOut.write(0);
                     }
 
-                    byte[] iv = s2k.getIV();
-
                     switch (s2k.getType())
                     {
                     case S2K.SIMPLE:
diff --git a/pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcAEADUtil.java b/pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcAEADUtil.java
@@ -91,21 +91,25 @@ protected static long getChunkLength(int chunkSize)
      * @param salt       salt
      * @param hkdfInfo   HKDF info
      * @return message key and separate IV
-     * @throws PGPException
      */
     static byte[][] deriveMessageKeyAndIv(int aeadAlgo, int cipherAlgo, byte[] sessionKey, byte[] salt, byte[] hkdfInfo)
-        throws PGPException
+    {
+        int keyLen = SymmetricKeyUtils.getKeyLengthInOctets(cipherAlgo);
+        int ivLen = AEADUtils.getIVLength(aeadAlgo);
+        byte[] messageKeyAndIv = generateHKDFBytes(sessionKey, salt, hkdfInfo, keyLen + ivLen - 8);
+
+        return new byte[][]{Arrays.copyOfRange(messageKeyAndIv, 0, keyLen), Arrays.copyOfRange(messageKeyAndIv, keyLen, keyLen + ivLen)};
+    }
+
+    static byte[] generateHKDFBytes(byte[] sessionKey, byte[] salt, byte[] hkdfInfo, int len)
     {
         HKDFParameters hkdfParameters = new HKDFParameters(sessionKey, salt, hkdfInfo);
         HKDFBytesGenerator hkdfGen = new HKDFBytesGenerator(new SHA256Digest());
 
         hkdfGen.init(hkdfParameters);
-        int keyLen = SymmetricKeyUtils.getKeyLengthInOctets(cipherAlgo);
-        int ivLen = AEADUtils.getIVLength(aeadAlgo);
-        byte[] messageKeyAndIv = new byte[keyLen + ivLen - 8];
+        byte[] messageKeyAndIv = new byte[len];
         hkdfGen.generateBytes(messageKeyAndIv, 0, messageKeyAndIv.length);
-
-        return new byte[][]{Arrays.copyOfRange(messageKeyAndIv, 0, keyLen), Arrays.copyOfRange(messageKeyAndIv, keyLen, keyLen + ivLen)};
+        return messageKeyAndIv;
     }
 
     public static AEADBlockCipher createAEADCipher(int encAlgorithm, int aeadAlgorithm)
diff --git a/pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcPBEDataDecryptorFactory.java b/pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcPBEDataDecryptorFactory.java
@@ -8,12 +8,8 @@
 import org.bouncycastle.crypto.BlockCipher;
 import org.bouncycastle.crypto.BufferedBlockCipher;
 import org.bouncycastle.crypto.InvalidCipherTextException;
-import org.bouncycastle.crypto.digests.SHA256Digest;
-import org.bouncycastle.crypto.engines.CamelliaEngine;
-import org.bouncycastle.crypto.generators.HKDFBytesGenerator;
 import org.bouncycastle.crypto.modes.AEADBlockCipher;
 import org.bouncycastle.crypto.params.AEADParameters;
-import org.bouncycastle.crypto.params.HKDFParameters;
 import org.bouncycastle.crypto.params.KeyParameter;
 import org.bouncycastle.openpgp.PGPException;
 import org.bouncycastle.openpgp.PGPSessionKey;
@@ -94,13 +90,10 @@ public byte[] recoverAEADEncryptedSessionData(SymmetricKeyEncSessionPacket keyDa
 
         byte[] hkdfInfo = keyData.getAAData(); // Between v5 and v6, these bytes differ
         int kekLen = SymmetricKeyUtils.getKeyLengthInOctets(keyData.getEncAlgorithm());
-        byte[] kek = new byte[kekLen];
 
         // HKDF
         // secretKey := HKDF_sha256(ikm, hkdfInfo).generate()
-        HKDFBytesGenerator hkdfGen = new HKDFBytesGenerator(new SHA256Digest());
-        hkdfGen.init(new HKDFParameters(ikm, null, hkdfInfo));
-        hkdfGen.generateBytes(kek, 0, kek.length);
+        byte[] kek = BcAEADUtil.generateHKDFBytes(ikm, null, hkdfInfo, kekLen);
         final KeyParameter secretKey = new KeyParameter(kek);
 
         // AEAD
diff --git a/pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcPBEKeyEncryptionMethodGenerator.java b/pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcPBEKeyEncryptionMethodGenerator.java
@@ -7,12 +7,8 @@
 import org.bouncycastle.crypto.BlockCipher;
 import org.bouncycastle.crypto.BufferedBlockCipher;
 import org.bouncycastle.crypto.InvalidCipherTextException;
-import org.bouncycastle.crypto.digests.SHA256Digest;
-import org.bouncycastle.crypto.engines.CamelliaEngine;
-import org.bouncycastle.crypto.generators.HKDFBytesGenerator;
 import org.bouncycastle.crypto.modes.AEADCipher;
 import org.bouncycastle.crypto.params.AEADParameters;
-import org.bouncycastle.crypto.params.HKDFParameters;
 import org.bouncycastle.crypto.params.KeyParameter;
 import org.bouncycastle.openpgp.PGPException;
 import org.bouncycastle.openpgp.operator.PBEKeyEncryptionMethodGenerator;
@@ -113,15 +109,8 @@ protected byte[] encryptSessionInfo(int encAlgorithm, byte[] key, byte[] session
     }
 
     protected byte[] generateV6KEK(int kekAlgorithm, byte[] ikm, byte[] info)
-        throws PGPException
     {
-        HKDFBytesGenerator hkdf = new HKDFBytesGenerator(new SHA256Digest());
-        hkdf.init(new HKDFParameters(ikm, null, info));
-
-        int kekLen = SymmetricKeyUtils.getKeyLengthInOctets(kekAlgorithm);
-        byte[] kek = new byte[kekLen];
-        hkdf.generateBytes(kek, 0, kek.length);
-        return kek;
+        return BcAEADUtil.generateHKDFBytes(ikm, null, info, SymmetricKeyUtils.getKeyLengthInOctets(kekAlgorithm));
     }
 
     protected byte[] getEskAndTag(int kekAlgorithm, int aeadAlgorithm, byte[] sessionInfo, byte[] key, byte[] iv, byte[] info)
diff --git a/pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcPGPKeyConverter.java b/pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcPGPKeyConverter.java
@@ -122,7 +122,7 @@ public AsymmetricKeyParameter getPrivateKey(PGPPrivateKey privKey)
             {
                 ECDHPublicBCPGKey ecdhPub = (ECDHPublicBCPGKey)pubPk.getKey();
 
-                if (CryptlibObjectIdentifiers.curvey25519.equals(ecdhPub.getCurveOID()))
+                if (BcUtil.isX25519(ecdhPub.getCurveOID()))
                 {
                     return PrivateKeyFactory.createKey(getPrivateKeyInfo(EdECObjectIdentifiers.id_X25519,
                         Arrays.reverseInPlace(BigIntegers.asUnsignedByteArray(((ECSecretBCPGKey)privPk).getX()))));
@@ -209,7 +209,7 @@ public AsymmetricKeyParameter getPublicKey(PGPPublicKey publicKey)
             {
                 ECDHPublicBCPGKey ecdhK = (ECDHPublicBCPGKey)publicPk.getKey();
 
-                if (ecdhK.getCurveOID().equals(CryptlibObjectIdentifiers.curvey25519))
+                if (BcUtil.isX25519(ecdhK.getCurveOID()))
                 {
                     byte[] pEnc = BigIntegers.asUnsignedByteArray(ecdhK.getEncodedPoint());
                     // skip the 0x40 header byte.
diff --git a/pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcPublicKeyDataDecryptorFactory.java b/pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcPublicKeyDataDecryptorFactory.java
@@ -3,7 +3,6 @@
 import java.io.IOException;
 import java.math.BigInteger;
 
-import org.bouncycastle.asn1.cryptlib.CryptlibObjectIdentifiers;
 import org.bouncycastle.bcpg.AEADEncDataPacket;
 import org.bouncycastle.bcpg.ECDHPublicBCPGKey;
 import org.bouncycastle.bcpg.HashAlgorithmTags;
@@ -110,7 +109,7 @@ else if (keyAlgorithm == PublicKeyAlgorithmTags.ECDH)
 
                 ECDHPublicBCPGKey ecPubKey = (ECDHPublicBCPGKey)pgpPrivKey.getPublicKeyPacket().getKey();
                 // XDH
-                if (ecPubKey.getCurveOID().equals(CryptlibObjectIdentifiers.curvey25519))
+                if (BcUtil.isX25519(ecPubKey.getCurveOID()))
                 {
                     if (pEnc.length != 1 + X25519PublicKeyParameters.KEY_SIZE || 0x40 != pEnc[0])
                     {
diff --git a/pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcPublicKeyKeyEncryptionMethodGenerator.java b/pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcPublicKeyKeyEncryptionMethodGenerator.java
@@ -4,7 +4,6 @@
 import java.math.BigInteger;
 import java.security.SecureRandom;
 
-import org.bouncycastle.asn1.cryptlib.CryptlibObjectIdentifiers;
 import org.bouncycastle.bcpg.ECDHPublicBCPGKey;
 import org.bouncycastle.bcpg.HashAlgorithmTags;
 import org.bouncycastle.bcpg.PublicKeyAlgorithmTags;
@@ -13,7 +12,6 @@
 import org.bouncycastle.crypto.AsymmetricBlockCipher;
 import org.bouncycastle.crypto.AsymmetricCipherKeyPair;
 import org.bouncycastle.crypto.AsymmetricCipherKeyPairGenerator;
-import org.bouncycastle.crypto.InvalidCipherTextException;
 import org.bouncycastle.crypto.KeyGenerationParameters;
 import org.bouncycastle.crypto.RawAgreement;
 import org.bouncycastle.crypto.Wrapper;
@@ -32,7 +30,6 @@
 import org.bouncycastle.crypto.params.X25519PublicKeyParameters;
 import org.bouncycastle.crypto.params.X448KeyGenerationParameters;
 import org.bouncycastle.crypto.params.X448PublicKeyParameters;
-import org.bouncycastle.internal.asn1.edec.EdECObjectIdentifiers;
 import org.bouncycastle.openpgp.PGPException;
 import org.bouncycastle.openpgp.PGPPublicKey;
 import org.bouncycastle.openpgp.operator.PGPPad;
@@ -86,7 +83,7 @@ protected byte[] encryptSessionInfo(PGPPublicKey pubKey, byte[] sessionInfo)
             {
                 ECDHPublicBCPGKey ecPubKey = (ECDHPublicBCPGKey)pubKeyPacket.getKey();
                 byte[] userKeyingMaterial = RFC6637Utils.createUserKeyingMaterial(pubKeyPacket, new BcKeyFingerprintCalculator());
-                if (ecPubKey.getCurveOID().equals(CryptlibObjectIdentifiers.curvey25519) || ecPubKey.getCurveOID().equals(EdECObjectIdentifiers.id_X25519))
+                if (BcUtil.isX25519(ecPubKey.getCurveOID()))
                 {
                     AsymmetricCipherKeyPair ephKp = getAsymmetricCipherKeyPair(new X25519KeyPairGenerator(), new X25519KeyGenerationParameters(random));
 
diff --git a/pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcUtil.java b/pg/src/main/java/org/bouncycastle/openpgp/operator/bc/BcUtil.java
@@ -4,6 +4,8 @@
 import java.math.BigInteger;
 
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.cryptlib.CryptlibObjectIdentifiers;
+import org.bouncycastle.asn1.edec.EdECObjectIdentifiers;
 import org.bouncycastle.asn1.x9.ECNamedCurveTable;
 import org.bouncycastle.asn1.x9.X9ECParameters;
 import org.bouncycastle.bcpg.AEADEncDataPacket;
@@ -125,4 +127,9 @@ static byte[] getSecret(RawAgreement agreement, AsymmetricKeyParameter privKey,
         agreement.calculateAgreement(ephPub, secret, 0);
         return secret;
     }
+
+    static boolean isX25519(ASN1ObjectIdentifier curveID)
+    {
+        return curveID.equals(CryptlibObjectIdentifiers.curvey25519) || curveID.equals(EdECObjectIdentifiers.id_X25519);
+    }
 }
diff --git a/pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcaJcePGPUtil.java b/pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcaJcePGPUtil.java
@@ -12,6 +12,8 @@
 import javax.crypto.spec.SecretKeySpec;
 
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.cryptlib.CryptlibObjectIdentifiers;
+import org.bouncycastle.asn1.edec.EdECObjectIdentifiers;
 import org.bouncycastle.asn1.x9.ECNamedCurveTable;
 import org.bouncycastle.asn1.x9.X9ECParameters;
 import org.bouncycastle.bcpg.PublicKeyPacket;
@@ -79,4 +81,9 @@ static Key getSecret(OperatorHelper helper, PublicKey cryptoPublicKey, String ke
         agreement.doPhase(cryptoPublicKey, true);
         return agreement.generateSecret(keyEncryptionOID);
     }
+
+    static boolean isX25519(ASN1ObjectIdentifier curveID)
+    {
+        return curveID.equals(CryptlibObjectIdentifiers.curvey25519) || curveID.equals(EdECObjectIdentifiers.id_X25519);
+    }
 }
diff --git a/pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcaPGPKeyConverter.java b/pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcaPGPKeyConverter.java
@@ -194,7 +194,7 @@ public PrivateKey getPrivateKey(PGPPrivateKey privKey)
                 ECDHPublicBCPGKey ecdhPub = (ECDHPublicBCPGKey)pubPk.getKey();
                 ECSecretBCPGKey ecdhK = (ECSecretBCPGKey)privPk;
 
-                if (CryptlibObjectIdentifiers.curvey25519.equals(ecdhPub.getCurveOID()))
+                if (JcaJcePGPUtil.isX25519(ecdhPub.getCurveOID()))
                 {
                     // 'reverse' because the native format for X25519 private keys is little-endian
                     return implGeneratePrivate("XDH", () -> getPrivateKeyInfo(EdECObjectIdentifiers.id_X25519,
@@ -289,7 +289,7 @@ public PublicKey getPublicKey(PGPPublicKey publicKey)
             {
                 ECDHPublicBCPGKey ecdhK = (ECDHPublicBCPGKey)publicPk.getKey();
 
-                if (ecdhK.getCurveOID().equals(CryptlibObjectIdentifiers.curvey25519))
+                if (JcaJcePGPUtil.isX25519(ecdhK.getCurveOID()))
                 {
                     return get25519PublicKey(ecdhK.getEncodedPoint(), EdECObjectIdentifiers.id_X25519, "XDH", "Curve");
                 }
diff --git a/pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JceAEADUtil.java b/pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JceAEADUtil.java
@@ -99,17 +99,23 @@ protected static long getChunkLength(int chunkSize)
     static byte[][] deriveMessageKeyAndIv(int aeadAlgo, int cipherAlgo, byte[] sessionKey, byte[] salt, byte[] hkdfInfo)
         throws PGPException
     {
-        // TODO: needs to be JCA based. KeyGenerator?
+        // TODO: needs to be JCA based. KeyGenerator
+        int keyLen = SymmetricKeyUtils.getKeyLengthInOctets(cipherAlgo);
+        int ivLen = AEADUtils.getIVLength(aeadAlgo);
+        byte[] messageKeyAndIv = generateHKDFBytes(sessionKey, salt, hkdfInfo, keyLen + ivLen - 8);
+
+        return new byte[][]{Arrays.copyOfRange(messageKeyAndIv, 0, keyLen), Arrays.copyOfRange(messageKeyAndIv, keyLen, keyLen + ivLen)};
+    }
+
+    static byte[] generateHKDFBytes(byte[] sessionKey, byte[] salt, byte[] hkdfInfo, int len)
+    {
         HKDFParameters hkdfParameters = new HKDFParameters(sessionKey, salt, hkdfInfo);
         HKDFBytesGenerator hkdfGen = new HKDFBytesGenerator(new SHA256Digest());
 
         hkdfGen.init(hkdfParameters);
-        int keyLen = SymmetricKeyUtils.getKeyLengthInOctets(cipherAlgo);
-        int ivLen = AEADUtils.getIVLength(aeadAlgo);
-        byte[] messageKeyAndIv = new byte[keyLen + ivLen - 8];
+        byte[] messageKeyAndIv = new byte[len];
         hkdfGen.generateBytes(messageKeyAndIv, 0, messageKeyAndIv.length);
-
-        return new byte[][]{Arrays.copyOfRange(messageKeyAndIv, 0, keyLen), Arrays.copyOfRange(messageKeyAndIv, keyLen, keyLen + ivLen)};
+        return messageKeyAndIv;
     }
 
     /**
diff --git a/pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcePBEDataDecryptorFactoryBuilder.java b/pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcePBEDataDecryptorFactoryBuilder.java
@@ -12,9 +12,6 @@
 import org.bouncycastle.bcpg.SymmetricEncIntegrityPacket;
 import org.bouncycastle.bcpg.SymmetricKeyEncSessionPacket;
 import org.bouncycastle.bcpg.SymmetricKeyUtils;
-import org.bouncycastle.crypto.digests.SHA256Digest;
-import org.bouncycastle.crypto.generators.HKDFBytesGenerator;
-import org.bouncycastle.crypto.params.HKDFParameters;
 import org.bouncycastle.jcajce.util.DefaultJcaJceHelper;
 import org.bouncycastle.jcajce.util.NamedJcaJceHelper;
 import org.bouncycastle.jcajce.util.ProviderJcaJceHelper;
@@ -144,13 +141,10 @@ public byte[] recoverAEADEncryptedSessionData(SymmetricKeyEncSessionPacket keyDa
 
                 byte[] hkdfInfo = keyData.getAAData(); // between v5 and v6, these bytes differ
                 int kekLen = SymmetricKeyUtils.getKeyLengthInOctets(keyData.getEncAlgorithm());
-                byte[] kek = new byte[kekLen];
 
                 // HKDF
                 // secretKey := HKDF_sha256(ikm, hkdfInfo).generate()
-                HKDFBytesGenerator hkdfGen = new HKDFBytesGenerator(new SHA256Digest()); // SHA256 is fixed
-                hkdfGen.init(new HKDFParameters(ikm, null, hkdfInfo));
-                hkdfGen.generateBytes(kek, 0, kek.length);
+                byte[] kek = JceAEADUtil.generateHKDFBytes(ikm, null, hkdfInfo, kekLen);
                 final SecretKey secretKey = new SecretKeySpec(kek, PGPUtil.getSymmetricCipherName(keyData.getEncAlgorithm()));
 
                 // AEAD
diff --git a/pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcePBEKeyEncryptionMethodGenerator.java b/pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcePBEKeyEncryptionMethodGenerator.java
@@ -15,11 +15,8 @@
 import org.bouncycastle.bcpg.S2K;
 import org.bouncycastle.bcpg.SymmetricKeyUtils;
 import org.bouncycastle.crypto.InvalidCipherTextException;
-import org.bouncycastle.crypto.digests.SHA256Digest;
-import org.bouncycastle.crypto.generators.HKDFBytesGenerator;
 import org.bouncycastle.crypto.modes.AEADCipher;
 import org.bouncycastle.crypto.params.AEADParameters;
-import org.bouncycastle.crypto.params.HKDFParameters;
 import org.bouncycastle.crypto.params.KeyParameter;
 import org.bouncycastle.jcajce.util.DefaultJcaJceHelper;
 import org.bouncycastle.jcajce.util.NamedJcaJceHelper;
@@ -150,15 +147,8 @@ protected byte[] encryptSessionInfo(int encAlgorithm, byte[] key, byte[] session
     }
 
     protected byte[] generateV6KEK(int kekAlgorithm, byte[] ikm, byte[] info)
-         throws PGPException
      {
-         HKDFBytesGenerator hkdf = new HKDFBytesGenerator(new SHA256Digest());
-         hkdf.init(new HKDFParameters(ikm, null, info));
-
-         int kekLen = SymmetricKeyUtils.getKeyLengthInOctets(kekAlgorithm);
-         byte[] kek = new byte[kekLen];
-         hkdf.generateBytes(kek, 0, kek.length);
-         return kek;
+         return JceAEADUtil.generateHKDFBytes(ikm, null, info, SymmetricKeyUtils.getKeyLengthInOctets(kekAlgorithm));
      }
 
      protected byte[] getEskAndTag(int kekAlgorithm, int aeadAlgorithm, byte[] sessionInfo, byte[] key, byte[] iv, byte[] info)
diff --git a/pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcePublicKeyDataDecryptorFactoryBuilder.java b/pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcePublicKeyDataDecryptorFactoryBuilder.java
@@ -17,7 +17,6 @@
 import javax.crypto.interfaces.DHKey;
 
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
-import org.bouncycastle.asn1.cryptlib.CryptlibObjectIdentifiers;
 import org.bouncycastle.asn1.edec.EdECObjectIdentifiers;
 import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
 import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
@@ -31,7 +30,6 @@
 import org.bouncycastle.bcpg.SymmetricKeyAlgorithmTags;
 import org.bouncycastle.bcpg.X25519PublicBCPGKey;
 import org.bouncycastle.bcpg.X448PublicBCPGKey;
-import org.bouncycastle.crypto.params.X25519PublicKeyParameters;
 import org.bouncycastle.jcajce.spec.UserKeyingMaterialSpec;
 import org.bouncycastle.jcajce.util.DefaultJcaJceHelper;
 import org.bouncycastle.jcajce.util.NamedJcaJceHelper;
@@ -257,7 +255,7 @@ private byte[] decryptSessionData(JcaPGPKeyConverter converter, PGPPrivateKey pr
             String agreementName;
             ECDHPublicBCPGKey ecKey = (ECDHPublicBCPGKey)pubKeyData.getKey();
             // XDH
-            if (ecKey.getCurveOID().equals(CryptlibObjectIdentifiers.curvey25519))
+            if (JcaJcePGPUtil.isX25519(ecKey.getCurveOID()))
             {
                 agreementName = RFC6637Utils.getXDHAlgorithm(pubKeyData);
                 if (pEnc.length != (1 + X25519PublicBCPGKey.LENGTH) || 0x40 != pEnc[0])
diff --git a/pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcePublicKeyKeyEncryptionMethodGenerator.java b/pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcePublicKeyKeyEncryptionMethodGenerator.java
@@ -17,15 +17,13 @@
 import javax.crypto.IllegalBlockSizeException;
 import javax.crypto.spec.SecretKeySpec;
 
-import org.bouncycastle.asn1.cryptlib.CryptlibObjectIdentifiers;
 import org.bouncycastle.asn1.nist.NISTObjectIdentifiers;
 import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
 import org.bouncycastle.asn1.x9.X962Parameters;
 import org.bouncycastle.bcpg.ECDHPublicBCPGKey;
 import org.bouncycastle.bcpg.PublicKeyAlgorithmTags;
 import org.bouncycastle.bcpg.PublicKeyPacket;
 import org.bouncycastle.bcpg.SymmetricKeyAlgorithmTags;
-import org.bouncycastle.internal.asn1.edec.EdECObjectIdentifiers;
 import org.bouncycastle.jcajce.spec.HybridValueParameterSpec;
 import org.bouncycastle.jcajce.spec.UserKeyingMaterialSpec;
 import org.bouncycastle.jcajce.util.DefaultJcaJceHelper;
@@ -101,7 +99,7 @@ protected byte[] encryptSessionInfo(PGPPublicKey pubKey, byte[] sessionInfo)
                 ECDHPublicBCPGKey ecKey = (ECDHPublicBCPGKey)pubKey.getPublicKeyPacket().getKey();
                 String keyEncryptionOID = RFC6637Utils.getKeyEncryptionOID(ecKey.getSymmetricKeyAlgorithm()).getId();
                 PublicKeyPacket pubKeyPacket = pubKey.getPublicKeyPacket();
-                if (ecKey.getCurveOID().equals(CryptlibObjectIdentifiers.curvey25519) || ecKey.getCurveOID().equals(EdECObjectIdentifiers.id_X25519))
+                if (JcaJcePGPUtil.isX25519(ecKey.getCurveOID()))
                 {
                     return getEncryptSessionInfo(pubKeyPacket, "X25519", cryptoPublicKey, keyEncryptionOID,
                         ecKey.getSymmetricKeyAlgorithm(), sessionInfo, RFC6637Utils.getXDHAlgorithm(pubKeyPacket),

Original file line number	Diff line number	Diff line change
`@@ -94,6 +94,7 @@ else if (s2k.getHashAlgorithm() != digestCalculator.getAlgorithm())`
`94`	`94`
`95`	`95`	`try`
`96`	`96`	`{`
	`97`	`+ byte[] iv = s2k != null? s2k.getIV() : null;`
`97`	`98`	`while (generatedBytes < keyBytes.length)`
`98`	`99`	`{`
`99`	`100`	`if (s2k != null)`
`@@ -103,8 +104,6 @@ else if (s2k.getHashAlgorithm() != digestCalculator.getAlgorithm())`
`103`	`104`	`dOut.write(0);`
`104`	`105`	`}`
`105`	`106`
`106`		`- byte[] iv = s2k.getIV();`
`107`		`-`
`108`	`107`	`switch (s2k.getType())`
`109`	`108`	`{`
`110`	`109`	`case S2K.SIMPLE:`
Original file line number	Diff line number	Diff line change
`@@ -122,7 +122,7 @@ public AsymmetricKeyParameter getPrivateKey(PGPPrivateKey privKey)`
`122`	`122`	`{`
`123`	`123`	`ECDHPublicBCPGKey ecdhPub = (ECDHPublicBCPGKey)pubPk.getKey();`
`124`	`124`
`125`		`- if (CryptlibObjectIdentifiers.curvey25519.equals(ecdhPub.getCurveOID()))`
	`125`	`+ if (BcUtil.isX25519(ecdhPub.getCurveOID()))`
`126`	`126`	`{`
`127`	`127`	`return PrivateKeyFactory.createKey(getPrivateKeyInfo(EdECObjectIdentifiers.id_X25519,`
`128`	`128`	`Arrays.reverseInPlace(BigIntegers.asUnsignedByteArray(((ECSecretBCPGKey)privPk).getX()))));`
`@@ -209,7 +209,7 @@ public AsymmetricKeyParameter getPublicKey(PGPPublicKey publicKey)`
`209`	`209`	`{`
`210`	`210`	`ECDHPublicBCPGKey ecdhK = (ECDHPublicBCPGKey)publicPk.getKey();`
`211`	`211`
`212`		`- if (ecdhK.getCurveOID().equals(CryptlibObjectIdentifiers.curvey25519))`
	`212`	`+ if (BcUtil.isX25519(ecdhK.getCurveOID()))`
`213`	`213`	`{`
`214`	`214`	`byte[] pEnc = BigIntegers.asUnsignedByteArray(ecdhK.getEncodedPoint());`
`215`	`215`	`// skip the 0x40 header byte.`
Original file line number	Diff line number	Diff line change
`@@ -3,7 +3,6 @@`
`3`	`3`	`import java.io.IOException;`
`4`	`4`	`import java.math.BigInteger;`
`5`	`5`
`6`		`-import org.bouncycastle.asn1.cryptlib.CryptlibObjectIdentifiers;`
`7`	`6`	`import org.bouncycastle.bcpg.AEADEncDataPacket;`
`8`	`7`	`import org.bouncycastle.bcpg.ECDHPublicBCPGKey;`
`9`	`8`	`import org.bouncycastle.bcpg.HashAlgorithmTags;`
`@@ -110,7 +109,7 @@ else if (keyAlgorithm == PublicKeyAlgorithmTags.ECDH)`
`110`	`109`
`111`	`110`	`ECDHPublicBCPGKey ecPubKey = (ECDHPublicBCPGKey)pgpPrivKey.getPublicKeyPacket().getKey();`
`112`	`111`	`// XDH`
`113`		`- if (ecPubKey.getCurveOID().equals(CryptlibObjectIdentifiers.curvey25519))`
	`112`	`+ if (BcUtil.isX25519(ecPubKey.getCurveOID()))`
`114`	`113`	`{`
`115`	`114`	`if (pEnc.length != 1 + X25519PublicKeyParameters.KEY_SIZE \|\| 0x40 != pEnc[0])`
`116`	`115`	`{`