New JCE Functionality

• Add Ed25519 / Ed448 support to Signature, KeyPairGenerator, and KeyFactory

• Add EdDSA key and certificate storage to WKS KeyStore

• Implement EdECPublicKey and EdECPrivateKey on JDK 15+

• Add AES-XTS Cipher support as AES/XTS/NoPadding

• Add AES Key Wrap (RFC 3394) Cipher support as AESWrap and AES/KW/NoPadding

• Add AES-CFB Cipher support for CFB128, CFB8, and CFB1

• Add SHAKE128 and SHAKE256 MessageDigest support

• Add RSA/ECB/NoPadding Cipher for raw RSA operations

New JNI Functionality

• Add new Ed448, AesXts, AesKeyWrap, AesCfb, and Shake classes

• Add Ed25519 DER key import/export plus context and pre-hash sign/verify

• Add raw RSA support: Rsa.direct()

• Add native AES-GCM IV generation: AesGcm.setIV() and AesGcm.encryptEx()

• Add WolfCrypt.getDigestSize() wrapping native wc_HashGetDigestSize()

• Add a WolfCrypt.encryptedKeyPemToDer() overload

New Property Support

• wolfjce.wks.maxIterations Security property – Bound the PBKDF2 iteration count accepted when loading WKS KeyStores (default 10,000,000)

Bug Fixes & Reliability Improvements

• JCE exception behavior – Signature throws SignatureException for wrong-length RSA signatures and native signing errors, oversized RSA encrypt input throws IllegalBlockSizeException, AES-CCM tag mismatches throw AEADBadTagException, and Cipher.update() throws ShortBufferException before input is consumed.

• AES parameters – Enforced 7 to 13 byte AES-CCM nonces, included the CCM auth tag in getOutputSize(), returned random IVs from getParameters() before init(), and allowed AES-GCM decrypt init() with null parameters.

• RSA and DH – Rejected invalid RSA key sizes and exponents at KeyPairGenerator.initialize(), fixed default-salt RSA-PSS verify for small keys, fixed DH KeyAgreement.init() handling of DHParameterSpec, and fixed DH shared secrets for primes over 4096 bits, such as ffdhe8192.

• Certificate path validation – Fixed PKIXCertPathChecker certificate ordering, PREFER_CRLS and NO_FALLBACK revocation behavior, reporting of revoked stapled OCSP responses as BasicReason.REVOKED, and evaluation of all keySize operators in jdk.certpath.disabledAlgorithms.

• WKS KeyStore – Fixed loading from streams that return partial reads and ML-DSA key and cert matching with NULL SPKI algorithm parameters, and WolfCryptPBEKey passwords are now compared in constant time.

• FIPS – Fixed FIPS RSA, DH, and ECC JNI wrappers passing wrong sizes on big-endian platforms, and the FIPS error callback leaving native threads attached to the JVM.

• Memory safety – Stricter IV, key, input, and output buffer validation across native AES, 3DES, ChaCha, PBKDF, MD5, SHA, RSA, and ECC wrappers, overflow-safe bounds checks, and fixes for native context leaks.

New Examples

• Added EdDSAExample, AesXtsExample, AesKeyWrapExample, AesCfbExample, and ShakeExample for new algorithms

• Added Ed25519 / Ed448 certs and WKS KeyStores, updated expired example certs, keys, and KeyStores

• Example scripts now run from any directory and handle paths containing spaces

• Android example native libraries are linked with 16 KB page alignment for Android 15+

Expanded Testing & CI Infrastructure

• GitHub Actions EdDSA build matrix on Linux and macOS

• AES-XTS non-streaming fallback testing, and AES Key Wrap and raw RSA enabled in the Windows Visual Studio build

• Known-answer and interop tests for the new AES modes, SHAKE, and EdDSA, plus new DH and ECC FIPS JNI wrapper tests

wolfCrypt JNI/JCE 1.12.0 can be downloaded from the wolfSSL download page, and an updated version of the wolfCrypt JNI/JCE User Manual can be found here. Full details on this release can be seen in the ChangeLog.md on GitHub. For any questions or to get help using wolfSSL products in your projects, contact us at support@wolfssl.com.

If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.

Download wolfSSL Now