bouncycastle: upgrade to version 1.56

Merge remote-tracking branch 'aosp/upstream-master' into merge-to-156

Test: ran the following cts modules: CtsLibcoreFileIOTestCases CtsLibcoreJavaUtilCollectionsTestCases CtsLibcoreJsr166TestCases CtsLibcoreLegacy22TestCases CtsLibcoreOjTestCases CtsLibcoreOkHttpTestCases CtsLibcoreTestCases
Bug: 31076342
Change-Id: Iceb926dc5a312b2047bf19d1c82fb16e42bc1461

13 files changed, 148 insertions, 22 deletions

diff --git a/bcpkix/src/main/java/org/bouncycastle/cert/ocsp/OCSPReqBuilder.java b/bcpkix/src/main/java/org/bouncycastle/cert/ocsp/OCSPReqBuilder.java
index b0cfb9ef..3f3c954a 100644
--- a/bcpkix/src/main/java/org/bouncycastle/cert/ocsp/OCSPReqBuilder.java
+++ b/bcpkix/src/main/java/org/bouncycastle/cert/ocsp/OCSPReqBuilder.java
@@ -75,9 +75,9 @@ public class OCSPReqBuilder
     }
 
     /**
-     * Set the requestor name to the passed in X500Principal
+     * Set the requestor name to the passed in X500Name
      * 
-     * @param requestorName a X500Principal representing the requestor name.
+     * @param requestorName an X500Name representing the requestor name.
      */
     public OCSPReqBuilder setRequestorName(
         X500Name requestorName)
@@ -176,7 +176,7 @@ public class OCSPReqBuilder
      * Generate an unsigned request
      * 
      * @return the OCSPReq
-     * @throws org.bouncycastle.ocsp.OCSPException
+     * @throws org.bouncycastle.cert.ocsp.OCSPException
      */
     public OCSPReq build()
         throws OCSPException
diff --git a/bcpkix/src/main/java/org/bouncycastle/cert/ocsp/RespID.java b/bcpkix/src/main/java/org/bouncycastle/cert/ocsp/RespID.java
index a0fd765a..4cd19ef9 100644
--- a/bcpkix/src/main/java/org/bouncycastle/cert/ocsp/RespID.java
+++ b/bcpkix/src/main/java/org/bouncycastle/cert/ocsp/RespID.java
@@ -48,7 +48,7 @@ public class RespID
         {
             if (!digCalc.getAlgorithmIdentifier().equals(HASH_SHA1))
             {
-                throw new IllegalArgumentException("only SHA-1 can be used with RespID");
+                throw new IllegalArgumentException("only SHA-1 can be used with RespID - found: " + digCalc.getAlgorithmIdentifier().getAlgorithm());
             }
 
             OutputStream     digOut = digCalc.getOutputStream();
diff --git a/bcpkix/src/main/java/org/bouncycastle/cms/CMSAbsentContent.java b/bcpkix/src/main/java/org/bouncycastle/cms/CMSAbsentContent.java
index f256e2a2..242d64bb 100644
--- a/bcpkix/src/main/java/org/bouncycastle/cms/CMSAbsentContent.java
+++ b/bcpkix/src/main/java/org/bouncycastle/cms/CMSAbsentContent.java
@@ -17,7 +17,7 @@ public class CMSAbsentContent
 
     public CMSAbsentContent()
     {
-        this(new ASN1ObjectIdentifier(CMSObjectIdentifiers.data.getId()));
+        this(CMSObjectIdentifiers.data);
     }
 
     public CMSAbsentContent(
diff --git a/bcpkix/src/main/java/org/bouncycastle/cms/DefaultCMSSignatureEncryptionAlgorithmFinder.java b/bcpkix/src/main/java/org/bouncycastle/cms/DefaultCMSSignatureEncryptionAlgorithmFinder.java
index e8ebc83e..780d4660 100644
--- a/bcpkix/src/main/java/org/bouncycastle/cms/DefaultCMSSignatureEncryptionAlgorithmFinder.java
+++ b/bcpkix/src/main/java/org/bouncycastle/cms/DefaultCMSSignatureEncryptionAlgorithmFinder.java
@@ -41,7 +41,7 @@ public class DefaultCMSSignatureEncryptionAlgorithmFinder
 
     public AlgorithmIdentifier findEncryptionAlgorithm(AlgorithmIdentifier signatureAlgorithm)
     {
-               // RFC3370 section 3.2
+               // RFC3370 section 3.2 with RFC 5754 update
         if (RSA_PKCS1d5.contains(signatureAlgorithm.getAlgorithm()))
         {
             return new AlgorithmIdentifier(PKCSObjectIdentifiers.rsaEncryption, DERNull.INSTANCE);
diff --git a/bcpkix/src/main/java/org/bouncycastle/cms/DefaultSignedAttributeTableGenerator.java b/bcpkix/src/main/java/org/bouncycastle/cms/DefaultSignedAttributeTableGenerator.java
index ddfd2ebd..fb268b29 100644
--- a/bcpkix/src/main/java/org/bouncycastle/cms/DefaultSignedAttributeTableGenerator.java
+++ b/bcpkix/src/main/java/org/bouncycastle/cms/DefaultSignedAttributeTableGenerator.java
@@ -51,8 +51,8 @@ public class DefaultSignedAttributeTableGenerator
 
     /**
      * Create a standard attribute table from the passed in parameters - this will
-     * normally include contentType, signingTime, and messageDigest. If the constructor
-     * using an AttributeTable was used, entries in it for contentType, signingTime, and
+     * normally include contentType, signingTime, messageDigest, and CMS algorithm protection.
+     * If the constructor using an AttributeTable was used, entries in it for contentType, signingTime, and
      * messageDigest will override the generated ones.
      *
      * @param parameters source parameters for table generation.
diff --git a/bcpkix/src/main/java/org/bouncycastle/cms/PasswordRecipient.java b/bcpkix/src/main/java/org/bouncycastle/cms/PasswordRecipient.java
index 7322fdcc..932c2762 100644
--- a/bcpkix/src/main/java/org/bouncycastle/cms/PasswordRecipient.java
+++ b/bcpkix/src/main/java/org/bouncycastle/cms/PasswordRecipient.java
@@ -1,5 +1,7 @@
 package org.bouncycastle.cms;
 
+import org.bouncycastle.asn1.DERNull;
+import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
 import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
 
 public interface PasswordRecipient
@@ -8,6 +10,34 @@ public interface PasswordRecipient
     public static final int PKCS5_SCHEME2 = 0;
     public static final int PKCS5_SCHEME2_UTF8 = 1;
 
+    static final class PRF
+    {
+        public static final PRF HMacSHA1 = new PRF("HMacSHA1", new AlgorithmIdentifier(PKCSObjectIdentifiers.id_hmacWithSHA1, DERNull.INSTANCE));
+        public static final PRF HMacSHA224 = new PRF("HMacSHA224", new AlgorithmIdentifier(PKCSObjectIdentifiers.id_hmacWithSHA224, DERNull.INSTANCE));
+        public static final PRF HMacSHA256 = new PRF("HMacSHA256", new AlgorithmIdentifier(PKCSObjectIdentifiers.id_hmacWithSHA256, DERNull.INSTANCE));
+        public static final PRF HMacSHA384 = new PRF("HMacSHA384", new AlgorithmIdentifier(PKCSObjectIdentifiers.id_hmacWithSHA384, DERNull.INSTANCE));
+        public static final PRF HMacSHA512 = new PRF("HMacSHA512", new AlgorithmIdentifier(PKCSObjectIdentifiers.id_hmacWithSHA512, DERNull.INSTANCE));
+
+        private final String hmac;
+        final AlgorithmIdentifier prfAlgID;
+
+        private PRF(String hmac, AlgorithmIdentifier prfAlgID)
+        {
+            this.hmac = hmac;
+            this.prfAlgID = prfAlgID;
+        }
+
+        public String getName()
+        {
+            return hmac;
+        }
+
+        public AlgorithmIdentifier getAlgorithmID()
+        {
+            return prfAlgID;
+        }
+    }
+
     byte[] calculateDerivedKey(int schemeID, AlgorithmIdentifier derivationAlgorithm, int keySize)
         throws CMSException;
 
diff --git a/bcpkix/src/main/java/org/bouncycastle/cms/SignerInfoGeneratorBuilder.java b/bcpkix/src/main/java/org/bouncycastle/cms/SignerInfoGeneratorBuilder.java
index 7a47a2f8..ccb6e2cf 100644
--- a/bcpkix/src/main/java/org/bouncycastle/cms/SignerInfoGeneratorBuilder.java
+++ b/bcpkix/src/main/java/org/bouncycastle/cms/SignerInfoGeneratorBuilder.java
@@ -29,10 +29,11 @@ public class SignerInfoGeneratorBuilder
         this(digestProvider, new DefaultCMSSignatureEncryptionAlgorithmFinder());
     }
 
-        /**
-     *  Base constructor.
+    /**
+     * Base constructor with a particular finder for signature algorithms.
      *
-     * @param digestProvider  a provider of digest calculators for the algorithms required in the signature and attribute calculations.
+     * @param digestProvider a provider of digest calculators for the algorithms required in the signature and attribute calculations.
+     * @param sigEncAlgFinder finder for algorithm IDs to store for the signature encryption/signature algorithm field.
      */
     public SignerInfoGeneratorBuilder(DigestCalculatorProvider digestProvider, CMSSignatureEncryptionAlgorithmFinder sigEncAlgFinder)
     {
diff --git a/bcpkix/src/main/java/org/bouncycastle/cms/jcajce/JcaSignerInfoGeneratorBuilder.java b/bcpkix/src/main/java/org/bouncycastle/cms/jcajce/JcaSignerInfoGeneratorBuilder.java
index 4a0e7ca4..17a2f093 100644
--- a/bcpkix/src/main/java/org/bouncycastle/cms/jcajce/JcaSignerInfoGeneratorBuilder.java
+++ b/bcpkix/src/main/java/org/bouncycastle/cms/jcajce/JcaSignerInfoGeneratorBuilder.java
@@ -6,6 +6,8 @@ import java.security.cert.X509Certificate;
 import org.bouncycastle.cert.X509CertificateHolder;
 import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder;
 import org.bouncycastle.cms.CMSAttributeTableGenerator;
+import org.bouncycastle.cms.CMSSignatureEncryptionAlgorithmFinder;
+import org.bouncycastle.cms.DefaultCMSSignatureEncryptionAlgorithmFinder;
 import org.bouncycastle.cms.SignerInfoGenerator;
 import org.bouncycastle.cms.SignerInfoGeneratorBuilder;
 import org.bouncycastle.operator.ContentSigner;
@@ -16,9 +18,25 @@ public class JcaSignerInfoGeneratorBuilder
 {
     private SignerInfoGeneratorBuilder builder;
 
+    /**
+     *  Base constructor.
+     *
+     * @param digestProvider  a provider of digest calculators for the algorithms required in the signature and attribute calculations.
+     */
     public JcaSignerInfoGeneratorBuilder(DigestCalculatorProvider digestProvider)
     {
-        builder = new SignerInfoGeneratorBuilder(digestProvider);
+        this(digestProvider, new DefaultCMSSignatureEncryptionAlgorithmFinder());
+    }
+
+    /**
+     * Base constructor with a particular finder for signature algorithms.
+     *
+     * @param digestProvider a provider of digest calculators for the algorithms required in the signature and attribute calculations.
+     * @param sigEncAlgFinder finder for algorithm IDs to store for the signature encryption/signature algorithm field.
+     */
+    public JcaSignerInfoGeneratorBuilder(DigestCalculatorProvider digestProvider, CMSSignatureEncryptionAlgorithmFinder sigEncAlgFinder)
+    {
+        builder = new SignerInfoGeneratorBuilder(digestProvider, sigEncAlgFinder);
     }
 
     /**
diff --git a/bcpkix/src/main/java/org/bouncycastle/operator/DefaultDigestAlgorithmIdentifierFinder.java b/bcpkix/src/main/java/org/bouncycastle/operator/DefaultDigestAlgorithmIdentifierFinder.java
index dc2c431b..57920181 100644
--- a/bcpkix/src/main/java/org/bouncycastle/operator/DefaultDigestAlgorithmIdentifierFinder.java
+++ b/bcpkix/src/main/java/org/bouncycastle/operator/DefaultDigestAlgorithmIdentifierFinder.java
@@ -6,6 +6,8 @@ import java.util.Map;
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
 import org.bouncycastle.asn1.DERNull;
 // BEGIN android-removed
+// import org.bouncycastle.asn1.bc.BCObjectIdentifiers;
+// import org.bouncycastle.asn1.bsi.BSIObjectIdentifiers;
 // import org.bouncycastle.asn1.cryptopro.CryptoProObjectIdentifiers;
 // END android-removed
 import org.bouncycastle.asn1.nist.NISTObjectIdentifiers;
@@ -51,6 +53,14 @@ public class DefaultDigestAlgorithmIdentifierFinder
         digestOids.put(X9ObjectIdentifiers.ecdsa_with_SHA512, NISTObjectIdentifiers.id_sha512);
         digestOids.put(X9ObjectIdentifiers.id_dsa_with_sha1, OIWObjectIdentifiers.idSHA1);
 
+        // BEGIN android-removed
+        // digestOids.put(BSIObjectIdentifiers.ecdsa_plain_SHA1, OIWObjectIdentifiers.idSHA1);
+        // digestOids.put(BSIObjectIdentifiers.ecdsa_plain_SHA224, NISTObjectIdentifiers.id_sha224);
+        // digestOids.put(BSIObjectIdentifiers.ecdsa_plain_SHA256, NISTObjectIdentifiers.id_sha256);
+        // digestOids.put(BSIObjectIdentifiers.ecdsa_plain_SHA384, NISTObjectIdentifiers.id_sha384);
+        // digestOids.put(BSIObjectIdentifiers.ecdsa_plain_SHA512, NISTObjectIdentifiers.id_sha512);
+        // END android-removed
+
         digestOids.put(NISTObjectIdentifiers.dsa_with_sha224, NISTObjectIdentifiers.id_sha224);
         digestOids.put(NISTObjectIdentifiers.dsa_with_sha256, NISTObjectIdentifiers.id_sha256);
         digestOids.put(NISTObjectIdentifiers.dsa_with_sha384, NISTObjectIdentifiers.id_sha384);
@@ -63,8 +73,31 @@ public class DefaultDigestAlgorithmIdentifierFinder
         //
         // digestOids.put(CryptoProObjectIdentifiers.gostR3411_94_with_gostR3410_94, CryptoProObjectIdentifiers.gostR3411);
         // digestOids.put(CryptoProObjectIdentifiers.gostR3411_94_with_gostR3410_2001, CryptoProObjectIdentifiers.gostR3411);
+        // digestOids.put(NISTObjectIdentifiers.id_rsassa_pkcs1_v1_5_with_sha3_224, NISTObjectIdentifiers.id_sha3_224);
+        // digestOids.put(NISTObjectIdentifiers.id_rsassa_pkcs1_v1_5_with_sha3_256, NISTObjectIdentifiers.id_sha3_256);
+        // digestOids.put(NISTObjectIdentifiers.id_rsassa_pkcs1_v1_5_with_sha3_384, NISTObjectIdentifiers.id_sha3_384);
+        // digestOids.put(NISTObjectIdentifiers.id_rsassa_pkcs1_v1_5_with_sha3_512, NISTObjectIdentifiers.id_sha3_512);
+        // digestOids.put(NISTObjectIdentifiers.id_dsa_with_sha3_224, NISTObjectIdentifiers.id_sha3_224);
+        // digestOids.put(NISTObjectIdentifiers.id_dsa_with_sha3_256, NISTObjectIdentifiers.id_sha3_256);
+        // digestOids.put(NISTObjectIdentifiers.id_dsa_with_sha3_384, NISTObjectIdentifiers.id_sha3_384);
+        // digestOids.put(NISTObjectIdentifiers.id_dsa_with_sha3_512, NISTObjectIdentifiers.id_sha3_512);
+        // digestOids.put(NISTObjectIdentifiers.id_ecdsa_with_sha3_224, NISTObjectIdentifiers.id_sha3_224);
+        // digestOids.put(NISTObjectIdentifiers.id_ecdsa_with_sha3_256, NISTObjectIdentifiers.id_sha3_256);
+        // digestOids.put(NISTObjectIdentifiers.id_ecdsa_with_sha3_384, NISTObjectIdentifiers.id_sha3_384);
+        // digestOids.put(NISTObjectIdentifiers.id_ecdsa_with_sha3_512, NISTObjectIdentifiers.id_sha3_512);
+        //
+        // digestOids.put(TeleTrusTObjectIdentifiers.rsaSignatureWithripemd128, TeleTrusTObjectIdentifiers.ripemd128);
+        // digestOids.put(TeleTrusTObjectIdentifiers.rsaSignatureWithripemd160, TeleTrusTObjectIdentifiers.ripemd160);
+        // digestOids.put(TeleTrusTObjectIdentifiers.rsaSignatureWithripemd256, TeleTrusTObjectIdentifiers.ripemd256);
+        //
+        // digestOids.put(CryptoProObjectIdentifiers.gostR3411_94_with_gostR3410_94, CryptoProObjectIdentifiers.gostR3411);
+        // digestOids.put(CryptoProObjectIdentifiers.gostR3411_94_with_gostR3410_2001, CryptoProObjectIdentifiers.gostR3411);
+        //
+        // digestOids.put(BCObjectIdentifiers.sphincs256_with_SHA3_512, NISTObjectIdentifiers.id_sha3_512);
+        // digestOids.put(BCObjectIdentifiers.sphincs256_with_SHA512, NISTObjectIdentifiers.id_sha512);
         // END android-removed
 
+
         digestNameToOids.put("SHA-1", OIWObjectIdentifiers.idSHA1);
         digestNameToOids.put("SHA-224", NISTObjectIdentifiers.id_sha224);
         digestNameToOids.put("SHA-256", NISTObjectIdentifiers.id_sha256);
diff --git a/bcpkix/src/main/java/org/bouncycastle/operator/DefaultSignatureAlgorithmIdentifierFinder.java b/bcpkix/src/main/java/org/bouncycastle/operator/DefaultSignatureAlgorithmIdentifierFinder.java
index f6a54821..77f358a0 100644
--- a/bcpkix/src/main/java/org/bouncycastle/operator/DefaultSignatureAlgorithmIdentifierFinder.java
+++ b/bcpkix/src/main/java/org/bouncycastle/operator/DefaultSignatureAlgorithmIdentifierFinder.java
@@ -10,6 +10,7 @@ import org.bouncycastle.asn1.ASN1Integer;
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
 import org.bouncycastle.asn1.DERNull;
 // BEGIN android-removed
+// import org.bouncycastle.asn1.bc.BCObjectIdentifiers;
 // import org.bouncycastle.asn1.bsi.BSIObjectIdentifiers;
 // import org.bouncycastle.asn1.cryptopro.CryptoProObjectIdentifiers;
 // import org.bouncycastle.asn1.eac.EACObjectIdentifiers;
@@ -84,6 +85,7 @@ public class DefaultSignatureAlgorithmIdentifierFinder
         algorithms.put("SHA256WITHECDSA", X9ObjectIdentifiers.ecdsa_with_SHA256);
         algorithms.put("SHA384WITHECDSA", X9ObjectIdentifiers.ecdsa_with_SHA384);
         algorithms.put("SHA512WITHECDSA", X9ObjectIdentifiers.ecdsa_with_SHA512);
+
         // BEGIN android-removed
         // algorithms.put("GOST3411WITHGOST3410", CryptoProObjectIdentifiers.gostR3411_94_with_gostR3410_94);
         // algorithms.put("GOST3411WITHGOST3410-94", CryptoProObjectIdentifiers.gostR3411_94_with_gostR3410_94);
@@ -101,7 +103,10 @@ public class DefaultSignatureAlgorithmIdentifierFinder
         // algorithms.put("SHA256WITHCVC-ECDSA", EACObjectIdentifiers.id_TA_ECDSA_SHA_256);
         // algorithms.put("SHA384WITHCVC-ECDSA", EACObjectIdentifiers.id_TA_ECDSA_SHA_384);
         // algorithms.put("SHA512WITHCVC-ECDSA", EACObjectIdentifiers.id_TA_ECDSA_SHA_512);
+        // algorithms.put("SHA3-512WITHSPHINCS256", BCObjectIdentifiers.sphincs256_with_SHA3_512);
+        // algorithms.put("SHA512WITHSPHINCS256", BCObjectIdentifiers.sphincs256_with_SHA512);
         // END android-removed
+
         //
         // According to RFC 3279, the ASN.1 encoding SHALL (id-dsa-with-sha1) or MUST (ecdsa-with-SHA*) omit the parameters field.
         // The parameters field SHALL be NULL for RSA based signature algorithms.
@@ -125,6 +130,14 @@ public class DefaultSignatureAlgorithmIdentifierFinder
         // noParams.add(CryptoProObjectIdentifiers.gostR3411_94_with_gostR3410_2001);
         // END android-removed
 
+        // BEGIN android-removed
+        //
+        // SPHINCS-256
+        //
+        // noParams.add(BCObjectIdentifiers.sphincs256_with_SHA512);
+        // noParams.add(BCObjectIdentifiers.sphincs256_with_SHA3_512);
+        // END android-removed
+
         //
         // PKCS 1.5 encrypted  algorithms
         //
diff --git a/bcpkix/src/main/java/org/bouncycastle/operator/bc/BcDefaultDigestProvider.java b/bcpkix/src/main/java/org/bouncycastle/operator/bc/BcDefaultDigestProvider.java
index 805dc479..74c0aa29 100644
--- a/bcpkix/src/main/java/org/bouncycastle/operator/bc/BcDefaultDigestProvider.java
+++ b/bcpkix/src/main/java/org/bouncycastle/operator/bc/BcDefaultDigestProvider.java
@@ -28,6 +28,9 @@ import org.bouncycastle.crypto.digests.SHA1Digest;
 import org.bouncycastle.crypto.digests.SHA224Digest;
 import org.bouncycastle.crypto.digests.SHA256Digest;
 import org.bouncycastle.crypto.digests.SHA384Digest;
+// BEGIN android-removed
+// import org.bouncycastle.crypto.digests.SHA3Digest;
+// END android-removed
 import org.bouncycastle.crypto.digests.SHA512Digest;
 import org.bouncycastle.operator.OperatorCreationException;
 
@@ -75,14 +78,42 @@ public class BcDefaultDigestProvider
                 return new SHA512Digest();
             }
         });
-        table.put(PKCSObjectIdentifiers.md5, new BcDigestProvider()
-        {
-            public ExtendedDigest get(AlgorithmIdentifier digestAlgorithmIdentifier)
-            {
-                return new MD5Digest();
-            }
-        });
         // BEGIN android-removed
+        // table.put(NISTObjectIdentifiers.id_sha3_224, new BcDigestProvider()
+        // {
+        //     public ExtendedDigest get(AlgorithmIdentifier digestAlgorithmIdentifier)
+        //     {
+        //         return new SHA3Digest(224);
+        //     }
+        // });
+        // table.put(NISTObjectIdentifiers.id_sha3_256, new BcDigestProvider()
+        // {
+        //     public ExtendedDigest get(AlgorithmIdentifier digestAlgorithmIdentifier)
+        //     {
+        //         return new SHA3Digest(256);
+        //     }
+        // });
+        // table.put(NISTObjectIdentifiers.id_sha3_384, new BcDigestProvider()
+        // {
+        //     public ExtendedDigest get(AlgorithmIdentifier digestAlgorithmIdentifier)
+        //     {
+        //         return new SHA3Digest(384);
+        //     }
+        // });
+        // table.put(NISTObjectIdentifiers.id_sha3_512, new BcDigestProvider()
+        // {
+        //     public ExtendedDigest get(AlgorithmIdentifier digestAlgorithmIdentifier)
+        //     {
+        //         return new SHA3Digest(512);
+        //     }
+        // });
+        // table.put(PKCSObjectIdentifiers.md5, new BcDigestProvider()
+        // {
+        //     public ExtendedDigest get(AlgorithmIdentifier digestAlgorithmIdentifier)
+        //     {
+        //         return new MD5Digest();
+        //     }
+        // });
         // table.put(PKCSObjectIdentifiers.md4, new BcDigestProvider()
         // {
         //     public ExtendedDigest get(AlgorithmIdentifier digestAlgorithmIdentifier)
diff --git a/bcpkix/src/main/java/org/bouncycastle/operator/jcajce/JcaContentSignerBuilder.java b/bcpkix/src/main/java/org/bouncycastle/operator/jcajce/JcaContentSignerBuilder.java
index 31af916f..55831943 100644
--- a/bcpkix/src/main/java/org/bouncycastle/operator/jcajce/JcaContentSignerBuilder.java
+++ b/bcpkix/src/main/java/org/bouncycastle/operator/jcajce/JcaContentSignerBuilder.java
@@ -59,6 +59,7 @@ public class JcaContentSignerBuilder
         try
         {
             final Signature sig = helper.createSignature(sigAlgId);
+            final AlgorithmIdentifier signatureAlgId = sigAlgId;
 
             if (random != null)
             {
@@ -75,7 +76,7 @@ public class JcaContentSignerBuilder
 
                 public AlgorithmIdentifier getAlgorithmIdentifier()
                 {
-                    return sigAlgId;
+                    return signatureAlgId;
                 }
 
                 public OutputStream getOutputStream()
diff --git a/bcpkix/src/main/java/org/bouncycastle/operator/jcajce/OperatorHelper.java b/bcpkix/src/main/java/org/bouncycastle/operator/jcajce/OperatorHelper.java
index 19d46ec9..532d3b51 100644
--- a/bcpkix/src/main/java/org/bouncycastle/operator/jcajce/OperatorHelper.java
+++ b/bcpkix/src/main/java/org/bouncycastle/operator/jcajce/OperatorHelper.java
@@ -383,7 +383,7 @@ class OperatorHelper
         String name = MessageDigestUtils.getDigestName(oid);
 
         int dIndex = name.indexOf('-');
-        if (dIndex > 0)
+        if (dIndex > 0 && !name.startsWith("SHA3"))
         {
             return name.substring(0, dIndex) + name.substring(dIndex + 1);
         }
@@ -394,7 +394,6 @@ class OperatorHelper
     public X509Certificate convertCertificate(X509CertificateHolder certHolder)
         throws CertificateException
     {
-
         try
         {
             CertificateFactory certFact = helper.createCertificateFactory("X.509");