From cdfa852eea28e6665f310ebb2d875376e7e21385 Mon Sep 17 00:00:00 2001
From: Mark Atwood <mark@wolfssl.com>
Date: Mon, 10 Aug 2026 13:52:30 -0700
Subject: [PATCH] fix: allow ECDH KeyAgreement init() reuse

---
 .../wolfssl/provider/jce/WolfCryptKeyAgreement.java   | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/main/java/com/wolfssl/provider/jce/WolfCryptKeyAgreement.java b/src/main/java/com/wolfssl/provider/jce/WolfCryptKeyAgreement.java
index 29bb8746..2f412249 100644
--- a/src/main/java/com/wolfssl/provider/jce/WolfCryptKeyAgreement.java
+++ b/src/main/java/com/wolfssl/provider/jce/WolfCryptKeyAgreement.java
@@ -603,6 +603,17 @@ private void wcInitECDHParams(Key key, AlgorithmParameterSpec params)
                 "ECC curve is null, please check algorithm parameters");
         }
 
+        /* Release and recreate native structs to support re-initialization.
+         * JCE requires KeyAgreement.init() to be callable multiple times. */
+        if (this.ecPrivate != null) {
+            this.ecPrivate.releaseNativeStruct();
+        }
+        this.ecPrivate = new Ecc();
+        if (this.ecPublic != null) {
+            this.ecPublic.releaseNativeStruct();
+        }
+        this.ecPublic = new Ecc();
+
         privKeyBytes = ecKey.getS().toByteArray();
 
         try {