src/java.base/share/classes/java/security/KeyStoreSpi.java

@@ -477,10 +477,14 @@
                 throw new UnsupportedOperationException
                     ("trusted certificate entries are not password-protected");
             } else if (engineIsKeyEntry(alias)) {
                 KeyStore.PasswordProtection pp =
                         (KeyStore.PasswordProtection)protParam;
+                if (pp.getProtectionAlgorithm() != null) {
+                    throw new KeyStoreException(
+                        "unsupported password protection algorithm");
+                }
                 char[] password = pp.getPassword();
 
                 Key key = engineGetKey(alias, password);
                 if (key instanceof PrivateKey) {
                     Certificate[] chain = engineGetCertificateChain(alias);

@@ -522,11 +526,15 @@
             throw new KeyStoreException("unsupported protection parameter");
         }
         KeyStore.PasswordProtection pProtect = null;
         if (protParam != null) {
             pProtect = (KeyStore.PasswordProtection)protParam;
+            if (pProtect.getProtectionAlgorithm() != null) {
+                throw new KeyStoreException(
+                    "unsupported password protection algorithm");
         }
+        }
 
         // set entry
         if (entry instanceof KeyStore.TrustedCertificateEntry) {
             if (protParam != null && pProtect.getPassword() != null) {
                 // pre-1.5 style setCertificateEntry did not allow password