I (randomly) generate an AES128-key for symmetrical encryption and use it to encrypt some data. That’s fine so far.

Then I need to transfer a secret-key (the AES128-key secured by my EC-key and the partners EC-certificate, SHA256 hashed and derived by ConcatKDF) beside the AES128 encrypted data to the partner to decrypt.

The partner should be able to generate from their EC-key, my EC-cert and the transferred secret-key, the AES128-key I used to encrypt the data – so they can decrypt the encrypted data by themself.

This is my approach.

public SecretKey createSecretKeyForTransfer (PrivateKey privk, X509Certificate cert, byte [] aeskey) throws Exception
{
    KeyAgreement ka = KeyAgreement.getInstance ("ECCDHwithSHA256CKDF", "BC");

    ka.init (privk, new UserKeyingMaterialSpec (randsecr));

    ka.doPhase (cert.getPublicKey (), true);

    SecretKey k = ka.generateSecret("AES[128]");
    return k;    // to share with partner to regenerate the aeskey at the other side
}

Unfortunately, it seems that the receiving partner is not able to recreate the AES128 key.

I am not very good in this things – and I am also not sure if ECCDHwithSHA256CKDF is usable for ConcatKDF.