GCMParameterSpec and authentication tag

If your BC version is <= 1.50 and if it's trying to do XML encryption with AES in GCM mode, then you can try

setting this system property:

org.apache.xml.security.cipher.gcm.useIvParameterSpec=true

That's because BC <= 1.50 doesn't support the new javax.crypto.spec.GCMParameterSpec that exists in Java 7+ (which is otherwise found reflectively), and instead requires use of the older javax.crypto.spec.IvParameterSpec.IvParameterSpec.

cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(sharedKey, "AES/GCM/NoPadding"), new GCMParameterSpec(128, ivBytes));

The authentication tag can be specified by using the GCMParameterSpec. The default length of authentication tag is 128.