javax.crypto.CipherSpi.engineUpdate(ByteBuffer input, ByteBuffer output) does not throw a NullPointerException when output is null. According to the spec, a NPE should be thrown if either parameter is null. A NPE is correctly thrown if input is null.