A DESCRIPTION OF THE REQUEST :
KeyAgreement provides a "public SecretKey generateSecret (String algorithm)" method which is sufficient for some algorithms but not all (e.g. AES with its variable key length). As a workaround the "byte[] generateSecret()" method is normally ok - except when using hardware tokens where you'd really like the derived secret to stay on the token.

My recommendation would be to add two methods (to mirror what's available in the initialize() methods of javax.crypto.KeyGenerator.

public SecretKey generateSecret (String algorithm, int keysize);
public SecretKey generateSecret (String algorithm, AlgorithmParameterSpec params);

Less important would be to add the variants on the above to provide a random number generator:

public SecretKey generateSecret (String algorithm, int keysize, SecureRandom rand);
pubic SecretKey generateSecret (String algorithm, AlgorithmParameterSpec params, SecureRandom rand);



JUSTIFICATION :
As noted above, extracting a calculated shared secret from a hardware security token may be either infeasible, unsecure or both. A method to derive a SecretKey object that remains on the token seems to require a bit more information than can be passed with the current implementation.