The following checking for key in the makeSessionKey() method is redundant as it the same checking has been performance before calling the method.

        if (k == null) {
            throw new InvalidKeyException("Empty key");
        }
        if (!isKeySizeValid(k.length)) {
             throw new InvalidKeyException("Invalid AES key length: " +
                                           k.length + " bytes");
        }