protected SecretKey engineGenerateSecret(KeySpec spec)
      throws InvalidKeySpecException
   {
      if (!(spec instanceof PBEKeySpec)) {
         throw new InvalidKeySpecException("not a PBEKeySpec");
      }
      IRandom kdf = PRNGFactory.getInstance("PBKDF2-"+macName);
      HashMap attr = new HashMap();
      attr.put(IPBE.PASSWORD, ((PBEKeySpec) spec).getPassword());
      byte[] salt = ((PBEKeySpec) spec).getSalt();
      if (salt == null) {
         salt = new byte[0];
      }
      attr.put(IPBE.SALT, salt);
      int ic = ((PBEKeySpec) spec).getIterationCount();
      if (ic <= 0) {
         ic = DEFAULT_ITERATION_COUNT;
      }
      attr.put(IPBE.ITERATION_COUNT, new Integer(ic));
      kdf.init(attr);
      int len = ((PBEKeySpec) spec).getKeyLength();
      if (len <= 0) {
         len = DEFAULT_KEY_LEN;
      }
      byte[] dk = new byte[len];
      try {
         kdf.nextBytes(dk, 0, len);
      } catch (LimitReachedException lre) {
         throw new IllegalArgumentException(lre.toString());
      }

      return new SecretKeySpec(dk, "PBKDF2");
   }