private static byte[] wrapM2015(SecretKey secretKey, PublicKey recipientKey, ParamsInterface recipientTransportParameters) throws Exception {
String keyAlgorithm = recipientKey.getAlgorithm();
String ephKeyAlgorithm = "GOST3410DHELEPH";
if (keyAlgorithm.equalsIgnoreCase("GOST3410_2012_256")) {
ephKeyAlgorithm = "GOST3410DHEPH_2012_256";
} else if (keyAlgorithm.equalsIgnoreCase("GOST3410_2012_512")) {
ephKeyAlgorithm = "GOST3410DHEPH_2012_512";
}

KeyPairGenerator kgp = KeyPairGenerator.getInstance(ephKeyAlgorithm, "Crypto");
AlgorithmParameterSpec spec = new X509PublicKeySpec(recipientKey.getEncoded());
kgp.initialize(spec);
KeyPair ephPair = kgp.generateKeyPair();
PrivateKey privateKey = ephPair.getPrivate();
PublicKey publicKey = ephPair.getPublic();
byte[] syncro = new byte[16];
SecureRandom random = SecureRandom.getInstance("CPRandom", "JCP");
random.nextBytes(syncro);
IvParameterSpec iv = new IvParameterSpec(syncro);
KeyAgreement ka = KeyAgreement.getInstance(privateKey.getAlgorithm(), "Crypto");
ka.init(privateKey, iv);
ka.doPhase(recipientKey, true);
Key dh = ka.generateSecret("GOST3412_2015_M");
Cipher cipher = Cipher.getInstance("GOST3412_2015_M/KEXP_2015_M_EXPORT/ISO10126Padding", "Crypto");
cipher.init(3, dh, recipientTransportParameters, (SecureRandom)null);
byte[] wrappedKey = cipher.wrap(secretKey);
Gost28147_89_EncryptedKey encryptedKey = new Gost28147_89_EncryptedKey();
Asn1BerDecodeBuffer decoder = new Asn1BerDecodeBuffer(wrappedKey);
encryptedKey.decode(decoder);
byte[] imita = encryptedKey.macKey.value;
byte[] wrapperKeyBytes = encryptedKey.encryptedKey.value;
byte[] publicKeyBytes = publicKey.getEncoded();
SubjectPublicKeyInfo publicKeyInfo = new SubjectPublicKeyInfo();
decoder = new Asn1BerDecodeBuffer(publicKeyBytes);
publicKeyInfo.decode(decoder);
GostR3410_KeyTransport keyTransport = new GostR3410_KeyTransport();
Asn1BerEncodeBuffer encoder = new Asn1BerEncodeBuffer();
keyTransport.sessionEncryptedKey = new Gost28147_89_EncryptedKey(wrapperKeyBytes, imita);
keyTransport.transportParameters = new GostR3410_TransportParameters(new Gost28147_89_ParamSet(recipientTransportParameters.getOID().value), publicKeyInfo, new Asn1OctetString(iv.getIV()));
keyTransport.encode(encoder);
return encoder.getMsgCopy();
}

Caused by: java.lang.NullPointerException
at ru.CryptoPro.JCP.Key.MagmaKExp15KeySpec.wrap(Unknown Source)
at ru.CryptoPro.Crypto.Cipher.GostCoreMagmaCipher.engineWrap(Unknown Source)
at ru.CryptoPro.Crypto.Cipher.BaseGostCipher.engineWrap(Unknown Source)
at java.base/javax.crypto.Cipher.wrap(Cipher.java:2535)

EnvelopedSignature - здесь все внутри.

ByteArrayOutputStream envelopedByteArrayOutStream = new ByteArrayOutputStream();
EnvelopedSignature signature = new EnvelopedSignature(EncryptionKeyAlgorithm.ekaKuznechik);

signature.addKeyAgreeRecipient(certificates.stream().findFirst().get());
signature.open(envelopedByteArrayOutStream);
signature.update(data);

signature.close();

return envelopedByteArrayOutStream.toByteArray();

Bad type on operand stack
Exception Details:
Location:
ru/CryptoPro/CAdES/pc_1/pc_0/cl_3.generate(Lorg/bouncycastle/operator/GenericKey;)Lorg/bouncycastle/asn1/cms/RecipientInfo; @974: invokespecial
Reason:
Type 'org/bouncycastle/asn1/DERObjectIdentifier' (current frame, stack[2]) is not assignable to 'org/bouncycastle/asn1/ASN1ObjectIdentifier'
Current Frame:
bci: @974
flags: { }
locals: { 'ru/CryptoPro/CAdES/pc_1/pc_0/cl_3', top, 'java/security/PrivateKey', 'java/security/PublicKey', 'javax/crypto/SecretKey', top, top, top, top, top, top, top, top, top, top, top, top, top, top, top, top, '[B', top, top, top, top, 'ru/CryptoPro/JCP/params/OID', top, '[B', top, 'org/bouncycastle/asn1/DERObjectIdentifier', top, 'com/objsys/asn1j/runtime/Asn1BerEncodeBuffer', 'org/bouncycastle/asn1/ASN1InputStream', 'ru/CryptoPro/JCP/ASN/Gost28147_89_EncryptionSyntax/Gost28147_89_ParamSet', 'ru/CryptoPro/JCP/ASN/GostR3410_EncryptionSyntax/Gost28147_89_KeyWrapParameters', 'org/bouncycastle/asn1/ASN1Primitive' }
stack: { uninitialized 955, uninitialized 955, 'org/bouncycastle/asn1/DERObjectIdentifier', 'org/bouncycastle/asn1/ASN1Primitive' }

На выходе получаю ошибку

на старой версии 2.0.40132-A этот пример работал, но не мог расшифроваться:
"Ошибка расшифрования сеансового ключа зашифрованного CMS/PKCS#7 сообщения"

Еще надо учитывать, что в JCP поддержка Кузнечик/Магма появилась буквально в последней версии. В JCSP - существенно раньше.