diff --git a/pkix/src/main/java/org/bouncycastle/cert/crmf/CertificateRequestMessage.java b/pkix/src/main/java/org/bouncycastle/cert/crmf/CertificateRequestMessage.java
index e267dcdba7..9c608cd389 100644
--- a/pkix/src/main/java/org/bouncycastle/cert/crmf/CertificateRequestMessage.java
+++ b/pkix/src/main/java/org/bouncycastle/cert/crmf/CertificateRequestMessage.java
@@ -16,6 +16,7 @@
 import org.bouncycastle.asn1.crmf.PKMACValue;
 import org.bouncycastle.asn1.crmf.POPOSigningKey;
 import org.bouncycastle.asn1.crmf.ProofOfPossession;
+import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
 import org.bouncycastle.cert.CertIOException;
 import org.bouncycastle.operator.ContentVerifier;
 import org.bouncycastle.operator.ContentVerifierProvider;
@@ -146,6 +147,10 @@ public Control getControl(ASN1ObjectIdentifier type)
             {
                 return new AuthenticatorControl(ASN1UTF8String.getInstance(found.getValue()));
             }
+            if (found.getType().equals(CRMFObjectIdentifiers.id_regCtrl_protocolEncrKey))
+            {
+                return new ProtocolEncrKeyControl(SubjectPublicKeyInfo.getInstance(found.getValue()));
+            }
         }
 
         return null;
diff --git a/pkix/src/main/java/org/bouncycastle/cert/crmf/ProtocolEncrKeyControl.java b/pkix/src/main/java/org/bouncycastle/cert/crmf/ProtocolEncrKeyControl.java
new file mode 100644
index 0000000000..0ec777a6b1
--- /dev/null
+++ b/pkix/src/main/java/org/bouncycastle/cert/crmf/ProtocolEncrKeyControl.java
@@ -0,0 +1,47 @@
+package org.bouncycastle.cert.crmf;
+
+import org.bouncycastle.asn1.ASN1Encodable;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.crmf.CRMFObjectIdentifiers;
+import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
+
+/**
+ * Carrier for a protocol encryption key control.
+ */
+public class ProtocolEncrKeyControl
+    implements Control
+{
+    private static final ASN1ObjectIdentifier type = CRMFObjectIdentifiers.id_regCtrl_protocolEncrKey;
+
+    private final SubjectPublicKeyInfo publicKeyInfo;
+
+    /**
+     * Basic constructor - build from the public key to use for protocol encryption.
+     *
+     * @param publicKeyInfo the public key to use for protocol encryption.
+     */
+    public ProtocolEncrKeyControl(SubjectPublicKeyInfo publicKeyInfo)
+    {
+        this.publicKeyInfo = publicKeyInfo;
+    }
+
+    /**
+     * Return the type of this control.
+     *
+     * @return CRMFObjectIdentifiers.id_regCtrl_protocolEncrKey
+     */
+    public ASN1ObjectIdentifier getType()
+    {
+        return type;
+    }
+
+    /**
+     * Return the public key associated with this control.
+     *
+     * @return a SubjectPublicKeyInfo structure.
+     */
+    public ASN1Encodable getValue()
+    {
+        return publicKeyInfo;
+    }
+}
diff --git a/pkix/src/test/java/org/bouncycastle/cert/crmf/test/AllTests.java b/pkix/src/test/java/org/bouncycastle/cert/crmf/test/AllTests.java
index 41066733e4..97aaa6ff73 100644
--- a/pkix/src/test/java/org/bouncycastle/cert/crmf/test/AllTests.java
+++ b/pkix/src/test/java/org/bouncycastle/cert/crmf/test/AllTests.java
@@ -47,6 +47,7 @@
 import org.bouncycastle.cert.crmf.EncryptedValueParser;
 import org.bouncycastle.cert.crmf.PKIArchiveControl;
 import org.bouncycastle.cert.crmf.PKMACBuilder;
+import org.bouncycastle.cert.crmf.ProtocolEncrKeyControl;
 import org.bouncycastle.cert.crmf.ValueDecryptorGenerator;
 import org.bouncycastle.cert.crmf.bc.BcCRMFEncryptorBuilder;
 import org.bouncycastle.cert.crmf.bc.BcEncryptedValueBuilder;
@@ -228,6 +229,40 @@ public void testBasicMessageWithRegInfo()
         TestCase.assertEquals(atavArr[0], certReqMsgASN1.getRegInfo()[0]);
     }
 
+    public void testBasicMessageWithProtocolEncrKeyControl()
+        throws Exception
+    {
+        KeyPairGenerator kGen = KeyPairGenerator.getInstance("RSA", BC);
+
+        kGen.initialize(512);
+
+        KeyPair kp = kGen.generateKeyPair();
+        SubjectPublicKeyInfo publicKeyInfo = SubjectPublicKeyInfo.getInstance(kp.getPublic().getEncoded());
+
+        JcaCertificateRequestMessageBuilder certReqBuild = new JcaCertificateRequestMessageBuilder(BigInteger.ONE);
+
+        certReqBuild.setSubject(new X500Principal("CN=Test"))
+            .setPublicKey(kp.getPublic())
+            .addControl(new ProtocolEncrKeyControl(publicKeyInfo));
+
+        CertificateRequestMessage certReqMsg = certReqBuild.build();
+
+        checkCertReqMsgWithProtocolEncrKeyControl(certReqMsg, publicKeyInfo);
+        checkCertReqMsgWithProtocolEncrKeyControl(new CertificateRequestMessage(certReqMsg.getEncoded()), publicKeyInfo);
+    }
+
+    private void checkCertReqMsgWithProtocolEncrKeyControl(CertificateRequestMessage certReqMsg,
+        SubjectPublicKeyInfo publicKeyInfo)
+    {
+        TestCase.assertTrue(certReqMsg.hasControl(CRMFObjectIdentifiers.id_regCtrl_protocolEncrKey));
+
+        ProtocolEncrKeyControl protocolEncrKeyControl = (ProtocolEncrKeyControl)certReqMsg.getControl(
+            CRMFObjectIdentifiers.id_regCtrl_protocolEncrKey);
+
+        TestCase.assertEquals(CRMFObjectIdentifiers.id_regCtrl_protocolEncrKey, protocolEncrKeyControl.getType());
+        TestCase.assertEquals(publicKeyInfo, protocolEncrKeyControl.getValue());
+    }
+
     public void testBasicMessageWithArchiveControl()
         throws Exception
     {