apache/hadoop · error · IOException

Can't get algorithm for key ${key} from ${path}

Error message

Can't get algorithm for key ${key} from ${path}

What it means

In getKeyVersion(), the JVM threw NoSuchAlgorithmException while retrieving the key — the algorithm used to protect or decode that keystore entry is not available in the current JCE environment (e.g. legacy or vendor JDK missing the algorithm). The message embeds the key reference, which may be null if the exception fired before assignment.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java:341

    return ProviderUtils.noPasswordError(KEYSTORE_PASSWORD_ENV_VAR,
        KEYSTORE_PASSWORD_FILE_KEY);
  }

  @Override
  public KeyVersion getKeyVersion(String versionName) throws IOException {
    readLock.lock();
    try {
      SecretKeySpec key = null;
      try {
        if (!keyStore.containsAlias(versionName)) {
          return null;
        }
        key = (SecretKeySpec) keyStore.getKey(versionName, password);
      } catch (KeyStoreException e) {
        throw new IOException("Can't get key " + versionName + " from " +
                              path, e);
      } catch (NoSuchAlgorithmException e) {
        throw new IOException("Can't get algorithm for key " + key + " from " +
                              path, e);
      } catch (UnrecoverableKeyException e) {
        throw new IOException("Can't recover key " + key + " from " + path, e);
      }
      return new KeyVersion(getBaseName(versionName), versionName, key.getEncoded());
    } finally {
      readLock.unlock();
    }
  }

  @Override
  public List<String> getKeys() throws IOException {
    readLock.lock();
    try {
      ArrayList<String> list = new ArrayList<String>();
      String alias = null;
      try {
        Enumeration<String> e = keyStore.aliases();

View on GitHub (pinned to 2add963021)

Solutions

1. Run the reader (KMS) on a modern JDK with unlimited-strength JCE (Java 8u161+ has it by default)
2. Recreate the keystore on the JDK family that will read it
3. Check the nested cause for the exact algorithm name and verify provider availability with jshell or a small KeyStore test

// Verify the runtime JCE supports the algorithms the keystore uses
Cipher.getMaxAllowedKeyLength("AES"); // throws if restricted
KeyStore.getInstance("jceks");

try {
  kv = provider.getKeyVersion(versionName);
} catch (IOException e) {
  if (e.getCause() instanceof NoSuchAlgorithmException) {
    // JVM lacks the entry-protection algorithm: switch JDK, then recreate keystore
  }
}

When it happens

Trigger: KeyProvider.getKeyVersion() hitting a keystore entry protected with an algorithm the JVM does not provide — e.g. keystore written with stronger/older algorithms under a different JDK, or restricted-JCE JDKs reading keys protected with AES-256.

Common situations: Keystore created on modern JDK, read by older or restricted-JCE runtime; JDK vendor differences in default keystore protection algorithms; keystore migrated between JVMs

Related errors

• Can't get algorithm for ${name} from keystore ${path}
• Can't create keystore: ${e}
• Keystore not loaded due to some inconsistency ('%s' and '%s'
• Can't load keystore ${path} : ${e}
• Can't get key ${versionName} from ${path}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/594ab1d7d857d652. Report an issue: GitHub.