apache/hadoop · error · NoSuchAlgorithmException

Doesn't support algorithm: ${algorithm} and mode: ${mode}

Error message

Doesn't support algorithm: ${algorithm} and mode: ${mode}

What it means

OpensslCipher is the native OpenSSL-backed cipher. Its AlgMode enum only accepts the algorithm/mode pairs AES_CTR and SM4_CTR. AlgMode.get() concatenates algorithm and mode and looks up the enum; any other combination throws NoSuchAlgorithmException with the rejected values in the message.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/OpensslCipher.java:58

 */
@InterfaceAudience.Private
public final class OpensslCipher {
  private static final Logger LOG =
      LoggerFactory.getLogger(OpensslCipher.class.getName());
  public static final int ENCRYPT_MODE = 1;
  public static final int DECRYPT_MODE = 0;

  /** Currently only support AES/CTR/NoPadding and SM4/CTR/NoPadding. */
  private enum AlgMode {
    AES_CTR,
    SM4_CTR;
    
    static int get(String algorithm, String mode) 
        throws NoSuchAlgorithmException {
      try {
        return AlgMode.valueOf(algorithm + "_" + mode).ordinal();
      } catch (Exception e) {
        throw new NoSuchAlgorithmException("Doesn't support algorithm: " + 
            algorithm + " and mode: " + mode);
      }
    }
  }
  
  private enum Padding {
    NoPadding;
    
    static int get(String padding) throws NoSuchPaddingException {
      try {
        return Padding.valueOf(padding).ordinal();
      } catch (Exception e) {
        throw new NoSuchPaddingException("Doesn't support padding: " + padding);
      }
    }
  }
  
  private long context = 0;

View on GitHub (pinned to 2add963021)

Solutions

1. Use only AES/CTR/NoPadding or SM4/CTR/NoPadding with OpensslCipher
2. Check capability first with OpensslCipher.isSupported(CipherSuite)
3. Prefer the JCE cipher (CryptoCodec dispatching) if you need a broader algorithm set — but note Hadoop's encryption layer still requires CTR
4. Fix the transformation string for typos in algorithm or mode tokens

Example fix

// before
Cipher c = OpensslCipher.getInstance("AES/CBC/NoPadding"); // NoSuchAlgorithmException

// after
Cipher c = OpensslCipher.getInstance("AES/CTR/NoPadding");

// Probe support before creating the cipher
if (!OpensslCipher.isSupported(CipherSuite.valueOfName("SM4/CTR/NoPadding"))) {
  // use AES/CTR/NoPadding instead
}

public boolean isOpensslSupported(String transformation) {
  try {
    OpensslCipher.tokenizeTransformationPublicly(transformation); // or isSupported
    return true;
  } catch (NoSuchAlgorithmException e) {
    return false;
  }
}

try {
  cipher = OpensslCipher.getInstance(transformation);
} catch (NoSuchAlgorithmException e) {
  throw new ConfigurationException(
    "Unsupported transformation '" + transformation + "'; use AES/CTR/NoPadding or SM4/CTR/NoPadding", e);
}

When it happens

Trigger: Calling OpensslCipher.getInstance() with a transformation whose algorithm/mode pair is not AES/CTR or SM4/CTR, e.g. "DES/CTR/NoPadding", "AES/CBC/NoPadding", or "SM4/CBC/NoPadding". Also reached via OpensslCipher.isSupported() probing arbitrary suites.

Common situations: Porting JCE code to the OpenSSL codec and reusing a non-CTR transformation string; configuration typos like AES-CTR/CTR/NoPadding; assuming the OpenSSL wrapper supports everything the JVM cipher API supports.

Related errors

• Doesn't support padding: ${padding}
• No transformation given.
• Invalid transformation format: ${transformation}
• The OpenSSL native library is built without SM4 CTR support
• Invalid cipher suite name: ${name}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/a7c87092eb9b32e8. Report an issue: GitHub.