apache/hadoop · error · NoSuchPaddingException

Doesn't support padding: ${padding}

Error message

Doesn't support padding: ${padding}

What it means

OpensslCipher's Padding enum contains only NoPadding. Counter mode is a stream-style mode that never needs padding, so the native wrapper rejects every other padding scheme with NoSuchPaddingException.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/OpensslCipher.java:71

    static int get(String algorithm, String mode) 
        throws NoSuchAlgorithmException {
      try {
        return AlgMode.valueOf(algorithm + "_" + mode).ordinal();
      } catch (Exception e) {
        throw new NoSuchAlgorithmException("Doesn't support algorithm: " + 
            algorithm + " and mode: " + mode);
      }
    }
  }
  
  private enum Padding {
    NoPadding;
    
    static int get(String padding) throws NoSuchPaddingException {
      try {
        return Padding.valueOf(padding).ordinal();
      } catch (Exception e) {
        throw new NoSuchPaddingException("Doesn't support padding: " + padding);
      }
    }
  }
  
  private long context = 0;
  private final int alg;
  private final int padding;
  private long engine;
  
  private static final String loadingFailureReason;

  static {
    String loadingFailure = null;
    try {
      if (!NativeCodeLoader.buildSupportsOpenssl()) {
        PerformanceAdvisory.LOG.warn("Build does not support openssl");
        loadingFailure = "build does not support openssl.";
      } else {

View on GitHub (pinned to 2add963021)

Solutions

1. Always use NoPadding as the padding component for OpensslCipher transformations
2. Verify the suite name with CipherSuite constants instead of hand-building strings
3. Check OpensslCipher.isSupported() before instantiating

Example fix

// before
Cipher c = OpensslCipher.getInstance("AES/CTR/PKCS5Padding"); // NoSuchPaddingException

// after
Cipher c = OpensslCipher.getInstance("AES/CTR/NoPadding");

// Validate the padding token before instantiation
String[] parts = transformation.split("/");
if (parts.length != 3 || !parts[2].equals("NoPadding")) {
  throw new IllegalArgumentException("Only NoPadding is supported: " + transformation);
}

public boolean isValidOpensslTransformation(String t) {
  String[] p = t.split("/");
  return p.length == 3
      && (p[0] + "_" + p[1]).matches("AES_CTR|SM4_CTR")
      && p[2].equals("NoPadding");
}

try {
  cipher = OpensslCipher.getInstance(transformation);
} catch (NoSuchAlgorithmException | NoSuchPaddingException e) {
  LOG.error("Bad transformation {}: {}", transformation, e.getMessage());
  cipher = OpensslCipher.getInstance("AES/CTR/NoPadding");
}

When it happens

Trigger: Calling OpensslCipher.getInstance() with a transformation whose third component is not exactly NoPadding — e.g. "AES/CTR/PKCS5Padding" or "AES/CTR/ISO10126Padding". Note the value is matched via enum valueOf after trim, so any casing/spacing deviation also fails.

Common situations: Copy-pasting a JCE transformation string that included PKCS5Padding; assuming symmetric padding defaults; changing only the mode of a working CBC/PKCS5 transformation and leaving the padding token.

Related errors

• Doesn't support algorithm: ${algorithm} and mode: ${mode}
• No transformation given.
• Invalid transformation format: ${transformation}
• The OpenSSL native library is built without SM4 CTR support
• Invalid cipher suite name: ${name}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/321892ef189c9d61. Report an issue: GitHub.