apache/hadoop · error · IllegalArgumentException

Invalid cipher suite name: ${name}

Error message

Invalid cipher suite name: ${name}

What it means

CipherSuite.convert(String) resolves a cipher-suite name to the enum by exact, case-sensitive equals() over CipherSuite.values(). In this version the defined names are "Unknown", "AES/CTR/NoPadding", and "SM4/CTR/NoPadding"; anything else throws IllegalArgumentException "Invalid cipher suite name: <name>".

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/CipherSuite.java:91

    }
    builder.append("}");
    return builder.toString();
  }
  
  /**
   * Convert to CipherSuite from name, {@link #algoBlockSize} is fixed for
   * certain cipher suite, just need to compare the name.
   * @param name cipher suite name
   * @return CipherSuite cipher suite
   */
  public static CipherSuite convert(String name) {
    CipherSuite[] suites = CipherSuite.values();
    for (CipherSuite suite : suites) {
      if (suite.getName().equals(name)) {
        return suite;
      }
    }
    throw new IllegalArgumentException("Invalid cipher suite name: " + name);
  }
  
  /**
   * Returns suffix of cipher suite configuration.
   * @return String configuration suffix
   */
  public String getConfigSuffix() {
    String[] parts = name.split("/");
    StringBuilder suffix = new StringBuilder();
    for (String part : parts) {
      suffix.append(".").append(StringUtils.toLowerCase(part));
    }
    
    return suffix.toString();
  }
}

View on GitHub (pinned to 2add963021)

Solutions

1. Use an exact supported name, typically AES/CTR/NoPadding
2. Enumerate CipherSuite.values() for your Hadoop version and pick a getName() string verbatim
3. Match case exactly — the comparison is case-sensitive equals(), and trim any stray whitespace

Example fix

<!-- before -->
<property><name>hadoop.security.crypto.cipher.suites</name><value>aes/ctr/nopadding</value></property>

<!-- after -->
<property><name>hadoop.security.crypto.cipher.suites</name><value>AES/CTR/NoPadding</value></property>

static boolean isSupportedSuite(String name) {
  for (CipherSuite s : CipherSuite.values()) {
    if (s.getName().equals(name)) { // case-sensitive
      return true;
    }
  }
  return false;
}
// if (!isSupportedSuite(name)) fail with the accepted list before calling convert()

static Optional<CipherSuite> toSuite(String name) {
  return Arrays.stream(CipherSuite.values())
      .filter(s -> s.getName().equals(name))
      .findFirst();
}
// toSuite(name).orElseThrow(() -> new ConfigException("unsupported suite: " + name))

try {
  suite = CipherSuite.convert(name);
} catch (IllegalArgumentException e) {
  throw new ConfigException("hadoop.security.crypto.cipher.suites: use one of "
      + Arrays.toString(Arrays.stream(CipherSuite.values()).map(CipherSuite::getName).toArray()), e);
}

When it happens

Trigger: hadoop.security.crypto.cipher.suites (or any code path) feeding convert() a lowercase variant like "aes/ctr/nopadding", a suite the enum does not define (e.g. "AES/GCM/NoPadding"), or a typo'd/whitespace-padded suite string.

Common situations: Crypto settings copied from another project with different suite naming; upgrading or downgrading Hadoop where the supported suite set differs; hand-editing core-site.xml encryption config without matching the enum exactly.

Related errors

• No more entry in " + f
• f + " is a directory"
• f + " already exists"
• Missing keyfile property ('%s') for authentication type '%s'
• Unknown authentication type: %s

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/8d00782427ed0b25. Report an issue: GitHub.