apache/hadoop · error · IOException

Invalid cipher suite, %s=%s

Error message

Invalid cipher suite, %s=%s

What it means

Client-side counterpart of the cipher suite check: when the negotiated SASL QOP includes privacy, SaslDataTransferClient builds a CipherOption list from dfs.encrypt.data.transfer.cipher.suites and only accepts 'aes/ctr/nopadding' or 'sm4/ctr/nopadding' (lowercase, exact). Any other value throws IOException while opening the first secured data connection.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/SaslDataTransferClient.java:561

      // step 1
      byte[] remoteResponse = readSaslMessage(in);
      byte[] localResponse = sasl.evaluateChallengeOrResponse(remoteResponse);
      List<CipherOption> cipherOptions = null;
      String cipherSuites = conf.get(
          DFS_ENCRYPT_DATA_TRANSFER_CIPHER_SUITES_KEY);
      if (requestedQopContainsPrivacy(saslProps)) {
        // Negotiate cipher suites if configured.  Currently, the only supported
        // cipher suite is AES/CTR/NoPadding or SM4/CTR/Nopadding,
        // but the protocol allows multiple values for future expansion.
        if (cipherSuites != null && !cipherSuites.isEmpty()) {
          CipherOption option = null;
          if (cipherSuites.equals(CipherSuite.AES_CTR_NOPADDING.getName())) {
            option = new CipherOption(CipherSuite.AES_CTR_NOPADDING);
          } else if (cipherSuites.equals(
              CipherSuite.SM4_CTR_NOPADDING.getName())) {
            option = new CipherOption(CipherSuite.SM4_CTR_NOPADDING);
          } else {
            throw new IOException(String.format("Invalid cipher suite, %s=%s",
                DFS_ENCRYPT_DATA_TRANSFER_CIPHER_SUITES_KEY, cipherSuites));
          }
          cipherOptions = Lists.newArrayListWithCapacity(1);
          cipherOptions.add(option);
        }
      }
      LOG.debug("{}: cipherOptions={}", sasl, cipherOptions);
      sendSaslMessageAndNegotiationCipherOptions(out, localResponse,
          cipherOptions);

      // step 2 (client-side only)
      SaslResponseWithNegotiatedCipherOption response =
          readSaslMessageAndNegotiatedCipherOption(in);
      localResponse = sasl.evaluateChallengeOrResponse(response.payload);
      assert localResponse == null;

      // SASL handshake is complete
      checkSaslComplete(sasl, saslProps);

View on GitHub (pinned to 2add963021)

Solutions

1. Fix the client-side value to exactly aes/ctr/nopadding or sm4/ctr/nopadding
2. Remove the property if accelerated crypto is not required - SASL privacy alone still encrypts
3. Distribute the identical security config to all clients

Example fix

<!-- before (client core-site.xml) -->
<property>
  <name>dfs.encrypt.data.transfer.cipher.suites</name>
  <value>AES/CTR/NoPadding</value>
</property>

<!-- after -->
<property>
  <name>dfs.encrypt.data.transfer.cipher.suites</name>
  <value>aes/ctr/nopadding</value>
</property>

String suite = conf.getTrimmed("dfs.encrypt.data.transfer.cipher.suites", "");
if (!suite.isEmpty()
    && !suite.equals("aes/ctr/nopadding")
    && !suite.equals("sm4/ctr/nopadding")) {
  throw new IllegalArgumentException("Unsupported cipher suite: " + suite);
}

When it happens

Trigger: Client-side config with dfs.data.transfer.protection containing privacy plus dfs.encrypt.data.transfer.cipher.suites set to an unsupported value; thrown in the SASL negotiation step before any data flows.

Common situations: Client core-site.xml diverging from the cluster's value (wrong casing, JCE-style name); value valid for a different Hadoop version than the bundled client.

Related errors

• No configuration found for the cipher suite {} prefixed with
• No KeyProvider is configured, cannot access an encrypted fil
• Invalid cipher suite, %s=%s
• Can not create a Path from a null string
• Can not create a Path from an empty string

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/5fd529548b46c5ab. Report an issue: GitHub.