What causes "Invalid transformation format: ${transformation}" in apache/hadoop?

Always use the canonical three-part form, ideally sourced from CipherSuite.getName() (e.g. AES/CTR/NoPadding)

apache/hadoop · error · NoSuchAlgorithmException

Invalid transformation format: ${transformation}

Error message

Invalid transformation format: ${transformation}

What it means

The transformation must consist of exactly three slash-separated tokens: algorithm, mode, and padding. tokenizeTransformation() tokenizes on '/', collects at most three parts, and throws NoSuchAlgorithmException when the count is not exactly 3 (including when more than 3 tokens remain).

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/OpensslCipher.java:175

    if (transformation == null) {
      throw new NoSuchAlgorithmException("No transformation given.");
    }
    
    /*
     * Array containing the components of a Cipher transformation:
     * 
     * index 0: algorithm (e.g., AES)
     * index 1: mode (e.g., CTR)
     * index 2: padding (e.g., NoPadding)
     */
    String[] parts = new String[3];
    int count = 0;
    StringTokenizer parser = new StringTokenizer(transformation, "/");
    while (parser.hasMoreTokens() && count < 3) {
      parts[count++] = parser.nextToken().trim();
    }
    if (count != 3 || parser.hasMoreTokens()) {
      throw new NoSuchAlgorithmException("Invalid transformation format: " + 
          transformation);
    }
    return new Transform(parts[0], parts[1], parts[2]);
  }

  public static boolean isSupported(CipherSuite suite) {
    Transform transform;
    int algMode;
    int padding;
    try {
      transform = tokenizeTransformation(suite.getName());
      algMode = AlgMode.get(transform.alg, transform.mode);
      padding = Padding.get(transform.padding);
    } catch (NoSuchAlgorithmException|NoSuchPaddingException e) {
      return false;
    }
    return isSupportedSuite(algMode, padding);
  }

View on GitHub (pinned to 2add963021)

Solutions

Always use the canonical three-part form, ideally sourced from CipherSuite.getName() (e.g. AES/CTR/NoPadding)
Validate the transformation format before use: exactly two '/' characters and three non-empty trimmed tokens
Reject the configuration at load time with a clear error instead of passing it downstream

Example fix

// before
String t = alg + "/" + mode + "/" + padding; // padding empty -> "AES/CTR/"
Cipher c = OpensslCipher.getInstance(t); // Invalid transformation format

// after
String t = String.join("/", alg, mode, padding);
 Preconditions.checkArgument(t.split("/").length == 3, "bad suite %s", t);
Cipher c = OpensslCipher.getInstance(t);

Defensive patterns

Strategy: validation

Validate before calling

// Structural pre-check
String[] p = transformation.split("/");
if (p.length != 3 || Arrays.stream(p).anyMatch(String::isEmpty)) {
  throw new IllegalArgumentException(
    "Transformation must be alg/mode/padding, got: " + transformation);
}

Type guard

private static final Pattern T = Pattern.compile("^(AES|SM4)/(CTR)/(NoPadding)$");
public boolean isWellFormedTransformation(String t) {
  return t != null && T.matcher(t).matches();
}

Try / catch

try {
  cipher = OpensslCipher.getInstance(transformation);
} catch (NoSuchAlgorithmException e) {
  throw new ConfigurationException("Malformed cipher transformation: '" + transformation + "'", e);
}

Prevention

Build transformations with String.join over explicit components, never concatenation with optional parts
Validate suite config at load time (exactly two slashes, three non-empty tokens)
Use the regex/enum approach so typos fail at configuration parse, not at cipher creation

When it happens

Trigger: Calling OpensslCipher.getInstance() with malformed strings: "AES" (1 token), "AES/CTR" (2 tokens), "AES/CTR/NoPadding/Extra" (4 tokens), or strings with empty or extra separators such as "AES//NoPadding" or "/AES/CTR/NoPadding" — empty tokens count as tokens, producing wrong counts or later enum failures.

Common situations: String concatenation bugs when assembling the transformation at runtime; config values with stray slashes or trailing whitespace plus a slash; user-typed suite names in configuration files.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/5fd48424bc5ab18f. Report an issue: GitHub.