apereo/cas · warning

Encrypted Value: [ ] Decryption Failed

Error message

Encrypted Value: [{}] Decryption Failed

What it means

JasyptTestAlgorithmsCommand.validateAlgorithms iterates JCE providers/algorithms, encrypts a sample value with each, then attempts decryption. When the cipher returns a non-null result, doIf logs success; the warn branch is reached only when the decrypted result is null, meaning the algorithm encrypted but could not round-trip decrypt the value.

Solutions

  1. Avoid configuring the flagged provider/algorithm in Jasypt; it failed the encrypt/decrypt round-trip.
  2. Choose an algorithm reported as 'Decryption succeeded' (commonly PBEWITHHMACSHA* AND AES variants) for CAS password encryption.
  3. Adjust the Jasypt key/iterations settings if strong algorithms return null and retry validation.

Example fix

// before
algorithm = PBEWITHSHA1ANDDESede // null on decrypt
// after
algorithm = PBEWITHHMACSHA512ANDAES_256 // verified by validateAlgorithms round-trip
Defensive patterns

Strategy: validation

Validate before calling

String encrypted = cipher.encryptValue(plain);
String decrypted = cipher.decryptValue(encrypted);
if (decrypted == null || !plain.equals(decrypted)) {
    LOGGER.warn("Algorithm failed round-trip; do not use it for CAS password encryption");
}

Prevention

When it happens

Trigger: An algorithm that can encrypt (encryptValue succeeded) but whose decryptValue returns null — e.g. algorithms with incompatible padding or block modes that silently fail the Jasypt round-trip for the given key/pool size settings.

Common situations: Selecting an algorithm unsuitable for Jasypt text encryption (e.g. ECB/stream mismatches); wrong key size for the algorithm; evaluating providers to find which Jasypt algorithm to configure for cas.authn... password encryption.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/d2af13144c8c5069. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-shell-core/src/main/java/org/apereo/cas/shell/commands/jasypt/JasyptTestAlgorithmsCommand.java:61

                val algorithmStr = algorithm.toString();
                cipher.setPassword(password);
                cipher.setKeyObtentionIterations("1");
                cipher.setProviderName(provider);
                try {
                    LOGGER.trace("Testing algorithm [{}]", algorithmStr);
                    cipher.setAlgorithm(algorithmStr);
                    val encryptedValue = cipher.encryptValue(value, e -> {
                        LOGGER.trace(e.getMessage(), e);
                        return null;
                    });
                    if (encryptedValue == null) {
                        continue;
                    }
                    LOGGER.info("Provider: [{}] Algorithm: [{}]", provider, algorithmStr);
                    val result = cipher.decryptValue(encryptedValue);
                    FunctionUtils.doIf(result != null,
                            r -> LOGGER.info("Encrypted Value: [{}] Decryption succeeded", encryptedValue),
                            t -> LOGGER.warn("Encrypted Value: [{}] Decryption Failed", encryptedValue))
                        .accept(result);

                } catch (final Exception e) {
                    if (e.getCause() instanceof NoSuchAlgorithmException) {
                        LOGGER.warn("Provider: [{}] does not support Algorithm: [{}]", provider, algorithmStr);
                    } else {
                        LOGGER.warn("Error encrypting using provider: [{}] and algorithm: [{}], Message: [{}]", provider, algorithmStr, e.getMessage());
                    }
                }
            }
        }
    }
}

View on GitHub (pinned to e7288fc434)