{"record":{"id":"1e86366e0191593a","repo":"pentaho/pentaho-kettle","slug":"secretkeygenerator-keygenerationerror","errorCode":"SecretKeyGenerator.KeyGenerationError","errorMessage":"SecretKeyGenerator.KeyGenerationError","messagePattern":"SecretKeyGenerator\\.KeyGenerationError","errorType":"exception","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"engine/src/main/java/org/pentaho/di/trans/steps/symmetriccrypto/secretkeygenerator/SecretKeyGenerator.java","lineNumber":114,"sourceCode":"\n      for ( int j = 0; j < data.secretKeyCount[i] && !isStopped(); j++ ) {\n\n        // Create a new row\n        row = buildEmptyRow();\n        incrementLinesRead();\n\n        int index = 0;\n\n        try {\n          // Return secret key\n          if ( meta.isOutputKeyInBinary() ) {\n            row[index++] = data.cryptoTrans[i].generateKey( data.secretKeyLen[i] );\n          } else {\n            row[index++] = data.cryptoTrans[i].generateKeyAsHex( data.secretKeyLen[i] );\n          }\n\n        } catch ( CryptoException k ) {\n          throw new KettleException( BaseMessages.getString( PKG, \"SecretKeyGenerator.KeyGenerationError\", i ), k );\n        }\n\n        if ( data.addAlgorithmOutput ) {\n          // add algorithm\n          row[index++] = meta.getAlgorithm()[i];\n        }\n\n        if ( data.addSecretKeyLengthOutput ) {\n          // add secret key len\n          row[index++] = new Long( data.secretKeyLen[i] );\n        }\n\n        if ( data.readsRows ) {\n          // build output row\n          row = RowDataUtil.addRowData( rowIn, data.prevNrField, row );\n        }\n\n        if ( isRowLevel() ) {","sourceCodeStart":96,"sourceCodeEnd":132,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/engine/src/main/java/org/pentaho/di/trans/steps/symmetriccrypto/secretkeygenerator/SecretKeyGenerator.java#L96-L132","documentation":"KettleException thrown by SecretKeyGenerator.processRow when the underlying CryptoException occurs while generating a symmetric secret key (e.g., AES/DES) for the crypto transform at index i — either raw bytes via generateKey or hex via generateKeyAsHex for the configured key length. The message includes the failing algorithm index and the CryptoException is chained as the cause.","triggerScenarios":"Requesting a key length unsupported by the algorithm/JCE policy (e.g., 256-bit AES with unlimited-strength policies absent in old JDKs), an unavailable crypto algorithm/provider, or an invalid key-length value that SecretKeyGenerator.init fails to enforce.","commonSituations":"Running an old JDK without JCE Unlimited Strength policy files requesting 256-bit keys; picking a key size not divisible by 8 or out of the algorithm's range; restricted crypto providers on hardened JVMs (FIPS mode); typo'd algorithm names in the step configuration.","solutions":["Read the chained CryptoException (getCause()) to see the exact JCE failure (InvalidKeyException/NoSuchAlgorithmException).","Set the key length to one supported by the algorithm (e.g., 128/192/256 for AES; 64/112/168 for DESede) in the step dialog.","Install the JCE Unlimited Strength policy files or run a modern JDK (8u161+) that enables unlimited crypto by default.","Verify the required security provider/algorithm is available in the JVM (check java.security configuration / FIPS restrictions)."],"exampleFix":"// before: 256-bit key on restricted JVM\nmeta.setSecretKeyLen(new int[]{256});\n// after: supported length\nmeta.setSecretKeyLen(new int[]{128});","handlingStrategy":"validation","validationCode":"// verify the key length is valid for the algorithm before running\nint len = meta.getSecretKeyLen()[i];\nSet<Integer> allowed = Set.of( 128, 192, 256 ); // AES\nif ( !allowed.contains( len ) ) throw new IllegalArgumentException( \"Unsupported key length for AES: \" + len );\n// also confirm max key length\nif ( Cipher.getMaxAllowedKeyLength( \"AES\" ) < len ) throw new IllegalStateException( \"JCE limited to \" + Cipher.getMaxAllowedKeyLength( \"AES\" ) );","typeGuard":null,"tryCatchPattern":"try { trans.execute( null ); } catch ( KettleException e ) { Throwable c = e.getCause(); if ( c instanceof CryptoException ) log.error( \"Key generation failed: \" + c.getMessage(), c ); throw e; }","preventionTips":["Check Cipher.getMaxAllowedKeyLength for the algorithm on target JVMs.","Use algorithm-standard key sizes only.","Run JDK 8u161+ or install JCE unlimited policy.","Confirm security providers in restricted/FIPS environments."],"tags":["kettle","crypto","key-generation","jce"],"backgroundTag":"unsupported-operation","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}