{"record":{"id":"249aedf6cdd0fec7","repo":"spring-projects/spring-security","slug":"unable-to-access-parameter","errorCode":null,"errorMessage":"Unable to access parameter","messagePattern":"Unable to access parameter","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/encrypt/CipherUtils.java","lineNumber":93,"sourceCode":"\t\t\treturn Cipher.getInstance(algorithm);\n\t\t}\n\t\tcatch (NoSuchAlgorithmException ex) {\n\t\t\tthrow new IllegalArgumentException(\"Not a valid encryption algorithm\", ex);\n\t\t}\n\t\tcatch (NoSuchPaddingException ex) {\n\t\t\tthrow new IllegalStateException(\"Should not happen\", ex);\n\t\t}\n\t}\n\n\t/**\n\t * Initializes the Cipher for use.\n\t */\n\tstatic <T extends AlgorithmParameterSpec> T getParameterSpec(Cipher cipher, Class<T> parameterSpecClass) {\n\t\ttry {\n\t\t\treturn cipher.getParameters().getParameterSpec(parameterSpecClass);\n\t\t}\n\t\tcatch (InvalidParameterSpecException ex) {\n\t\t\tthrow new IllegalArgumentException(\"Unable to access parameter\", ex);\n\t\t}\n\t}\n\n\t/**\n\t * Initializes the Cipher for use.\n\t */\n\tstatic void initCipher(Cipher cipher, int mode, SecretKey secretKey) {\n\t\tinitCipher(cipher, mode, secretKey, null);\n\t}\n\n\t/**\n\t * Initializes the Cipher for use.\n\t */\n\tstatic void initCipher(Cipher cipher, int mode, SecretKey secretKey, byte[] salt, int iterationCount) {\n\t\tinitCipher(cipher, mode, secretKey, new PBEParameterSpec(salt, iterationCount));\n\t}\n\n\t/**","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/encrypt/CipherUtils.java#L75-L111","documentation":"Thrown by CipherUtils.getParameterSpec when cipher.getParameters().getParameterSpec(parameterSpecClass) throws InvalidParameterSpecException. The cipher's algorithm parameters cannot be converted to the requested AlgorithmParameterSpec class (e.g. requesting GCMParameterSpec from a cipher in CBC mode, or a provider that doesn't expose parameters).","triggerScenarios":"Calling getParameterSpec(cipher, GCMParameterSpec.class) on a Cipher initialized with a CBC/IvParameterSpec-based transformation; calling it before cipher.init(...); using a provider that doesn't return parameters for the transformation; requesting the wrong spec class for the active algorithm mode.","commonSituations":"Custom encryptor code reusing CipherUtils across mixed CBC/GCM ciphers; refactors that swap a GCM cipher for CBC (or vice versa) without updating the spec class; storing/persisting IVs after a mode change.","solutions":["Match the spec class to the cipher mode: IvParameterSpec for CBC, GCMParameterSpec for GCM.","Call getParameterSpec only after cipher.init(...) so the parameters are generated.","Check cipher.getParameters() for null before requesting a spec (some transformations have none).","If switching algorithms, update all parameter-handling code, including IV storage/serialization."],"exampleFix":"// before\nIvParameterSpec iv = CipherUtils.getParameterSpec(cipher, IvParameterSpec.class); // cipher is GCM\n// after\nGCMParameterSpec spec = CipherUtils.getParameterSpec(cipher, GCMParameterSpec.class);","handlingStrategy":"validation","validationCode":"if (cipher.getParameters() == null) throw new IllegalStateException(\"cipher has no algorithm parameters; call init() first\");\n// pick spec class from mode: IvParameterSpec for CBC, GCMParameterSpec for GCM","typeGuard":null,"tryCatchPattern":"try {\n    return CipherUtils.getParameterSpec(cipher, specClass);\n} catch (IllegalArgumentException ex) {\n    throw new IllegalStateException(\"Wrong parameter spec class for cipher mode\", ex);\n}","preventionTips":["Match spec class to transformation: IvParameterSpec<->CBC, GCMParameterSpec<->GCM.","Only call after cipher.init() so parameters exist.","When migrating cipher modes, update all IV/spec handling in the same change.","Unit-test parameter extraction for each cipher mode your app uses."],"tags":["crypto","algorithm-parameters","cipher","iv","spring-security"],"backgroundTag":"invalid-argument-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}