{"record":{"id":"321892ef189c9d61","repo":"apache/hadoop","slug":"doesn-t-support-padding-padding","errorCode":null,"errorMessage":"Doesn't support padding: ${padding}","messagePattern":"Doesn't support padding: (.+?)","errorType":"validation","errorClass":"NoSuchPaddingException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/OpensslCipher.java","lineNumber":71,"sourceCode":"    static int get(String algorithm, String mode) \n        throws NoSuchAlgorithmException {\n      try {\n        return AlgMode.valueOf(algorithm + \"_\" + mode).ordinal();\n      } catch (Exception e) {\n        throw new NoSuchAlgorithmException(\"Doesn't support algorithm: \" + \n            algorithm + \" and mode: \" + mode);\n      }\n    }\n  }\n  \n  private enum Padding {\n    NoPadding;\n    \n    static int get(String padding) throws NoSuchPaddingException {\n      try {\n        return Padding.valueOf(padding).ordinal();\n      } catch (Exception e) {\n        throw new NoSuchPaddingException(\"Doesn't support padding: \" + padding);\n      }\n    }\n  }\n  \n  private long context = 0;\n  private final int alg;\n  private final int padding;\n  private long engine;\n  \n  private static final String loadingFailureReason;\n\n  static {\n    String loadingFailure = null;\n    try {\n      if (!NativeCodeLoader.buildSupportsOpenssl()) {\n        PerformanceAdvisory.LOG.warn(\"Build does not support openssl\");\n        loadingFailure = \"build does not support openssl.\";\n      } else {","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/OpensslCipher.java#L53-L89","documentation":"OpensslCipher's Padding enum contains only NoPadding. Counter mode is a stream-style mode that never needs padding, so the native wrapper rejects every other padding scheme with NoSuchPaddingException.","triggerScenarios":"Calling OpensslCipher.getInstance() with a transformation whose third component is not exactly NoPadding — e.g. \"AES/CTR/PKCS5Padding\" or \"AES/CTR/ISO10126Padding\". Note the value is matched via enum valueOf after trim, so any casing/spacing deviation also fails.","commonSituations":"Copy-pasting a JCE transformation string that included PKCS5Padding; assuming symmetric padding defaults; changing only the mode of a working CBC/PKCS5 transformation and leaving the padding token.","solutions":["Always use NoPadding as the padding component for OpensslCipher transformations","Verify the suite name with CipherSuite constants instead of hand-building strings","Check OpensslCipher.isSupported() before instantiating"],"exampleFix":"// before\nCipher c = OpensslCipher.getInstance(\"AES/CTR/PKCS5Padding\"); // NoSuchPaddingException\n\n// after\nCipher c = OpensslCipher.getInstance(\"AES/CTR/NoPadding\");","handlingStrategy":"validation","validationCode":"// Validate the padding token before instantiation\nString[] parts = transformation.split(\"/\");\nif (parts.length != 3 || !parts[2].equals(\"NoPadding\")) {\n  throw new IllegalArgumentException(\"Only NoPadding is supported: \" + transformation);\n}","typeGuard":"public boolean isValidOpensslTransformation(String t) {\n  String[] p = t.split(\"/\");\n  return p.length == 3\n      && (p[0] + \"_\" + p[1]).matches(\"AES_CTR|SM4_CTR\")\n      && p[2].equals(\"NoPadding\");\n}","tryCatchPattern":"try {\n  cipher = OpensslCipher.getInstance(transformation);\n} catch (NoSuchAlgorithmException | NoSuchPaddingException e) {\n  LOG.error(\"Bad transformation {}: {}\", transformation, e.getMessage());\n  cipher = OpensslCipher.getInstance(\"AES/CTR/NoPadding\");\n}","preventionTips":["CTR mode never pads — never carry over padding tokens from CBC/ECB strings","Prefer CipherSuite enum names over string literals","Unit-test transformation construction code against the two valid values"],"tags":["crypto","openssl","cipher","padding","transformation"],"backgroundTag":"unsupported-cipher-padding","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}