{"record":{"id":"594ab1d7d857d652","repo":"apache/hadoop","slug":"can-t-get-algorithm-for-key-key-from-path","errorCode":null,"errorMessage":"Can't get algorithm for key ${key} from ${path}","messagePattern":"Can't get algorithm for key (.+?) from (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java","lineNumber":341,"sourceCode":"    return ProviderUtils.noPasswordError(KEYSTORE_PASSWORD_ENV_VAR,\n        KEYSTORE_PASSWORD_FILE_KEY);\n  }\n\n  @Override\n  public KeyVersion getKeyVersion(String versionName) throws IOException {\n    readLock.lock();\n    try {\n      SecretKeySpec key = null;\n      try {\n        if (!keyStore.containsAlias(versionName)) {\n          return null;\n        }\n        key = (SecretKeySpec) keyStore.getKey(versionName, password);\n      } catch (KeyStoreException e) {\n        throw new IOException(\"Can't get key \" + versionName + \" from \" +\n                              path, e);\n      } catch (NoSuchAlgorithmException e) {\n        throw new IOException(\"Can't get algorithm for key \" + key + \" from \" +\n                              path, e);\n      } catch (UnrecoverableKeyException e) {\n        throw new IOException(\"Can't recover key \" + key + \" from \" + path, e);\n      }\n      return new KeyVersion(getBaseName(versionName), versionName, key.getEncoded());\n    } finally {\n      readLock.unlock();\n    }\n  }\n\n  @Override\n  public List<String> getKeys() throws IOException {\n    readLock.lock();\n    try {\n      ArrayList<String> list = new ArrayList<String>();\n      String alias = null;\n      try {\n        Enumeration<String> e = keyStore.aliases();","sourceCodeStart":323,"sourceCodeEnd":359,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java#L323-L359","documentation":"In getKeyVersion(), the JVM threw NoSuchAlgorithmException while retrieving the key — the algorithm used to protect or decode that keystore entry is not available in the current JCE environment (e.g. legacy or vendor JDK missing the algorithm). The message embeds the key reference, which may be null if the exception fired before assignment.","triggerScenarios":"KeyProvider.getKeyVersion() hitting a keystore entry protected with an algorithm the JVM does not provide — e.g. keystore written with stronger/older algorithms under a different JDK, or restricted-JCE JDKs reading keys protected with AES-256.","commonSituations":"Keystore created on modern JDK, read by older or restricted-JCE runtime; JDK vendor differences in default keystore protection algorithms; keystore migrated between JVMs","solutions":["Run the reader (KMS) on a modern JDK with unlimited-strength JCE (Java 8u161+ has it by default)","Recreate the keystore on the JDK family that will read it","Check the nested cause for the exact algorithm name and verify provider availability with jshell or a small KeyStore test"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Verify the runtime JCE supports the algorithms the keystore uses\nCipher.getMaxAllowedKeyLength(\"AES\"); // throws if restricted\nKeyStore.getInstance(\"jceks\");","typeGuard":null,"tryCatchPattern":"try {\n  kv = provider.getKeyVersion(versionName);\n} catch (IOException e) {\n  if (e.getCause() instanceof NoSuchAlgorithmException) {\n    // JVM lacks the entry-protection algorithm: switch JDK, then recreate keystore\n  }\n}","preventionTips":["Run KMS on Java 8u161+ or Java 11+ where unlimited JCE is default","Create and read keystores on the same JDK family","Log the nested algorithm name to identify the missing provider capability"],"tags":["keystore","kms","crypto","jce","algorithm-unavailable"],"backgroundTag":"keystore-algorithm-unavailable","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}