{"record":{"id":"6cb4722229a788d5","repo":"apache/hadoop","slug":"aes-ctr-nopadding-or-sm4-ctr-nopadding-is-required","errorCode":null,"errorMessage":"AES/CTR/NoPadding or SM4/CTR/NoPadding is required","messagePattern":"AES/CTR/NoPadding or SM4/CTR/NoPadding is required","errorType":"validation","errorClass":"UnsupportedCodecException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/CryptoStreamUtils.java","lineNumber":78,"sourceCode":"   * Read crypto buffer size.\n   *\n   * @param conf configuration.\n   * @return hadoop.security.crypto.buffer.size.\n   */\n  public static int getBufferSize(Configuration conf) {\n    return conf.getInt(HADOOP_SECURITY_CRYPTO_BUFFER_SIZE_KEY, \n        HADOOP_SECURITY_CRYPTO_BUFFER_SIZE_DEFAULT);\n  }\n\n  /**\n   * AES/CTR/NoPadding or SM4/CTR/NoPadding is required.\n   *\n   * @param codec crypto codec.\n   */\n  public static void checkCodec(CryptoCodec codec) {\n    if (codec.getCipherSuite() != CipherSuite.AES_CTR_NOPADDING &&\n            codec.getCipherSuite() != CipherSuite.SM4_CTR_NOPADDING) {\n      throw new UnsupportedCodecException(\n          \"AES/CTR/NoPadding or SM4/CTR/NoPadding is required\");\n    }\n  }\n\n  /**\n   * Check and floor buffer size.\n   *\n   * @param codec crypto codec.\n   * @param bufferSize the size of the buffer to be used.\n   * @return calc buffer size.\n   */\n  public static int checkBufferSize(CryptoCodec codec, int bufferSize) {\n    Preconditions.checkArgument(bufferSize >= MIN_BUFFER_SIZE, \n        \"Minimum value of buffer size is \" + MIN_BUFFER_SIZE + \".\");\n    return bufferSize - bufferSize % codec.getCipherSuite()\n        .getAlgorithmBlockSize();\n  }\n","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/CryptoStreamUtils.java#L60-L96","documentation":"CryptoStreamUtils.checkCodec enforces that Hadoop transparent-encryption streams only use counter mode ciphers: AES/CTR/NoPadding or SM4/CTR/NoPadding. CTR mode is required because encrypted streams must preserve plaintext length and be seekable. Any codec whose CipherSuite is neither of these is rejected with UnsupportedCodecException.","triggerScenarios":"Passing a CryptoCodec whose getCipherSuite() returns a suite other than AES_CTR_NOPADDING or SM4_CTR_NOPADDING into checkCodec — e.g. after setting hadoop.security.crypto.cipher.suite to a non-CTR value, or plugging in a custom CryptoCodec implementation with a different suite.","commonSituations":"Setting hadoop.security.crypto.cipher.suite to something like AES/CBC/PKCS5Padding or AES/GCM/NoPadding; developing a custom CryptoCodec and forgetting Hadoop only accepts CTR-mode suites; SM4 configured on a cluster where code paths still validate against AES-only expectations.","solutions":["Set hadoop.security.crypto.cipher.suite to AES/CTR/NoPadding (the default and safest choice)","If SM4 is required, use SM4/CTR/NoPadding and confirm the native OpenSSL library supports it","For custom codecs, return CipherSuite.AES_CTR_NOPADDING or SM4_CTR_NOPADDING from getCipherSuite()","Remove or correct any client-side override of the cipher suite configuration"],"exampleFix":"// before\nconf.set(\"hadoop.security.crypto.cipher.suite\", \"AES/CBC/PKCS5Padding\");\nCryptoCodec codec = CryptoCodec.getInstance(conf); // later throws in checkCodec\n\n// after\nconf.set(\"hadoop.security.crypto.cipher.suite\", \"AES/CTR/NoPadding\");\nCryptoCodec codec = CryptoCodec.getInstance(conf);","handlingStrategy":"validation","validationCode":"// Validate before use\nCipherSuite suite = codec.getCipherSuite();\nif (suite != CipherSuite.AES_CTR_NOPADDING && suite != CipherSuite.SM4_CTR_NOPADDING) {\n  throw new IllegalArgumentException(\"Only CTR suites supported, got: \" + suite);\n}","typeGuard":"public boolean isAcceptableSuite(CryptoCodec codec) {\n  CipherSuite s = codec.getCipherSuite();\n  return s == CipherSuite.AES_CTR_NOPADDING || s == CipherSuite.SM4_CTR_NOPADDING;\n}","tryCatchPattern":"try {\n  CryptoStreamUtils.checkCodec(codec);\n} catch (UnsupportedCodecException e) {\n  // fall back to default AES/CTR codec\n  codec = CryptoCodec.getInstance(defaultConf);\n}","preventionTips":["Never override hadoop.security.crypto.cipher.suite with non-CTR values","Use CipherSuite enum constants instead of hand-written suite strings","For custom codecs, always return one of the two accepted suites from getCipherSuite()"],"tags":["crypto","codec","cipher-suite","configuration"],"backgroundTag":"unsupported-cipher-suite","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}