{"record":{"id":"8a78095d3a66ce8e","repo":"apache/hadoop","slug":"invalid-cipher-suite-s-s","errorCode":null,"errorMessage":"Invalid cipher suite, %s=%s","messagePattern":"Invalid cipher suite, (.+?)=(.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/DataTransferSaslUtil.java","lineNumber":323,"sourceCode":"  /**\n   * Negotiate a cipher option which server supports.\n   *\n   * @param conf the configuration\n   * @param options the cipher options which client supports\n   * @return CipherOption negotiated cipher option\n   */\n  public static CipherOption negotiateCipherOption(Configuration conf,\n      List<CipherOption> options) throws IOException {\n    // Negotiate cipher suites if configured.  Currently, the only supported\n    // cipher suite is AES/CTR/NoPadding or SM4/CTR/NoPadding, but the protocol\n    // allows multiple values for future expansion.\n    String cipherSuites = conf.get(DFS_ENCRYPT_DATA_TRANSFER_CIPHER_SUITES_KEY);\n    if (cipherSuites == null || cipherSuites.isEmpty()) {\n      return null;\n    }\n    if (!cipherSuites.equals(CipherSuite.AES_CTR_NOPADDING.getName()) &&\n        !cipherSuites.equals(CipherSuite.SM4_CTR_NOPADDING.getName())) {\n      throw new IOException(String.format(\"Invalid cipher suite, %s=%s\",\n          DFS_ENCRYPT_DATA_TRANSFER_CIPHER_SUITES_KEY, cipherSuites));\n    }\n    if (options != null) {\n      for (CipherOption option : options) {\n        CipherSuite suite = option.getCipherSuite();\n        if (suite == CipherSuite.AES_CTR_NOPADDING ||\n            suite == CipherSuite.SM4_CTR_NOPADDING) {\n          int keyLen = conf.getInt(\n              DFS_ENCRYPT_DATA_TRANSFER_CIPHER_KEY_BITLENGTH_KEY,\n              DFS_ENCRYPT_DATA_TRANSFER_CIPHER_KEY_BITLENGTH_DEFAULT) / 8;\n          CryptoCodec codec = CryptoCodec.getInstance(conf, suite);\n          byte[] inKey = new byte[keyLen];\n          byte[] inIv = new byte[suite.getAlgorithmBlockSize()];\n          byte[] outKey = new byte[keyLen];\n          byte[] outIv = new byte[suite.getAlgorithmBlockSize()];\n          assert codec != null;\n          codec.generateSecureRandom(inKey);\n          codec.generateSecureRandom(inIv);","sourceCodeStart":305,"sourceCodeEnd":341,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/DataTransferSaslUtil.java#L305-L341","documentation":"When negotiating a crypto cipher for encrypted data transfer, DataTransferSaslUtil.negotiateCipherOption accepts exactly 'aes/ctr/nopadding' or 'sm4/ctr/nopadding' as the value of dfs.encrypt.data.transfer.cipher.suites (the key is singular despite the name). Any other value throws IOException before negotiation starts.","triggerScenarios":"dfs.encrypt.data.transfer enabled with privacy QOP and dfs.encrypt.data.transfer.cipher.suites set to an unsupported string such as 'AES/CTR/PKCS5Padding', '3des', or a typo; thrown as soon as the node/client tries to negotiate cipher options.","commonSituations":"Copying JCE or OpenSSL cipher names into the property; expecting a comma-separated list of suites; older versions that do not know SM4.","solutions":["Set dfs.encrypt.data.transfer.cipher.suites=aes/ctr/nopadding (or sm4/ctr/nopadding where supported) on all nodes","Unset the property to use SASL privacy without an accelerated crypto cipher","Confirm the CryptoCodec implementation for the chosen suite (native OpenSSL libs) is present on all nodes"],"exampleFix":"<!-- before -->\n<property>\n  <name>dfs.encrypt.data.transfer.cipher.suites</name>\n  <value>AES/CTR/PKCS5Padding</value>\n</property>\n\n<!-- after -->\n<property>\n  <name>dfs.encrypt.data.transfer.cipher.suites</name>\n  <value>aes/ctr/nopadding</value>\n</property>","handlingStrategy":"validation","validationCode":"String suite = conf.getTrimmed(\"dfs.encrypt.data.transfer.cipher.suites\", \"\");\nif (!suite.isEmpty()\n    && !suite.equals(\"aes/ctr/nopadding\")\n    && !suite.equals(\"sm4/ctr/nopadding\")) {\n  throw new IllegalArgumentException(\"Unsupported cipher suite: \" + suite);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use the exact lowercase suite names; there is no list support despite the plural key","Validate security configs with a canary connection before rolling out"],"tags":["hdfs","configuration","encryption","cipher-suite"],"backgroundTag":"invalid-config-value","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}