{"record":{"id":"97b14c4da2b64dbb","repo":"spring-projects/spring-security","slug":"should-not-happen","errorCode":null,"errorMessage":"Should not happen","messagePattern":"Should not happen","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/encrypt/CipherUtils.java","lineNumber":81,"sourceCode":"\t\t\tthrow new IllegalArgumentException(\"Not a valid encryption algorithm\", ex);\n\t\t}\n\t\tcatch (InvalidKeySpecException ex) {\n\t\t\tthrow new IllegalArgumentException(\"Not a valid secret key\", ex);\n\t\t}\n\t}\n\n\t/**\n\t * Constructs a new Cipher.\n\t */\n\tstatic Cipher newCipher(String algorithm) {\n\t\ttry {\n\t\t\treturn Cipher.getInstance(algorithm);\n\t\t}\n\t\tcatch (NoSuchAlgorithmException ex) {\n\t\t\tthrow new IllegalArgumentException(\"Not a valid encryption algorithm\", ex);\n\t\t}\n\t\tcatch (NoSuchPaddingException ex) {\n\t\t\tthrow new IllegalStateException(\"Should not happen\", ex);\n\t\t}\n\t}\n\n\t/**\n\t * Initializes the Cipher for use.\n\t */\n\tstatic <T extends AlgorithmParameterSpec> T getParameterSpec(Cipher cipher, Class<T> parameterSpecClass) {\n\t\ttry {\n\t\t\treturn cipher.getParameters().getParameterSpec(parameterSpecClass);\n\t\t}\n\t\tcatch (InvalidParameterSpecException ex) {\n\t\t\tthrow new IllegalArgumentException(\"Unable to access parameter\", ex);\n\t\t}\n\t}\n\n\t/**\n\t * Initializes the Cipher for use.\n\t */","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/encrypt/CipherUtils.java#L63-L99","documentation":"Thrown by CipherUtils.newCipher when Cipher.getInstance succeeds in finding the transformation but rejects the requested padding scheme (NoSuchPaddingException). The library declares this 'should not happen' because all transformations it uses include valid padding names, so hitting it indicates an unusual custom algorithm string.","triggerScenarios":"Requesting a Cipher transformation whose padding component is unrecognized by any provider, e.g. \"AES/CBC/PKCS7Padding\" or a malformed \"AES/CBC/NoSuchPad\" transformation passed to a custom AesBytesEncryptor variant.","commonSituations":"Hand-editing algorithm constants copied from non-Java documentation (PKCS7 naming); provider-restricted (FIPS) JVMs that lack standard padding implementations; copy-paste from other-language examples.","solutions":["Replace the padding name with a JCE-standard one: \"PKCS5Padding\" or \"NoPadding\".","Register the BouncyCastle provider if using padding schemes it supplies.","Review the transformation string format: Algorithm/Mode/Padding, each segment valid.","If this fires with Spring Security's own constants, report it — the library treats it as an internal invariant."],"exampleFix":"// before\nCipher cipher = CipherUtils.newCipher(\"AES/CBC/PKCS7Padding\");\n// after\nCipher cipher = CipherUtils.newCipher(\"AES/CBC/PKCS5Padding\");","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    return CipherUtils.newCipher(transformation);\n} catch (IllegalStateException ex) {\n    throw new ConfigurationException(\"Invalid padding in transformation: \" + transformation, ex);\n}","preventionTips":["Use NoPadding or PKCS5Padding — the only padding names standard JCE recognizes for these modes.","Treat 'Should not happen' as a sign your custom transformation string is malformed.","Validate transformation format (Algorithm/Mode/Padding) in config validation.","Keep Spring Security's default algorithm constants unless you have a tested reason to change."],"tags":["crypto","cipher","padding","internal-invariant","spring-security"],"backgroundTag":"internal-invariant-violation","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}