{"record":{"id":"a7c87092eb9b32e8","repo":"apache/hadoop","slug":"doesn-t-support-algorithm-algorithm-and-mode","errorCode":null,"errorMessage":"Doesn't support algorithm: ${algorithm} and mode: ${mode}","messagePattern":"Doesn't support algorithm: (.+?) and mode: (.+?)","errorType":"validation","errorClass":"NoSuchAlgorithmException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/OpensslCipher.java","lineNumber":58,"sourceCode":" */\n@InterfaceAudience.Private\npublic final class OpensslCipher {\n  private static final Logger LOG =\n      LoggerFactory.getLogger(OpensslCipher.class.getName());\n  public static final int ENCRYPT_MODE = 1;\n  public static final int DECRYPT_MODE = 0;\n\n  /** Currently only support AES/CTR/NoPadding and SM4/CTR/NoPadding. */\n  private enum AlgMode {\n    AES_CTR,\n    SM4_CTR;\n    \n    static int get(String algorithm, String mode) \n        throws NoSuchAlgorithmException {\n      try {\n        return AlgMode.valueOf(algorithm + \"_\" + mode).ordinal();\n      } catch (Exception e) {\n        throw new NoSuchAlgorithmException(\"Doesn't support algorithm: \" + \n            algorithm + \" and mode: \" + mode);\n      }\n    }\n  }\n  \n  private enum Padding {\n    NoPadding;\n    \n    static int get(String padding) throws NoSuchPaddingException {\n      try {\n        return Padding.valueOf(padding).ordinal();\n      } catch (Exception e) {\n        throw new NoSuchPaddingException(\"Doesn't support padding: \" + padding);\n      }\n    }\n  }\n  \n  private long context = 0;","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/OpensslCipher.java#L40-L76","documentation":"OpensslCipher is the native OpenSSL-backed cipher. Its AlgMode enum only accepts the algorithm/mode pairs AES_CTR and SM4_CTR. AlgMode.get() concatenates algorithm and mode and looks up the enum; any other combination throws NoSuchAlgorithmException with the rejected values in the message.","triggerScenarios":"Calling OpensslCipher.getInstance() with a transformation whose algorithm/mode pair is not AES/CTR or SM4/CTR, e.g. \"DES/CTR/NoPadding\", \"AES/CBC/NoPadding\", or \"SM4/CBC/NoPadding\". Also reached via OpensslCipher.isSupported() probing arbitrary suites.","commonSituations":"Porting JCE code to the OpenSSL codec and reusing a non-CTR transformation string; configuration typos like AES-CTR/CTR/NoPadding; assuming the OpenSSL wrapper supports everything the JVM cipher API supports.","solutions":["Use only AES/CTR/NoPadding or SM4/CTR/NoPadding with OpensslCipher","Check capability first with OpensslCipher.isSupported(CipherSuite)","Prefer the JCE cipher (CryptoCodec dispatching) if you need a broader algorithm set — but note Hadoop's encryption layer still requires CTR","Fix the transformation string for typos in algorithm or mode tokens"],"exampleFix":"// before\nCipher c = OpensslCipher.getInstance(\"AES/CBC/NoPadding\"); // NoSuchAlgorithmException\n\n// after\nCipher c = OpensslCipher.getInstance(\"AES/CTR/NoPadding\");","handlingStrategy":"validation","validationCode":"// Probe support before creating the cipher\nif (!OpensslCipher.isSupported(CipherSuite.valueOfName(\"SM4/CTR/NoPadding\"))) {\n  // use AES/CTR/NoPadding instead\n}","typeGuard":"public boolean isOpensslSupported(String transformation) {\n  try {\n    OpensslCipher.tokenizeTransformationPublicly(transformation); // or isSupported\n    return true;\n  } catch (NoSuchAlgorithmException e) {\n    return false;\n  }\n}","tryCatchPattern":"try {\n  cipher = OpensslCipher.getInstance(transformation);\n} catch (NoSuchAlgorithmException e) {\n  throw new ConfigurationException(\n    \"Unsupported transformation '\" + transformation + \"'; use AES/CTR/NoPadding or SM4/CTR/NoPadding\", e);\n}","preventionTips":["Hard-code the two supported transformations or source them from CipherSuite.getName()","Add config validation at startup so bad suite names fail fast with a clear message","Remember the OpenSSL wrapper is intentionally narrower than the JCE cipher API"],"tags":["crypto","openssl","cipher","transformation","native"],"backgroundTag":"unsupported-cipher-transformation","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}