{"record":{"id":"b428b42be539b4e6","repo":"binarywang/WxJava","slug":"hmacsha256-signature-failed","errorCode":null,"errorMessage":"HmacSHA256 signature failed","messagePattern":"HmacSHA256 signature failed","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"weixin-java-aispeech/src/main/java/me/chanjar/weixin/aispeech/util/WxAispeechSignUtil.java","lineNumber":31,"sourceCode":"public final class WxAispeechSignUtil {\n  private WxAispeechSignUtil() {\n  }\n\n  public static String calcDialogSign(String token, long timestamp, String nonce, String body) {\n    String bodyMd5 = DigestUtils.md5Hex(defaultString(body));\n    return DigestUtils.md5Hex(defaultString(token) + timestamp + defaultString(nonce) + bodyMd5);\n  }\n\n  public static String calcKnowledgeSignature(String secretKey, long timestamp, String nonce, String requestId,\n                                              String requestBody) {\n    String payload = timestamp + \"\\n\" + defaultString(nonce) + \"\\n\" + defaultString(requestId) + \"\\n\"\n      + defaultString(requestBody);\n    try {\n      Mac mac = Mac.getInstance(\"HmacSHA256\");\n      mac.init(new SecretKeySpec(defaultString(secretKey).getBytes(StandardCharsets.UTF_8), \"HmacSHA256\"));\n      return bytesToHex(mac.doFinal(payload.getBytes(StandardCharsets.UTF_8)));\n    } catch (GeneralSecurityException e) {\n      throw new IllegalStateException(\"HmacSHA256 signature failed\", e);\n    }\n  }\n\n  public static String encryptAesCbcToBase64(String plainText, String aesKey) {\n    try {\n      byte[] keyBytes = decodeAesKey(aesKey);\n      Cipher cipher = Cipher.getInstance(\"AES/CBC/PKCS5Padding\");\n      cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(keyBytes, \"AES\"), new IvParameterSpec(Arrays.copyOf(keyBytes, 16)));\n      byte[] encrypted = cipher.doFinal(defaultString(plainText).getBytes(StandardCharsets.UTF_8));\n      return Base64.encodeBase64String(encrypted);\n    } catch (GeneralSecurityException e) {\n      throw new IllegalStateException(\"AES CBC encrypt failed\", e);\n    }\n  }\n\n  public static String decryptAesCbcFromBase64(String cipherTextBase64, String aesKey) {\n    try {\n      byte[] keyBytes = decodeAesKey(aesKey);","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/binarywang/WxJava/blob/1c43293a3c2c9d7e91304b6d037fb017f680d0c6/weixin-java-aispeech/src/main/java/me/chanjar/weixin/aispeech/util/WxAispeechSignUtil.java#L13-L49","documentation":"Thrown by `calcKnowledgeSignature` when the JCE `Mac.getInstance(\"HmacSHA256\")` or `mac.init(...)` raises a GeneralSecurityException, wrapped as IllegalStateException. HmacSHA256 is mandatory in every JDK, so in practice this only fires on a corrupted/custom security provider, a bad SecretKeySpec, or a severely misconfigured JVM.","triggerScenarios":"An exotic JCE provider that does not implement HmacSHA256; a SecurityManager/provider override stripping algorithms; running on a stripped JVM image lacking the HmacSHA256 algorithm.","commonSituations":"Custom/JNI security provider misconfigured; hardened/restricted JRE; rarely a JDK bug.","solutions":["Confirm the JVM provides HmacSHA256: run a tiny `Mac.getInstance(\"HmacSHA256\")` test.","Remove or fix any custom security provider registered via `java.security`.","Use a standard JDK distribution rather than a stripped image.","Inspect the wrapped cause exception for the exact algorithm/provider error."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Sanity-check the JCE provider at startup\ntry {\n    javax.crypto.Mac.getInstance(\"HmacSHA256\");\n} catch (java.security.NoSuchAlgorithmException e) {\n    throw new IllegalStateException(\"JVM lacks HmacSHA256\", e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    String sig = WxAispeechSignUtil.calcKnowledgeSignature(secretKey, ts, nonce, reqId, body);\n} catch (IllegalStateException e) {\n    // unwrap GeneralSecurityException; provider/algorithm problem\n    log.error(\"HmacSHA256 unavailable on this JVM\", e.getCause());\n    throw e;\n}","preventionTips":["Run on a standard, unstripped JDK.","Avoid registering custom JCE providers that drop HmacSHA256.","Add a startup self-test for required crypto algorithms."],"tags":["aispeech","crypto","jce","runtime"],"backgroundTag":null,"analyzedSha":"1c43293a3c2c9d7e91304b6d037fb017f680d0c6","analyzedAt":"2026-08-14T02:29:11.060Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}