{"record":{"id":"c05ef0032aa1c5fa","repo":"apache/hadoop","slug":"namenode-specified-unknown-ciphersuite-with-id","errorCode":null,"errorMessage":"NameNode specified unknown CipherSuite with ID {}, cannot instantiate CryptoCodec.","messagePattern":"NameNode specified unknown CipherSuite with ID (.+?), cannot instantiate CryptoCodec\\.","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/HdfsKMSUtil.java","lineNumber":107,"sourceCode":"    }\n    return version;\n  }\n\n  /**\n   * Obtain a CryptoCodec based on the CipherSuite set in a FileEncryptionInfo\n   * and the available CryptoCodecs configured in the Configuration.\n   *\n   * @param conf   Configuration\n   * @param feInfo FileEncryptionInfo\n   * @return CryptoCodec\n   * @throws IOException if no suitable CryptoCodec for the CipherSuite is\n   *                     available.\n   */\n  public static CryptoCodec getCryptoCodec(Configuration conf,\n      FileEncryptionInfo feInfo) throws IOException {\n    final CipherSuite suite = feInfo.getCipherSuite();\n    if (suite.equals(CipherSuite.UNKNOWN)) {\n      throw new IOException(\"NameNode specified unknown CipherSuite with ID \"\n          + suite.getUnknownValue() + \", cannot instantiate CryptoCodec.\");\n    }\n    final CryptoCodec codec = CryptoCodec.getInstance(conf, suite);\n    if (codec == null) {\n      throw new UnknownCipherSuiteException(\n          \"No configuration found for the cipher suite \"\n              + suite.getConfigSuffix() + \" prefixed with \"\n              + HADOOP_SECURITY_CRYPTO_CODEC_CLASSES_KEY_PREFIX\n              + \". Please see the example configuration \"\n              + \"hadoop.security.crypto.codec.classes.EXAMPLECIPHERSUITE \"\n              + \"at core-default.xml for details.\");\n    }\n    return codec;\n  }\n\n  /**\n   * The key provider uri is searched in the following order.\n   * 1. If there is a mapping in Credential's secrets map for namenode uri.","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/HdfsKMSUtil.java#L89-L125","documentation":"The FileEncryptionInfo for a file in an encryption zone carries a CipherSuite; when the client's CipherSuite enum cannot map the ID the NameNode sent, the suite equals CipherSuite.UNKNOWN and HdfsKMSUtil refuses to build a CryptoCodec, reporting the raw unknown ID. Like the protocol-version error, this is a client-too-old / jar-mismatch signal: the NameNode knows a cipher suite this client has never heard of.","triggerScenarios":"Reading an encrypted file whose suite ID (from feInfo.getCipherSuite()) is not in the client's CipherSuite enum: newer NameNode with an extended suite list, fork-added suites, or an old hadoop-common shadowing a new one; also possible if a non-HDFS-compatible middle layer mangles the encryption info.","commonSituations":"Legacy Hive/Spark clients on upgraded encrypted clusters; mixed hadoop-common versions in application containers; vendor distributions with extra cipher suites.","solutions":["Upgrade the client hadoop-common/hdfs-client jars so the CipherSuite enum includes the NameNode's suite","Inspect the classpath for a stale hadoop-common jar and remove it (CipherSuite lives in hadoop-common)","Verify with the cluster admin which cipher suite the encryption zone uses (default AES/CTR/NoPadding) and that nothing exotic was enabled"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"FileEncryptionInfo feInfo = getFileEncryptionInfo(fs, path);\nif (feInfo != null && feInfo.getCipherSuite().equals(CipherSuite.UNKNOWN)) {\n  throw new UnsupportedOperationException(\n      \"Client cannot recognize cipher suite ID \" + feInfo.getCipherSuite().getUnknownValue()\n      + \" — upgrade client Hadoop jars\");\n}","typeGuard":"private static boolean cipherSuiteKnown(FileEncryptionInfo feInfo) {\n  return feInfo != null && !feInfo.getCipherSuite().equals(CipherSuite.UNKNOWN);\n}","tryCatchPattern":"try {\n  return HdfsKMSUtil.decryptEncryptedDataEncryptionKey(feInfo, keyProvider);\n} catch (IOException e) {\n  if (e.getMessage().contains(\"unknown CipherSuite\")) {\n    // surface as a version-mismatch error with actionable text\n    throw new UnsupportedOperationException(\"Client too old for cluster cipher suite\", e);\n  }\n  throw e;\n}","preventionTips":["Match client and cluster Hadoop versions in encrypted environments","Check CipherSuite.UNKNOWN early when you already hold the FileEncryptionInfo","Track vendor/fork extensions to cipher suites before rolling them out to mixed clients"],"tags":["hdfs","encryption","cipher-suite","version-mismatch","classpath"],"backgroundTag":"unsupported-cipher-suite","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}