{"record":{"id":"c82f3e743dbdbae2","repo":"alibaba/nacos","slug":"unsupported-algorithm","errorCode":null,"errorMessage":"unsupported Algorithm:{}","messagePattern":"unsupported Algorithm:(.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"client-basic/src/main/java/com/alibaba/nacos/client/auth/ram/utils/CalculateV4SigningKeyUtil.java","lineNumber":76,"sourceCode":"        Mac mac = Mac.getInstance(signMethod);\n        mac.init(new SecretKeySpec(firstSignkey, signMethod));\n        return mac.doFinal(region.getBytes(StandardCharsets.UTF_8));\n    }\n    \n    private static byte[] finalSigningKey(String secret, String date, String region,\n        String productCode,\n        String signMethod) {\n        try {\n            byte[] secondSignkey = regionSigningKey(secret, date, region, signMethod);\n            Mac mac = Mac.getInstance(signMethod);\n            mac.init(new SecretKeySpec(secondSignkey, signMethod));\n            byte[] thirdSigningKey = mac.doFinal(productCode.getBytes(StandardCharsets.UTF_8));\n            // 计算最终派生秘钥\n            mac = Mac.getInstance(signMethod);\n            mac.init(new SecretKeySpec(thirdSigningKey, signMethod));\n            return mac.doFinal(CONSTANT.getBytes(StandardCharsets.UTF_8));\n        } catch (NoSuchAlgorithmException e) {\n            throw new RuntimeException(\"unsupported Algorithm:\" + signMethod);\n        } catch (InvalidKeyException e) {\n            throw new RuntimeException(\"InvalidKey\");\n        }\n    }\n    \n    /**\n     * Return V4 signature key with base64 encode.\n     *\n     * @param secret      secret key\n     * @param date        date  with utc format, like 20211222\n     * @param region      region id\n     * @param productCode cloud product code\n     * @param signMethod  sign method\n     * @return V4 signature key with base64 encode\n     */\n    public static String finalSigningKeyString(String secret, String date, String region,\n        String productCode,\n        String signMethod) {","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/client-basic/src/main/java/com/alibaba/nacos/client/auth/ram/utils/CalculateV4SigningKeyUtil.java#L58-L94","documentation":"Thrown by CalculateV4SigningKeyUtil.finalSigningKey() as an unchecked RuntimeException when Mac.getInstance(signMethod) throws NoSuchAlgorithmException. This means the requested MAC algorithm is not available in the JVM's security providers. The default signMethod is HmacSHA256 (RamConstants.SIGNATURE_V4_METHOD), which is available on all standard JDKs, so this typically indicates a stripped-down or misconfigured JCE environment.","triggerScenarios":"A custom or non-standard signMethod is passed to finalSigningKeyString() that is not registered with any JCE provider. Or the JVM has been configured with security providers that do not include the HMAC-SHA256 algorithm.","commonSituations":"Running on a minimal JRE or custom JDK distribution with removed crypto modules (jlink --no-header-files); BouncyCastle provider misconfiguration; FIPS-mode JVM that restricts available algorithms; passing a typo'd algorithm name.","solutions":["Verify the signMethod value from the exception message; the default and expected value is 'HmacSHA256'.","Ensure the JVM has the standard SunJCE provider registered in java.security.","If using a custom JRE image built with jlink, include the necessary crypto modules or use a full JDK.","If running in FIPS mode, verify that HmacSHA256 is permitted by the FIPS provider configuration."],"exampleFix":"// before — custom algorithm name not available\nString key = CalculateV4SigningKeyUtil.finalSigningKeyString(secret, date, region, product, \"HmacMD5\");\n\n// after — use the standard algorithm\nString key = CalculateV4SigningKeyUtil.finalSigningKeyString(secret, date, region, product, \"HmacSHA256\");","handlingStrategy":"validation","validationCode":"String signMethod = \"HmacSHA256\";\ntry {\n    Mac.getInstance(signMethod);\n} catch (NoSuchAlgorithmException e) {\n    throw new IllegalStateException(\"Required MAC algorithm not available: \" + signMethod\n        + \". Check JCE provider configuration.\", e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    key = CalculateV4SigningKeyUtil.finalSigningKeyString(secret, date, region, product, signMethod);\n} catch (RuntimeException e) {\n    if (e.getMessage().contains(\"unsupported Algorithm\")) {\n        throw new IllegalStateException(\"JCE provider misconfiguration: HmacSHA256 not available\", e);\n    }\n    throw e;\n}","preventionTips":["Use the default signMethod 'HmacSHA256' unless you have a specific reason to change it.","Verify SunJCE is in the security provider list when using custom JVM images.","Avoid jlink-built minimal runtimes that strip crypto modules for Nacos RAM auth."],"tags":["auth","ram","crypto","jce-provider","signing"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}