{"record":{"id":"d2af13144c8c5069","repo":"apereo/cas","slug":"encrypted-value-decryption-failed","errorCode":null,"errorMessage":"Encrypted Value: [{}] Decryption Failed","messagePattern":"Encrypted Value: \\[(.+?)\\] Decryption Failed","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-shell-core/src/main/java/org/apereo/cas/shell/commands/jasypt/JasyptTestAlgorithmsCommand.java","lineNumber":61,"sourceCode":"                val algorithmStr = algorithm.toString();\n                cipher.setPassword(password);\n                cipher.setKeyObtentionIterations(\"1\");\n                cipher.setProviderName(provider);\n                try {\n                    LOGGER.trace(\"Testing algorithm [{}]\", algorithmStr);\n                    cipher.setAlgorithm(algorithmStr);\n                    val encryptedValue = cipher.encryptValue(value, e -> {\n                        LOGGER.trace(e.getMessage(), e);\n                        return null;\n                    });\n                    if (encryptedValue == null) {\n                        continue;\n                    }\n                    LOGGER.info(\"Provider: [{}] Algorithm: [{}]\", provider, algorithmStr);\n                    val result = cipher.decryptValue(encryptedValue);\n                    FunctionUtils.doIf(result != null,\n                            r -> LOGGER.info(\"Encrypted Value: [{}] Decryption succeeded\", encryptedValue),\n                            t -> LOGGER.warn(\"Encrypted Value: [{}] Decryption Failed\", encryptedValue))\n                        .accept(result);\n\n                } catch (final Exception e) {\n                    if (e.getCause() instanceof NoSuchAlgorithmException) {\n                        LOGGER.warn(\"Provider: [{}] does not support Algorithm: [{}]\", provider, algorithmStr);\n                    } else {\n                        LOGGER.warn(\"Error encrypting using provider: [{}] and algorithm: [{}], Message: [{}]\", provider, algorithmStr, e.getMessage());\n                    }\n                }\n            }\n        }\n    }\n}\n","sourceCodeStart":43,"sourceCodeEnd":75,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-shell-core/src/main/java/org/apereo/cas/shell/commands/jasypt/JasyptTestAlgorithmsCommand.java#L43-L75","documentation":"JasyptTestAlgorithmsCommand.validateAlgorithms iterates JCE providers/algorithms, encrypts a sample value with each, then attempts decryption. When the cipher returns a non-null result, doIf logs success; the warn branch is reached only when the decrypted result is null, meaning the algorithm encrypted but could not round-trip decrypt the value.","triggerScenarios":"An algorithm that can encrypt (encryptValue succeeded) but whose decryptValue returns null — e.g. algorithms with incompatible padding or block modes that silently fail the Jasypt round-trip for the given key/pool size settings.","commonSituations":"Selecting an algorithm unsuitable for Jasypt text encryption (e.g. ECB/stream mismatches); wrong key size for the algorithm; evaluating providers to find which Jasypt algorithm to configure for cas.authn... password encryption.","solutions":["Avoid configuring the flagged provider/algorithm in Jasypt; it failed the encrypt/decrypt round-trip.","Choose an algorithm reported as 'Decryption succeeded' (commonly PBEWITHHMACSHA* AND AES variants) for CAS password encryption.","Adjust the Jasypt key/iterations settings if strong algorithms return null and retry validation."],"exampleFix":"// before\nalgorithm = PBEWITHSHA1ANDDESede // null on decrypt\n// after\nalgorithm = PBEWITHHMACSHA512ANDAES_256 // verified by validateAlgorithms round-trip","handlingStrategy":"validation","validationCode":"String encrypted = cipher.encryptValue(plain);\nString decrypted = cipher.decryptValue(encrypted);\nif (decrypted == null || !plain.equals(decrypted)) {\n    LOGGER.warn(\"Algorithm failed round-trip; do not use it for CAS password encryption\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run validateAlgorithms and only adopt algorithms reported as 'Decryption succeeded'.","Prefer modern PBEWithHmacSHA*AndAES algorithms.","Verify key sizes match the algorithm requirements."],"tags":["jasypt","encryption","cli","crypto"],"backgroundTag":"decryption-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}