{"record":{"id":"dea04d21a12a7b04","repo":"apache/cassandra","slug":"cannot-load-cipher","errorCode":null,"errorMessage":"cannot load cipher","messagePattern":"cannot load cipher","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"critical","filePath":"src/java/org/apache/cassandra/security/CipherFactory.java","lineNumber":137,"sourceCode":"            if (cachedCipher != null)\n            {\n                Cipher cipher = cachedCipher.cipher;\n                // rigorous checks to make sure we've absolutely got the correct instance (with correct alg/key/iv/...)\n                if (cachedCipher.mode == cipherMode && cipher.getAlgorithm().equals(transformation)\n                    && cachedCipher.keyAlias.equals(keyAlias) && Arrays.equals(cipher.getIV(), iv))\n                    return cipher;\n            }\n\n            Key key = retrieveKey(keyAlias);\n            Cipher cipher = Cipher.getInstance(transformation);\n            cipher.init(cipherMode, key, new IvParameterSpec(iv));\n            cipherThreadLocal.set(new CachedCipher(cipherMode, keyAlias, cipher));\n            return cipher;\n        }\n        catch (NoSuchAlgorithmException | NoSuchPaddingException | InvalidAlgorithmParameterException | InvalidKeyException e)\n        {\n            logger.error(\"could not build cipher\", e);\n            throw new IOException(\"cannot load cipher\", e);\n        }\n    }\n\n    private Key retrieveKey(String keyAlias) throws IOException\n    {\n        try\n        {\n            return cache.get(keyAlias);\n        }\n        catch (CompletionException e)\n        {\n            if (e.getCause() instanceof IOException)\n                throw (IOException)e.getCause();\n            throw new IOException(\"failed to load key from cache: \" + keyAlias, e);\n        }\n    }\n\n    /**","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/CipherFactory.java#L119-L155","documentation":"buildCipher obtains a JCE Cipher for the configured transformation (e.g. AES/CBC/PKCS5Padding) with a key from the key provider. Failures like unknown algorithm, bad padding, invalid key, or invalid algorithm parameters are logged and rethrown as IOException(\"cannot load cipher\").","triggerScenarios":"getEncryptor/getDecryptor -> buildCipher with a cipher name the JVM's JCE provider doesn't support, a key_alias with no key in the provider, or IV bytes invalid for the algorithm.","commonSituations":"Typo'd cipher name in transparent_data_encryption_options (e.g. AES/CBC/PKCS5Padding misspelled), wrong key_alias, key deleted/rotated out of the keystore, or an older JDK lacking the algorithm.","solutions":["Verify transparent_data_encryption_options.cipher is a valid JCE transformation supported by your JVM (typically AES/CBC/PKCS5Padding).","Confirm the key_alias exists in the keystore: `keytool -list -v -keystore <file>`.","Check the logged 'could not build cipher' stack trace for the specific JCE exception and fix key/IV material accordingly.","Ensure the JVM has the needed crypto provider / unlimited strength policy."],"exampleFix":"// before\ntransparent_data_encryption_options:\n  cipher: AES/CBC/PKCS Padding\n// after\ntransparent_data_encryption_options:\n  cipher: AES/CBC/PKCS5Padding","handlingStrategy":"validation","validationCode":"String transformation = tdeOptions.cipher; // e.g. AES/CBC/PKCS5Padding\nCipher.getInstance(transformation); // throws NoSuchAlgorithmException/NoSuchPaddingException if unsupported\nKeyStore ks = KeyStore.getInstance(\"JCEKS\");\ntry (InputStream in = new FileInputStream(keystorePath)) { ks.load(in, password.toCharArray()); }\nif (!ks.containsAlias(tdeOptions.key_alias)) throw new IllegalStateException(\"Missing key alias: \" + tdeOptions.key_alias);","typeGuard":null,"tryCatchPattern":"try {\n    Cipher c = cipherFactory.getEncryptor(tdeOptions.cipher, tdeOptions.key_alias);\n} catch (IOException e) {\n    logger.error(\"Cipher load failed; check cipher name and key_alias\", e);\n}","preventionTips":["Pin a supported transformation string (AES/CBC/PKCS5Padding)","Verify key aliases exist after every keystore rotation","Test encryption path on the target JDK before rollout"],"tags":["encryption","jce","configuration"],"backgroundTag":"invalid-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}