{"record":{"id":"ea601a709f8f57e1","repo":"spring-projects/spring-security","slug":"unable-to-invoke-cipher-due-to-illegal-block-size","errorCode":null,"errorMessage":"Unable to invoke Cipher due to illegal block size","messagePattern":"Unable to invoke Cipher due to illegal block size","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/encrypt/CipherUtils.java","lineNumber":141,"sourceCode":"\t\t}\n\t\tcatch (InvalidKeyException ex) {\n\t\t\tthrow new IllegalArgumentException(\"Unable to initialize due to invalid secret key\", ex);\n\t\t}\n\t\tcatch (InvalidAlgorithmParameterException ex) {\n\t\t\tthrow new IllegalStateException(\"Unable to initialize due to invalid decryption parameter spec\", ex);\n\t\t}\n\t}\n\n\t/**\n\t * Invokes the Cipher to perform encryption or decryption (depending on the\n\t * initialized mode).\n\t */\n\tstatic byte[] doFinal(Cipher cipher, byte[] input) {\n\t\ttry {\n\t\t\treturn cipher.doFinal(input);\n\t\t}\n\t\tcatch (IllegalBlockSizeException ex) {\n\t\t\tthrow new IllegalStateException(\"Unable to invoke Cipher due to illegal block size\", ex);\n\t\t}\n\t\tcatch (BadPaddingException ex) {\n\t\t\tthrow new IllegalStateException(\"Unable to invoke Cipher due to bad padding\", ex);\n\t\t}\n\t}\n\n}\n","sourceCodeStart":123,"sourceCodeEnd":149,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/encrypt/CipherUtils.java#L123-L149","documentation":"Thrown by CipherUtils.doFinal when cipher.doFinal(input) throws IllegalBlockSizeException. The input length is not a valid multiple of the cipher's block size (typical for a no-padding block cipher) or the cipher is in a state (e.g. already finalized) that forbids processing more data.","triggerScenarios":"Using a transformation with NoPadding and passing input whose length isn't a block-size multiple (e.g. 20 bytes to AES with no padding); calling doFinal twice on the same Cipher instance; corrupting/truncating ciphertext so the final block is incomplete.","commonSituations":"Custom encryptors configured with \"AES/CBC/NoPadding\"; reusing a Cipher object across calls instead of creating a new one per operation; storage layers that truncate binary columns or strip trailing bytes from ciphertext.","solutions":["Use a padding mode (e.g. \"AES/CBC/PKCS5Padding\") or pad input to a multiple of 16 bytes yourself when using NoPadding.","Create a fresh Cipher per encrypt/decrypt operation rather than reusing a finalized instance.","Verify ciphertext is stored/retrieved in full (check column types are VARBINARY/BLOB or Base64 text, not lossy CHAR columns).","Confirm encrypt and decrypt use the same transformation string."],"exampleFix":"// before\nCipher cipher = CipherUtils.newCipher(\"AES/CBC/NoPadding\");\nbyte[] out = CipherUtils.doFinal(cipher, twentyByteArray); // not a multiple of 16\n// after\nCipher cipher = CipherUtils.newCipher(\"AES/CBC/PKCS5Padding\");\nbyte[] out = CipherUtils.doFinal(cipher, input); // any length OK with padding","handlingStrategy":"validation","validationCode":"if (input == null || input.length % 16 != 0) {\n    throw new IllegalArgumentException(\"NoPadding ciphers require input length multiple of 16 bytes\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    return CipherUtils.doFinal(cipher, input);\n} catch (IllegalStateException ex) {\n    throw new DataCorruptionException(\"Cipher doFinal failed (block size/state) — check padding mode and ciphertext integrity\", ex);\n}","preventionTips":["Use PKCS5Padding rather than NoPadding unless input lengths are guaranteed.","Instantiate a new Cipher for every operation; never reuse a finalized one.","Store ciphertext in binary-safe storage (BLOB/VARBINARY or Base64 text).","Verify encrypt/decrypt sides use identical transformation strings."],"tags":["crypto","block-size","padding","cipher","spring-security"],"backgroundTag":"invalid-argument-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}