{"record":{"id":"f45e420a9a67f928","repo":"iflytek/astron-agent","slug":"40006-aes-encryption-failed","errorCode":"-40006","errorMessage":"AES encryption failed","messagePattern":"AES encryption failed","errorType":"error_code","errorClass":"AesException","httpStatus":null,"severity":"error","filePath":"console/backend/hub/src/main/java/com/iflytek/astron/console/hub/util/wechat/WXBizMsgCrypt.java","lineNumber":137,"sourceCode":"        byte[] unencrypted = byteCollector.toBytes();\n\n        try {\n            // Set encryption mode to AES CBC mode\n            Cipher cipher = Cipher.getInstance(\"AES/CBC/NoPadding\");\n            SecretKeySpec keySpec = new SecretKeySpec(aesKey, \"AES\");\n            IvParameterSpec iv = new IvParameterSpec(aesKey, 0, 16);\n            cipher.init(Cipher.ENCRYPT_MODE, keySpec, iv);\n\n            // Encrypt\n            byte[] encrypted = cipher.doFinal(unencrypted);\n\n            // Use BASE64 to encode encrypted string\n            String base64Encrypted = base64.encodeToString(encrypted);\n\n            return base64Encrypted;\n        } catch (Exception e) {\n            e.printStackTrace();\n            throw new AesException(AesException.EncryptAESError);\n        }\n    }\n\n    /**\n     * Decrypt ciphertext.\n     *\n     * @param text Ciphertext to be decrypted\n     * @return Decrypted plaintext\n     * @throws AesException AES decryption failed\n     */\n    String decrypt(String text) throws AesException {\n        byte[] original;\n        try {\n            // Set decryption mode to AES CBC mode\n            Cipher cipher = Cipher.getInstance(\"AES/CBC/NoPadding\");\n            SecretKeySpec key_spec = new SecretKeySpec(aesKey, \"AES\");\n            IvParameterSpec iv = new IvParameterSpec(Arrays.copyOfRange(aesKey, 0, 16));\n            cipher.init(Cipher.DECRYPT_MODE, key_spec, iv);","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/hub/src/main/java/com/iflytek/astron/console/hub/util/wechat/WXBizMsgCrypt.java#L119-L155","documentation":"The encrypt method wraps any failure while initializing the AES cipher or performing AES-256-CBC encryption into AesException(-40006, 'AES encryption failed'). Given a valid 32-byte key this is rare; it usually indicates an environmental crypto problem rather than bad input.","triggerScenarios":"Cipher.getInstance(\"AES/CBC/NoPadding\") unavailable (restricted JCE policy / missing AES-256 support in the JVM), a key that decoded to the wrong length so init() failed, or an unexpected internal error inside cipher.doFinal.","commonSituations":"Old JDK or JRE without unlimited-strength JCE policy files when encrypting with a 256-bit key, exotic JVMs lacking the AES provider, or a corrupted key that slipped past validation.","solutions":["Install the JCE Unlimited Strength policy files or upgrade to JDK 8u161+ where unlimited crypto is the default","Re-verify the encodingAesKey is 43 chars so it decodes to exactly 32 bytes","Check the console stack trace printed by e.printStackTrace() for the underlying CryptoException","Ensure a standard JVM provider (SunJCE) is present and not overridden by a broken security.properties"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { String enc = crypt.encrypt(msg); } catch (AesException e) { if (e.getCode() == -40006) { log.error(\"AES encryption failed — check JCE policy/key\", e); } throw e; }","preventionTips":["Use JDK 8u161+ (or install unlimited JCE policy) for AES-256","Validate the AES key decodes to 32 bytes before constructing the cryptor"],"tags":["java","wechat","aes","encryption","jce"],"backgroundTag":"api-error-response","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}