{"record":{"id":"fbc345c760160f00","repo":"spring-projects/spring-security","slug":"not-a-valid-encryption-algorithm","errorCode":null,"errorMessage":"Not a valid encryption algorithm","messagePattern":"Not a valid encryption algorithm","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/encrypt/CipherUtils.java","lineNumber":63,"sourceCode":"\t}\n\n\t/**\n\t * Generates a SecretKey.\n\t */\n\tstatic SecretKey newSecretKey(String algorithm, String password) {\n\t\treturn newSecretKey(algorithm, new PBEKeySpec(password.toCharArray()));\n\t}\n\n\t/**\n\t * Generates a SecretKey.\n\t */\n\tstatic SecretKey newSecretKey(String algorithm, PBEKeySpec keySpec) {\n\t\ttry {\n\t\t\tSecretKeyFactory factory = SecretKeyFactory.getInstance(algorithm);\n\t\t\treturn factory.generateSecret(keySpec);\n\t\t}\n\t\tcatch (NoSuchAlgorithmException ex) {\n\t\t\tthrow new IllegalArgumentException(\"Not a valid encryption algorithm\", ex);\n\t\t}\n\t\tcatch (InvalidKeySpecException ex) {\n\t\t\tthrow new IllegalArgumentException(\"Not a valid secret key\", ex);\n\t\t}\n\t}\n\n\t/**\n\t * Constructs a new Cipher.\n\t */\n\tstatic Cipher newCipher(String algorithm) {\n\t\ttry {\n\t\t\treturn Cipher.getInstance(algorithm);\n\t\t}\n\t\tcatch (NoSuchAlgorithmException ex) {\n\t\t\tthrow new IllegalArgumentException(\"Not a valid encryption algorithm\", ex);\n\t\t}\n\t\tcatch (NoSuchPaddingException ex) {\n\t\t\tthrow new IllegalStateException(\"Should not happen\", ex);","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/encrypt/CipherUtils.java#L45-L81","documentation":"Thrown by CipherUtils.newSecretKey when SecretKeyFactory.getInstance(algorithm) cannot find the requested PBE algorithm (NoSuchAlgorithmException). The algorithm name string passed to the encryptor/encoder is not recognized by the installed JCE providers.","triggerScenarios":"Calling new SecretKeyFactory-based encryptors such as new BouncyCastleAesCbcBytesEncryptor(password, salt) with a keystrength/algorithm variant, or directly invoking CipherUtils.newSecretKey(\"PBKDF2WithHmacSHA...\", keySpec) with a misspelled or unsupported algorithm name (e.g. \"PBKDF2WithHMACSHA256\" on a JDK whose providers only expose certain variants, or \"PBEWITHSHA256AND128BITAES-CBC-BC\" without the BouncyCastle provider registered).","commonSituations":"Typos in algorithm constants; running on a JDK that lacks the algorithm variant (older JDKs missing PBKDF2WithHmacSHA256); forgetting to register Security.addProvider(new BouncyCastleProvider()) before using the *-BC encryptors with BC-specific algorithm names; FIPS-only JVMs.","solutions":["Check the algorithm string spelling against CipherUtils constants (e.g. \"PBKDF2WithHmacSHA1\", \"PBKDF2WithHmacSHA256\").","Register the provider: Security.addProvider(new BouncyCastleProvider()) before creating BC-based encryptors.","Use a JDK-supported algorithm variant available on your JVM (query Security.getProviders() / SecretKeyFactory algorithms to list what exists).","Upgrade the JDK or add BouncyCastle bcprov dependency if the required PBE variant is missing."],"exampleFix":"// before\nSecretKey key = CipherUtils.newSecretKey(\"PBKDF2WithHmacSHA512\", keySpec); // NoSuchAlgorithmException on some JDKs\n// after\nSecurity.addProvider(new BouncyCastleProvider());\nSecretKey key = CipherUtils.newSecretKey(\"PBKDF2WithHmacSHA256\", keySpec);","handlingStrategy":"validation","validationCode":"boolean supported = java.util.Arrays.stream(java.security.Security.getProviders())\n    .flatMap(p -> java.util.Arrays.stream(p.getServices()))\n    .filter(s -> s.getType().equals(\"SecretKeyFactory\"))\n    .anyMatch(s -> s.getAlgorithm().equalsIgnoreCase(\"PBKDF2WithHmacSHA256\"));","typeGuard":null,"tryCatchPattern":"try {\n    return CipherUtils.newSecretKey(algorithm, keySpec);\n} catch (IllegalArgumentException ex) {\n    throw new ConfigurationException(\"Unsupported PBE algorithm: \" + algorithm, ex);\n}","preventionTips":["Reference Spring Security's CipherUtils constants instead of hardcoding algorithm strings.","Register BouncyCastleProvider at application startup when using BC variants.","Fail fast at startup with a smoke encrypt/decrypt call.","Check JDK release notes for algorithm availability before upgrades/downgrades."],"tags":["crypto","algorithm","invalid-algorithm","jce","spring-security"],"backgroundTag":"invalid-argument-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}