iflytek/astron-agent · error · AesException

-40006

-40006

Error message

AES encryption failed

What it means

The encrypt method wraps any failure while initializing the AES cipher or performing AES-256-CBC encryption into AesException(-40006, 'AES encryption failed'). Given a valid 32-byte key this is rare; it usually indicates an environmental crypto problem rather than bad input.

Solutions

  1. Install the JCE Unlimited Strength policy files or upgrade to JDK 8u161+ where unlimited crypto is the default
  2. Re-verify the encodingAesKey is 43 chars so it decodes to exactly 32 bytes
  3. Check the console stack trace printed by e.printStackTrace() for the underlying CryptoException
  4. Ensure a standard JVM provider (SunJCE) is present and not overridden by a broken security.properties
Defensive patterns

Strategy: try-catch

Try / catch

try { String enc = crypt.encrypt(msg); } catch (AesException e) { if (e.getCode() == -40006) { log.error("AES encryption failed — check JCE policy/key", e); } throw e; }

Prevention

When it happens

Trigger: Cipher.getInstance("AES/CBC/NoPadding") unavailable (restricted JCE policy / missing AES-256 support in the JVM), a key that decoded to the wrong length so init() failed, or an unexpected internal error inside cipher.doFinal.

Common situations: Old JDK or JRE without unlimited-strength JCE policy files when encrypting with a 256-bit key, exotic JVMs lacking the AES provider, or a corrupted key that slipped past validation.

Related errors

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/f45e420a9a67f928. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/hub/src/main/java/com/iflytek/astron/console/hub/util/wechat/WXBizMsgCrypt.java:137

        byte[] unencrypted = byteCollector.toBytes();

        try {
            // Set encryption mode to AES CBC mode
            Cipher cipher = Cipher.getInstance("AES/CBC/NoPadding");
            SecretKeySpec keySpec = new SecretKeySpec(aesKey, "AES");
            IvParameterSpec iv = new IvParameterSpec(aesKey, 0, 16);
            cipher.init(Cipher.ENCRYPT_MODE, keySpec, iv);

            // Encrypt
            byte[] encrypted = cipher.doFinal(unencrypted);

            // Use BASE64 to encode encrypted string
            String base64Encrypted = base64.encodeToString(encrypted);

            return base64Encrypted;
        } catch (Exception e) {
            e.printStackTrace();
            throw new AesException(AesException.EncryptAESError);
        }
    }

    /**
     * Decrypt ciphertext.
     *
     * @param text Ciphertext to be decrypted
     * @return Decrypted plaintext
     * @throws AesException AES decryption failed
     */
    String decrypt(String text) throws AesException {
        byte[] original;
        try {
            // Set decryption mode to AES CBC mode
            Cipher cipher = Cipher.getInstance("AES/CBC/NoPadding");
            SecretKeySpec key_spec = new SecretKeySpec(aesKey, "AES");
            IvParameterSpec iv = new IvParameterSpec(Arrays.copyOfRange(aesKey, 0, 16));
            cipher.init(Cipher.DECRYPT_MODE, key_spec, iv);

View on GitHub (pinned to 5e758547a8)