infiniflow/ragflow · error · ValueError

Unsupported algorithm: {algorithm}

Error message

Unsupported algorithm: {algorithm}

What it means

ValueError from CryptoUtils.__init__ in common/crypto_utils.py:249-263. The utility supports exactly three cipher suites — aes-128-cbc, aes-256-cbc (default), and sm4-cbc — keyed by the SUPPORTED_ALGORITHMS map. Any other algorithm string passed to the constructor (including typos, algorithm names from other libraries like 'aes-256-gcm', or None with a non-default expectation) fails fast before any key handling.

Source

Thrown at common/crypto_utils.py:256

class CryptoUtil:
    """Cryptographic utility class, using factory pattern to create cryptographic algorithm instances"""

    # Supported cryptographic algorithms mapping
    SUPPORTED_ALGORITHMS = {"aes-128-cbc": AES128CBC, "aes-256-cbc": AES256CBC, "sm4-cbc": SM4CBC}

    def __init__(self, algorithm="aes-256-cbc", key=None, iv=None):
        """
        Initialize cryptographic utility

        Args:
            algorithm: Cryptographic algorithm, default is aes-256-cbc
            key: Encryption key, uses RAGFLOW_CRYPTO_KEY environment variable if None
            iv: Initialization vector, automatically generated if None
        """
        if algorithm not in self.SUPPORTED_ALGORITHMS:
            raise ValueError(f"Unsupported algorithm: {algorithm}")

        if not key:
            raise ValueError("Encryption key not provided and RAGFLOW_CRYPTO_KEY environment variable not set")

        # Create cryptographic algorithm instance
        self.algorithm_name = algorithm
        self.crypto = self.SUPPORTED_ALGORITHMS[algorithm](key=key, iv=iv)

    def encrypt(self, data):
        """
        Encrypt data

        Args:
            data: Data to encrypt (bytes)

        Returns:
            Encrypted data (bytes)
        """

View on GitHub (pinned to 554fb1133a)

Solutions

1. Use one of the three supported lowercase names: 'aes-128-cbc', 'aes-256-cbc', or 'sm4-cbc'.
2. If the value comes from config, correct the config entry to an exact supported string (case-sensitive).
3. If you truly need GCM/CTR, implement it outside CryptoUtils — do not try to extend the map ad hoc without understanding key/IV handling.

Example fix

# before
CryptoUtils(algorithm="AES-256-GCM", key=k)
# after
CryptoUtils(algorithm="aes-256-cbc", key=k)

SUPPORTED = {"aes-128-cbc", "aes-256-cbc", "sm4-cbc"}
if algorithm not in SUPPORTED:
    raise ValueError(f"unsupported algorithm {algorithm!r}; choose from {sorted(SUPPORTED)}")

def is_supported_algorithm(name: str) -> bool:
    return name in {"aes-128-cbc", "aes-256-cbc", "sm4-cbc"}

try:
    cu = CryptoUtils(algorithm=alg, key=key)
except ValueError as e:
    if "Unsupported algorithm" in str(e):
        alg = "aes-256-cbc"  # fall back to default, or prompt for re-entry
        cu = CryptoUtils(algorithm=alg, key=key)
    else:
        raise

When it happens

Trigger: Instantiating CryptoUtils(algorithm=...) with a value outside {aes-128-cbc, aes-256-cbc, sm4-cbc}. Common in code copied from other crypto tooling that uses GCM/CTR mode names, or config-driven algorithm names with a typo like 'AES-256-CBC' (case-sensitive map).

Common situations: Porting encryption code that used AES-GCM elsewhere and assuming RAGFlow supports it; case-mismatched algorithm names from config; upstream config files naming algorithms differently after a version change.

Related errors

• main() must return a value. Use null for an empty result.
• main() returned a non-JSON-serializable value.
• message.compileNotSupported
• Failed to fetch search detail
• {} not supported, should be a float number in range [0, 1]

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/b5f2eb33f8a5d788. Report an issue: GitHub.