pentaho/pentaho-kettle · error · CryptoException

SymmetricCrypto.SymmetricCrypto.Error.Cipher

SymmetricCrypto.SymmetricCrypto.Error.Cipher

Error message

SymmetricCrypto.SymmetricCrypto.Error.Cipher

What it means

In the two-argument SymmetricCrypto constructor, CryptoException 'SymmetricCrypto.SymmetricCrypto.Error.Cipher' wraps any exception thrown by Cipher.getInstance(scheme) — most commonly NoSuchAlgorithmException/NoSuchProviderException because the requested transformation is not available from installed JCE providers.

Solutions

  1. Fix the scheme string to an exact JCE transformation, e.g. "AES" or "AES/CBC/PKCS5Padding"
  2. Register BouncyCastle if the scheme needs it: Security.addProvider(new BouncyCastleProvider())
  3. On legacy JDKs, install the unlimited strength JCE policy files (or upgrade to JDK 8u161+)
  4. Print available algorithms: iterate Security.getProviders() and their services to confirm support

Example fix

// before
SymmetricCrypto c = new SymmetricCrypto(meta, "AES/ANY/Pad"); // invalid transformation
// after
SymmetricCrypto c = new SymmetricCrypto(meta, "AES/CBC/PKCS5Padding");
Defensive patterns

Strategy: try-catch

Validate before calling

// probe JCE support before constructing
try {
  javax.crypto.Cipher.getInstance(scheme);
} catch (javax.crypto.NoSuchPaddingException | java.security.NoSuchAlgorithmException e) {
  throw new IllegalArgumentException("Scheme not supported: " + scheme, e);
}

Try / catch

try { crypto = new SymmetricCrypto(meta, scheme); } catch (CryptoException e) { log.error("Cipher unavailable for " + scheme + ": " + e.getMessage(), e); }

Prevention

When it happens

Trigger: Cipher.getInstance(scheme) throwing NoSuchAlgorithmException for a scheme name typo or unsupported combination (e.g. 'AES/GCM/NoPadding' on old JDKs), or an unlimited-strength policy missing for strong keys on very old JDKs.

Common situations: Scheme string misspelled or wrong case/spacing ('AES/CBC/PKCS5Padding' variants); algorithm not registered in java.security config; running on an old JDK (<8u161) without unlimited strength JCE policy files; third-party provider (BouncyCastle) not registered.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/30cd36dfb207d5ff. Report an issue: GitHub.

Appendix: source

Thrown at engine/src/main/java/org/pentaho/di/trans/steps/symmetriccrypto/symmetricalgorithm/SymmetricCrypto.java:82

    }
  }

  /**
   * Construct a new Symetric SymmetricCrypto trans
   *
   * @param inf
   *          The Database Connection Info to construct the connection with.
   */
  public SymmetricCrypto( SymmetricCryptoMeta meta, String xform ) throws CryptoException {
    this.meta = meta;
    this.scheme = Const.NVL( xform, meta.getDefaultScheme() );
    try {
      if ( this.scheme == null ) {
        throw new CryptoException( BaseMessages.getString( PKG, "SymmetricCrypto.SchemeMissing" ) );
      }
      this.cipher = Cipher.getInstance( this.scheme );
    } catch ( Exception e ) {
      throw new CryptoException( BaseMessages.getString( PKG, "SymmetricCrypto.SymmetricCrypto.Error.Cipher", e ) );
    }
  }

  public void setEncryptMode() throws CryptoException {
    try {
      this.cipher.init( Cipher.ENCRYPT_MODE, this.secretKeySpec );
    } catch ( Exception e ) {
      throw new CryptoException( e );
    }
  }

  public void setDecryptMode() throws CryptoException {
    try {
      this.cipher.init( Cipher.DECRYPT_MODE, this.secretKeySpec );
    } catch ( Exception e ) {
      throw new CryptoException( e );
    }
  }

View on GitHub (pinned to f3058517a1)